This repository packages a simple RAG application for checking products and related materials for export control signals across ITAR, EAR, and 10 CFR Part 810-style workflows.
The app is designed to:
- accept free-text or uploaded documents
- retrieve relevant regulatory context
- generate a draft analysis with citations
- expose metrics and review views in a lightweight dashboard
It is meant to assist human reviewers, not replace formal export control review.
- FastAPI backend for:
POST /chatPOST /uploadGET /metrics/recentGET /metrics/summaryGET /demo
- React dashboard served at
/dashboard - GitHub Actions pipelines to:
- create Azure infrastructure
- build and deploy the app into your Azure environment
The repo is set up so someone can:
- fork the repo
- add their Azure and model configuration to GitHub
- click
Deploy Infra - click
Deploy App - get a working app in their own ACR and AKS
The deploy flow assumes:
- you want Azure infrastructure created for this fork
Deploy Infra creates:
- Resource group
- Azure Container Registry
- Azure Kubernetes Service
- Log Analytics workspace
- Static public IP
- Azure Cosmos DB account, database, and required containers
- Azure OpenAI resource and deployment
Deploy App then:
- builds the API image
- builds the dashboard image
- pushes both images to the ACR created for the fork
- installs
ingress-nginxon AKS - deploys the app manifests to AKS
- points the app at the Cosmos DB and Azure OpenAI resources created by
Deploy Infra
By default, the app comes up at:
http://<public-ip>.nip.io
That keeps first deployment simple and avoids requiring custom DNS before the app is running.
Fork this repository into your own GitHub account or organization.
Create or choose an Azure Entra application or service principal that GitHub Actions can use with OIDC.
That identity needs permissions to create and manage:
- Resource groups
- ACR
- AKS
- Public IPs
- Role assignments
- Deployments in the target subscription or resource group scope
You will use its values as GitHub secrets:
AZURE_CLIENT_IDAZURE_TENANT_IDAZURE_SUBSCRIPTION_ID
In your fork, go to Settings -> Secrets and variables -> Actions and add:
Required:
AZURE_CLIENT_IDAZURE_TENANT_IDAZURE_SUBSCRIPTION_ID
Optional:
OPENAI_API_KEY- only needed if you intentionally want to switch the app to generic OpenAI instead of the Azure OpenAI resource created by infra
VC_RPS_SECNOVC_RPS_PASSWORD
Add these variables for your environment:
Recommended for the default Azure deployment:
LLM_PROVIDERAZURE_OPENAI_LOCATIONAZURE_OPENAI_API_VERSIONAZURE_OPENAI_DEPLOYMENT_NAMEAZURE_OPENAI_MODEL_NAMEAZURE_OPENAI_MODEL_VERSIONAZURE_OPENAI_MODEL_CAPACITY
If your Azure OpenAI region does not support the default model or version, override those values before running Deploy Infra.
Useful optional overrides:
AZURE_LOCATIONAKS_NODE_COUNTAKS_VM_SIZEKUBERNETES_VERSIONOPENAI_MODELOPENAI_BASE_URLOPENAI_TIMEOUT_SECONDSAZURE_OPENAI_TIMEOUT_SECONDSANALYSIS_MODECRAG_TOP_KCRAG_DOC_CHARSMAX_ANALYSIS_CHARSANALYSIS_TIMEOUT_SECONDSANALYSIS_REQUEST_LIMITANALYSIS_TOTAL_TOKENS_LIMITDEEPEVAL_ENABLEDDEEPEVAL_USE_AZUREDOCUMENT_STORE_BACKENDCOSMOS_DOCUMENT_DATABASECOSMOS_DOCUMENT_CONTENT_CONTAINERCOSMOS_DOCUMENT_CHUNK_CONTAINERCOSMOS_DOCUMENT_REQUEST_CONTAINERAPI_REPLICASDASHBOARD_REPLICAS
The full list is in infra/github-actions-config.md.
Open Actions in your fork and run:
This creates Azure resources with deterministic names based on the GitHub repository id, so forks do not need to hand-pick unique ACR names.
Default naming pattern:
- Resource group:
rg-ai4itar-<repo-id> - ACR:
ai4itar<repo-id> - AKS:
aks-ai4itar-<repo-id> - Public IP:
pip-ai4itar-<repo-id>
After infra is complete, run:
This workflow will:
- read the Azure outputs from
Deploy Infra - build and push the images into your fork's ACR
- get AKS credentials
- install ingress
- deploy the API and dashboard
After Deploy App finishes, the app should be available at:
http://<public-ip>.nip.io
Endpoints:
/health check/demobrowser demo/dashboardmetrics dashboard/chatanalysis API/uploadfile upload analysis API
Demo output example:
This is the browser-facing demo page after a product or document has been analyzed for export-control relevance.
ci.yml- runs tests and validates dashboard build
deploy_infra.yml- creates Azure infrastructure
deploy_app.yml- builds and deploys the app
High-level components:
src/app/main.py- FastAPI application
src/app/agents/rag_checker.py- top-level retrieval-grounded checking flow
src/app/agents/crag_agent.py- retrieval and correction flow
src/app/document_store.py- document persistence support
src/app/metrics_tracker.py- metrics and evaluation persistence
dashboard/- React dashboard
Metrics dashboard example:
This dashboard shows recent evaluations and summary metrics for reviewing export-control checking activity.
If you want to run the app locally instead of deploying through GitHub Actions:
git clone git@github.com:your-org/AI4ITAR-gh.git
cd AI4ITAR-gh
uv venv
source .venv/bin/activate
uv sync --extra rag --extra metricsCreate a .env file from src/app/.env-example, then run:
ANALYSIS_MODE=direct ENABLE_RPS_ADDON=false uv run uvicorn main:app --app-dir src/app --reload --host 127.0.0.1 --port 8000Useful local URLs:
http://127.0.0.1:8000/docshttp://127.0.0.1:8000/demohttp://127.0.0.1:8000/
To run the dashboard locally:
cd dashboard
npm install
VITE_AI4ITAR_API_BASE_URL=http://127.0.0.1:8000 npm run dev- This app is an assistant, not a final decision-maker
- Secrets must be stored in GitHub Actions secrets or another secret manager, never committed
- Cosmos DB and model access should follow your organization's security controls
- Uploaded documents and outputs may contain sensitive internal information
- Use feature branches and pull requests in GitHub
- Add tests under
tests/ - Keep deployment docs aligned with the workflows when changing infra