[ACR] Fix Azure/azure-cli#33698: az acr login: Fix ARM token exchange fallback for AzureML MSI/SSO#33699
az acr login: Fix ARM token exchange fallback for AzureML MSI/SSO#33699Conversation
️✔️AzureCLI-FullTest
|
️✔️AzureCLI-BreakingChangeTest
|
microsoft-github-policy-service
Bot
added
Auto-Assign
… AzureML MSI/SSO
az acr login: Fix ARM token exchange fallback for AzureML MSI/SSO
a0x1ab
left a comment
a0x1ab
left a comment
There was a problem hiding this comment.
CI Review — PR #33699
Live test (Tester): No changed test files were detected in this PR (tests/**/test_*.py), so the azdev test --live step had nothing to run. This is informational only — not a blocker.
CI failure — action required:
- ❌ Test Homebrew Formula — https://github.com/Azure/azure-cli/runs/84989975666 (Azure DevOps build details)
Please investigate why the Homebrew formula test is failing for this change (e.g. formula/checksum generation, packaging metadata, or a dependency pinned incorrectly) and push a fix. Note the companion Build Homebrew Formula step succeeded, so the regression is specific to the formula test step — check the linked Azure DevOps build log for the exact assertion/error before making changes.
All other completed checks are currently passing (71/72 completed checks green); several packaging checks are still in progress and will be re-evaluated on the next pass.
Posted by agent-assist (autonomous bug-fix pipeline).
|
@copilot the automated CI and live-test review on this PR found failures. Please look into the requested changes here: #33699 (review) and push a fix. Posted by agent-assist (autonomous bug-fix pipeline). |
Investigated the Root cause analysis:
What I found:
Fix pushed: Added the |
|
ACR |
a0x1ab
left a comment
a0x1ab
left a comment
There was a problem hiding this comment.
Automated review summary — PR #33699
CI status: ✅ All 48 checks passed, no failures, nothing pending.
Live test (Tester): live-test.yml workflow run
(https://github.com/Azure/issue-sentinel/actions/runs/28658380150) failed
before any test code executed, due to an infrastructure/auth issue: the
classic PAT stored in the azclibotfinegrainedpat Key Vault
(azclibot-pat) is being rejected by the Microsoft Open Source enterprise
policy (HTTP 403: ... forbids access via a personal access tokens (classic) if the token's lifetime is greater than 8 days). This happened while the
job was simply trying to fetch the PR's head SHA via gh api, so no live
test selectors were ever resolved or run.
This is not a code issue in this PR and is outside the scope of what the
Copilot coding agent can fix (it requires rotating/shortening the lifetime
of the azclibot-pat secret in Key Vault, a maintainer/infra action).
Given all CI checks are green, this PR is not being blocked on the tester
step; a maintainer should confirm live-test coverage manually before merge,
and the azclibot-pat secret should be refreshed to restore automated live
testing for this and future PRs.
Posted by agent-assist (autonomous bug-fix pipeline).
![azure-client-tools-agent[bot]](https://avatars.githubusercontent.com/in/4205534?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated Review — CI/Tester Failures
This PR's checks did not pass at the current head commit (a0cd2077).
Failed checks:
-
Azure.azure-cli(Azure Pipelines build) — FAILED
https://github.com/Azure/azure-cli/runs/85025911191
Build #20260703.10 failed with 1 error / 1 warning. The build log annotation
points to a failing step around line 70 (Bash exited with code '1'),
which likely indicates a lint/style/unit-test failure introduced by this
change to_get_aad_token_after_challengein the ACR module. -
Azure.azure-cli (Test Homebrew Formula)— FAILED
https://github.com/Azure/azure-cli/runs/85009162758 -
Live test (issue-sentinel
azdev test --live) — FAILED
https://github.com/Azure/issue-sentinel/actions/runs/28658380150
The live test run for the changed ACR test file(s) did not pass; the
az acr loginfallback fix likely needs adjustment or additional test
updates to reflect the new behavior.
Requested action: Please investigate the build failure first (check the
full Azure Pipelines log at the link above for the exact error, since GitHub's
annotation only shows the line number), fix the root cause, and update/adjust
the ACR live test as needed so all three checks pass. Once pushed, this PR
will be re-reviewed automatically.
Posted by agent-assist (autonomous bug-fix pipeline).
|
@copilot the automated CI and live-test review on this PR found failures. Please look into the requested changes here: #33699 (review) and push a fix. Posted by agent-assist (autonomous bug-fix pipeline). |
Investigated the CI failure. The Fixed in commit that escapes the Windows path backslashes in the example: |
Live test results —
|
Live test results —
|
There was a problem hiding this comment.
Automated Review Summary
✅ Live test (Tester): Passed
✅ CI checks: All 20 checks passed, none pending or failed
This PR looks good from an automated verification standpoint — all live tests and CI checks are green for the current head commit.
Posted by agent-assist (autonomous bug-fix pipeline).
Related command
az acr loginDescription
In AzureML Compute Instance environments using
az login --identity(MSI/SSO),az acr loginfails because acquiring an AAD token scoped tohttps://containerregistry.azure.netreturns an SSO error. ACR's/oauth2/exchangeendpoint accepts ARM management tokens (https://management.azure.com/) equally well, and that token is available in these environments — this path worked in 2.81.0.The regression was introduced in #31798, which removed the conditional ARM-token fallback and hardcoded the ACR audience as the only option.
Fix: In
_get_aad_token_after_challenge, catchCLIErrorfromprofile.get_raw_token(resource=<acr-scope>)and retry with no resource (ARM management endpoint). The ACR-specific audience is still preferred; ARM is only used when the scoped request fails.Testing Guide
On an AzureML Compute Instance with MSI login:
Unit test
test_get_docker_credentials_arm_token_fallbackadded: mocksget_raw_tokento raiseCLIErroron the ACR-scope call and verifies login succeeds via the ARM fallback.History Notes
[ACR]
az acr login: Fix ARM token exchange fallback for AzureML MSI/SSO environmentsThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.