Deploying the Warewolf Execution Engine with an AI coding agent

This article is for anyone driving the deployment with an agentic AI coding assistant (GitHub Copilot CLI, Claude Code, Cursor, etc.) instead of typing every az and PowerShell command by hand. It is deliberately short: point your bot at warewolf.io/skill.md — a pointer file written for LLM agents — give it one prompt containing every value it needs, and it deploys for you without stopping to ask you any follow-up questions.

The one-prompt pattern

Copy the prompt below into your agent, fill in or remove placeholders, and send it. Everything after “Parameters:” maps directly onto a Deploy-WwExecutionEngine.ps1 parameter, so the agent has no reason to prompt you for anything else. All the parameters from PublishPath down are optional and can be left off.

Read https://warewolf.io/skill.md and follow it to deploy the Warewolf
Execution Engine to Azure using Deploy-WwExecutionEngine.ps1.

Run it once with -DryRun first and show me the plan. If it looks right, run it again for real with the same parameters (minus -DryRun). Use -NonInteractive both times.

Required Parameters:
ResourceGroup:        DEV2
Location:             southafricanorth
StorageAccount:       wwexecdev2sa
AppName:              wwexecution-dev2
Optional Parameters:
PublishPath:          D:\ExecutionEngine\Publish
SecureConfigPath:     D:\ExecutionEngine\secure.config
WorkflowsSourcePath:  D:\ExecutionEngine\Resources
LicenseConfigPath:    D:\ExecutionEngine\Warewolf License.secureconfig
EnableAppInsights:    true
ExecutionLogLevel:    INFO
SkipAuthProvisioning: true   (flip to false + give AuthConfigPath once Entra/Easy Auth is needed)
LogDir:               D:\ExecutionEngine\Scripts\logs

That’s the minimal, no-encryption, no-auth “get something running” path. It maps onto the Core rows in the table below. Add the Optional rows as your scenario needs them — encryption, Elasticsearch, or the job-processor/Service-Bus companion deploys.

Parameter reference (what to hand the bot)

Core — always resolve these before you prompt

Parameter	Required?	What it is	Example
ResourceGroup	Yes	Resource group to create/use	DEV2
Location	Yes	Azure region	southafricanorth
StorageAccount	Yes	Storage account name (3–24 lowercase chars)	wwexecdev2sa
AppName	Yes	Function App name (globally unique)	wwexecution-dev2
PublishPath	Yes	Already-published engine output — a folder or a .zip	D:\ExecutionEngine\Publish
SubscriptionId / TenantId	No	Resolved from az account show if omitted — only pass them if you need to target a non-default subscription/tenant	—
NonInteractive	Recommended	Switch — never prompt; throw early and clearly if something required is still missing	(switch)
DryRun	Recommended (first run)	Switch — print every action, change nothing	(switch)
LogDir	No	Where the transcript + masked summary JSON land. Default: <PublishDir>..\deploy-logs	D:\ExecutionEngine\Scripts\logs

Package inputs — give the bot the paths, not the file contents

Parameter	When needed	Notes
SecureConfigPath	Almost always	Plaintext JSON is auto-encrypted before staging; an already-encrypted file is validated and staged as-is.
WorkflowsSourcePath	Almost always	Folder of .bite workflow resources, staged into Resources/.
LicenseConfigPath	Strongly recommended	Path to Warewolf License.secureconfig. Omit it and the license check (on by default) can fail at startup — see Security & Encryption.

Auth — Entra ID + Easy Auth

Parameter	When needed	Notes
SkipAuthProvisioning	First smoke-test deploys only	Switch. Skips Entra/Easy Auth entirely — fastest path to “does it run”, but the engine ends up unsecured.
AuthConfigPath	Whenever auth isn’t skipped	JSON describing GroupPermissions/UserAssignments for Configure-WwExecutionAuth.ps1. Start from Deploy-WwExecutionEngine.authconfig.example.json.

Encryption / Key Vault — only if you’re encrypting sources

Parameter	When needed	Notes
EncryptResources	First deploy of plaintext sources	$true once to encrypt everything to WFAES; leave it off on later deploys — sources are already encrypted.
KeyVaultName	If EncryptResources or sources are already WFAES-encrypted	Vault the engine reads at runtime.
KeyVaultSecretName	Same as above	No default — name it explicitly.
GenerateNewKey	New vault only	Switch — generates a fresh AES key.
VerifyDecryption	Optional	Switch — in-memory round-trip check after encrypting, nothing written to disk.

Optional features

Parameter	When needed	Notes
EnableAppInsights / AppInsightsName	Recommended	Default App Insights name is <AppName>-ai.
EnableElasticsearch / ElasticsearchSourcePath	If shipping logs to Elasticsearch	Source file must be named exactly ElasticsearchLoggingSource.bite; requires Key Vault.
EnablePersistence / PersistenceSettingsPath / PersistenceDbSourcePath	If using Hangfire suspend/resume	DB source is WFAES-encrypted the same way as Elasticsearch.
ExecutionLogLevel	Optional	TRACE|DEBUG|INFO|WARN|ERROR|FATAL|OFF. Default INFO.
EnableConsoleLogging / StructuredLogs / LicenseCheckEnabled	Optional	Sensible defaults; only pass these to override.
PublishMethod	Optional	Auto (default) or Zip use az zip-deploy; Func is advanced/opt-in and needs Azure Functions Core Tools.

Companion deploys — only if you’re chaining them in the same run

Parameter group	Triggers	Notes
DeployJobProcessor, JobProcessorAppName, JobProcessorPublishPath, JobProcessorStorageAccount, EngineResumeScope	Poller/reaper Function App	JobProcessorPublishPath must be a separate publish output from the engine’s own PublishPath.
DeployServiceBusWorker, ServiceBusWorkerAppName, ServiceBusWorkerPublishPath, ServiceBusWorkerStorageAccount, WwExecutionScope	Service Bus-triggered Function App (Shovel bridge)	Same rule — its publish path must differ from the engine’s.

Tell your agent this, too

• If your agent still asks you for a value not in the table above, it’s an advanced/companion parameter — point it back at docs/Deploy-RunGuide.md (the full parameter reference) rather than answering blind.
• If it asks for something that is in the table but you left it out of your prompt, that’s -NonInteractive doing its job — the value really is required for your scenario. Add it and re-send.
• Always let it run -DryRun first. The masked plan it prints is the fastest way to sanity-check what an agent is about to create in your subscription before it creates it.

See also

• Skill.md — the pointer file this article is a companion to; ships in every release.
• Scripts/README.md — the full script-set index and phased deploy flow.
• docs/Deploy-RunGuide.md — the complete parameter reference, role/privilege matrix, and troubleshooting.
• docs/Deploy-EndToEnd-Runbook.md — a full copy-paste runbook, including auth and encryption end to end.
• How to configure Client Apps with Azure Entra Id and Easy Auth — once the engine is up, wiring a caller app to it.
• Security — secure.config & licensing — the license file and encryption model referenced above.