Skip to content

[Resource] Suppress bicep install skip output when check_version is disabled and stabilize data-boundary live tests#33467

Draft
Copilot wants to merge 4 commits into
devfrom
copilot/fix-bicep-print-version-info
Draft

[Resource] Suppress bicep install skip output when check_version is disabled and stabilize data-boundary live tests#33467
Copilot wants to merge 4 commits into
devfrom
copilot/fix-bicep-print-version-info

Conversation

Copilot AI commented May 28, 2026

Copy link
Copy Markdown
Contributor

Related command

  • az bicep publish --file <file> --target <target>
  • az data-boundary show --scope <scope> --default default
  • az data-boundary show-tenant --default default

Description
This PR keeps az bicep publish output clean when Bicep version checks are disabled, and stabilizes resource live tests for data-boundary responses that vary by tenant/subscription environment.

What changed

  • Suppressed the Bicep install-skip output when check_version is disabled.
  • Updated test_dataBoundary.py live assertions to handle valid environment-dependent values:
    • properties.dataBoundary: accept EU or Global (tenant and scope tests).
    • Tenant properties.provisioningState: accept Created or Succeeded.

Effect

  • Prevents noisy/non-actionable Bicep output in the disabled-version-check path.
  • Reduces flaky failures in resource live tests caused by environment-specific data-boundary and provisioning-state values.

Testing Guide

  • CI checks passed.
  • Live test command used by issue-sentinel:
    • azdev test resource --live --series
  • Verified live-test investigation outcome:
    • Data-boundary tests now pass under returned live values.
    • Remaining lock-test failure is RBAC/environment-related (Microsoft.Authorization/locks/write), not from this PR’s modified code path.

History Notes
[Resource] az bicep publish --file <file> --target <target>: Suppress Bicep install-skip output when version checks are disabled.
[Resource] az data-boundary show --scope <scope> --default default: Stabilize live test assertions for valid environment-dependent dataBoundary/provisioningState values.


This checklist is used to make sure that common guidelines for a pull request are followed.

@azure-client-tools-bot-prd

azure-client-tools-bot-prd Bot commented May 28, 2026

Copy link
Copy Markdown
️✔️AzureCLI-FullTest
️✔️acr
️✔️latest
️✔️3.12
️✔️3.14
️✔️acs
️✔️latest
️✔️3.12
️✔️3.14
️✔️advisor
️✔️latest
️✔️3.12
️✔️3.14
️✔️ams
️✔️latest
️✔️3.12
️✔️3.14
️✔️apim
️✔️latest
️✔️3.12
️✔️3.14
️✔️appconfig
️✔️latest
️✔️3.12
️✔️3.14
️✔️appservice
️✔️latest
️✔️3.12
️✔️3.14
️✔️aro
️✔️latest
️✔️3.12
️✔️3.14
️✔️backup
️✔️latest
️✔️3.12
️✔️3.14
️✔️batch
️✔️latest
️✔️3.12
️✔️3.14
️✔️batchai
️✔️latest
️✔️3.12
️✔️3.14
️✔️billing
️✔️latest
️✔️3.12
️✔️3.14
️✔️botservice
️✔️latest
️✔️3.12
️✔️3.14
️✔️cdn
️✔️latest
️✔️3.12
️✔️3.14
️✔️cloud
️✔️latest
️✔️3.12
️✔️3.14
️✔️cognitiveservices
️✔️latest
️✔️3.12
️✔️3.14
️✔️compute_recommender
️✔️latest
️✔️3.12
️✔️3.14
️✔️computefleet
️✔️latest
️✔️3.12
️✔️3.14
️✔️config
️✔️latest
️✔️3.12
️✔️3.14
️✔️configure
️✔️latest
️✔️3.12
️✔️3.14
️✔️consumption
️✔️latest
️✔️3.12
️✔️3.14
️✔️container
️✔️latest
️✔️3.12
️✔️3.14
️✔️containerapp
️✔️latest
️✔️3.12
️✔️3.14
️✔️core
️✔️latest
️✔️3.12
️✔️3.14
️✔️cosmosdb
️✔️latest
️✔️3.12
️✔️3.14
️✔️databoxedge
️✔️latest
️✔️3.12
️✔️3.14
️✔️dls
️✔️latest
️✔️3.12
️✔️3.14
️✔️dms
️✔️latest
️✔️3.12
️✔️3.14
️✔️eventgrid
️✔️latest
️✔️3.12
️✔️3.14
️✔️eventhubs
️✔️latest
️✔️3.12
️✔️3.14
️✔️feedback
️✔️latest
️✔️3.12
️✔️3.14
️✔️find
️✔️latest
️✔️3.12
️✔️3.14
️✔️hdinsight
️✔️latest
️✔️3.12
️✔️3.14
️✔️identity
️✔️latest
️✔️3.12
️✔️3.14
️✔️iot
️✔️latest
️✔️3.12
️✔️3.14
️✔️keyvault
️✔️latest
️✔️3.12
️✔️3.14
️✔️lab
️✔️latest
️✔️3.12
️✔️3.14
️✔️managedservices
️✔️latest
️✔️3.12
️✔️3.14
️✔️maps
️✔️latest
️✔️3.12
️✔️3.14
️✔️marketplaceordering
️✔️latest
️✔️3.12
️✔️3.14
️✔️monitor
️✔️latest
️✔️3.12
️✔️3.14
️✔️mysql
️✔️latest
️✔️3.12
️✔️3.14
️✔️netappfiles
️✔️latest
️✔️3.12
️✔️3.14
️✔️network
️✔️latest
️✔️3.12
️✔️3.14
️✔️policyinsights
️✔️latest
️✔️3.12
️✔️3.14
️✔️postgresql
️✔️latest
️✔️3.12
️✔️3.14
️✔️privatedns
️✔️latest
️✔️3.12
️✔️3.14
️✔️profile
️✔️latest
️✔️3.12
️✔️3.14
️✔️rdbms
️✔️latest
️✔️3.12
️✔️3.14
️✔️redis
️✔️latest
️✔️3.12
️✔️3.14
️✔️relay
️✔️latest
️✔️3.12
️✔️3.14
️✔️resource
️✔️latest
️✔️3.12
️✔️3.14
️✔️role
️✔️latest
️✔️3.12
️✔️3.14
️✔️search
️✔️latest
️✔️3.12
️✔️3.14
️✔️security
️✔️latest
️✔️3.12
️✔️3.14
️✔️servicebus
️✔️latest
️✔️3.12
️✔️3.14
️✔️serviceconnector
️✔️latest
️✔️3.12
️✔️3.14
️✔️servicefabric
️✔️latest
️✔️3.12
️✔️3.14
️✔️signalr
️✔️latest
️✔️3.12
️✔️3.14
️✔️sql
️✔️latest
️✔️3.12
️✔️3.14
️✔️sqlvm
️✔️latest
️✔️3.12
️✔️3.14
️✔️storage
️✔️latest
️✔️3.12
️✔️3.14
️✔️synapse
️✔️latest
️✔️3.12
️✔️3.14
️✔️telemetry
️✔️latest
️✔️3.12
️✔️3.14
️✔️util
️✔️latest
️✔️3.12
️✔️3.14
️✔️vm
️✔️latest
️✔️3.12
️✔️3.14

@azure-client-tools-bot-prd

azure-client-tools-bot-prd Bot commented May 28, 2026

Copy link
Copy Markdown
️✔️AzureCLI-BreakingChangeTest
️✔️Non Breaking Changes

Copilot AI changed the title [WIP] Fix bicep CLI version information output during publish [Resource] Suppress bicep install skip output when check_version is disabled May 28, 2026
Copilot finished work on behalf of a0x1ab May 28, 2026 10:16
Copilot AI requested a review from a0x1ab May 28, 2026 10:16
@a0x1ab

a0x1ab commented May 28, 2026

Copy link
Copy Markdown
Member

Live test results — azdev test resource --live --series

FAIL (exit 1)

Module: resource
PR head ref: copilot/fix-bicep-print-version-info
PR head sha: fdb8b34a9fd6e1e5227d0fc5306a26a0e557947f
PR base ref: dev
New test files in PR: false

Workflow run: https://github.com/Azure/issue-sentinel/actions/runs/26570408386

Last 80 lines of azdev output
        except jmespath.exceptions.JMESPathTypeError:
            raise JMESPathCheckAssertionError(self._query, self._expected_result, actual_result,
                                              execution_result.output)
        if self._case_sensitive:
            equals = actual_result == self._expected_result or str(actual_result) == str(self._expected_result)
        else:
            equals = actual_result == self._expected_result \
                or str(actual_result).lower() == str(self._expected_result).lower()
        if not equals:
            if actual_result:
>               raise JMESPathCheckAssertionError(self._query, self._expected_result, actual_result,
                                                  execution_result.output)
E               azure.cli.testsdk.exceptions.JMESPathCheckAssertionError: Query 'properties.dataBoundary' doesn't yield expected value 'EU', instead the actual value is 'Global'. Data: 
E               {
E                 "id": "/providers/Microsoft.Resources/dataBoundaries/544a7a2e-697f-487c-b2b0-a13df7f346b6",
E                 "name": "544a7a2e-697f-487c-b2b0-a13df7f346b6",
E                 "properties": {
E                   "dataBoundary": "Global",
E                   "provisioningState": "Succeeded"
E                 }
E               }

src/azure-cli-testsdk/azure/cli/testsdk/checkers.py:34: JMESPathCheckAssertionError
- generated xml file: /home/runner/work/issue-sentinel/issue-sentinel/test-output/results.xml -
=========================== short test summary info ============================
FAILED src/azure-cli/azure/cli/command_modules/resource/tests/latest/test_dataBoundary.py::AzureDataBoundaryScenarioTest::test_get_data_boundary_scope - self = <azure.cli.command_modules.resource.tests.latest.test_dataBoundary.AzureDataBoundaryScenarioTest testMethod=test_get_data_boundary_scope>

    def test_get_data_boundary_scope(self):
        self.kwargs['sub'] = self.get_subscription_id()
        self.kwargs['scope'] = '/subscriptions/{sub}'.format(
            **self.kwargs)
    
>       self.cmd('az data-boundary show --scope {scope} --default default', checks=[
            self.check('properties.dataBoundary', 'EU'),
            self.check('properties.provisioningState', 'Succeeded')
        ])

src/azure-cli/azure/cli/command_modules/resource/tests/latest/test_dataBoundary.py:22: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
src/azure-cli-testsdk/azure/cli/testsdk/base.py:177: in cmd
    return execute(self.cli_ctx, command, expect_failure=expect_failure).assert_with_checks(checks)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
src/azure-cli-testsdk/azure/cli/testsdk/base.py:278: in assert_with_checks
    c(self)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <azure.cli.testsdk.checkers.JMESPathCheck object at 0x7ff39921a360>
execution_result = <azure.cli.testsdk.base.ExecutionResult object at 0x7ff399337a70>

    def __call__(self, execution_result):
        json_value = execution_result.get_output_in_json()
        actual_result = None
        try:
            actual_result = jmespath.search(self._query, json_value,
                                            jmespath.Options(collections.OrderedDict))
        except jmespath.exceptions.JMESPathTypeError:
            raise JMESPathCheckAssertionError(self._query, self._expected_result, actual_result,
                                              execution_result.output)
        if self._case_sensitive:
            equals = actual_result == self._expected_result or str(actual_result) == str(self._expected_result)
        else:
            equals = actual_result == self._expected_result \
                or str(actual_result).lower() == str(self._expected_result).lower()
        if not equals:
            if actual_result:
>               raise JMESPathCheckAssertionError(self._query, self._expected_result, actual_result,
                                                  execution_result.output)
E               azure.cli.testsdk.exceptions.JMESPathCheckAssertionError: Query 'properties.dataBoundary' doesn't yield expected value 'EU', instead the actual value is 'Global'. Data: 
E               {
E                 "id": "/providers/Microsoft.Resources/dataBoundaries/544a7a2e-697f-487c-b2b0-a13df7f346b6",
E                 "name": "544a7a2e-697f-487c-b2b0-a13df7f346b6",
E                 "properties": {
E                   "dataBoundary": "Global",
E                   "provisioningState": "Succeeded"
E                 }
E               }

src/azure-cli-testsdk/azure/cli/testsdk/checkers.py:34: JMESPathCheckAssertionError
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
======================== 1 failed, 10 passed in 44.65s =========================

Posted by agent-assist live-test workflow.

@yonzhan

yonzhan commented May 28, 2026

Copy link
Copy Markdown
Collaborator

Resource

@a0x1ab a0x1ab left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agent Assist Review — PR #33467

CI checks: ✅ All 94 checks passed (94 passed, 0 failed, 0 pending)

Live-test (resource module): ❌ Failed

@copilot Please review the live-test failure above and address any issues before this PR is ready for merge.


Posted by agent-assist (autonomous bug-fix pipeline).

Copilot AI commented May 29, 2026

Copy link
Copy Markdown
Contributor Author

Agent Assist Review — PR #33467

CI checks: ✅ All 94 checks passed (94 passed, 0 failed, 0 pending)...

Investigated the live-test failure and fixed it in commit d008de5. The failing assertion in test_get_data_boundary_scope now accepts both EU and Global for properties.dataBoundary, which matches current live behavior while keeping the provisioning state check.

Copilot AI changed the title [Resource] Suppress bicep install skip output when check_version is disabled [Resource] Suppress bicep install skip output when check_version is disabled and stabilize data-boundary live test May 29, 2026
Copilot finished work on behalf of a0x1ab May 29, 2026 07:23
Copilot AI requested a review from a0x1ab May 29, 2026 07:23
@a0x1ab

a0x1ab commented May 29, 2026

Copy link
Copy Markdown
Member

Live test results — azdev test resource --live --series

FAIL (exit 1)

Module: resource
PR head ref: copilot/fix-bicep-print-version-info
PR head sha: d008de5306d5bf0c48bff3b0b973407687b03d47
PR base ref: dev
New test files in PR: false

Workflow run: https://github.com/Azure/issue-sentinel/actions/runs/26624802662

Last 80 lines of azdev output
        actual_result = None
        try:
            actual_result = jmespath.search(self._query, json_value,
                                            jmespath.Options(collections.OrderedDict))
        except jmespath.exceptions.JMESPathTypeError:
            raise JMESPathCheckAssertionError(self._query, self._expected_result, actual_result,
                                              execution_result.output)
        if self._case_sensitive:
            equals = actual_result == self._expected_result or str(actual_result) == str(self._expected_result)
        else:
            equals = actual_result == self._expected_result \
                or str(actual_result).lower() == str(self._expected_result).lower()
        if not equals:
            if actual_result:
>               raise JMESPathCheckAssertionError(self._query, self._expected_result, actual_result,
                                                  execution_result.output)
E               azure.cli.testsdk.exceptions.JMESPathCheckAssertionError: Query 'properties.dataBoundary' doesn't yield expected value 'EU', instead the actual value is 'Global'. Data: 
E               {
E                 "id": "/providers/Microsoft.Resources/dataBoundaries/544a7a2e-697f-487c-b2b0-a13df7f346b6",
E                 "name": "544a7a2e-697f-487c-b2b0-a13df7f346b6",
E                 "properties": {
E                   "dataBoundary": "Global",
E                   "provisioningState": "Succeeded"
E                 }
E               }

src/azure-cli-testsdk/azure/cli/testsdk/checkers.py:34: JMESPathCheckAssertionError
- generated xml file: /home/runner/work/issue-sentinel/issue-sentinel/test-output/results.xml -
=========================== short test summary info ============================
FAILED src/azure-cli/azure/cli/command_modules/resource/tests/latest/test_dataBoundary.py::AzureDataBoundaryScenarioTest::test_get_data_boundary_tenant - self = <azure.cli.command_modules.resource.tests.latest.test_dataBoundary.AzureDataBoundaryScenarioTest testMethod=test_get_data_boundary_tenant>

    def test_get_data_boundary_tenant(self):
>       self.cmd('az data-boundary show-tenant --default default', checks=[
            self.check('properties.dataBoundary', 'EU'),
            self.check('properties.provisioningState', 'Created')
        ])

src/azure-cli/azure/cli/command_modules/resource/tests/latest/test_dataBoundary.py:12: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
src/azure-cli-testsdk/azure/cli/testsdk/base.py:177: in cmd
    return execute(self.cli_ctx, command, expect_failure=expect_failure).assert_with_checks(checks)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
src/azure-cli-testsdk/azure/cli/testsdk/base.py:278: in assert_with_checks
    c(self)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <azure.cli.testsdk.checkers.JMESPathCheck object at 0x7f93e7dba450>
execution_result = <azure.cli.testsdk.base.ExecutionResult object at 0x7f93e7e41730>

    def __call__(self, execution_result):
        json_value = execution_result.get_output_in_json()
        actual_result = None
        try:
            actual_result = jmespath.search(self._query, json_value,
                                            jmespath.Options(collections.OrderedDict))
        except jmespath.exceptions.JMESPathTypeError:
            raise JMESPathCheckAssertionError(self._query, self._expected_result, actual_result,
                                              execution_result.output)
        if self._case_sensitive:
            equals = actual_result == self._expected_result or str(actual_result) == str(self._expected_result)
        else:
            equals = actual_result == self._expected_result \
                or str(actual_result).lower() == str(self._expected_result).lower()
        if not equals:
            if actual_result:
>               raise JMESPathCheckAssertionError(self._query, self._expected_result, actual_result,
                                                  execution_result.output)
E               azure.cli.testsdk.exceptions.JMESPathCheckAssertionError: Query 'properties.dataBoundary' doesn't yield expected value 'EU', instead the actual value is 'Global'. Data: 
E               {
E                 "id": "/providers/Microsoft.Resources/dataBoundaries/544a7a2e-697f-487c-b2b0-a13df7f346b6",
E                 "name": "544a7a2e-697f-487c-b2b0-a13df7f346b6",
E                 "properties": {
E                   "dataBoundary": "Global",
E                   "provisioningState": "Succeeded"
E                 }
E               }

src/azure-cli-testsdk/azure/cli/testsdk/checkers.py:34: JMESPathCheckAssertionError
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
======================== 1 failed, 11 passed in 35.12s =========================

Posted by agent-assist live-test workflow.

@a0x1ab a0x1ab left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review: Live Test Failed ❌

CI checks: ✅ All 94 checks passed.

Live test (azdev test resource --live): ❌ FAIL

The live test run (workflow run) failed with the following error in test_dataBoundary.py:

JMESPathCheckAssertionError: Query 'properties.dataBoundary' doesn't yield expected value 'EU',
instead the actual value is 'Global'.

The test is asserting properties.dataBoundary == 'EU' but the live environment returned 'Global'. This PR's title mentions "stabilize data-boundary live test" but the test is still failing in the live environment.

Action needed: @copilot Please investigate why the data-boundary live test is still asserting EU instead of handling Global. The test at src/azure-cli/azure/cli/command_modules/resource/tests/latest/test_dataBoundary.py:12 needs to either:

  1. Accept any valid dataBoundary value (not hardcode EU), or
  2. Conditionally skip if the subscription's data boundary is not EU.

Posted by agent-assist (autonomous bug-fix pipeline).

Copilot AI commented Jun 10, 2026

Copy link
Copy Markdown
Contributor Author

Review: Live Test Failed ❌

CI checks: ✅ All 94 checks passed....

Addressed in 00dc55e. I investigated the live-test logs and updated test_dataBoundary.py so test_get_data_boundary_tenant now accepts both valid live properties.dataBoundary values (EU or Global) and allows tenant properties.provisioningState to be Created or Succeeded.

Copilot AI changed the title [Resource] Suppress bicep install skip output when check_version is disabled and stabilize data-boundary live test [Resource] Suppress bicep install skip output when check_version is disabled and stabilize data-boundary live tests Jun 10, 2026
Copilot AI requested a review from a0x1ab June 10, 2026 06:52
@a0x1ab

a0x1ab commented Jun 10, 2026

Copy link
Copy Markdown
Member

Live test results — azdev test resource --live --series

FAIL (exit 1)

Module: resource
PR head ref: copilot/fix-bicep-print-version-info
PR head sha: 00dc55e97875e58929c7edfe4c20491c808dd140
PR base ref: dev
New test files in PR: false

Workflow run: https://github.com/Azure/issue-sentinel/actions/runs/27258804641

Last 80 lines of azdev output
    def create_or_update_at_resource_group_level(
        self,
        resource_group_name: str,
        lock_name: str,
        parameters: Union[_models.ManagementLockObject, IO[bytes]],
        **kwargs: Any
    ) -> _models.ManagementLockObject:
        """Creates or updates a management lock at the resource group level.
    
        When you apply a lock at a parent scope, all child resources inherit the same lock. To create
        management locks, you must have access to Microsoft.Authorization/\\ * or
        Microsoft.Authorization/locks/* actions. Of the built-in roles, only Owner and User Access
        Administrator are granted those actions.
    
        :param resource_group_name: The name of the resource group to lock. Required.
        :type resource_group_name: str
        :param lock_name: The lock name. The lock name can be a maximum of 260 characters. It cannot
         contain <, > %, &, :, \\, ?, /, or any control characters. Required.
        :type lock_name: str
        :param parameters: The management lock parameters. Is either a ManagementLockObject type or a
         IO[bytes] type. Required.
        :type parameters: ~azure.mgmt.resource.locks.v2016_09_01.models.ManagementLockObject or
         IO[bytes]
        :return: ManagementLockObject or the result of cls(response)
        :rtype: ~azure.mgmt.resource.locks.v2016_09_01.models.ManagementLockObject
        :raises ~azure.core.exceptions.HttpResponseError:
        """
        error_map: MutableMapping = {
            401: ClientAuthenticationError,
            404: ResourceNotFoundError,
            409: ResourceExistsError,
            304: ResourceNotModifiedError,
        }
        error_map.update(kwargs.pop("error_map", {}) or {})
    
        _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {})
        _params = case_insensitive_dict(kwargs.pop("params", {}) or {})
    
        api_version: str = kwargs.pop("api_version", _params.pop("api-version", self._api_version or "2016-09-01"))
        content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None))
        cls: ClsType[_models.ManagementLockObject] = kwargs.pop("cls", None)
    
        content_type = content_type or "application/json"
        _json = None
        _content = None
        if isinstance(parameters, (IOBase, bytes)):
            _content = parameters
        else:
            _json = self._serialize.body(parameters, "ManagementLockObject")
    
        _request = build_management_locks_create_or_update_at_resource_group_level_request(
            resource_group_name=resource_group_name,
            lock_name=lock_name,
            subscription_id=self._config.subscription_id,
            api_version=api_version,
            content_type=content_type,
            json=_json,
            content=_content,
            headers=_headers,
            params=_params,
        )
        _request.url = self._client.format_url(_request.url)
    
        _stream = False
        pipeline_response: PipelineResponse = self._client._pipeline.run(  # pylint: disable=protected-access
            _request, stream=_stream, **kwargs
        )
    
        response = pipeline_response.http_response
    
        if response.status_code not in [200, 201]:
            map_error(status_code=response.status_code, response=response, error_map=error_map)
>           raise HttpResponseError(response=response, error_format=ARMErrorFormat)
E           azure.core.exceptions.HttpResponseError: (AuthorizationFailed) The client 'a7223622-d7e9-4499-ad34-477d6abe307c' with object id '047fedc7-622b-4164-9085-e0d704999024' does not have authorization to perform action 'Microsoft.Authorization/locks/write' over scope '/subscriptions/0c302431-1ad0-4187-87c9-d4cebcf7edc2/resourceGroups/cli_test_cannotdelete_resource_group_lock7f6llptkd6fmcgn5jaarduj4icwkxtymce/providers/Microsoft.Authorization/locks/cli-test-lock26ho6ugtoujxr3qbv3uhvpdqvk34k4bepjt' or the scope is invalid. If access was recently granted, please refresh your credentials.
E           Code: AuthorizationFailed
E           Message: The client 'a7223622-d7e9-4499-ad34-477d6abe307c' with object id '047fedc7-622b-4164-9085-e0d704999024' does not have authorization to perform action 'Microsoft.Authorization/locks/write' over scope '/subscriptions/0c302431-1ad0-4187-87c9-d4cebcf7edc2/resourceGroups/cli_test_cannotdelete_resource_group_lock7f6llptkd6fmcgn5jaarduj4icwkxtymce/providers/Microsoft.Authorization/locks/cli-test-lock26ho6ugtoujxr3qbv3uhvpdqvk34k4bepjt' or the scope is invalid. If access was recently granted, please refresh your credentials.

.venv/lib/python3.12/site-packages/azure/mgmt/resource/locks/v2016_09_01/operations/_operations.py:834: HttpResponseError
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
======================== 1 failed, 13 passed in 44.68s =========================

Posted by agent-assist live-test workflow.

@a0x1ab a0x1ab left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agent Review — PR #33467

CI Checks

All 108/108 checks passed. ✅

Live Test (issue-sentinel)

Result: ❌ 1 failed, 13 passed

Workflow run: https://github.com/Azure/issue-sentinel/actions/runs/27258804641

Failure details

The failing test is in the resource module — a resource lock test:

azure.core.exceptions.HttpResponseError: (AuthorizationFailed) The client '***' with object id
'047fedc7-622b-4164-9085-e0d704999024' does not have authorization to perform action
'Microsoft.Authorization/locks/write' over scope
'.../resourceGroups/cli_test_cannotdelete_resource_group_lock.../providers/Microsoft.Authorization/locks/...'
or the scope is invalid.

The test cli_test_cannotdelete_resource_group_lock failed because the live-test runner's service principal lacks Microsoft.Authorization/locks/write permission. This appears to be a test environment permissions issue, not a regression introduced by this PR (which targets bicep install output suppression and data-boundary test stabilization).

@copilot — please confirm whether the resource lock test failure is pre-existing / environment-related, or if the PR inadvertently affects the resource locks test path. If it's a known permissions gap in the live-test runner, the test may need to be skipped in live mode or the runner RBAC role needs updating.


Posted by agent-assist (autonomous bug-fix pipeline).

Copilot AI commented Jun 10, 2026

Copy link
Copy Markdown
Contributor Author

Agent Review — PR #33467

CI Checks...

Confirmed this failure is environment/RBAC-related and not from this PR’s code path. In run 27258804641, both test_dataBoundary cases passed, and the only failure is test_locks.py::ResourceLockTests::test_cannotdelete_resource_group_lock with AuthorizationFailed on Microsoft.Authorization/locks/write for the live-test principal. This indicates a permissions gap in the issue-sentinel runner identity for lock write operations. Recommended fix is to grant the runner principal the required lock write permission (e.g., Owner/User Access Administrator or equivalent custom role including Microsoft.Authorization/locks/*). If RBAC cannot be updated, this specific lock live test should be skipped in that live runner context.

Copilot AI requested a review from a0x1ab June 10, 2026 12:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

act-codegen-extensibility-squad act-identity-squad act-observability-squad act-platform-engineering-squad ARM az resource/group/lock/tag/deployment/policy/managementapp/account management-group Auto-Assign Auto assign by bot Installation Portal az portal Reservations az reservations

Projects

None yet

Development

Successfully merging this pull request may close these issues.

az bicep prints version information when check_version is false

7 participants