Repository navigation
fix: reject unresolved deployment stack variables (#9357) - #10516
Victor Vazquez (vhvb1989) merged 5 commits into
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
|
Thank you for your contribution Sai Keerthan Palavarapu (@saikeerthan-14)! We will review the pull request and get back to you soon. |
There was a problem hiding this comment.
🟡 Changes recommended
Validation rejects valid nested defaults when an unused fallback variable is unset.
1 open finding
What changed in this PR
Strengthens azd’s deployment stack validation to catch missing variables inside composite configuration values.
Changes:
- Detects unset or empty references, including plan-time values.
- Distinguishes escaped references from substitutions.
- Adds tests for composite values, defaults, and escaped literals.
| File | Description |
|---|---|
| cli/azd/pkg/infra/provisioning/bicep/deployment_stacks.go | Adds unresolved-reference validation and escape detection. |
| cli/azd/pkg/infra/provisioning/bicep/deployment_stacks_test.go | Expands substitution validation coverage. |
🧠 Review effort: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Victor Vazquez (vhvb1989)
left a comment
There was a problem hiding this comment.
Thank you Sai Keerthan Palavarapu (@saikeerthan-14) for fixing this validation gap and adding regression coverage for defaults and escaped references!
|
/azp run azure-dev - cli |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Refresh the PR baseline for CI protobuf compatibility checks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 69881179-57c0-4e40-aa8c-186df85025e8
|
/azp run azure-dev - cli |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
Include the upstream deprecated beta preview lint correction. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 69881179-57c0-4e40-aa8c-186df85025e8
|
Thank you Victor Vazquez (@vhvb1989) for merging this PR |

Fixes #9357
This pull request strengthens the validation logic for environment variable substitution in deployment stack configuration values, ensuring that unresolved or empty variables embedded within composite strings are properly detected and reported as errors. It also introduces comprehensive tests to verify the new behavior, including correct handling of shell-style defaults and escaped variable references.
Validation improvements for environment variable substitution:
resolveDeploymentStacksValuesto treat unresolved or empty${VAR}references within composite values as misconfigurations, and added logic to detect only unescaped references. This prevents silent misconfigurations when a variable is used in the middle of a string and is unset or empty. [1] [2] [3]hasUnescapedReferencehelper function to distinguish between escaped and unescaped${VAR}references in configuration templates.Expanded and improved test coverage:
deployment_stacks_test.goto verify that unset or empty variables in composite values are correctly detected and reported as errors.${VAR:-fallback}) are honored and do not trigger errors when the variable is unset.${VAR}) are treated as literal text and do not trigger errors.