2 docs tagged with "run-command"

Operationalises ADR-022 §3 (Phase 3f) for the dev tier: the stable demo VM at dev-azure.securityv0.com deploys on every main CI success via Azure Run Command using a new tightly-scoped Entra app + OIDC federation from GitHub Actions. No SSH key in the deploy path. Hetzner stays warm as fallback during cutover (no behavior change on the Hetzner side). PR-preview ephemeral VMs are explicitly out of scope; the design for that surface is banked in [docs/infrastructure/azure-ephemeral-pr-previews-design.md](../../infrastructure/azure-ephemeral-pr-previews-design.md) for re-activation when triggered.

BANKED (2026-06-03) — superseded for now by Tailscale SSH (ADR-023 §3.4.6, sv0-infrastructure#120). Designed-and-reviewed plan for FULLY-UNATTENDED headless ops on dev Azure VMs via a GitHub-Actions OIDC run-command workflow (no local secret), with a tighter run-command-only role. Activate at the first-client/compliance/≥3-operator trigger; prod stays on interactive Cloudflare Access SSH.