Merge branch 'master' into sy/improve-cleanup0409

* disable vm

* update

* update

.github/workflows/azure-login-negative.yml

@@ -333,36 +333,3 @@ jobs:
       with:
           script: |
             core.setFailed('Last action should fail but not. Please check it.')
-
-  VMTest:
-    strategy:
-      matrix:
-        os: [self_linux, self_windows]
-    runs-on: ${{ matrix.os }}
-    environment: Automation test
-
-    steps:
-    - name: 'Checking out repo code'
-      uses: actions/checkout@v4
-
-    - name: Set Node.js 20.x for GitHub Action
-      uses: actions/setup-node@v4
-      with:
-        node-version: 20.x
-
-    - name: 'Validate build'
-      run: |
-        npm install
-        npm run build
-
-    - name: Login with system-assigned managed identity without auth-type
-      id: login_14
-      continue-on-error: true
-      uses: ./
-    
-    - name: Check Last step failed
-      if: steps.login_14.outcome == 'success'
-      uses: actions/github-script@v7
-      with:
-          script: |
-            core.setFailed('Last action should fail but not. Please check it.')

.github/workflows/azure-login-positive.yml

@@ -12,7 +12,7 @@ jobs:
   BasicTest:
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, self_linux, self_windows]
+        os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     environment: Automation test
 
@@ -47,13 +47,11 @@ jobs:
         az vm list --output none
 
     - name: Run Azure PowerShell
-      uses: azure/powershell@v1
+      uses: azure/powershell@v2
       with:
         azPSVersion: "latest"
         inlineScript: |
             $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            $checkResult = $checkResult -and ((Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG')
-            $checkResult = $checkResult -and ((Get-AzVM).Count -gt 0)
             if(-not $checkResult){
                 throw "Not all checks passed!"
             }
@@ -71,7 +69,7 @@ jobs:
         az account show --output none
 
     - name: Run Azure PowerShell again
-      uses: azure/powershell@v1
+      uses: azure/powershell@v2
       with:
         azPSVersion: "latest"
         inlineScript: |
@@ -94,13 +92,11 @@ jobs:
         az vm list --output none
 
     - name: Run Azure PowerShell
-      uses: azure/powershell@v1
+      uses: azure/powershell@v2
       with:
         azPSVersion: "latest"
         inlineScript: |
             $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            $checkResult = $checkResult -and ((Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG')
-            $checkResult = $checkResult -and ((Get-AzVM).Count -gt 0)
             if(-not $checkResult){
                 throw "Not all checks passed!"
             }
@@ -164,13 +160,11 @@ jobs:
         az vm list --output none
  
     - name: Run Azure PowerShell
-      uses: azure/powershell@v1
+      uses: azure/powershell@v2
       with:
         azPSVersion: "latest"
         inlineScript: |
             $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            $checkResult = $checkResult -and ((Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG')
-            $checkResult = $checkResult -and ((Get-AzVM).Count -gt 0)
             if(-not $checkResult){
                 throw "Not all checks passed!"
             }
@@ -189,7 +183,7 @@ jobs:
         az account show --output none
 
     - name: Run Azure PowerShell again
-      uses: azure/powershell@v1
+      uses: azure/powershell@v2
       with:
         azPSVersion: "latest"
         inlineScript: |
@@ -209,13 +203,13 @@ jobs:
     - name: Run Azure Cli
       shell: pwsh
       run: |
-        $checkResult = (az account list --output json | ConvertFrom-Json).Count -eq 2
+        $checkResult = (az account list --output json | ConvertFrom-Json).Count -eq 3
         if(-not $checkResult){
             throw "Not all checks passed!"
         }
 
     - name: Run Azure PowerShell
-      uses: azure/powershell@v1
+      uses: azure/powershell@v2
       with:
         azPSVersion: "latest"
         inlineScript: |
@@ -236,7 +230,7 @@ jobs:
         az account show --output none
 
     - name: Run Azure PowerShell
-      uses: azure/powershell@v1
+      uses: azure/powershell@v2
       with:
         azPSVersion: "latest"
         inlineScript: |
@@ -245,118 +239,3 @@ jobs:
                 throw "Not all checks passed!"
             }
 
-  VMTest:
-    strategy:
-      matrix:
-        os: [self_linux, self_windows]
-    runs-on: ${{ matrix.os }}
-    environment: Automation test
-
-    steps:
-    - name: 'Checking out repo code'
-      uses: actions/checkout@v4
-
-    - name: Set Node.js 20.x for GitHub Action
-      uses: actions/setup-node@v4
-      with:
-        node-version: 20.x
-
-    - name: 'Validate build'
-      run: |
-        npm install
-        npm run build
-
-    - name: Login with system-assigned managed identity, no subscription-id
-      uses: ./
-      with:
-        auth-type: IDENTITY
-        allow-no-subscriptions: true
-        enable-AzPSSession: true
-  
-    - name: Run Azure Cli
-      run: |
-        az account show --output none
-    
-    - name: Run Azure PowerShell
-      uses: azure/powershell@v1
-      with:
-        azPSVersion: "latest"
-        inlineScript: |
-            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            if(-not $checkResult){
-                throw "Not all checks passed!"
-            }
-
-    - name: Login with system-assigned managed identity, with subscription id
-      uses: ./
-      with:
-        auth-type: IDENTITY
-        subscription-id: ${{ secrets.AZURE_SUBSCRIPTIONID }}
-        enable-AzPSSession: true
-
-    - name: Run Azure Cli
-      run: |
-        az account show --output none
-        az group show --name GitHubAction_CI_RG --output none
-        az vm list --output none
-  
-    - name: Run Azure PowerShell
-      uses: azure/powershell@v1
-      with:
-        azPSVersion: "latest"
-        inlineScript: |
-            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            $checkResult = $checkResult -and ((Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG')
-            $checkResult = $checkResult -and ((Get-AzVM).Count -gt 0)
-            if(-not $checkResult){
-                throw "Not all checks passed!"
-            }
-
-    - name: Login with tenant-level user-assigned managed identity with allow-no-subscriptions
-      uses: ./
-      with:
-        client-id: ${{ secrets.UMI2_CLIENT_ID }}
-        allow-no-subscriptions: true
-        auth-type: IDENTITY
-        enable-AzPSSession: true
-    
-    - name: Run Azure Cli
-      run: |
-        az account show --output none
-    
-    - name: Run Azure PowerShell
-      uses: azure/powershell@v1
-      with:
-        azPSVersion: "latest"
-        inlineScript: |
-            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            if(-not $checkResult){
-                throw "Not all checks passed!"
-            }
-
-    - name: Login with user-assigned managed identity, subscription-id
-      uses: ./
-      with:
-        client-id: ${{ secrets.UMI1_CLIENT_ID }}
-        subscription-id: ${{ secrets.UMI1_SUBSCRIPTION_ID }}
-        auth-type: IDENTITY
-        enable-AzPSSession: true
-
-    - name: Run Azure Cli
-      run: |
-        az account show --output none
-        az group show --name GitHubAction_CI_RG --output none
-        az vm list --output none
-    
-    - name: Run Azure PowerShell
-      uses: azure/powershell@v1
-      with:
-        azPSVersion: "latest"
-        inlineScript: |
-            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            $checkResult = $checkResult -and ((Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG')
-            $checkResult = $checkResult -and ((Get-AzVM).Count -gt 0)
-            if(-not $checkResult){
-                throw "Not all checks passed!"
-            }
-

README.md

@@ -56,7 +56,7 @@ Azure Login Action supports different ways of authentication with Azure.
 |tenant-id|false|UUID||the login tenant id|
 |creds|false|string||a json string for login with an Azure service principal|
 |enable-AzPSSession|false|boolean|false|if Azure PowerShell login is enabled|
-|environment|false|string|azurecloud|the Azure Cloud environment|
+|environment|false|string|azurecloud|the Azure Cloud environment. For cloud environments other than the public cloud, the `audience` will also need to be updated.|
 |allow-no-subscriptions|false|boolean|false|if login without subscription is allowed|
 |audience|false|string|api://AzureADTokenExchange|the audience to get the JWT ID token from GitHub OIDC provider|
 |auth-type|false|string|SERVICE_PRINCIPAL|the auth type|
@@ -126,6 +126,8 @@ By default, Azure Login Action connects to the Azure Public Cloud (`AzureCloud`)
 
 To login to one of the Azure Government clouds or Azure Stack, set `environment` to one of the supported values `AzureUSGovernment` or `AzureChinaCloud` or `AzureGermanCloud` or `AzureStack`.
 
+The default [`audience`](#audience) for each of these clouds is different and will also need to be set if using anything other than the public environment.
+
 Refer to [Login to Azure US Government cloud](#login-to-azure-us-government-cloud) for its usage.
 
 ### `allow-no-subscriptions`

action.yml

@@ -40,5 +40,7 @@ branding:
 runs:
   using: 'node20'
   pre: 'lib/cleanup/index.js'
+  pre-if: (! env.AZURE_LOGIN_PRE_CLEANUP_OFF)
   main: 'lib/main/index.js'
   post: 'lib/cleanup/index.js'
+  post-if: (! env.AZURE_LOGIN_POST_CLEANUP_OFF)

src/Cli/AzureCliLogin.ts

@@ -28,10 +28,10 @@ export class AzureCliLogin {
             }
         };
 
-        await this.executeAzCliCommand(["--version"], true, execOptions);
+        await this.executeAzCliCommand(["version"], true, execOptions);
         core.debug(`Azure CLI version used:\n${output}`);
 
-        this.setAzurestackEnvIfNecessary();
+        await this.registerAzurestackEnvIfNecessary();
 
         await this.executeAzCliCommand(["cloud", "set", "-n", this.loginConfig.environment], false);
         core.info(`Done setting cloud: "${this.loginConfig.environment}"`);
@@ -59,7 +59,7 @@ export class AzureCliLogin {
         }
     }
 
-    async setAzurestackEnvIfNecessary() {
+    async registerAzurestackEnvIfNecessary() {
         if (this.loginConfig.environment != "azurestack") {
             return;
         }
@@ -85,7 +85,7 @@ export class AzureCliLogin {
             let suffixKeyvault = ".vault" + baseUri.substring(baseUri.indexOf('.')); // keyvault suffix starts with .
             let suffixStorage = baseUri.substring(baseUri.indexOf('.') + 1); // storage suffix starts without .
             let profileVersion = "2019-03-01-hybrid";
-            await this.executeAzCliCommand(["cloud", "register", "-n", this.loginConfig.environment, "--endpoint-resource-manager", `"${this.loginConfig.resourceManagerEndpointUrl}"`, "--suffix-keyvault-dns", `"${suffixKeyvault}"`, "--suffix-storage-endpoint", `"${suffixStorage}"`, "--profile", `"${profileVersion}"`], false);
+            await this.executeAzCliCommand(["cloud", "register", "-n", this.loginConfig.environment, "--endpoint-resource-manager", this.loginConfig.resourceManagerEndpointUrl, "--suffix-keyvault-dns", suffixKeyvault, "--suffix-storage-endpoint", suffixStorage, "--profile", profileVersion], false);
         }
         catch (error) {
             core.error(`Error while trying to register cloud "${this.loginConfig.environment}"`);