fix(install): ADO Entra ID auth path + --update pre-flight abort (#1015) by danielmeppiel · Pull Request #1031 · microsoft/apm

danielmeppiel · 2026-04-29T09:51:12Z

TL;DR

Fixes the ADO Entra ID (AAD) bearer auth path that silently failed since #852 — the bearer token's auth_scheme and git_env were never threaded through _validate_package_exists, causing git ls-remote to run unauthenticated and fall through to a misleading "not accessible or doesn't exist" error. Additionally, apm install --update silently overwrote local files even when authentication failed. This PR plumbs the bearer correctly, raises a typed AuthenticationError with actionable diagnostics, and adds a pre-flight auth check that aborts --update before modifying any files.

Note

Closes #1015. Integration tests require live ADO access (APM_TEST_ADO_BEARER=1 + az login); they are skipped in default CI.

Problem (WHY)

Bearer auth_scheme dropped. _validate_package_exists hardcoded auth_scheme="basic", so bearer tokens were embedded as :<token>@ in the clone URL instead of being passed via GIT_ASKPASS — causing a 401 on every ADO bearer-only install.
git_env never merged. The subprocess environment for git ls-remote in validation did not include dep_ctx.git_env, so GIT_ASKPASS and GIT_TERMINAL_PROMPT=0 were missing — git would either prompt interactively or use no auth at all.
Auth failures swallowed. A broad except Exception at line 489 of validation.py caught AuthenticationError(RuntimeError), silently returning False and producing the ambiguous "not accessible or doesn't exist" error instead of an actionable diagnostic.
--update overwrites on auth failure. No pre-flight check existed — the pipeline proceeded to modify apm.yml, apm.lock.yaml, and apm_modules/ even when every remote operation failed due to missing credentials.
[!] Error double-wrapping. AuthenticationError was caught by the generic except Exception in install_pipeline(), re-wrapped as "Failed to install APM dependencies: Failed to resolve…", hiding the original diagnostic.

Approach (WHAT)

#	Fix
1	Capture `dep_ctx.auth_scheme` and pass it to `_build_repo_url` so bearer uses `GIT_ASKPASS`, not URL embedding
2	Merge `dep_ctx.git_env` into the subprocess environment for `git ls-remote` in validation
3	Detect 401/403/auth-failure patterns in `git ls-remote` stderr and raise `AuthenticationError` with `build_error_context` diagnostics
4	Add `except AuthenticationError: raise` before the broad `except Exception` in both `validation.py` and `pipeline.py`
5	Add `_preflight_auth_check()` to `pipeline.py` — clusters deps by `(host, org)`, runs one `git ls-remote` per cluster, aborts with "No files were modified" on failure
6	Add `except AuthenticationError` handlers at both install entry points in `commands/install.py` — render diagnostic on default output path

Implementation (HOW)

src/apm_cli/install/errors.py — Added AuthenticationError(RuntimeError) with a diagnostic_context: str attribute for carrying the pre-rendered 4-case ADO diagnostic from build_error_context.
src/apm_cli/install/validation.py — Three surgical fixes: (1) capture _auth_scheme from dep_ctx and pass to _build_repo_url, (2) merge dep_ctx.git_env into subprocess env, (3) detect auth-failure patterns in stderr and raise AuthenticationError. Also added except AuthenticationError: raise before the outer except Exception that was swallowing it.
src/apm_cli/install/pipeline.py — Added _preflight_auth_check() that clusters --update deps by (host, org), skips github.com, and runs one git ls-remote per cluster. On failure raises AuthenticationError with "No files were modified" + file list. Also added except AuthenticationError: raise before the generic handler.
src/apm_cli/commands/install.py — Added except AuthenticationError at both entry points (before except Exception). Renders _rich_error(str(e)) + _rich_echo(e.diagnostic_context) on the default output path, then sys.exit(1).
docs/…/authentication.md + packages/…/authentication.md — Reordered ADO section to lead with az login, added tenant-discovery guidance, documented auth-failure diagnostics and --update pre-flight behavior. Skill resource mirrored.
CHANGELOG.md — Unreleased entry documenting the fix.

Diagrams

Legend: Data flow from AuthResolver through validation, pipeline, and rendering — dashed nodes are new in this PR.

flowchart LR
    subgraph Resolve["AuthResolver"]
        A1["resolve_for_dep()"]
    end
    subgraph Validate["validation.py"]
        V1["_validate_package_exists()"]
        V2["auth_scheme passthrough"]:::new
        V3["git_env merge"]:::new
        V4["401/403 detection"]:::new
    end
    subgraph Pipeline["pipeline.py"]
        P1["_preflight_auth_check()"]:::new
        P2["install_pipeline()"]
        P3["AuthenticationError re-raise"]:::new
    end
    subgraph Render["commands/install.py"]
        R1["except AuthenticationError"]:::new
        R2["_rich_error + diagnostic"]:::new
    end
    A1 --> V1
    V2 --> V1
    V3 --> V1
    V1 -->|"auth failure"| V4
    V4 -->|"raises"| P3
    P1 -->|"--update pre-flight"| V1
    P3 -->|"propagates"| R1
    R1 --> R2
    classDef new stroke-dasharray: 5 5;
    class V2,V3,V4,P1,P3,R1,R2 new;

Trade-offs

One typed exception vs per-host error classes. Chose a single AuthenticationError carrying a diagnostic_context string; rejected per-host subclasses (AdoAuthError, GheAuthError) because the 4-case diagnostic from build_error_context already encodes host-specific guidance — a class hierarchy would add indirection without new signal.
Pre-flight git ls-remote vs try_with_fallback in validation. Rejected refactoring _validate_package_exists to use try_with_fallback because the blast radius would touch every host type, not just ADO. The pre-flight probe is additive and ADO-scoped.
Subprocess az vs azure-identity SDK. Kept the existing azure_cli.py subprocess contract (az account get-access-token); adding azure-identity would pull a heavy dependency and change the auth surface for a bug fix.
except AuthenticationError: raise pattern (2 sites). Surgical re-raise before broad except Exception rather than narrowing the outer catch — minimal diff, zero risk to non-auth paths.

Benefits

ADO bearer-only installs work. Users whose orgs disabled PAT creation can now az login && apm install without hitting silent failures.
Actionable diagnostics. Auth failures surface the specific 4-case ADO diagnostic (no PAT + no az, no az session, tenant mismatch, stale PAT) instead of "not accessible or doesn't exist".
--update is safe. Pre-flight probe rejects bad auth before modifying apm.yml, apm.lock.yaml, or apm_modules/ — users see "No files were modified".
20 new unit tests + 4 integration tests. Covering AuthenticationError roundtrip, validation bearer plumbing, pipeline preflight, and install command rendering.

Validation

uv run --extra dev pytest tests/unit tests/test_console.py -x:

Full pytest output (6695 tests)

6695 passed, 1 warning in 69.83s (0:01:09)

New test files only:

tests/unit/install/test_errors.py ....                        [  4/20]
tests/unit/install/test_validation_ado_bearer.py ......       [ 10/20]
tests/unit/install/test_pipeline_auth_preflight.py .....      [ 15/20]
tests/unit/install/test_install_cmd_auth_rendering.py .....   [ 20/20]
20 passed in 0.49s

How to test

uv run --extra dev pytest tests/unit/install/test_errors.py tests/unit/install/test_validation_ado_bearer.py tests/unit/install/test_pipeline_auth_preflight.py tests/unit/install/test_install_cmd_auth_rendering.py -x — all 20 pass.
uv run --extra dev pytest tests/unit tests/test_console.py -x — full suite (6695) passes.
(Live, optional) unset ADO_APM_PAT && az login --tenant <tenant> && apm install dev.azure.com/<org>/<project>/<repo> — succeeds via bearer.
(Live, optional) unset ADO_APM_PAT && AZURE_CONFIG_DIR=/nonexistent apm install dev.azure.com/<org>/<project>/<repo> — prints 4-case diagnostic, exits non-zero.
(Live, optional) Same as above with --update — prints "No files were modified", local files untouched.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

…-> v0.71.1 Replace the on.steps: 'exit 1' label-name guards in pr-review-panel and triage-panel with top-level frontmatter 'if:' fields. gh-aw propagates top-level 'if:' to BOTH the pre_activation and activation jobs, so unmatched label events now render as a clean gray Skipped status instead of red Failed (which was polluting the CI dashboard on every PR labeled with anything other than 'panel-review', and on every issue labeled with anything other than 'status/needs-triage'). Workaround for the lack of native label-name filtering on pull_request_target / issues 'labeled' triggers. Both .md files now carry a TODO marker pointing at github/gh-aw ADR-28737, which adds a first-class 'on.labels:' filter (committed 2026-04-27, post-v0.71.1, not yet released). Once released, both gates can collapse to 'on.labels: [<name>]'. Also bump gh-aw v0.68.3 -> v0.71.1 (latest released) and recompile all workflows. Other lock.yml files and agentics-maintenance.yml change only because of the setup-action SHA bump and the regenerated maintenance-workflow template; no behavioural change there. Repro of the original noise: https://github.com/microsoft/apm/actions/runs/25089778042 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Resolved conflicts in generated files by taking main's versions, then re-running 'gh aw compile' to re-apply the panel/triage label-gate 'if:' fields and re-bump setup-cli SHA to v0.71.1. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Typed exception for remote-host auth failures (PAT rejected, bearer rejected, no credentials available). Carries a pre-rendered diagnostic_context from build_error_context so the renderer can display actionable guidance on the default output path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Three defects fixed: 1. Pass auth_scheme from _dep_ctx to _build_repo_url so bearer tokens use extraheader injection instead of embedding JWT in URL userinfo. 2. Merge _dep_ctx.git_env (GIT_CONFIG_COUNT/KEY_0/VALUE_0 overrides) into the subprocess env so git ls-remote sends the Authorization header for AAD bearer tokens. 3. Detect auth-related failures (401/403/Authentication failed) from git ls-remote stderr and raise AuthenticationError with build_error_context diagnostics instead of returning bare False. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

#1015) - Add AuthenticationError to the re-raise chain (alongside PolicyViolationError, DirectDependencyError, PathTraversalError) so auth failures are not wrapped as "Failed to resolve APM dependencies: ...". - Add _preflight_auth_check(): when update_refs is set, run one git ls-remote per distinct (host, org) cluster BEFORE any write phase. Aborts with AuthenticationError carrying "No files were modified" + build_error_context diagnostics. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add except AuthenticationError handlers at both install entry points in commands/install.py. Renders the diagnostic_context (from build_error_context) on the DEFAULT path -- not --verbose-gated. Catches AuthenticationError BEFORE the generic Exception handler so the "Failed to install APM dependencies:" double-wrap is avoided. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…1015) - test_errors.py: AuthenticationError attribute roundtrip, isinstance - test_validation_ado_bearer.py: bearer scheme passed to _build_repo_url, git_env merged into subprocess, 401/403 raise AuthenticationError, DNS failure returns False, PAT regression (basic scheme embeds token) - test_pipeline_auth_preflight.py: --update pre-flight rejects bad auth with "No files were modified", passes good auth, skips github.com, deduplicates (host, org) clusters - test_install_cmd_auth_rendering.py: AuthenticationError not caught by PolicyViolationError, bypasses generic RuntimeError wrap - Fix: let AuthenticationError propagate through outer try/except in _validate_package_exists (the catch-all was for parse failures only) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- bearer-only install (no PAT) succeeds via az cli - bogus PAT + no az -> actionable diagnostic, no legacy wording - --update pre-flight abort: "No files were modified", files untouched - explicit PAT regression after bearer fix Note: integration tests require live ADO access + az login; skipped in CI unless APM_TEST_ADO_BEARER=1 and tenant context is configured. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ance - Reorder ADO quick-start to recommend `az login` first, PAT second - Add tenant-discovery guidance (org settings URL + az account show) - Document auth-failure diagnostics and --update pre-flight behavior - Mirror changes to skill resource (authentication.md sync) Closes #1015 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR fixes Azure DevOps (ADO) Entra ID (AAD) bearer authentication plumbing during install/validation, introduces a --update auth preflight to abort before destructive writes on auth failure, and updates docs/workflows/tests to cover the regression and new behavior.

Changes:

Plumbs auth_scheme and per-dependency git_env into ADO/GHES validation and raises a typed AuthenticationError for auth-specific failures.
Adds an --update preflight auth probe in the install pipeline and renders AuthenticationError diagnostics on the default CLI output path.
Adds unit/integration coverage plus docs + changelog updates; updates gh-aw workflow gating to “skip not fail” for non-matching labels.

Show a summary per file

File	Description
`src/apm_cli/install/validation.py`	Passes `auth_scheme`, merges `git_env`, and raises `AuthenticationError` on auth failures during repo validation.
`src/apm_cli/install/pipeline.py`	Adds `_preflight_auth_check()` and re-raises `AuthenticationError` to avoid generic wrapping.
`src/apm_cli/install/errors.py`	Introduces `AuthenticationError` carrying `diagnostic_context`.
`src/apm_cli/commands/install.py`	Renders `AuthenticationError` diagnostics without requiring `--verbose`.
`tests/unit/install/test_validation_ado_bearer.py`	Unit tests for bearer scheme plumbing and env merging in validation.
`tests/unit/install/test_pipeline_auth_preflight.py`	Unit tests for preflight probe behavior and deduping.
`tests/unit/install/test_install_cmd_auth_rendering.py`	Tests exception hierarchy expectations for clean rendering (no double wrap).
`tests/unit/install/test_errors.py`	Tests `AuthenticationError` fields and defaults.
`tests/integration/test_ado_bearer_e2e.py`	Adds #1015 regression coverage for bearer-only install + diagnostic output + update abort behavior.
`packages/apm-guide/.apm/skills/apm-usage/authentication.md`	Updates ADO auth guidance and documents preflight/diagnostics.
`docs/src/content/docs/getting-started/authentication.md`	Updates public docs with recommended `az login` flow and diagnostics.
`CHANGELOG.md`	Adds an Unreleased entry describing the #1015 fix.
`.github/workflows/*.md` / `.lock.yml` / `.github/aw/actions-lock.json`	Updates gh-aw gating approach and refreshes generated lock artifacts.

Copilot's findings

Files reviewed: 21/21 changed files
Comments generated: 1

… test asserts - pipeline.py:301 — pass ctx.auth_resolver to _preflight_auth_check instead of the local arg, which can be None even after resolve phase populates ctx.auth_resolver (resolve.py:91-92). Prevents an AttributeError on update installs that don't pass an AuthResolver explicitly. Flagged by Copilot reviewer. - 3 test files — replace 'dev.azure.com' in str(...) with bounded full-phrase equality assertion against 'Authentication failed for dev.azure.com'. Satisfies CodeQL #82/#83/#84 (incomplete URL substring sanitization) and our own tests.instructions.md rule banning bare URL/host substring checks. Tests: 20/20 green in tests/unit/install/. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- pipeline.py:301 -- pass ctx.auth_resolver to _preflight_auth_check instead of the local 'auth_resolver' arg, which can be None even after resolve phase populates ctx.auth_resolver (resolve.py:91-92). Prevents AttributeError on update installs that don't pass an AuthResolver explicitly. Flagged by Copilot reviewer. - 3 test files -- replace 'dev.azure.com' in str(...) with bounded full-phrase equality assertion against 'Authentication failed for dev.azure.com'. Satisfies CodeQL alerts #82/#83/#84 (incomplete URL substring sanitization) and our own tests.instructions.md rule banning bare URL/host substring checks. Verified: 20/20 unit tests in tests/unit/install/test_*.py green. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

danielmeppiel · 2026-04-29T10:35:03Z

Review fixes pushed (`ecf6ffb3`) + live verification with `az login`

Thanks for the careful review. All four review threads are addressed in a single follow-up commit, plus I ran end-to-end live verification against a real ADO repo. Three proofs below — each one corresponds to a user-visible behavior the original issue (#1015) put on the line.

Review threads addressed

Thread	File:Line	Fix
@copilot-pull-request-reviewer	`src/apm_cli/install/pipeline.py:301`	`_preflight_auth_check(ctx, auth_resolver, …)` → `_preflight_auth_check(ctx, ctx.auth_resolver, …)`. Resolve phase guarantees `ctx.auth_resolver` is populated (`resolve.py:91-92`); the local arg can still be `None`. Inline comment added.
CodeQL #82	`tests/unit/install/test_install_cmd_auth_rendering.py:32`	`assert "dev.azure.com" in str(e)` → `assert str(e) == "Authentication failed for dev.azure.com"` (bounded full-phrase).
CodeQL #83	`tests/unit/install/test_pipeline_auth_preflight.py:79`	Same pattern.
CodeQL #84	`tests/unit/install/test_validation_ado_bearer.py:159`	Same pattern.

The bounded-equality fix also satisfies our own .github/instructions/tests.instructions.md rule banning bare URL/host substring checks, so it eliminates two classes of issue at once. Targeted suite: 20/20 green (uv run --extra dev pytest tests/unit/install/test_install_cmd_auth_rendering.py tests/unit/install/test_pipeline_auth_preflight.py tests/unit/install/test_validation_ado_bearer.py tests/unit/install/test_errors.py -x).

Live verification with real `az login`

Local environment, real az, real ADO repo dev.azure.com/dmeppiel-org/market-js-app/_git/compliance-rules:

$ az account show --query "{user: user.name, tenant: tenantId}" -o json
{
  "tenant": "<redacted-tenant-id>",
  "user": "<redacted-user>"
}

Proof 1 — `az login` + NO `ADO_APM_PAT` → install succeeds

This is the headline bug from #1015. Before this PR: silent failure. After this PR:

$ env -u ADO_APM_PAT apm install --only apm --verbose \
    "dev.azure.com/dmeppiel-org/market-js-app/_git/compliance-rules"

[*] Validating 1 package...
  Trying git ls-remote for dev.azure.com (1 attempt)
  git ls-remote (https) rc=0 for dev.azure.com/dmeppiel-org/market-js-app/_git/compliance-rules
[+] dev.azure.com/dmeppiel-org/market-js-app/compliance-rules
Added dev.azure.com/dmeppiel-org/market-js-app/compliance-rules to apm.yml
[*] Updated apm.yml with 1 new package(s)
[>] Installing 1 new package...
Parsed apm.yml: 1 APM deps, 0 MCP deps
  [i] dev.azure.com -- using bearer from az cli (source: AAD_BEARER_AZ_CLI)
Resolved 1 direct dependencies (no transitive)
  [+] dmeppiel-org/market-js-app/compliance-rules (cached)
  |-- 1 instruction(s) integrated -> .github/instructions/
  |-- 3 prompts integrated -> .github/prompts/
  |-- 1 agents integrated -> .github/agents/
[i] Added apm_modules/ to .gitignore
Generated apm.lock.yaml with 1 dependencies
[*] Installed 1 APM dependency.

$ echo $?
0

Note [i] dev.azure.com -- using bearer from az cli (source: AAD_BEARER_AZ_CLI) — the bearer fix surfaces the real auth source. Compare against main where the JWT was being embedded in the URL and ADO rejected it.

Proof 2 — NO PAT + `az` NOT signed in → diagnostic on the default path, zero mutation

Simulated logged-out az via AZURE_CONFIG_DIR=<empty-dir>:

$ env -u ADO_APM_PAT AZURE_CONFIG_DIR=/tmp/empty-az-config apm install --only apm \
    "dev.azure.com/dmeppiel-org/market-js-app/_git/compliance-rules"
[*] Validating 1 package...
[i] apm.yml restored to its previous state.
Authentication failed for dev.azure.com

    Azure DevOps requires authentication. You have two options:

    1. Sign in with Azure CLI (recommended for Entra ID users):
         az login
         apm install                   # retry -- no env var needed

    2. Use a Personal Access Token:
         export ADO_APM_PAT=your_token

    Docs: https://microsoft.github.io/apm/getting-started/authentication/#azure-devops

$ echo $?
1

Key observations:

No --verbose flag — diagnostic renders on the default output path, exactly as the issue comment promised.
The legacy not accessible or doesn't exist string is gone.
az login is listed first as recommended for Entra users — matches the docs reorder in this PR.
apm.yml, apm.lock.yaml, apm_modules/ — none mutated (apm.lock.yaml and apm_modules/ not even created).

Proof 3 — `apm install --update` with broken auth → abort + byte-identical state

Started from a successfully installed project (Proof 1's tree), then ran --update with az logged out:

$ # Pre-snapshot
$ shasum -a 256 apm.yml apm.lock.yaml
0782b11fb5cfb02768168c4fb3119a7abb56c201772b2e57bc1cbf12e7243586  apm.yml
314774b230df0a1f562b806ea092eac96437736a097b642c9c1254495eb0c538  apm.lock.yaml
$ # apm_modules/ aggregate hash (find -exec sha256sum | sort | sha256sum):
931c76abb90736348c0f02672c7e1802fcfc5476342436a67c0556d7318aa583  -

$ env -u ADO_APM_PAT AZURE_CONFIG_DIR=/tmp/empty-az-config apm install --update --only apm
[>] Installing dependencies from apm.yml...
Authentication failed for dev.azure.com

    Azure DevOps requires authentication. You have two options:

    1. Sign in with Azure CLI (recommended for Entra ID users):
         az login
         apm install                   # retry -- no env var needed

    2. Use a Personal Access Token:
         export ADO_APM_PAT=your_token

    Docs: https://microsoft.github.io/apm/getting-started/authentication/#azure-devops

    No files were modified.
    apm.yml, apm.lock.yaml, and apm_modules/ are unchanged.

$ echo $?
1

$ # Post-snapshot — must match pre exactly
$ shasum -a 256 apm.yml apm.lock.yaml
0782b11fb5cfb02768168c4fb3119a7abb56c201772b2e57bc1cbf12e7243586  apm.yml
314774b230df0a1f562b806ea092eac96437736a097b642c9c1254495eb0c538  apm.lock.yaml
931c76abb90736348c0f02672c7e1802fcfc5476342436a67c0556d7318aa583  -

Match? YES — zero mutation.

Pre/post SHA256 match exactly for all three at-risk artifacts. The pre-flight probe aborted before any write phase fired, the abort message contains the literal "No files were modified" guarantee, and the three artifacts are listed by name. This is the data-loss trap from #1015 closed.

Re-requesting review.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

danielmeppiel and others added 10 commits April 29, 2026 09:40

chore: CHANGELOG entry for #1015 + trim install.py to LOC budget

36ec4a7

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 29, 2026 09:51

danielmeppiel requested a review from sergio-sisternes-epam as a code owner April 29, 2026 09:51

danielmeppiel added the bug Deprecated: use type/bug. Kept for issue history; will be removed in milestone 0.10.0. label Apr 29, 2026

Copilot started reviewing on behalf of danielmeppiel April 29, 2026 09:52 View session

github-advanced-security AI found potential problems Apr 29, 2026

View reviewed changes

Comment thread tests/unit/install/test_install_cmd_auth_rendering.py Fixed

Comment thread tests/unit/install/test_pipeline_auth_preflight.py Fixed

Comment thread tests/unit/install/test_validation_ado_bearer.py Fixed

Copilot AI reviewed Apr 29, 2026

View reviewed changes

Comment thread src/apm_cli/install/pipeline.py Outdated

danielmeppiel force-pushed the fix/1015-ado-entra-auth branch from 3d071f8 to 36ec4a7 Compare April 29, 2026 10:33

Copilot started work on behalf of danielmeppiel April 29, 2026 10:35 View session

Copilot finished work on behalf of danielmeppiel April 29, 2026 10:38

danielmeppiel added the panel-review Trigger the apm-review-panel gh-aw workflow label Apr 29, 2026

danielmeppiel merged commit add02ad into main Apr 29, 2026
19 of 20 checks passed

danielmeppiel deleted the fix/1015-ado-entra-auth branch April 29, 2026 10:53

This was referenced Apr 29, 2026

Import-input arrays are stringified as Go-slice [a b] instead of JSON, breaking jq --argjson consumers github/gh-aw#29076

Closed

fix(shared/apm): repair gh-aw [a b] import-input serialization that breaks apm-prep #1033

Merged

Copilot AI mentioned this pull request Apr 29, 2026

fix: serialize array import-inputs as JSON instead of Go slice format [a b] github/gh-aw#29084

Merged

danielmeppiel mentioned this pull request Apr 29, 2026

[docs] Update documentation for features from 2026-04-29 #1037

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(install): ADO Entra ID auth path + --update pre-flight abort (#1015)#1031

fix(install): ADO Entra ID auth path + --update pre-flight abort (#1015)#1031
danielmeppiel merged 11 commits intomainfrom
fix/1015-ado-entra-auth

danielmeppiel commented Apr 29, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

danielmeppiel commented Apr 29, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

danielmeppiel commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TL;DR

Problem (WHY)

Approach (WHAT)

Implementation (HOW)

Diagrams

Trade-offs

Benefits

Validation

How to test

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

danielmeppiel commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review fixes pushed (ecf6ffb3) + live verification with az login

Review threads addressed

Live verification with real az login

Proof 1 — az login + NO ADO_APM_PAT → install succeeds

Proof 2 — NO PAT + az NOT signed in → diagnostic on the default path, zero mutation

Proof 3 — apm install --update with broken auth → abort + byte-identical state

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

danielmeppiel commented Apr 29, 2026 •

edited

Loading

danielmeppiel commented Apr 29, 2026 •

edited

Loading

Review fixes pushed (`ecf6ffb3`) + live verification with `az login`

Live verification with real `az login`

Proof 1 — `az login` + NO `ADO_APM_PAT` → install succeeds

Proof 2 — NO PAT + `az` NOT signed in → diagnostic on the default path, zero mutation

Proof 3 — `apm install --update` with broken auth → abort + byte-identical state