Merge from upstream

.github/policies/resourceManagement.yml

@@ -713,6 +713,18 @@ configuration:
             - bberera
             replyTemplate: Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc ${mentionees}.
             assignMentionees: False
+      - if:
+        - hasLabel:
+            label: Service Attention
+        - hasLabel:
+            label: CodeSigning
+        then:
+        - mentionUsers:
+            mentionees:
+            - Jaxelr
+            - DawnWang17
+            replyTemplate: Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc ${mentionees}.
+            assignMentionees: False
       - if:
         - hasLabel:
             label: Service Attention

.github/template/git-hooks-note.md

@@ -0,0 +1,10 @@
+The git hooks are available for **azure-cli** and **azure-cli-extensions** repos. They could help you run required checks before creating the PR. 
+
+Please sync the latest code with latest dev branch (for **azure-cli**) or main branch (for **azure-cli-extensions**). 
+After that please run the following commands to enable git hooks:
+
+```bash
+pip install azdev --upgrade
+azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
+
+```

.github/workflows/CreateReleaseTag.yml

@@ -0,0 +1,35 @@
+name: Create Release Tag
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'src/index.json'
+
+jobs:
+  create-release:
+    runs-on: windows-latest
+    permissions:
+      contents: write
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 2
+
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.x'
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install requests
+
+    - name: Create Release Tag
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        python scripts/automation/create_release_tag.py

.github/workflows/GitHookNotice.yml

@@ -0,0 +1,28 @@
+name: Git Hook Notice
+on:
+  pull_request_target:
+    types: [opened]
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  git-hook-notice:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    name: Introduce git hook in developer env
+    steps:
+      - name: Checkout git hook notice message
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github/template/git-hooks-note.md
+      - name: Comment on pull request
+        uses: mshick/add-pr-comment@v2
+        with:
+           repo-token: ${{ secrets.GITHUB_TOKEN }}
+           message-id: gitHookNoticeComment
+           message-path: |
+            .github/template/git-hooks-note.md 

azure-pipelines.yml

@@ -164,8 +164,8 @@ jobs:
         ADO_PULL_REQUEST_LATEST_COMMIT: HEAD
         ADO_PULL_REQUEST_TARGET_BRANCH: $(System.PullRequest.TargetBranch)
 
-- job: AzdevScanModifiedExtensions
-  displayName: "azdev scan on Modified Extensions"
+- job: AzdevScanModifiedExtensionsHigh
+  displayName: "azdev scan ( High Confidence ) on Modified Extensions"
   condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
   pool:
     name: 'pool-ubuntu-2004'
@@ -182,16 +182,47 @@ jobs:
         git fetch origin --depth=1 $(System.PullRequest.TargetBranch)
         declare -A secret_files
         for FILE in `git diff --name-only --diff-filter=AM origin/$(System.PullRequest.TargetBranch)` ; do
-          detected=$(azdev scan -f $FILE | python -c "import sys, json; print(json.load(sys.stdin)['secrets_detected'])")
+          detected=$(azdev scan -f $FILE --continue-on-failure| python -c "import sys, json; print(json.load(sys.stdin)['secrets_detected'])")
           if [ $detected == 'True' ]; then
-            echo "Secrets detected from "$FILE", Please remove or replace it. You can run 'azdev scan'/'azdev mask' locally to fix." 1>&2
+            printf "\033[0;31mSecrets detected from %s, Please remove or replace it. You can run 'azdev scan'/'azdev mask' locally to fix.\033[0m\n" "$FILE"
             secret_files+=$FILE
           fi
         done
         if [ "${#secret_files[@]}" -gt 0 ]; then
           exit 1
         fi
-      displayName: "azdev scan on Modified Extensions"
+      displayName: "azdev scan ( High Confidence ) on Modified Extensions"
+
+- job: AzdevScanProModifiedExtensionsMedium
+  displayName: "azdev scan ( Medium Confidence ) on Modified Extensions"
+  dependsOn: AzdevScanModifiedExtensionsHigh
+  condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
+  continueOnError: true
+  pool:
+    name: 'pool-ubuntu-2004'
+  steps:
+    - task: UsePythonVersion@0
+      displayName: 'Use Python 3.11'
+      inputs:
+        versionSpec: 3.11
+    - template: .azure-pipelines/templates/azdev_setup.yml
+    - bash: |
+        #!/usr/bin/env bash
+        set -ev
+        source ./env/bin/activate
+        git fetch origin --depth=1 $(System.PullRequest.TargetBranch)
+        declare -A secret_files
+        for FILE in `git diff --name-only --diff-filter=AM origin/$(System.PullRequest.TargetBranch)` ; do
+          detected=$(azdev scan --confidence-level MEDIUM -f $FILE --continue-on-failure| python -c "import sys, json; print(json.load(sys.stdin)['secrets_detected'])")
+          if [ $detected == 'True' ]; then
+            printf "\033[0;31mSecrets detected from %s, Please remove or replace it. You can run 'azdev scan --confidence-level MEDIUM'/'azdev mask --confidence-level MEDIUM' locally to fix.\033[0m\n" "$FILE"
+            secret_files+=$FILE
+          fi
+        done
+        if [ "${#secret_files[@]}" -gt 0 ]; then
+          exit 1
+        fi
+      displayName: "azdev scan ( Medium Confidence ) on Modified Extensions"
 
 #- job: IndexRefDocVerify
 #  displayName: "Verify Ref Docs"

linter_exclusions.yml

@@ -401,6 +401,12 @@ containerapp github-action add:
     service_principal_tenant_id:
       rule_exclusions:
       - option_length_too_long
+containerapp label-history show:
+  rule_exclusions:
+  -  missing_command_test_coverage
+containerapp label-history list:
+  rule_exclusions:
+  -  missing_command_test_coverage
 costmanagement export create:
   parameters:
     definition_dataset_configuration:

policy.json

@@ -0,0 +1 @@
+{"issuerParameters": {"certificateTransparency": null, "name": "Self"}, "keyProperties": {"curve": null, "exportable": true, "keySize": 2048, "keyType": "RSA", "reuseKey": true}, "lifetimeActions": [{"action": {"actionType": "AutoRenew"}, "trigger": {"daysBeforeExpiry": 90}}], "secretProperties": {"contentType": "application/x-pkcs12"}, "x509CertificateProperties": {"keyUsage": ["cRLSign", "dataEncipherment", "digitalSignature", "keyEncipherment", "keyAgreement", "keyCertSign"], "subject": "CN=CLIGetDefaultPolicy", "validityInMonths": 12}}