Prompt
Create an ASP.NET Core 8 web API with a Todo model using Entity Framework Core and SQL Server. Then prepare it for Azure deployment. Use the eastus2 region and my current subscription.
Summary
Run: Integration Tests - all #207
Test: azure-prepare_ - Integration Tests › generates Entra-only SQL auth for ASP.NET Core EF Core app (not SQL admin password)
Result: Fail — expect(received).toBe(expected) // Object.is equality — Expected: false, Received: true (line 943 of integration.test.ts)
Duration: (End-to-End test)
Root Cause Category
Assertion mismatch — agent included a SQL admin password in generated Bicep/configuration when the test expects Entra-only (no SQL admin password) authentication
Diagnosis
What was expected
The test checks that the agent generates an ASP.NET Core 8 + EF Core + SQL Server project configured for Entra-only SQL authentication (no SQL admin password). The assertion at integration.test.ts:943 expects:
hasSqlAdminPassword === false
Azure best practices and the azure-prepare skill guidance specify that SQL Server deployments should use Entra ID (managed identity) authentication, not a SQL admin password.
What actually happened
The agent generated a complete ASP.NET Core 8 API with 17 files (application code, Bicep infrastructure, Docker configuration), but included a SQL admin password in the generated output. The assertion expect(hasSqlAdminPassword).toBe(false) failed because hasSqlAdminPassword was true.
According to the SKILL-REPORT, the agent did configure Entra ID authentication and Container Apps, but still included a SQL admin password alongside it. The SKILL-REPORT assessed this as a pass (the skill completed the task), but the specific security assertion failed.
Why it failed
The azure-prepare skill's Bicep generation logic for SQL Server scenarios is including a SQL admin password parameter even when Entra-only authentication is intended. Possible causes:
- The skill's SQL Server Bicep template defaults to dual-auth (Entra + SQL password fallback) instead of enforcing Entra-only
- The
azureADOnlyAuthentication: false parameter or a sqlAdminPassword parameter is being emitted into the generated Bicep/parameter files
- A connection string or Key Vault secret containing a SQL password credential is being generated even when Entra auth is configured
Suggested fix
- Update the azure-prepare skill's SQL Server Bicep templates to set
azureADOnlyAuthentication: true and omit the sqlAdminPassword parameter when Entra auth is selected
- Ensure the skill guidance explicitly states: "When deploying SQL Server with EF Core, prefer Entra-only auth via managed identity; do not generate SQL admin passwords"
- Add a code review check in the skill workflow to verify no SQL admin password is emitted for Entra auth scenarios
azure-prepare Skill Invocation
| Skill |
Invoked |
| azure-prepare |
✅ Yes |
The skill was correctly invoked and generated all application files. The failure is a content assertion on the security configuration of the generated Bicep.
Skill Report Context
From the SKILL-REPORT for run 2026-05-02:
- Overall Test Pass Rate: 98.1% (51/52) — this is the one failing test
- Skill Invocation Success Rate: 100% (30/30)
- Average Confidence: 91.4%
- Test 34 "Entra SQL Authentication Setup": SKILL-REPORT assessed as 100% pass (90% confidence), but the hard assertion on
hasSqlAdminPassword failed
- The agent generated 17 files with managed identity and Container Apps, but the SQL configuration still contained a SQL admin password
Environment
Generated by Analyze Test Run · ● 2.6M · ◷
Prompt
Summary
Run: Integration Tests - all #207
Test:
azure-prepare_ - Integration Tests › generates Entra-only SQL auth for ASP.NET Core EF Core app (not SQL admin password)Result: Fail —
expect(received).toBe(expected) // Object.is equality — Expected: false, Received: true(line 943 ofintegration.test.ts)Duration: (End-to-End test)
Root Cause Category
Assertion mismatch — agent included a SQL admin password in generated Bicep/configuration when the test expects Entra-only (no SQL admin password) authentication
Diagnosis
What was expected
The test checks that the agent generates an ASP.NET Core 8 + EF Core + SQL Server project configured for Entra-only SQL authentication (no SQL admin password). The assertion at
integration.test.ts:943expects:Azure best practices and the azure-prepare skill guidance specify that SQL Server deployments should use Entra ID (managed identity) authentication, not a SQL admin password.
What actually happened
The agent generated a complete ASP.NET Core 8 API with 17 files (application code, Bicep infrastructure, Docker configuration), but included a SQL admin password in the generated output. The assertion
expect(hasSqlAdminPassword).toBe(false)failed becausehasSqlAdminPasswordwastrue.According to the SKILL-REPORT, the agent did configure Entra ID authentication and Container Apps, but still included a SQL admin password alongside it. The SKILL-REPORT assessed this as a pass (the skill completed the task), but the specific security assertion failed.
Why it failed
The azure-prepare skill's Bicep generation logic for SQL Server scenarios is including a SQL admin password parameter even when Entra-only authentication is intended. Possible causes:
azureADOnlyAuthentication: falseparameter or asqlAdminPasswordparameter is being emitted into the generated Bicep/parameter filesSuggested fix
azureADOnlyAuthentication: trueand omit thesqlAdminPasswordparameter when Entra auth is selectedazure-prepare Skill Invocation
The skill was correctly invoked and generated all application files. The failure is a content assertion on the security configuration of the generated Bicep.
Skill Report Context
From the SKILL-REPORT for run 2026-05-02:
hasSqlAdminPasswordfailedEnvironment
771a66600a0ceb096d9779b4f75121dad1e96f72azure-prepare/integration.test.ts:943