Harden extension registry CI: validate registry.dev.json and guard workflow path-list drift - #9338
Merged
JeffreyCA merged 2 commits intoJul 31, 2026
Conversation
|
Azure Pipelines: 20 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
…w path drift Co-authored-by: JeffreyCA <9157833+JeffreyCA@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Add validation CI for registry.dev.json in extension registry
Harden extension registry CI: validate registry.dev.json and guard workflow path-list drift
Jul 28, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Hardens extension registry CI by validating both registries and detecting workflow/script path-list drift.
Changes:
- Runs validation when
registry.dev.jsonchanges. - Improves development-registry validation errors.
- Adds a test ensuring registry path lists remain synchronized.
Show a summary per file
| File | Description |
|---|---|
cli/azd/pkg/extensions/registry_files_test.go |
Improves dev-registry failure output. |
.github/workflows/scripts-ci.yml |
Triggers script tests for registry workflow changes. |
.github/workflows/ext-registry-ci.yml |
Validates both registry files. |
.github/scripts/test/ext-registry-check.test.js |
Tests workflow/script path-list consistency. |
.github/scripts/src/ext-registry-check.js |
Exports registry paths for testing. |
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 0
- Review effort level: Medium
JeffreyCA
marked this pull request as ready for review
July 29, 2026 21:49
JeffreyCA
requested review from
RickWinter,
danieljurek,
hemarina,
richardpark-msft,
tg-msft and
vhvb1989
as code owners
July 29, 2026 21:49
Contributor
|
/azp run azure-dev - cli |
|
Azure Pipelines: Successfully started running 1 pipeline(s). 21 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
📋 Prioritization NoteThanks for the contribution! The linked issue isn't in the current milestone yet. |
Contributor
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
vhvb1989
approved these changes
Jul 31, 2026
Contributor
|
/check-enforcer override |
JeffreyCA
enabled auto-merge (squash)
July 31, 2026 16:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
registry.dev.jsoncarries the same approval policy asregistry.jsonbut had no validation CI, soTestDevRegistryFileIsValidnever ran on a PR touching only the dev registry —ext-registry-citriggered only onregistry.json, and bothcli-ciand the ADOrelease-clipipeline excludecli/azd/extensions/**. Separately,ext-registry-check.ymlkeeps its own inline copy of the registry path list, which can silently drift fromREGISTRY_JSON_PATHSin the script.Both failures are green checks, not red ones: a malformed dev registry merges clean and surfaces later in an unrelated
cli/azdPR, and a registry path added to the script but missed in the workflow leaves the required check reporting success without the policy ever running.Dev registry validation (
ext-registry-ci.yml)Added
cli/azd/extensions/registry.dev.jsonto thepaths:trigger.Generalized the test selector to run both registry tests:
Generalized the step's
::error::text and the comment block above it, which hardcodedregistry.json.Readable dev-registry failures (
registry_files_test.go)TestDevRegistryFileIsValidnow usescollectValidationErrors+t.Fatalfinstead ofrequire.True(t, result.Valid, "%+v", result), matching the production test. With an unsatisfiable dependency injected:Workflow path-list drift guard (
ext-registry-check)REGISTRY_JSON_PATHSonmodule.exports.forTests. The declaration moved above the export block, since referencing it from the object literal below would hit the TDZ at module load.registryPathsSet fromext-registry-check.ymland compares it againstREGISTRY_JSON_PATHS. No YAML parser added todevDependencies. It asserts the match is non-null (so a renamed or restructured literal fails loudly rather than silently ceasing to guard) and that the extracted list is non-empty before comparing..github/workflows/ext-registry-check.ymlto thescripts-citrigger, so editing the workflow's list also runs the guard — otherwise one of the guard's two inputs could change without the test executing.Mutation-checked against the three drift shapes: script gains a path, workflow gains a path, workflow Set literal renamed.