Skip to content

[azure-ai-ml] Validate artifact cache paths and handle concurrent downloads - #49185

Merged
ayushhgarg-work merged 4 commits into
Azure:mainfrom
ayushhgarg-work:ayushhgarg-microsoft-artifact-cache-validation
Sep 25, 2026
Merged

ayushhgarg-work merged 4 commits into
Azure:mainfrom
ayushhgarg-work:ayushhgarg-microsoft-artifact-cache-validation

Conversation

@ayushhgarg-work

@ayushhgarg-work ayushhgarg-work commented Sep 25, 2026 •

Copy link
Copy Markdown
Member

Description

Improve Azure DevOps artifact caching used by component additional_includes.

  • Validate cache components and resolve package/checksum locations under the configured cache root before access.
  • Reject traversal and escaping filesystem links, preserve supported project names, and use portable cache keys without changing version selectors passed to the Azure CLI.
  • Stage downloads safely, revalidate destinations, and handle concurrent readers/writers with bounded retries without hiding unrelated filesystem errors.
  • Check for the Azure CLI before subprocess startup and retain the singleton only after successful initialization.
  • Add regression coverage for invalid paths, wildcard selectors, cache lifecycle, native symlinks/Windows junctions, concurrency, and environment isolation.

Artifact-tool HTTP request validation is addressed separately in #49186. This PR does not include that fallback change or a package release/version bump. The two branches were checked for conflict-free integration. No public API signatures are changed; unsafe cache inputs are intentionally rejected.

Validation

Review/CI follow-up at 225f7a17391d37511b81579aa89d5f470b3b7dc0, preserving the existing upstream merge:

  • Official SDK MCP tests on Python 3.13.13: 326 passed, including the wildcard cases that failed in CI, strict encoded-filename checks, initialization failures, and deterministic reader/writer regressions.
  • Official formatting and spelling checks passed.
  • The full local build was not green: dependency bootstrap failed before Pylint, and MyPy reported an unrelated unchanged component diagnostic. No unrelated component code, CI definitions, or validation rules were changed.
  • The final SDK review branches merge without conflicts in either order. Their combined tree passed all 400 selected tests through the official MCP tool, with both absent and pre-existing artifact-tool overrides.

The original cache fix was also tested on Windows and native Linux. These local results do not imply that the latest PR CI is green; the new Python 3.13/3.14 CI results remain required. No live Azure service or real credentials were used.

All SDK Contribution checklist:

  • The pull request does not introduce [breaking changes]
  • CHANGELOG is updated for new features, bug fixes or other significant changes.
  • I have read the contribution guidelines.

General Guidelines and Best Practices

  • Title of the pull request is clear and informative.
  • There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

  • Pull request includes test coverage for the included changes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Constructor-time CLI validation and cross-process publication races remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 High severity · 1 Medium severity

Open (2)
What changed in this PR

Improves Azure AI ML artifact-cache validation, publication reliability, and test coverage.

Changes:

  • Validates cache path components and wildcard versions.
  • Adds staged publication and concurrent-writer retry handling.
  • Adds comprehensive artifact-cache fixtures, tests, and changelog entry.
File Description
azure/​ai/​ml/​_utils/​_artifact_utils.py Implements validation and safer cache publication.
tests/​utils/​unittests/​test_artifact_cache.py Tests validation, failures, and concurrency.
tests/​test_utilities/​artifact_fixtures.py Adds isolated artifact-cache fixtures.
tests/​test_utilities/​utils.py Isolates existing artifact mocks from disk cache.
CHANGELOG.md Documents the fixes.

Comment thread sdk/ml/azure-ai-ml/azure/ai/ml/_utils/_artifact_utils.py
Comment thread sdk/ml/azure-ai-ml/azure/ai/ml/_utils/_artifact_utils.py
@ayushhgarg-work ayushhgarg-work changed the title Improve artifact cache path validation and publication [azure-ai-ml] Validate artifact cache paths and handle concurrent downloads Sep 25, 2026
ayushhgarg-work and others added 2 commits September 25, 2026 11:43
Wait for incomplete cache publications before cleanup, validate the Azure CLI before caching the singleton, and check encoded cache filenames on newer Python versions.

Add regression coverage and the coordinated platform-aware tool fixture.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings September 25, 2026 06:45

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The initial cache validation can still expose transient checksum-sharing errors instead of retrying.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 Medium severity

Open (1)
Resolved since last review (2)

Comment thread sdk/ml/azure-ai-ml/azure/ai/ml/_utils/_artifact_utils.py Outdated
Include the first cache validation in the existing bounded retry path while preserving non-resolving lookups, fast cache hits, containment checks, and error propagation.

Add first-read sharing-error and persistence regressions plus cache-hit and non-resolving behavior coverage.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings September 25, 2026 07:33
@ayushhgarg-work
ayushhgarg-work enabled auto-merge (squash) September 25, 2026 07:36

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

Invalid-cache cleanup can still fail under concurrent readers due to check-then-act filesystem races.

Review effort: Balanced
Findings: None

Resolved since last review (1)

@ayushhgarg-work
ayushhgarg-work merged commit caa6ed6 into Azure:main Sep 25, 2026
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants