[Core] raw githubusercontent urls are updated to refer azcli blob to restrict external system access#33240
[Core] raw githubusercontent urls are updated to refer azcli blob to restrict external system access#33240
Conversation
msarfraz
requested review from
ReaNAiveD,
YanaXu,
bebound,
isra-fel,
jiasli,
naga-nandyala,
notyashhh,
teresaritorto,
wangzelin007,
xuming-ms and
yonzhan
as code owners
️✔️AzureCLI-FullTest
|
|
Hi @msarfraz, |
️✔️AzureCLI-BreakingChangeTest
|
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
|
The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR. Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions). pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
|
microsoft-github-policy-service
Bot
requested review from
calvinhzy and
evelyn-ys
microsoft-github-policy-service
Bot
added
Storage
There was a problem hiding this comment.
Pull request overview
This PR aims to remove Azure CLI’s dependency on raw.githubusercontent.com for VM image aliases by switching to an Azure Blob Storage URL (azcliprod.blob.core.windows.net), and adds a CI validation to prevent reintroducing the forbidden URL.
Changes:
- Update test recordings to use the Azure Blob URL for VM image aliases.
- Add a CI script to fail PRs that introduce the forbidden
raw.githubusercontent.com/.../aliases.jsonURL in new diff lines. - Wire the new CI check into
azure-pipelines.yml.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/azure-cli/azure/cli/command_modules/resource/tests/latest/recordings/test_delete_dependent_resources.yaml | Updates recorded request URL for aliases.json from GitHub to Azure Blob. |
| src/azure-cli/azure/cli/command_modules/cloud/tests/latest/recordings/test_cloud_scenario.yaml | Updates recorded cloud metadata response to use Azure Blob for vmImageAliasDoc. |
| src/azure-cli-core/azure/cli/core/cloud.py | Touches vm_image_alias_doc for Azure Bleu cloud (currently still raw GitHub). |
| scripts/ci/check_aliases_source_url.py | Introduces a new CI guard script for forbidden aliases URL usage. |
| azure-pipelines.yml | Runs the new CI guard script during the linter job. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
|
|
||
| FORBIDDEN_URL_PATTERN = re.compile( | ||
| r"https://raw\.githubusercontent\.com/Azure/azure-rest-api-specs/[A-Za-z0-9._/-]+/arm-compute/quickstart-templates/aliases\.json" |
There was a problem hiding this comment.
The regex only matches the exact azure-rest-api-specs/.../aliases.json path. If someone introduces a different raw.githubusercontent.com URL for other files, this check won't catch it. The PR's stated goal is to block GitHub URLs in network-isolated environments, so the pattern should be broader —
e.g., simply matching https://raw.githubusercontent.com/.
There was a problem hiding this comment.
The regex is updated to match base URL "https://raw.githubusercontent.com" in the code. The documentation, tests, scripts and recordings directories are excluded from validation to avoid false positives
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
msarfraz
changed the title
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| parser = argparse.ArgumentParser(description="Check diff for forbidden raw github URL usage.") | ||
| parser.add_argument("--src", default="HEAD", help="Source ref/commit for git diff.") |
There was a problem hiding this comment.
In this user-facing argparse description, “github” should be capitalized as “GitHub” to match common project wording and other strings in this file.
There was a problem hiding this comment.
@copilot apply changes based on this feedback
| print("No forbidden external github URL found in added lines.") | ||
| return 0 | ||
|
|
||
| print("Found forbidden external github URL in this change:", file=sys.stderr) | ||
| for file_path, content in violations: | ||
| print(f" - {file_path}: {content}", file=sys.stderr) |
There was a problem hiding this comment.
The log message uses “github” in lowercase; please use “GitHub” for consistency and clarity in CI output.
There was a problem hiding this comment.
@copilot apply changes based on this feedback
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Related command
Description
This PR removes the dependency on GitHub (raw.githubusercontent.com) VM image aliases, replacing it with Azure Blob Storage (azcliprod.blob.core.windows.net). This change enables Azure CLI to work properly in network isolated environments where GitHub access is blocked.
In addition, new validation added in CI pipeline to flag if any raw.githubusercontent.com URL is used in the code.
Background
In enterprise environments with strict network isolation policies, access to raw.githubusercontent.com is not allowed.
Changes
VM Image Alias Migration
Before:
https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/arm-compute/quickstart-templates/aliases.json
After:
https://azcliprod.blob.core.windows.net/cli/vm/aliases_master.json
Release pipeline task:
Testing Guide
History Notes
[Component Name 1] BREAKING CHANGE:
az command a: Make some customer-facing breaking change[Component Name 2]
az command b: Add some customer-facing featureThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.