Repository navigation
Fix my FIC CLI - #1508
Fix my FIC CLI#1508
Conversation
|
/azp run |
|
Commenter does not have sufficient privileges for PR 1508 in repo Azure/azure-devops-cli-extension |
|
/azp run |
|
Commenter does not have sufficient privileges for PR 1508 in repo Azure/azure-devops-cli-extension |
| }, | ||
| data=json.dumps({'serviceConnectionInput': azdo_subject}), | ||
| timeout=30 | ||
| ) |
There was a problem hiding this comment.
What is the experience in the cli if someone runs this on a service connection which is already migrated.
There was a problem hiding this comment.
The CLI does not check whether the service connection is already migrated. It sends the migration request to Azure DevOps every time.
If the API returns success, the CLI prints its JSON response.
If the API returns a non-success status, the CLI raises Migration request failed (): .
| logger.debug("Derived organization URL from --azdo-subject: %s", origin) | ||
| elif detect: | ||
| # Only use resolve_instance when auto-detection from git config is requested | ||
| origin = resolve_instance(detect=detect, organization=origin) |
There was a problem hiding this comment.
We should never go into elif branch here, right? It should be an error scenario here, if the intention is to get the org name from the service connection string.
There was a problem hiding this comment.
it is reachable when someone explicitly passes --detect true. That asks the CLI to resolve the organization from configuration or Git instead of deriving it from the subject.
It isn’t inherently an error. Resolution can fail if no valid organization is found.
| help="Federated credential subject of the Azure DevOps issuer, in " | ||
| "'sc://<organization>/<project>/<serviceConnectionName>' format. " | ||
| "The organization URL is derived from --azdo-subject when --organization is not provided.") | ||
| context.argument('origin', |
There was a problem hiding this comment.
Based on recent security incidents, it has been told to avoid such passing of non-trusted origins.
|
Igor Tsoi (@igortsoi) Please update PR description with the changes done. |
Add sanitized migration acceptance and error recordings with CLI playback scenarios, update service endpoint unit tests, and document recording and replay requirements.
Translate timeout, proxy, TLS, and connection failures into actionable CLI errors without retrying migration requests. Add focused transport-error and exception propagation tests.
Bhavesh Bhati (bhaveshbhati)
left a comment
Bhavesh Bhati (bhaveshbhati)
left a comment
There was a problem hiding this comment.
LGTM
5 participants
Adds az devops service-endpoint convert --azdo-subject "sc:////" to migrate Azure DevOps service connections to external federated credentials.
The command derives the organization URL from the subject, authenticates using the existing Azure CLI login, invokes the migration API, and reports the result or error. Includes command help and unit tests.