Lab 4: state-account placeholder, deprecated azurerm attrs, macOS pip/venv

[abdie-grcengineer]

Feedback from running Lab 4 (labs/04-evidence) end to end on a fresh free subscription (macOS). All three are things that failed following the doc as written, not student mistakes. Suggestions only — merge, adjust, or close as you see fit.

1. Step 2 — state-account placeholder in a runnable line → cryptic no such host

The step ships:

export TF_VAR_state_storage_account=stgrctfstateXXXXXXXX   # your value from backend.hcl

variables.tf gives state_storage_account no default, so this line is the value source. Copied as-is (the pattern the whole lab trains), terraform plan fails at data.terraform_remote_state.foundation:

Get "https://stgrctfstateXXXXXXXX.blob.core.windows.net/tfstate/01-foundation.tfstate":
dial tcp: lookup stgrctfstateXXXXXXXX.blob.core.windows.net: no such host

Nothing points back to "you didn't substitute the placeholder." Same class as the Lab 1 you@example.com placeholder.

This PR's change (doc-only, safe): replaced the placeholder line with one that reads the value out of backend.hcl:

export TF_VAR_state_storage_account=$(grep storage_account_name ../../labs/03-foundation/backend.hcl | cut -d'"' -f2)

Recommended deeper fix (not in this diff — your call): the name is deterministic (bootstrap.sh = stgrctfstate + first 8 chars of the sub ID), so the stage can derive it and drop the variable entirely. In providers.tf:

data "azurerm_subscription" "current" {}

locals {
  # mirrors labs/03-foundation/bootstrap.sh
  state_storage_account = "stgrctfstate${substr(replace(data.azurerm_subscription.current.subscription_id, "-", ""), 0, 8)}"
}
# ... storage_account_name = local.state_storage_account

Then delete the state_storage_account variable (only referenced in providers.tf:33) and the Step 2 export line — zero student action, no placeholder. Trade-off: naming rule then lives in two files. Alternative if you prefer one source of truth: have bootstrap.sh also write a *.auto.tfvars. I left this out of the diff because it's a design choice and I couldn't validate it with terraform plan (see note below).

2. Step 4 — pip install is non-portable; fails on macOS/Homebrew

Verified on the machine: pip3 targets a different interpreter than the Homebrew python3 that runs the script (→ ModuleNotFoundError: No module named 'azure'), and python3 -m pip install is blocked by PEP 668 (externally-managed-environment). The labs warn Windows/Git Bash users at every friction point but have no macOS callout, so Mac students hit this blind.

This PR's change: added a macOS / Homebrew callout box after the Step 4 command, mirroring the existing Windows/Git Bash boxes, pointing at a venv:

python3 -m venv ~/cge-venv
source ~/cge-venv/bin/activate
pip install azure-cosmos azure-identity

Inside a venv, pip and python3 are the same interpreter and PEP 668 doesn't apply — identical on macOS, Linux, WSL.

3. stages/03-evidence-store/main.tf — two deprecated azurerm attributes

Warnings today, hard errors once a student is on azurerm v5.0:

• local_authentication_disabled = true → local_authentication_enabled = false (provider-stated rename; boolean inverts).
• azurerm_storage_container.reports.resource_manager_id → .id (verified: resource_manager_id is gone from the current docs; id now returns the resource-manager ID this argument expects).

This PR's change: applied both swaps, with explaining comments.

⚠️ Unvalidated: I could not run terraform plan/apply in this repo to confirm the code changes — the club-ops guard blocks terraform. Please validate the main.tf changes on an apply before merging.

Scope

• labs/04-evidence/README.md (Steps 2 + 4) and stages/03-evidence-store/main.tf.
• Finding 1's deeper (HCL-derive) fix is described, not applied.

🤖 Generated with Claude Code

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: f444ac9d-ed06-4f89-9ff2-922b4972cc0d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}