Use the Azure-scoped emulator host as the azurerm provider metadata_host in
every sample's providers.tf and in the Terraform READMEs that quote it, so
the documented configuration matches what the deploy scripts apply.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…mples

Introduce the ASP.NET Core Razor Pages port of the Vacation Planner used by
every web-app sample: one Index page with TempData flash messages, a Delete
page keyed on the store id, an IActivityStore abstraction initialized at
startup, a /health endpoint, and Kestrel binding to the PORT that App Service
and the emulator inject. The custom-image variant serves the same info page
and /api/status from a multi-stage sdk:10.0 -> aspnet:10.0 image; the
managed-identity variant stores one blob per activity through
DefaultAzureCredential.

Deployment artifacts mirror the Python siblings: DOTNETCORE|10.0 code
deployment with the project source zipped for the Oryx build, dotnet_version
in Terraform, runtimeName 'dotnetcore' in Bicep, unchanged WEBSITES_PORT
values and validation scripts. Register both samples in run-samples.sh, link
them from the root README and normalize line endings for C# sources.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…ry sample in the root README

The Vacation Planner reads its SQL connection string from the Key Vault
secret (falling back to SQL_* variables or a Microsoft Entra token), serves
HTTPS on port 8443 with the Key Vault certificate, and exposes /update/{id}
and /api/certificate like the Python sample; get-web-app-url.sh now fails
when the 8443 endpoint or its certificate cannot be retrieved instead of
comparing two empty thumbprints. InvariantGlobalization is dropped from the
template because Microsoft.Data.SqlClient cannot open connections in
invariant mode.

The root README outline gains an introduction, a longer description per
sample, the implementation language in parentheses, and separate Python and
.NET links for the web-app samples.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

MySqlConnector store with the same idempotent DDL, md5 ids, 30x2s startup
retry and TLS-without-verification semantics (MYSQL_SSL) as the Python
sample; artifacts switch to DOTNETCORE|10.0 with a source zip for the Oryx
build, dotnet_version in Terraform and 'dotnetcore' in Bicep.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Npgsql store with the same DDL, indexes, md5 ids, 30x2s startup retry and
libpq "prefer" TLS semantics as the Python sample; artifacts switch to
DOTNETCORE|10.0 with a source zip for the Oryx build, dotnet_version in
Terraform and 'dotnetcore' in Bicep.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

MongoDB.Driver store keeping the {_id, username, activity, timestamp}
documents, md5 ids and the three indexes of the Python sample, created once at
startup instead of on every operation; artifacts switch to DOTNETCORE|10.0
with a source zip for the Oryx build, dotnet_version in Terraform and
'dotnetcore' in Bicep. call-web-app.sh probes container port 8000, the port
this sample sets through WEBSITES_PORT, instead of 80.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Microsoft.Azure.Cosmos store in Gateway mode (the emulator exposes the account
endpoint over HTTPS only), keeping the {id, username, activity, timestamp}
items partitioned by /username, the 400 RU container created on demand and
id-keyed deletes of the Python sample; scripts-only deployment as in the
Python sibling, switched to DOTNETCORE:10.0 with a source zip.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

The port kept only the startup and store-initialization logs, so nothing
appeared in the container log while adding, updating or deleting an activity —
unlike the Python samples, which log a gunicorn access line per request, the
store operation (with the affected documents) and an application-level
"Activity added/updated" line.

Add the same three layers to every .NET sample: a one-line access log
("POST / -> 302 in 45.3ms") from a small middleware, the store operation with
its documents or affected-row counts, and "Activity added/updated/deleted" from
the page handlers. Each store logs at the granularity its Python counterpart
does: full documents for Cosmos DB (MongoDB and NoSQL APIs), blob names and
sizes for Blob Storage, row counts and ids for SQL Database, retrieval counts
for the MySQL and PostgreSQL flexible servers.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The .NET sample now carries its own Visio drawing and rendered PNG instead of
the copies inherited from the Python sibling.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ample in CI

The .NET SQL Database sample's get-web-app-url.sh becomes call-web-app.sh, the
name every other sample uses and the one its Python sibling's README already
documented; the Python script is renamed with it so both run-samples.sh entries
resolve. The renamed .NET copy keeps the strict certificate checks (a failed
call, an empty thumbprint or a missing TLS certificate now exit 1 instead of
comparing two empty strings).

Also from manual validation of the samples: the Terraform deployments use the
local-* resource naming of the script deployments and pass secret_name through,
and the validate/README instructions show how to read the web app host name.

Register samples/web-app-cosmosdb-nosql-api/dotnet in run-samples.sh; it was
the only validated .NET web app missing from the matrix, which now builds 17
web-app-*/dotnet jobs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ubject check

Two CI failures that survived four re-runs were deterministic, not flaky:

- web-app-cosmosdb-nosql-api/scripts/deploy.sh did `cd "../src"` without
  anchoring to the script's own location, so it worked when run from scripts/
  but not as `bash scripts/deploy.sh` from the sample root, which is how
  run-samples.sh invokes it: `cd: ../src: No such file or directory`. Both
  language variants now set CURRENT_DIR the way every other sample does.
- The SQL Database certificate check compared distinguished names literally,
  so OpenSSL 3's "CN = sample-web-app-sql" never matched Key Vault's
  "CN=sample-web-app-sql". Both are normalized before comparing (leading "/"
  and the spaces around "=" of the OpenSSL 1 and 3 spellings), and the match
  is a fixed-string one so a CN with regex metacharacters cannot misfire.

The Python copy of that check also stops reporting success when there is
nothing to check: its app only serves HTTPS on 8443 when started directly, so
under gunicorn the old code compared two empty thumbprints and called them
equal. It now says the port is not served and skips.

From the Copilot review: the NoSQL delete flash message reads "Activity
deleted." like the Python sample, and the unused Docker helper functions are
gone from the custom-image call script.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…g the job

Of the 11 jobs that failed on the first run of the samples workflow, 8 were in
samples this branch does not touch and went green when re-run by hand: two
never reached the sample at all (`localstack wait -t 600` expired while ~80
jobs competed for runner I/O and image pulls) and one hit a transient 500 from
the emulator while creating a MySQL firewall rule.

Automate what the manual re-runs were doing:

- the emulator start gets one clean retry, printing the container's last log
  lines when the first wait expires;
- the sample runs with continue-on-error and, on failure, once more against a
  freshly restarted emulator, because the deploy scripts are not idempotent and
  would otherwise re-run against half-provisioned resources. A genuinely broken
  sample fails both attempts, so it still fails the job.

The job also gets a 90-minute bound: a sample takes 10-25 minutes, a retry
doubles the worst case, and a hung deployment would otherwise hold a runner for
GitHub's 6-hour default.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ator start

The samples workflow came back with 2 failures out of 78 (from 11), and both
were emulator-side transients rather than sample defects:

- web-app-mysql-flexible-server/dotnet failed twice, both times on
  `az mysql flexible-server firewall-rule create` answering 500. The Azure
  CLI's own retries all land within ~5 seconds of each other, which is too
  early: the PUT succeeds once the server finishes provisioning. The create is
  now retried five times at 10-second intervals in the MySQL and PostgreSQL
  samples (both languages, since the blocks were identical), and a persistent
  failure warns instead of aborting: the rule only governs public network
  access, which the emulator does not enforce, and the database bootstrap a few
  lines later fails loudly if the server is genuinely unreachable.
- aci-blob-storage/python/bicep failed on an arm64 runner because the emulator
  never became ready - the container logged nothing for the last ten minutes of
  each 600-second wait, so the boot had stalled rather than slowed. The
  readiness retry now makes three 400-second attempts instead of two
  600-second ones: the same overall budget, one more chance, and a stalled
  container is replaced sooner.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>