Merge main into feature/dps-csr-preview

.github/CODEOWNERS

@@ -15,15 +15,15 @@
 /sdk/                          @rickwinter @ronniegeraghty
 
 # Samples
-/samples/                      @antkmsft @rickwinter @gearama @LarryOsterman
+/samples/                      @antkmsft @rickwinter @LarryOsterman
 
 # Service teams
 # Core
-/sdk/docs/core/                @antkmsft @rickwinter @gearama @LarryOsterman
-/sdk/inc/azure/core/           @antkmsft @rickwinter @gearama @LarryOsterman
-/sdk/samples/core/             @antkmsft @rickwinter @gearama @LarryOsterman
-/sdk/src/azure/core/           @antkmsft @rickwinter @gearama @LarryOsterman
-/sdk/tests/core/               @antkmsft @rickwinter @gearama @LarryOsterman
+/sdk/docs/core/                @antkmsft @rickwinter @LarryOsterman
+/sdk/inc/azure/core/           @antkmsft @rickwinter @LarryOsterman
+/sdk/samples/core/             @antkmsft @rickwinter @LarryOsterman
+/sdk/src/azure/core/           @antkmsft @rickwinter @LarryOsterman
+/sdk/tests/core/               @antkmsft @rickwinter @LarryOsterman
 
 # IoT
 /sdk/docs/iot/                 @ewertons @RLeclair @vaavva
@@ -33,7 +33,7 @@
 /sdk/tests/iot/                @ewertons @RLeclair @vaavva
 
 # Platform
-/sdk/src/azure/platform/       @antkmsft @rickwinter @gearama @LarryOsterman
+/sdk/src/azure/platform/       @antkmsft @rickwinter @LarryOsterman
 
 ###########
 # Eng Sys
@@ -42,3 +42,6 @@
 /eng/common/                   @Azure/azure-sdk-eng
 /.github/workflows/            @Azure/azure-sdk-eng
 /.github/CODEOWNERS            @rickwinter @ronniegeraghty @Azure/azure-sdk-eng
+
+# Add owners for notifications for specific pipelines
+/eng/common/pipelines/codeowners-linter.yml       @rickwinter @danieljurek

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+enable-beta-ecosystems: true
+updates:
+  - package-ecosystem: "vcpkg"
+    directory: "/"
+    schedule:
+      interval: weekly
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: weekly
+    exclude-paths:
+      - "eng/common"

.github/workflows/event-processor.yml

@@ -51,6 +51,15 @@ jobs:
           echo "::add-mask::$LABEL_SERVICE_API_KEY"
           echo "LABEL_SERVICE_API_KEY=$LABEL_SERVICE_API_KEY" >> $GITHUB_ENV
 
+          APP_CONFIG_ENDPOINT=$(az keyvault secret show \
+            --vault-name issue-labeler \
+            -n app-config-endpoint \
+            -o tsv \
+            --query value)
+
+          echo "::add-mask::$APP_CONFIG_ENDPOINT"
+          echo "APP_CONFIG_ENDPOINT=$APP_CONFIG_ENDPOINT" >> $GITHUB_ENV
+
       # To run github-event-processor built from source, for testing purposes, uncomment everything
       # in between the Start/End-Build From Source comments and comment everything in between the
       # Start/End-Install comments
@@ -59,7 +68,7 @@ jobs:
         run: >
           dotnet tool install
           Azure.Sdk.Tools.GitHubEventProcessor
-          --version 1.0.0-dev.20250314.4
+          --version 1.0.0-dev.20260129.1
           --add-source https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json
           --global
         shell: bash
@@ -95,9 +104,10 @@ jobs:
           # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#about-the-github_token-secret
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           LABEL_SERVICE_API_KEY: ${{ env.LABEL_SERVICE_API_KEY }}
+          APP_CONFIG_ENDPOINT: ${{ env.APP_CONFIG_ENDPOINT }}
 
       - name: Archive github event data
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: event

.github/workflows/post-apiview.yml

@@ -11,14 +11,15 @@ permissions:
 jobs:
   post-apiview:
     name: After APIView
-    runs-on: ubuntu-24.04
+    runs-on: ["self-hosted", "1ES.Pool=azsdk-pool-github-runners"]
     if: |
+      toJson(github.event.check_run.pull_requests) != '[]' &&
       github.event.check_run.check_suite.app.name == 'Azure Pipelines' && (
       contains(github.event.check_run.name, 'Build Build') ||
       contains(github.event.check_run.name, 'Build Analyze') )
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           sparse-checkout: 'eng/common'
 

.github/workflows/scheduled-event-processor.yml

@@ -39,7 +39,7 @@ jobs:
         run: >
           dotnet tool install
           Azure.Sdk.Tools.GitHubEventProcessor
-          --version 1.0.0-dev.20250425.1
+          --version 1.0.0-dev.20260129.1
           --add-source https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json
           --global
         shell: bash
@@ -123,7 +123,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Archive github event data
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: event

.vscode/cspell.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1",
+  "version": "0.2",
   "language": "en",
   "languageId": "cpp",
   "dictionaries": [],

CHANGELOG.md

@@ -10,6 +10,8 @@
 
 ### Other Changes
 
+- Changed POSIX implementation of `az_platform_clock_msec()` to use `clock_gettime()` instead of `clock()`.
+
 ## 1.5.0 (2023-01-10)
 
 ### Features Added

cmake-modules/AzureVcpkg.cmake

@@ -16,7 +16,7 @@ macro(az_vcpkg_integrate)
       message("AZURE_SDK_DISABLE_AUTO_VCPKG is not defined. Fetch a local copy of vcpkg.")
       # GET VCPKG FROM SOURCE
       #  User can set env var AZURE_SDK_VCPKG_COMMIT to pick the VCPKG commit to fetch
-      set(VCPKG_COMMIT_STRING 2c7705e70dcfb70e5f726459c3e399bd780bc1fc) # default SDK tested commit
+      set(VCPKG_COMMIT_STRING 66c0373dc7fca549e5803087b9487edfe3aca0a1) # default SDK tested commit
       if(DEFINED ENV{AZURE_SDK_VCPKG_COMMIT})
         message("AZURE_SDK_VCPKG_COMMIT is defined. Using that instead of the default.")
         set(VCPKG_COMMIT_STRING "$ENV{AZURE_SDK_VCPKG_COMMIT}") # default SDK tested commit
@@ -30,10 +30,10 @@ macro(az_vcpkg_integrate)
           )
       FetchContent_GetProperties(vcpkg)
       # make sure to pull vcpkg only once.
-      if(NOT vcpkg_POPULATED) 
+      if(NOT vcpkg_POPULATED)
           FetchContent_Populate(vcpkg)
       endif()
-      # use the vcpkg source path 
+      # use the vcpkg source path
       set(CMAKE_TOOLCHAIN_FILE "${vcpkg_SOURCE_DIR}/scripts/buildsystems/vcpkg.cmake" CACHE STRING "")
     endif()
   endif()

eng/common/.gitignore

@@ -0,0 +1,4 @@
+## Node
+
+# Dependency directories
+node_modules/

eng/common/TestResources/New-TestResources.ps1

@@ -129,6 +129,11 @@ param (
 
 $wellKnownTMETenants = @('70a036f6-8e4d-4615-bad6-149c02e7720d')
 
+# People keep passing this legacy parameter. Throw an error to save them future keystrokes
+if ($NewTestResourcesRemainingArguments -like '*UserAuth*') {
+    throw "The -UserAuth parameter is deprecated and is now the default behavior"
+}
+
 if (!$ServicePrincipalAuth) {
     # Clear secrets if not using Service Principal auth. This prevents secrets
     # from being passed to pre- and post-scripts.
@@ -174,7 +179,7 @@ try {
         }
         Write-Verbose "Overriding test resources search directory to '$root'"
     }
-    
+
     $templateFiles = @()
 
     "$ResourceType-resources.json", "$ResourceType-resources.bicep" | ForEach-Object {
@@ -198,7 +203,7 @@ try {
 
     # returns empty string if $ServiceDirectory is not set
     $serviceName = GetServiceLeafDirectoryName $ServiceDirectory
-    
+
     # in ci, random names are used
     # in non-ci, without BaseName, ResourceGroupName or ServiceDirectory, all invocations will
     # generate the same resource group name and base name for a given user
@@ -267,13 +272,13 @@ try {
             if ($context.Tenant.Name -like '*TME*') {
                 if ($currentSubscriptionId -ne '4d042dc6-fe17-4698-a23f-ec6a8d1e98f4') {
                     Log "Attempting to select subscription 'Azure SDK Test Resources - TME (4d042dc6-fe17-4698-a23f-ec6a8d1e98f4)'"
-                    $null = Select-AzSubscription -Subscription '4d042dc6-fe17-4698-a23f-ec6a8d1e98f4' -ErrorAction Ignore
+                    $null = Select-AzSubscription -Subscription '4d042dc6-fe17-4698-a23f-ec6a8d1e98f4' -ErrorAction Ignore -WarningAction Ignore
                     # Update the context.
                     $context = Get-AzContext
                 }
             } elseif ($currentSubcriptionId -ne 'faa080af-c1d8-40ad-9cce-e1a450ca5b57') {
                 Log "Attempting to select subscription 'Azure SDK Developer Playground (faa080af-c1d8-40ad-9cce-e1a450ca5b57)'"
-                $null = Select-AzSubscription -Subscription 'faa080af-c1d8-40ad-9cce-e1a450ca5b57' -ErrorAction Ignore
+                $null = Select-AzSubscription -Subscription 'faa080af-c1d8-40ad-9cce-e1a450ca5b57' -ErrorAction Ignore -WarningAction Ignore
                 # Update the context.
                 $context = Get-AzContext
             }
@@ -305,7 +310,7 @@ try {
         }
     }
 
-    # This needs to happen after we set the TenantId but before we use the ResourceGroupName	
+    # This needs to happen after we set the TenantId but before we use the ResourceGroupName
     if ($wellKnownTMETenants.Contains($TenantId)) {
         # Add a prefix to the resource group name to avoid flagging the usages of local auth
         # See details at https://eng.ms/docs/products/onecert-certificates-key-vault-and-dsms/key-vault-dsms/certandsecretmngmt/credfreefaqs#how-can-i-disable-s360-reporting-when-testing-customer-facing-3p-features-that-depend-on-use-of-unsafe-local-auth
@@ -353,15 +358,19 @@ try {
     # Make sure the provisioner OID is set so we can pass it through to the deployment.
     if (!$ProvisionerApplicationId -and !$ProvisionerApplicationOid) {
         if ($context.Account.Type -eq 'User') {
-            # Support corp tenant and TME tenant user id lookups
-            $user = Get-AzADUser -Mail $context.Account.Id
-            if ($null -eq $user -or !$user.Id) {
-                $user = Get-AzADUser -UserPrincipalName $context.Account.Id
+            # Calls to graph API in corp tenant get blocked by conditional access policy now
+            # but not in TME. For corp tenant we get the user's id from the login context
+            # but for TME it is different so we have to source it from graph
+            $userAccountId = if ($wellKnownTMETenants.Contains($TenantId)) {
+                (Get-AzADUser -SignedIn).Id
+            } else {
+                # HomeAccountId format is '<object id>.<tenant id>'
+                (Get-AzContext).Account.ExtendedProperties.HomeAccountId.Split('.')[0]
             }
-            if ($null -eq $user -or !$user.Id) {
+            if ($null -eq $userAccountId) {
                 throw "Failed to find entra object ID for the current user"
             }
-            $ProvisionerApplicationOid = $user.Id
+            $ProvisionerApplicationOid = $userAccountId
         } elseif ($context.Account.Type -eq 'ServicePrincipal') {
             $sp = Get-AzADServicePrincipal -ApplicationId $context.Account.Id
             $ProvisionerApplicationOid = $sp.Id
@@ -428,20 +437,25 @@ try {
 
     if (!$CI -and !$ServicePrincipalAuth) {
         if ($TestApplicationId) {
-            Write-Warning "The specified TestApplicationId '$TestApplicationId' will be ignored when -ServicePrincipalAutth is not set."
+            Write-Warning "The specified TestApplicationId '$TestApplicationId' will be ignored when -ServicePrincipalAuth is not set."
         }
 
-        # Support corp tenant and TME tenant user id lookups
-        $userAccount = (Get-AzADUser -Mail (Get-AzContext).Account.Id)
-        if ($null -eq $userAccount -or !$userAccount.Id) {
-            $userAccount = (Get-AzADUser -UserPrincipalName (Get-AzContext).Account)
+        $userAccountName = (Get-AzContext).Account.Id
+        # HomeAccountId format is '<object id>.<tenant id>'
+        # Calls to graph API in corp tenant get blocked by conditional access policy now
+        # but not in TME. For corp tenant we get the user's id from the login context
+        # but for TME it is different so we have to source it from graph
+        $userAccountId = if ($wellKnownTMETenants.Contains($TenantId)) {
+            (Get-AzADUser -SignedIn).Id
+        } else {
+            # HomeAccountId format is '<object id>.<tenant id>'
+            (Get-AzContext).Account.ExtendedProperties.HomeAccountId.Split('.')[0]
         }
-        if ($null -eq $userAccount -or !$userAccount.Id) {
+        if ($null -eq $userAccountId) {
             throw "Failed to find entra object ID for the current user"
         }
-        $TestApplicationOid = $userAccount.Id
+        $TestApplicationOid = $userAccountId
         $TestApplicationId = $testApplicationOid
-        $userAccountName = $userAccount.UserPrincipalName
         Log "User authentication with user '$userAccountName' ('$TestApplicationId') will be used."
     }
     # If user has specified -ServicePrincipalAuth
@@ -613,22 +627,44 @@ try {
         }
         Log $msg
 
-        $deployment = Retry {
-            New-AzResourceGroupDeployment `
+        # Run a first pass outside of Retry to fail fast for
+        # template validation errors that won't be fixed with retries.
+        # Only run Test-AzResourceGroupDeployment after error because it can
+        # take a while for large templates even during success cases.
+        try {
+            $deployment = New-AzResourceGroupDeployment `
+                            -Name $BaseName `
+                            -ResourceGroupName $resourceGroup.ResourceGroupName `
+                            -TemplateFile $templateFile.jsonFilePath `
+                            -TemplateParameterObject $templateFileParameters `
+                            -Force:$Force
+        } catch {
+            # Throw if we hit a template validation error, otherwise proceed
+            if ($_.Exception.Message -like '*InvalidTemplateDeployment*') {
+                $validation = Test-AzResourceGroupDeployment `
+                    -ResourceGroupName $resourceGroup.ResourceGroupName `
+                    -TemplateFile $templateFile.jsonFilePath `
+                    -TemplateParameterObject $templateFileParameters
+
+                HandleTemplateDeploymentError $validation
+                throw
+            }
+        }
+
+        if (!$deployment -or $deployment.ProvisioningState -ne 'Succeeded') {
+            Write-Warning "Initial deployment attempt failed, retrying..."
+            $deployment = Retry -Attempts 4 -Action {
+                New-AzResourceGroupDeployment `
                     -Name $BaseName `
                     -ResourceGroupName $resourceGroup.ResourceGroupName `
                     -TemplateFile $templateFile.jsonFilePath `
                     -TemplateParameterObject $templateFileParameters `
                     -Force:$Force
+            }
         }
+
         if ($deployment.ProvisioningState -ne 'Succeeded') {
-            Write-Host "Deployment '$($deployment.DeploymentName)' has state '$($deployment.ProvisioningState)' with CorrelationId '$($deployment.CorrelationId)'. Exiting..."
-            Write-Host @'
-#####################################################
-# For help debugging live test provisioning issues, #
-# see http://aka.ms/azsdk/engsys/live-test-help     #
-#####################################################
-'@
+            HandleDeploymentFailure $deployment
             exit 1
         }
 

eng/common/TestResources/Remove-TestResources.ps1

@@ -7,6 +7,8 @@
 #Requires -PSEdition Core
 #Requires -Modules @{ModuleName='Az.Accounts'; ModuleVersion='1.6.4'}
 #Requires -Modules @{ModuleName='Az.Resources'; ModuleVersion='1.8.0'}
+#Requires -Modules @{ModuleName='Az.Storage'; ModuleVersion='7.0.0'}
+#Requires -Modules @{ModuleName='Az.StorageSync'; ModuleVersion='2.1.1'}
 
 [CmdletBinding(DefaultParameterSetName = 'Default', SupportsShouldProcess = $true, ConfirmImpact = 'Medium')]
 param (
@@ -174,25 +176,25 @@ if (!$ResourceGroupName) {
     }
 }
 
-# If no subscription was specified, try to select the Azure SDK Developer Playground subscription.
+# If no subscription was specified, try to select the 'Azure SDK Test Resources - TME' subscription.
 # Ignore errors to leave the automatically selected subscription.
 if ($SubscriptionId) {
     $currentSubcriptionId = $context.Subscription.Id
     if ($currentSubcriptionId -ne $SubscriptionId) {
         Log "Selecting subscription '$SubscriptionId'"
-        $null = Select-AzSubscription -Subscription $SubscriptionId
+        $null = Select-AzSubscription -Subscription $SubscriptionId -WarningAction Ignore
 
         $exitActions += {
             Log "Selecting previous subscription '$currentSubcriptionId'"
-            $null = Select-AzSubscription -Subscription $currentSubcriptionId
+            $null = Select-AzSubscription -Subscription $currentSubcriptionId -WarningAction Ignore
         }
 
         # Update the context.
         $context = Get-AzContext
     }
 } else {
-    Log "Attempting to select subscription 'Azure SDK Developer Playground (faa080af-c1d8-40ad-9cce-e1a450ca5b57)'"
-    $null = Select-AzSubscription -Subscription 'faa080af-c1d8-40ad-9cce-e1a450ca5b57' -ErrorAction Ignore
+    Log "Attempting to select subscription 'Azure SDK Test Resources - TME (4d042dc6-fe17-4698-a23f-ec6a8d1e98f4)'"
+    $null = Select-AzSubscription -Subscription '4d042dc6-fe17-4698-a23f-ec6a8d1e98f4' -ErrorAction Ignore -WarningAction Ignore
 
     # Update the context.
     $context = Get-AzContext
@@ -206,6 +208,7 @@ $wellKnownSubscriptions = @{
     'faa080af-c1d8-40ad-9cce-e1a450ca5b57' = 'Azure SDK Developer Playground'
     'a18897a6-7e44-457d-9260-f2854c0aca42' = 'Azure SDK Engineering System'
     '2cd617ea-1866-46b1-90e3-fffb087ebf9b' = 'Azure SDK Test Resources'
+    '4d042dc6-fe17-4698-a23f-ec6a8d1e98f4' = 'Azure SDK Test Resources - TME'
 }
 
 # Print which subscription is currently selected.
@@ -261,6 +264,7 @@ $purgeableResources = Get-PurgeableGroupResources $ResourceGroupName
 
 SetResourceNetworkAccessRules -ResourceGroupName $ResourceGroupName -AllowIpRanges $AllowIpRanges -SetFirewall -CI:$CI
 Remove-WormStorageAccounts -GroupPrefix $ResourceGroupName -CI:$CI
+Remove-StorageSyncServices -GroupPrefix $ResourceGroupName -CI:$CI
 
 Log "Deleting resource group '$ResourceGroupName'"
 if ($Force -and !$purgeableResources) {