Reads the three _FILE-convention secrets (mounted by Swarm from Docker secrets
provisioned by Woodpecker — see secrets/flowagent.secrets.example), performs
`az login --service-principal`, then execs into whatever command mcpo invokes
(node /app/flowagent/mcp.mjs). No secret value is ever written to disk outside
the ephemeral Docker secret mount, logged, or baked into the image.
Part 1/3 of FlowAgent (Power Automate MCP) integration into the mcpo service
(NOT mcpo-critical). This PR only adds the image build artifacts; it does not
modify ai.yaml, mcpo/config.json, or the Woodpecker deploy pipeline, so no live
service is affected by merging this alone.
Background: mcpo/config.json previously had a dead/abandoned "powerautomate"
entry (npm package powerautomate-mcp, never onboarded to the secrets pipeline)
that will be replaced by this in a follow-up PR. This build produces a
self-contained image with:
- azure-cli, for non-interactive `az login --service-principal` at container
start (see entrypoint.sh)
- FlowAgent's self-contained MCP engine (server/mcp.mjs from
microsoft/power-platform-skills — official MIT-licensed Microsoft repo),
pinned via FLOWAGENT_REF build arg rather than tracking `main`, so builds
stay reproducible until deliberately bumped.
Requires (added in follow-up PRs, not yet live):
- Woodpecker secrets: flowagent_azure_client_id, flowagent_azure_tenant_id,
flowagent_azure_client_secret (Pattern C, Docker secrets via _FILE)
- Azure AD App Registration with Power Automate + Dataverse permissions,
admin-consented (manual, outside GitOps — see secrets/flowagent.secrets.example)
admin