feat: replace azure-validate Aspire ACA env-var setup with a script - #2855
Merged
Tom Meschter (tmeschter) merged 8 commits intoJul 17, 2026
Merged
Conversation
Replace the inline bash + PowerShell get-and-set sequence in the azure-validate
Aspire recipe with set-aspire-aca-env.{sh,ps1}. The scripts load azd env values
safely (no eval), derive the resource group, and set the three Container Apps env
vars only if missing, printing a compact summary. aspire.md now links to the
scripts with sample invocations and a short description.
Fixes microsoft#2504
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7b3989d9-1cae-4615-8f24-8d005f8c0e46
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b3989d9-1cae-4615-8f24-8d005f8c0e46
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b3989d9-1cae-4615-8f24-8d005f8c0e46
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b3989d9-1cae-4615-8f24-8d005f8c0e46
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b3989d9-1cae-4615-8f24-8d005f8c0e46
The azure-validate Aspire recipe now runs set-aspire-aca-env.{sh,ps1} instead of inline 'azd env set' commands, so the env-var names no longer appear on the command line. Treat invoking the script as satisfying softCheckContainerDeployEnvVars.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7b3989d9-1cae-4615-8f24-8d005f8c0e46
Tom Meschter (tmeschter)
requested a review
from Rick Winter (RickWinter)
as a code owner
July 15, 2026 22:31
Contributor
There was a problem hiding this comment.
Pull request overview
This PR refactors the azure-validate Aspire/Container Apps post-provisioning “env-var fill” steps by moving the previously inline bash/PowerShell logic into dedicated helper scripts, updating documentation to invoke those scripts, and adjusting azure-deploy integration-test heuristics to recognize script-based setup.
Changes:
- Add
set-aspire-aca-env.shandset-aspire-aca-env.ps1helper scripts to set required ACA-related env vars only when missing. - Update the Aspire AZD recipe docs to link to and invoke the helper scripts instead of embedding command sequences.
- Update
softCheckContainerDeployEnvVarsto treat invoking the helper script as satisfying env-var expectations.
Show a summary per file
| File | Description |
|---|---|
tests/azure-deploy/utils.ts |
Updates the soft-check logic to accept the new helper-script invocation in place of literal azd env set ... commands. |
plugin/skills/azure-validate/references/recipes/azd/scripts/set-aspire-aca-env.sh |
Introduces a bash helper script to resolve RG/resources and set missing Aspire/ACA env vars. |
plugin/skills/azure-validate/references/recipes/azd/scripts/set-aspire-aca-env.ps1 |
Introduces a PowerShell helper script with the same intent for Windows/PowerShell scenarios. |
plugin/skills/azure-validate/references/recipes/azd/aspire.md |
Updates documentation to point to the new scripts and provide example invocations. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 7
- Review effort level: Low
Bash (set-aspire-aca-env.sh): - Remove `declare -A` (Bash 4+ only) so it runs on the widely-available Bash 3.2 (e.g. macOS); parse azd values with a small POSIX-friendly get_env_value helper. - Capture `azd env get-values` via command substitution so `set -e` reliably aborts when the azd call fails (instead of process substitution). - Drop `eval`; pass each resolver command as arguments and run it via "$@". - Use `#!/usr/bin/env bash`. PowerShell (set-aspire-aca-env.ps1): - Remove `$ErrorActionPreference = 'Stop'` and instead check `$LASTEXITCODE` after `azd env get-values`, since PowerShell doesn't treat native-command failures as terminating errors. Tests (azure-deploy/utils.ts): - Tighten ASPIRE_ACA_ENV_SCRIPT_PATTERN to match only an actual script invocation at the start of a command (optionally via bash/sh/pwsh/powershell), so references like `cat`/`chmod` no longer satisfy softCheckContainerDeployEnvVars. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b3989d9-1cae-4615-8f24-8d005f8c0e46
Surface error messages on the error stream (still exiting non-zero) so failures are captured by CI/log collectors, per PR review. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b3989d9-1cae-4615-8f24-8d005f8c0e46
JasonYeMSFT (JasonYeMSFT)
approved these changes
Jul 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The
azure-validateAspire recipe (plugin/skills/azure-validate/references/recipes/azd/aspire.md) hand-wrote a deterministic get-and-set sequence — duplicated across bash and PowerShell — to populate the Container Apps environment variables that Aspire "limited mode" leaves unset afterazd provision(needed beforeazd deploy). The bash path parsedazd env get-valueswithgrep | cut | trand the PowerShell path duplicated the logic withSelect-String/.Split(), which is fragile and drifts.This PR replaces that inline sequence with a pair of cross-platform helper scripts:
set-aspire-aca-env.shandset-aspire-aca-env.ps1(behavior parity) underplugin/skills/azure-validate/references/recipes/azd/scripts/.azd env get-valuessafely (noeval), derive the resource group, and setAZURE_CONTAINER_REGISTRY_ENDPOINT,AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID, andMANAGED_IDENTITY_CLIENT_IDonly if missing, printing a compact summary (or "already present"). They fail with a clear message if the resource group or a resource can't be resolved.throw) and uses a<# ... #>comment-based help header.aspire.mdnow links to both scripts with sample invocations and lists the env vars they set, instead of embedding the shell logic.Relevant tests / evals
tests/azure-deploy/integration.test.ts(brownfield-dotnetAspire deploy tests) are the tests that actually exercise the script: they run the fullazd provision → azd deployflow for Aspire Container Apps, passing through the post-provision env-var window.deploys aspire orleans-votingexplicitly soft-asserts the three env vars viasoftCheckContainerDeployEnvVars.tests/azure-deploy/utils.ts— updatedsoftCheckContainerDeployEnvVarsso that invokingset-aspire-aca-env.{sh,ps1}satisfies the check. Previously it scanned the agent's shell commands for the literal env-var names; now that thoseazd env setcalls live inside the script, the names no longer appear on the command line, so the check now also accepts the script invocation.azure-validateunit/trigger tests pass (SKIP_INTEGRATION_TESTS=true npm test -- --testPathPatterns=azure-validate).azure-validateeval currently drives the post-provision step end-to-end (allevals/azure-validatestimuliearlyTerminateat/beforeazd provision); coverage comes from the azure-deploy Aspire integration tests above.Validation run locally: bash/PowerShell parser checks,
npm run build,scriptsfrontmatter + references validators (referencespasses, no orphaned/escaped links), token check (aspire.mdwithin budget), andteststypecheck + ESLint.Related Issues
Fixes #2504