[App Service] az webapp deploy, az webapp secure-build show, az webapp troubleshoot deployment: Add Secure Build and deployment troubleshooting commands

src/azure-cli/azure/cli/command_modules/appservice/_help.py

@@ -3612,4 +3612,33 @@
       text: az webapp deploy --resource-group ResourceGroup --name AppName --src-path SourcePath --type static --target-path staticfiles/test.txt
     - name: Deploy a zip file with enriched error diagnostics on failure.
       text: az webapp deploy -g ResourceGroup -n AppName --src-path app.zip --enriched-errors true
+    - name: Deploy a Python app and show a Secure Build summary and full-report link.
+      text: az webapp deploy -g ResourceGroup -n AppName --src-path app.zip --show-secure-build
+"""
+
+helps['webapp secure-build'] = """
+    type: group
+    short-summary: Review open source vulnerabilities in a web app's packages.
+"""
+
+helps['webapp secure-build show'] = """
+    type: command
+    short-summary: Show the Secure Build report for the active deployment of a Linux web app.
+    long-summary: "The service uses a cached report when available. Use --rescan to request fresh dependency analysis, which can take several minutes. Default table output shows a human-readable summary and up to 20 findings. Standard --query processing remains available and controls the resulting table shape. Use JSON output or the provided Kudu link for the full report. Secure Build currently supports Python dependency information produced by supported platform builds."
+    examples:
+    - name: Show the Secure Build report for the active deployment.
+      text: az webapp secure-build show --resource-group ResourceGroup --name AppName --output table
+    - name: Run a fresh analysis for a deployment slot and show critical findings.
+      text: az webapp secure-build show --resource-group ResourceGroup --name AppName --slot staging --rescan --query "findings[?advisory.severity=='CRITICAL']" --output table
+"""
+
+helps['webapp troubleshoot deployment'] = """
+    type: command
+    short-summary: Show the latest deployment state and diagnostic information for a web app.
+    long-summary: Returns a point-in-time snapshot from Kudu and enriches it with platform build and runtime status when available. The command does not wait for deployment completion.
+    examples:
+    - name: Show the latest deployment status for a web app.
+      text: az webapp troubleshoot deployment --resource-group ResourceGroup --name AppName
+    - name: Show the latest deployment status for a deployment slot.
+      text: az webapp troubleshoot deployment --resource-group ResourceGroup --name AppName --slot staging
 """

src/azure-cli/azure/cli/command_modules/appservice/_params.py

@@ -886,6 +886,20 @@ def load_arguments(self, _):
         c.argument('instance', options_list=['--instance'], help="Scope the report to a single worker instance. Accepts either the ARM instanceId or the machine name (e.g. `lw0sdlwk0007AB`). When omitted, returns an overview of every instance seen in the last 24 hours.")
         c.argument('report', options_list=['--report'], arg_type=get_three_state_flag(), help="Print a human-readable, color-coded report to stdout instead of returning the structured payload.")
 
+    with self.argument_context('webapp troubleshoot deployment') as c:
+        c.argument('name', arg_type=webapp_name_arg_type, id_part=None)
+        c.argument('resource_group_name', arg_type=resource_group_name_type)
+        c.argument('slot', options_list=['--slot', '-s'],
+                   help='Name of the web app slot. Defaults to the production slot.')
+
+    with self.argument_context('webapp secure-build show') as c:
+        c.argument('name', arg_type=webapp_name_arg_type, id_part=None)
+        c.argument('resource_group_name', arg_type=resource_group_name_type)
+        c.argument('slot', options_list=['--slot', '-s'],
+                   help='Name of the web app slot. Defaults to the production slot.')
+        c.argument('rescan', options_list=['--rescan'], action='store_true',
+                   help='Run a fresh dependency analysis instead of using a cached report.')
+
     with self.argument_context('webapp troubleshoot collect network-capture') as c:
         c.argument('name', arg_type=webapp_name_arg_type, id_part=None)
         c.argument('resource_group', arg_type=resource_group_name_type)
@@ -1147,6 +1161,9 @@ def load_arguments(self, _):
                    help='If true, deployment failures will show context-enriched diagnostics with error codes, suggested fixes, and Copilot prompts. Enabled by default; use --enriched-errors false to disable.',
                    arg_type=get_three_state_flag(), default=True)
         c.argument('tag', help='Linux only. A friendly name used to identify the deployment.')
+        c.argument('show_secure_build', options_list=['--show-secure-build'], action='store_true', default=False,
+                   help='Show a Secure Build summary and full-report link after deployment. '
+                        'This option can add several minutes to the command.')
 
     with self.argument_context('functionapp deploy') as c:
         c.argument('name', options_list=['--name', '-n'], help='Name of the function app to deploy to.')

src/azure-cli/azure/cli/command_modules/appservice/commands.py

@@ -48,6 +48,34 @@ def transform_runtime_list_output(result):
     ]) for r in result]
 
 
+def transform_secure_build_output(result):
+    import sys
+    from .custom import _render_secure_build_table_report, _secure_build_finding_rows
+    if isinstance(result, dict):
+        _render_secure_build_table_report(result, file=sys.stdout)
+        return []
+    rows = _secure_build_finding_rows(result)
+    for row in rows:
+        row.pop('Details URL', None)
+    return rows
+
+
+def transform_troubleshoot_deployment_output(result):
+    from collections import OrderedDict
+
+    if not isinstance(result, dict):
+        return []
+    runtime = result.get('runtime') or {}
+    return [OrderedDict([
+        ('DeploymentId', result.get('deploymentId') or '-'),
+        ('State', result.get('state') or 'Unknown'),
+        ('Active', result.get('active', False)),
+        ('Succeeded', runtime.get('instancesSuccessful', '-')),
+        ('Failed', runtime.get('instancesFailed', '-')),
+        ('LastDeploymentTime', result.get('lastDeploymentTime') or '-'),
+    ])]
+
+
 def transform_troubleshoot_config_output(result):
     """Flatten the troubleshoot config payload into a per-setting table.
 
@@ -380,6 +408,12 @@ def load_command_table(self, _):
                          table_transformer=transform_troubleshoot_config_output)
         g.custom_command('status', 'troubleshoot_status',
                          table_transformer=transform_troubleshoot_status_output)
+        g.custom_command('deployment', 'troubleshoot_deployment',
+                         table_transformer=transform_troubleshoot_deployment_output)
+
+    with self.command_group('webapp secure-build', is_preview=True) as g:
+        g.custom_show_command('show', 'show_secure_build_report',
+                              table_transformer=transform_secure_build_output)
 
     with self.command_group('webapp troubleshoot collect', is_preview=True) as g:
         g.custom_command('network-capture', 'collect_network_capture',