[App Service] Fix #30021: az webapp deployment source config: Detect SP auth and provide guidance#33053
Closed
[App Service] Fix #30021: az webapp deployment source config: Detect SP auth and provide guidance#33053
az webapp deployment source config: Detect SP auth and provide guidance#33053Conversation
seligj95
requested review from
NoriZC,
teresaritorto and
yanzhudd
as code owners
️✔️AzureCLI-FullTest
|
|
Hi @seligj95, |
|
The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR. Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions). pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
|
Collaborator
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
️✔️AzureCLI-BreakingChangeTest
|
microsoft-github-policy-service
bot
requested review from
jsntcy,
wangzelin007,
yonzhan and
zhoxing-ms
microsoft-github-policy-service
bot
added
Web Apps
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses #30021 by adding client-side validation to az webapp deployment source config --github-action so that Service Principal authentication is detected early and a clear ValidationError guides users to az webapp deployment github-actions add.
Changes:
- Added
_is_service_principal_auth(cli_ctx)helper to detect Service Principal authentication. - Added validation in
config_source_controlto block--github-actionwhen running under SP auth with a clear error message. - Added unit tests covering SP + GitHub Actions (error) and non-blocked paths.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
src/azure-cli/azure/cli/command_modules/appservice/custom.py |
Adds SP-auth detection helper and validation guard in config_source_control. |
src/azure-cli/azure/cli/command_modules/appservice/tests/latest/test_webapp_commands_thru_mock.py |
Adds unit tests validating the new SP + --github-action behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
...zure-cli/azure/cli/command_modules/appservice/tests/latest/test_webapp_commands_thru_mock.py
Show resolved
Hide resolved
...zure-cli/azure/cli/command_modules/appservice/tests/latest/test_webapp_commands_thru_mock.py
Show resolved
Hide resolved
...zure-cli/azure/cli/command_modules/appservice/tests/latest/test_webapp_commands_thru_mock.py
Outdated
Show resolved
Hide resolved
...zure-cli/azure/cli/command_modules/appservice/tests/latest/test_webapp_commands_thru_mock.py
Show resolved
Hide resolved
seligj95
changed the title
az webapp deployment source config: Detect SP auth and provide guidance
…nfig When az webapp deployment source config --github-action is called with Service Principal authentication, the Azure API returns 404 trying to look up a publishing user. This change adds client-side detection to provide a clear error message directing users to az webapp deployment github-actions add, which supports SP auth. Fixes Azure#30021 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
seligj95
force-pushed
the
fix/30021-sp-deployment-source
branch
from
4e663c6 to
9903174
Compare
Contributor
Author
|
Consolidated into #33075 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes issue #30021 where
az webapp deployment source config --github-actionfails with a cryptic "Cannot find User" error when called with Service Principal authentication.Root Cause
The Azure App Service backend API requires a publishing user when
isGitHubAction=trueis set in the deployment source config request. Service Principals do not have publishing users, causing a 404 error from the backend.Solution
Added client-side validation in the
config_source_controlfunction to detect when:--github-actionflag is set to trueWhen both conditions are met, the CLI now raises a clear
ValidationErrordirecting users to useaz webapp deployment github-actions addinstead, which properly supports Service Principal authentication.Changes
_is_service_principal_authhelper function to detect SP authenticationconfig_source_controlfunctionTesting
All tests pass:
Style checks pass:
Breaking Change
This is not a breaking change. The current behavior is already broken for Service Principals. This change adds validation to prevent a confusing backend error and provides clear guidance to users.
Related Issue
Fixes #30021
History Notes
App Service
az webapp deployment source configand provide clear error when--github-actionis used, directing users toaz webapp deployment github-actions add