Check Azure Container Apps Deployments for Recruiting Sites With Claude Code

A recruiting site can look healthy while the application form silently posts to staging. The HR team sees a job page, an apply button, a public URL, a form endpoint, and a thank-you page. The engineering team sees Azure Container Apps, ingress, revisions, environment variables, secrets, and custom domains. The release only works when both views describe the same candidate journey.

This article shows how a small hiring team can use Claude Code to turn Azure Container Apps settings into a launch review table. The goal is not to let AI deploy. The goal is to check public URL, form endpoint, secrets, revision traffic, owner, and rollback before candidates arrive from ads, job boards, or search.

Key Points

• For recruiting sites, public page status is not enough. Check the application form, public URL, environment variables, and thank-you path.
• Azure Container Apps supports ingress, environment variables, secrets, custom domains, managed identities, and revisions. Those are release risks when nobody reviews them together.
• Claude Code should read sanitized settings and produce a table of candidate-facing failures.
• Humans decide job content, privacy wording, ATS connection, public approval, traffic switch, and rollback.
• Measure form reach rate, application completion rate, send errors, stopped release mistakes, and minutes spent on release review.

Recruiting Release Workflow

The concrete artifacts are the job page URL, application form, screenshots, environment variable list, Container Apps FQDN, custom domain, and revision list. A developer may stop at container health. A hiring owner needs to know whether a candidate can open the job, click apply, submit the form, and receive the next message.

Use Microsoft Learn as the source for the platform facts: Azure Container Apps overview, ingress overview, configure ingress, environment variables, manage secrets, managed identities, custom domains and certificates, and revisions. For the IaC side, see the previous Bicep safety review.

What Claude Code Checks And What Humans Decide

Give Claude Code the sanitized release sheet: variable names, redacted values, Container Apps YAML, public URL, revision traffic, form endpoint, and rollback note. Do not provide candidate data, resumes, ATS tokens, production secrets, or private mailboxes.

Claude Code can flag URL mismatches, empty variables, staging strings, plain secret candidates, insecure ingress, traffic set to zero, missing owner, and missing rollback. Humans decide job wording, salary, location, privacy consent, ATS ownership, launch time, domain approval, and traffic switch. That split keeps the release review useful instead of magical.

3 Use Cases

Use case 1: Check public URL and custom domain

• Input: Container Apps FQDN, custom domain, canonical job URL, screenshots.
• Output: candidate-facing URL table, staging URL findings, certificate check, apply button URL.
• Human review: company name, job title, location, mobile page, approval, and ad links.

Use case 2: Check environment variables and secrets

• Input: environment variable names, secret names, form endpoint, mail settings, ATS integration label.
• Output: empty values, staging strings, plain token candidates, missing secret references, thank-you path.
• Human review: candidate data, ATS contract, email destination, consent text, retention rules.

Use case 3: Check revision traffic and rollback

• Input: revision list, latest ready status, traffic split, launch time, previous revision, rollback note.
• Output: live revision table, preview-only revision, switch condition, rollback target.
• Human review: job board publish time, ad start, application support owner, emergency decision.

Copy-Paste Prompt

Act as a release reviewer for a recruiting site running on Azure Container Apps.
Goal: confirm that candidates can open the production job URL, submit the application form, and reach the thank-you flow.

Inputs:
- planned public URL and Container Apps FQDN
- custom domain and certificate state
- environment variable names with secret values removed
- secret names and Key Vault reference status
- application form endpoint
- revision list and traffic split
- rollback note and human approver

Check staging URLs, localhost, empty FORM_POST_ENDPOINT, PUBLIC_SITE_URL, THANKS_PAGE_URL, plain TOKEN or SECRET values, ingress, HTTPS, custom domain, latest revision traffic, rollback, and human approval.
Never run deployment or traffic commands.
Return the five rows the team should inspect today.

Working Check Code

// verify-container-apps-release-sheet.mjs
// No dependencies. Run with: node verify-container-apps-release-sheet.mjs
const releaseSheet = {
  industry: "recruiting",
  page: "career-site",
  expectedPublicUrl: "https://jobs.example.co.jp",
  actualFqdn: "career-prod.red-bay.azurecontainerapps.io",
  customDomainBound: false,
  ingress: { enabled: true, external: true, targetPort: 3000, allowInsecure: true },
  environmentVariables: [
    { name: "PUBLIC_SITE_URL", value: "https://staging-jobs.example.co.jp", secretRef: "" },
    { name: "FORM_POST_ENDPOINT", value: "", secretRef: "" },
    { name: "ATS_API_TOKEN", value: "plain-token-example", secretRef: "" }
  ],
  secrets: [],
  revision: { latestReady: true, trafficToLatest: 0, oldRevisionTraffic: 100 },
  owner: "",
  rollbackNote: ""
};

const problems = [];

if (!releaseSheet.customDomainBound || !releaseSheet.actualFqdn.includes("jobs.example.co.jp")) {
  problems.push({ item: "public URL", fix: "confirm custom domain, managed certificate, and canonical job URL" });
}
if (!releaseSheet.ingress.enabled || !releaseSheet.ingress.external) {
  problems.push({ item: "ingress", fix: "external recruiting pages need reviewed HTTP ingress before launch" });
}
if (releaseSheet.ingress.allowInsecure) {
  problems.push({ item: "HTTPS", fix: "disable insecure connections before candidates open the page" });
}
for (const env of releaseSheet.environmentVariables) {
  if (!env.value && !env.secretRef) {
    problems.push({ item: "env: " + env.name, fix: "set the value or a secret reference before launch" });
  }
  if (/TOKEN|SECRET|PASSWORD|KEY/i.test(env.name) && env.value && !env.secretRef) {
    problems.push({ item: "plain secret: " + env.name, fix: "move token values to Container Apps secrets or Key Vault references" });
  }
}
if (releaseSheet.revision.latestReady && releaseSheet.revision.trafficToLatest === 0) {
  problems.push({ item: "revision traffic", fix: "assign test traffic or switch traffic after preview approval" });
}
if (!releaseSheet.owner) {
  problems.push({ item: "owner", fix: "write the human owner for public URL, form delivery, and rollback" });
}
if (!releaseSheet.rollbackNote) {
  problems.push({ item: "rollback", fix: "write the previous revision or stop condition before campaign launch" });
}

if (problems.length > 0) {
  console.table(problems);
  process.exitCode = 1;
} else {
  console.log("Container Apps recruiting release sheet passed.");
}

This script checks public URL, custom domain, ingress, HTTPS, empty variables, plain secrets, revision traffic, owner, and rollback. In production, combine it with Azure Portal, Azure CLI, Container Apps revisions, Log Analytics, and a real application form submission test.

Pitfall: Common Failure Cases

The first failure is approving launch after the job page loads. The form endpoint, thank-you path, email notification, and ATS integration may live in separate settings. Fix it by reviewing the full application journey, not only the homepage.

The second failure is storing ATS tokens as plain environment variable values. This happens during quick testing. Fix it by redacting values before AI review and using Container Apps secrets or Key Vault references.

The third failure is confusing the Container Apps FQDN with the public recruiting URL. The azurecontainerapps.io URL may work while the job board uses a custom domain. Fix it by checking canonical URL, OGP URL, apply button, and thank-you page together.

The fourth failure is ignoring revision traffic. A latest revision can be ready while candidates still see the old revision. Fix it by checking latest ready, traffic split, old revision, and rollback before approval.

FAQ

Q. Is Container Apps a good fit for recruiting sites?

A. It is useful when the site has a containerized form backend, ATS integration, preview revisions, or custom runtime needs. A simple static job page may not need it.

Q. Can Claude Code read environment variables?

A. It can read names and redacted values. Do not share candidate data, resumes, ATS tokens, production secrets, or private mailboxes.

Q. What should I check today?

A. PUBLIC_SITE_URL, FORM_POST_ENDPOINT, THANKS_PAGE_URL, custom domain, and revision traffic.

Q. What metric matters?

A. Use form reach rate, application completion rate, send error count, stopped release mistakes, and review minutes. Pageviews alone do not prove recruiting revenue impact.

Training And Consultation Signal

If pageviews are rising but applications are not, the next work is release quality, not more content. Container Apps settings, secret handling, custom domain, revision traffic, and ATS integration are a good fit for ClaudeCodeLab training.

What I Verified

I checked Microsoft Learn references for Container Apps overview, ingress, environment variables, secrets, managed identity, custom domains, and revisions. I also checked the CTA, executable JavaScript, internal link, external links, locale coverage, queue removal, and local build expectations. The first action is to copy PUBLIC_SITE_URL, FORM_POST_ENDPOINT, THANKS_PAGE_URL, custom domain, and revision traffic into one release table.