feat: add Script Provisioning Provider extension (microsoft.azd.scripts)

Implements the Script Provisioning Provider extension that enables
shell script-based provisioning and teardown workflows in azd.

This extension registers a 'scripts' provisioning provider via gRPC,
allowing users to configure bash/PowerShell scripts as their
infrastructure provider in azure.yaml.

Key components:
- Extension scaffold following microsoft.azd.demo pattern
- Config parsing with validation (path safety, kind inference, platform overrides)
- EnvResolver with 4-layer environment variable merging
- ScriptExecutor for bash/pwsh script execution
- OutputCollector for outputs.json discovery and parsing
- Full ProvisioningProvider interface implementation

Resolves #7734, #7735, #7736
Part of #7733

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: wbreza

cli/azd/extensions/microsoft.azd.scripts/.gitignore

@@ -0,0 +1,25 @@
+# If you prefer the allow list template instead of the deny list, see community template:
+# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+#
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+# Go workspace file
+go.work
+go.work.sum
+
+# env file
+.env

cli/azd/extensions/microsoft.azd.scripts/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Release History
+
+## 0.1.0-alpha.1 (Unreleased)
+
+### Features Added
+
+- Initial scaffold for the Script Provisioning Provider extension.
+- Registers `scripts` provisioning provider with azd via gRPC.
+- Configuration parsing for `provision` and `destroy` script lists from `azure.yaml`.
+- Script execution with 4-layer environment variable merging.
+- Output collection from `outputs.json` files.

cli/azd/extensions/microsoft.azd.scripts/README.md

@@ -0,0 +1,74 @@
+# Script Provisioning Provider (`microsoft.azd.scripts`)
+
+A first-party azd extension that enables shell script-based provisioning and teardown workflows.
+
+## Overview
+
+The Script Provisioning Provider allows teams with existing script-based infrastructure workflows to adopt azd without rewriting their provisioning logic. Configure bash or PowerShell scripts as your provisioning provider in `azure.yaml`, and azd will execute them during `azd provision` and `azd down`.
+
+## Installation
+
+```bash
+azd ext install microsoft.azd.scripts
+```
+
+## Configuration
+
+Configure the extension in your `azure.yaml`:
+
+```yaml
+infra:
+  provider: scripts
+  config:
+    provision:
+      - kind: sh
+        run: scripts/setup.sh
+        name: Setup Infrastructure
+        env:
+          AZURE_LOCATION: ${AZURE_LOCATION}
+          RESOURCE_GROUP: rg-${AZURE_ENV_NAME}
+      - kind: pwsh
+        run: scripts/configure-app.ps1
+        env:
+          APP_NAME: myapp-${AZURE_ENV_NAME}
+    destroy:
+      - kind: sh
+        run: scripts/teardown.sh
+        env:
+          RESOURCE_GROUP: rg-${AZURE_ENV_NAME}
+```
+
+### Script Configuration Options
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `run` | string | Yes | Relative path to the script file |
+| `kind` | string | No | Script type: `sh` or `pwsh` (auto-detected from extension) |
+| `name` | string | No | Display name for progress reporting |
+| `env` | map | No | Environment variables with `${EXPRESSION}` substitution |
+| `secrets` | map | No | Secret references (`akvs://vault/secret`) |
+| `continueOnError` | bool | No | Continue execution on script failure |
+| `windows` | object | No | Windows-specific overrides |
+| `posix` | object | No | Linux/macOS-specific overrides |
+
+### Environment Variable Resolution
+
+Variables are resolved using a 4-layer priority model:
+
+1. **OS environment** (lowest priority)
+2. **azd environment** values (`.env` + prior script outputs)
+3. **`env` map** values (`${EXPRESSION}` substitution)
+4. **`secrets` map** values (highest priority)
+
+### Output Collection
+
+Scripts can produce outputs by writing an `outputs.json` file alongside the script:
+
+```json
+{
+  "WEBSITE_URL": { "type": "string", "value": "https://myapp.azurewebsites.net" },
+  "RESOURCE_GROUP": { "type": "string", "value": "rg-myapp-dev" }
+}
+```
+
+Outputs are merged across scripts and stored in the azd environment.

cli/azd/extensions/microsoft.azd.scripts/build.ps1

@@ -0,0 +1,112 @@
+# Ensure script fails on any error
+$ErrorActionPreference = 'Stop'
+
+# Get the directory of the script
+$EXTENSION_DIR = Split-Path -Parent $MyInvocation.MyCommand.Path
+
+# Change to the script directory
+Set-Location -Path $EXTENSION_DIR
+
+# Create a safe version of EXTENSION_ID replacing dots with dashes
+$EXTENSION_ID_SAFE = $env:EXTENSION_ID -replace '\.', '-'
+
+# Define output directory
+$OUTPUT_DIR = if ($env:OUTPUT_DIR) { $env:OUTPUT_DIR } else { Join-Path $EXTENSION_DIR "bin" }
+
+# Create output directory if it doesn't exist
+if (-not (Test-Path -Path $OUTPUT_DIR)) {
+    New-Item -ItemType Directory -Path $OUTPUT_DIR | Out-Null
+}
+
+# Get Git commit hash and build date
+$COMMIT = git rev-parse HEAD
+if ($LASTEXITCODE -ne 0) {
+    Write-Host "Error: Failed to get git commit hash"
+    exit 1
+}
+$BUILD_DATE = (Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ")
+
+# List of OS and architecture combinations
+if ($env:EXTENSION_PLATFORM) {
+    $PLATFORMS = @($env:EXTENSION_PLATFORM)
+} else {
+    $PLATFORMS = @(
+        "windows/amd64",
+        "windows/arm64",
+        "darwin/amd64",
+        "darwin/arm64",
+        "linux/amd64",
+        "linux/arm64"
+    )
+}
+
+$APP_PATH = "github.com/azure/azure-dev/cli/azd/extensions/$env:EXTENSION_ID/internal/cmd"
+
+# Check if the build type is specified
+if (-not $env:EXTENSION_LANGUAGE) {
+    Write-Host "Error: BUILD_TYPE environment variable is required (go or dotnet)"
+    exit 1
+}
+
+# Loop through platforms and build
+foreach ($PLATFORM in $PLATFORMS) {
+    $OS, $ARCH = $PLATFORM -split '/'
+
+    $OUTPUT_NAME = Join-Path $OUTPUT_DIR "$EXTENSION_ID_SAFE-$OS-$ARCH"
+
+    if ($OS -eq "windows") {
+        $OUTPUT_NAME += ".exe"
+    }
+
+    Write-Host "Building for $OS/$ARCH..."
+
+    # Delete the output file if it already exists
+    if (Test-Path -Path $OUTPUT_NAME) {
+        Remove-Item -Path $OUTPUT_NAME -Force
+    }
+
+    if ($env:EXTENSION_LANGUAGE -eq "dotnet") {
+        # Set runtime identifier for .NET
+        $RUNTIME = if ($OS -eq "windows") { "win-$ARCH" } elseif ($OS -eq "darwin") { "osx-$ARCH" } else { "linux-$ARCH" }
+        $PROJECT_FILE = "$EXTENSION_ID_SAFE.csproj"
+
+        # Run dotnet publish for single file executable
+        dotnet publish `
+            -c Release `
+            -r $RUNTIME `
+            -o $OUTPUT_DIR `
+            /p:PublishTrimmed=true `
+            $PROJECT_FILE
+
+        if ($LASTEXITCODE -ne 0) {
+            Write-Host "An error occurred while building for $OS/$ARCH"
+            exit 1
+        }
+
+        $EXPECTED_OUTPUT_NAME = $EXTENSION_ID_SAFE
+        if ($OS -eq "windows") {
+            $EXPECTED_OUTPUT_NAME += ".exe"
+        }
+
+        Rename-Item -Path "$OUTPUT_DIR/$EXPECTED_OUTPUT_NAME" -NewName $OUTPUT_NAME
+    } elseif ($env:EXTENSION_LANGUAGE -eq "go") {
+        # Set environment variables for Go build
+        $env:GOOS = $OS
+        $env:GOARCH = $ARCH
+
+        go build `
+            -ldflags="-X '$APP_PATH.Version=$env:EXTENSION_VERSION' -X '$APP_PATH.Commit=$COMMIT' -X '$APP_PATH.BuildDate=$BUILD_DATE'" `
+            -o $OUTPUT_NAME
+
+        if ($LASTEXITCODE -ne 0) {
+            Write-Host "An error occurred while building for $OS/$ARCH"
+            exit 1
+        }
+    } else {
+        Write-Host "Error: Unsupported BUILD_TYPE '$env:BUILD_TYPE'. Use 'go' or 'dotnet'."
+        exit 1
+    }
+}
+
+Write-Host "Build completed successfully!"
+Write-Host "Binaries are located in the $OUTPUT_DIR directory."

cli/azd/extensions/microsoft.azd.scripts/build.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+
+# Get the directory of the script
+EXTENSION_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+# Change to the script directory
+cd "$EXTENSION_DIR" || exit
+
+# Create a safe version of EXTENSION_ID replacing dots with dashes
+EXTENSION_ID_SAFE="${EXTENSION_ID//./-}"
+
+# Define output directory
+OUTPUT_DIR="${OUTPUT_DIR:-$EXTENSION_DIR/bin}"
+
+# Create output and target directories if they don't exist
+mkdir -p "$OUTPUT_DIR"
+
+# Get Git commit hash and build date
+COMMIT=$(git rev-parse HEAD)
+BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+# List of OS and architecture combinations
+if [ -n "$EXTENSION_PLATFORM" ]; then
+    PLATFORMS=("$EXTENSION_PLATFORM")
+else
+    PLATFORMS=(
+        "windows/amd64"
+        "windows/arm64"
+        "darwin/amd64"
+        "darwin/arm64"
+        "linux/amd64"
+        "linux/arm64"
+    )
+fi
+
+APP_PATH="$EXTENSION_ID/internal/cmd"
+
+# Loop through platforms and build
+for PLATFORM in "${PLATFORMS[@]}"; do
+    OS=$(echo "$PLATFORM" | cut -d'/' -f1)
+    ARCH=$(echo "$PLATFORM" | cut -d'/' -f2)
+
+    OUTPUT_NAME="$OUTPUT_DIR/$EXTENSION_ID_SAFE-$OS-$ARCH"
+
+    if [ "$OS" = "windows" ]; then
+        OUTPUT_NAME+='.exe'
+    fi
+
+    echo "Building for $OS/$ARCH..."
+
+    # Delete the output file if it already exists
+    [ -f "$OUTPUT_NAME" ] && rm -f "$OUTPUT_NAME"
+
+    # Set environment variables for Go build
+    GOOS=$OS GOARCH=$ARCH go build \
+        -ldflags="-X '$APP_PATH.Version=$EXTENSION_VERSION' -X '$APP_PATH.Commit=$COMMIT' -X '$APP_PATH.BuildDate=$BUILD_DATE'" \
+        -o "$OUTPUT_NAME"
+
+    if [ $? -ne 0 ]; then
+        echo "An error occurred while building for $OS/$ARCH"
+        exit 1
+    fi
+done
+
+echo "Build completed successfully!"
+echo "Binaries are located in the $OUTPUT_DIR directory."