Skip to content

fix: prevent first-run tool check recursion and JSON contamination #8084

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Wallace Breza (wbreza) merged 4 commits into from
May 7, 2026
Merged

fix: prevent first-run tool check recursion and JSON contamination #8084

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c17c3f8
fix: prevent first-run tool check recursion and JSON contamination (#…
wbreza May 6, 2026
e3c7fd2
fix: address PR review feedback for tool first-run recursion fix
wbreza May 6, 2026
2f1d0de
test: tighten mock matcher in env vars test to validate args
wbreza May 6, 2026
4fb9b46
refactor: remove detector env vars, rely on command scoping allowlist
wbreza May 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 23 additions & 12 deletions cli/azd/cmd/root.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -546,29 +546,40 @@ func newRootCmd(
return cmd
}

// workflowCommands lists root-level commands where the first-run tool
// check and update notifications add value. Utility commands (auth,
// config, env, extension, etc.) are excluded to avoid blocking and to
// prevent recursive subprocess issues when the tool check spawns
// `azd extension list` (#8052).
Comment thread
wbreza marked this conversation as resolved.
Resolved
var workflowCommands = map[string]struct{}{
"init": {},
"up": {},
"provision": {},
"deploy": {},
"down": {},
"publish": {},
"build": {},
"package": {},
"restore": {},
}

// isWorkflowCommand reports whether the command is a primary workflow
// command where a first-run tool check adds value. Utility commands
// (auth, config, env, show, etc.) are excluded so they are never
// blocked by the first-run experience or update notifications.
//
// Instead of maintaining a hard-coded allowlist, we rely on the
// RootLevelHelpOption group annotation so that any new command added
// to a workflow group is automatically covered.
// command where a first-run tool check adds value.
func isWorkflowCommand(descriptor *actions.ActionDescriptor) bool {
// Walk up to the root-level subcommand (first segment after "azd").
current := descriptor
for current.Parent() != nil && current.Parent().Parent() != nil {
current = current.Parent()
}

if current.Options == nil {
if current.Options == nil || current.Options.Command == nil {
return false
}

group := current.Options.GroupingOptions.RootLevelHelp
return group == actions.CmdGroupStart ||
group == actions.CmdGroupAzure ||
group == actions.CmdGroupBeta
name := current.Options.Command.Name()

_, ok := workflowCommands[name]
return ok
}

func getCmdRootHelpFooter(cmd *cobra.Command) string {
Expand Down
Loading