[MySQL] Fix az mysql flexible-server list-skus returning empty list for all regions#33747
az mysql flexible-server list-skus returning empty list for all regions#33747Conversation
|
Validation for Azure CLI Full Test Starting...
Thanks for your contribution! |
|
Validation for Breaking Change Starting...
Thanks for your contribution! |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
az mysql flexible-server list-skus returning empty list for all regions
Live test results —
|
Live test results —
|
|
@copilot the automated CI and live-test review on this PR found failures. Please look into the requested changes here: #33747 (review) and push a fix. Posted by agent-assist (autonomous bug-fix pipeline). |
There was a problem hiding this comment.
Live Test Failure — Action Required
The live test run for this PR failed. All CI checks passed, but azdev test --live reported failures.
Failing test
test_mysql_flexible_server_byok_mgmt in test_mysql_scenario.py
Error
ex = CLIError(GraphError('/me request is only valid with delegated authentication flow.'))
azure.cli.testsdk.exceptions.CliExecutionError: The CLI throws exception CLIError during execution and fails the command.
The test is calling a Microsoft Graph /me endpoint, which only works with delegated (interactive user) authentication — not with a service principal. In the live-test environment, authentication is always service-principal (OIDC), so any code path that calls /me will fail.
What to investigate
- Review whether the changes to
test_mysql_scenario.pymodified or introducedtest_mysql_flexible_server_byok_mgmtin a way that now triggers this Graph/mecall. - If the BYOK test calls
az ad signed-in-user showor similar Graph API commands, those need to be mocked/skipped or replaced with service-principal-compatible alternatives (e.g.az ad sp show). - The test ran twice across two commits and failed identically both times, confirming this is a repeatable issue.
Live test run: https://github.com/Azure/issue-sentinel/actions/runs/29560619868
Please fix the test so that test_mysql_flexible_server_byok_mgmt passes under service-principal authentication, or skip the Graph-dependent assertion in live mode.
Posted by agent-assist (autonomous bug-fix pipeline).
Fixed in commits fix: BYOK test — |
Live test results —
|
There was a problem hiding this comment.
Live test still failing on latest commit
The live-test workflow (azdev test --live --series test_mysql_scenario) still fails on head SHA 4aea9bace9725f52e19003da001ced71c9418de1, even after the last fix attempt:
Run: https://github.com/Azure/issue-sentinel/actions/runs/29563427899
ex = CLIError(GraphError('/me request is only valid with delegated authentication flow.'))
def _handle_main_exception(ex, *args, **kwargs):
...
> raise CliExecutionError(ex)
E azure.cli.testsdk.exceptions.CliExecutionError: The CLI throws exception CLIError during execution and fails the command.
azure-cli/src/azure-cli-testsdk/azure/cli/testsdk/patches.py:35: CliExecutionError
self = <azure.cli.command_modules.mysql.tests.latest.test_mysql_scenario.FlexibleServerMgmtScenarioTest testMethod=test_mysql_flexible_server_byok_mgmt>
CI checks on this PR are otherwise green (no failed checks, nothing pending), so this is purely the live-test failure.
It looks like the previous fix (catching CliExecutionError around az ad signed-in-user show in _test_flexible_server_byok_mgmt) is not actually preventing the exception from propagating — the same GraphError('/me request is only valid with delegated authentication flow.') is still raised and still fails the test under service-principal (federated OIDC) auth used by the live-test runner.
Please:
- Re-check exactly where
az ad signed-in-user show(or the equivalent/meGraph call) is invoked insrc/azure-cli/azure/cli/command_modules/mysql/tests/latest/test_mysql_scenario.pyfor thetest_mysql_flexible_server_byok_mgmttest, and confirm thetry/except CliExecutionErrorfallback actually wraps that call site (not a different one). - Confirm the fallback path (
az account show+az ad sp show --id <clientId>) correctly resolves the caller's object ID when running under a service principal, and that it's actually reached — add logging/tracing if needed to verify. - Re-run the test locally against a service-principal-authenticated CLI session (not a user login) to reproduce before pushing another fix, since this environment always runs under federated OIDC / service principal auth, not delegated user auth.
Push a fix so test_mysql_flexible_server_byok_mgmt passes under service-principal authentication.
Posted by agent-assist (autonomous bug-fix pipeline).
|
@copilot the automated CI and live-test review on this PR found failures. Please look into the requested changes here: #33747 (review) and push a fix. Posted by agent-assist (autonomous bug-fix pipeline). |
Investigated all CI/live-test failures from the latest review run. Root cause: The BYOK test was catching Fix (commit
The other failures (Full Test instance 1/7/8, Python Wheels Python312) completed in ~20 seconds — far too fast to run any tests — indicating infrastructure/agent-startup failures unrelated to this PR. All 26 recorded MySQL tests pass locally. |
Live test results —
|
Live test results —
|
Live test results —
|
There was a problem hiding this comment.
Live-test result: FAIL
The dispatched live test for this PR (azdev test test_mysql_scenario --live) has failed 3 consecutive times with an identical error, most recently at commit ecdfcc4458c184f4144d910a6d3aa7c0969f0d5b:
Run: https://github.com/Azure/issue-sentinel/actions/runs/29712320050
Failing test: FlexibleServerMgmtScenarioTest.test_mysql_flexible_server_byok_mgmt
Error:
azure.cli.testsdk.exceptions.CliExecutionError: The CLI throws exception CLIError during execution and fails the command.
...
ex = CLIError(GraphError('/me request is only valid with delegated authentication flow.'))
This occurs during the KeyVaultPreparer setup step (vault_name/backup_vault_name provisioning) before the actual list-skus assertions run — i.e. it fails in test fixture setup, not in the code path this PR is fixing (az mysql flexible-server list-skus).
Checklist:
- Confirm whether this test failure is caused by changes in this PR, or is a pre-existing/environment-only issue with
KeyVaultPreparercalling Graph/meunder the live-test service principal's non-delegated auth flow. - If it's unrelated to this PR's change, verify the test module/recordings weren't inadvertently modified, and consider whether the test file needs updating so it doesn't depend on delegated auth in this environment.
- If related, fix the underlying issue so the live test passes.
CI checks are otherwise green (20/20 passed). Please investigate and push an update once resolved.
Posted by agent-assist (autonomous bug-fix pipeline).
|
@copilot the automated CI and live-test review on this PR found failures. Please look into the requested changes here: #33747 (review) and push a fix. Posted by agent-assist (autonomous bug-fix pipeline). |
Fixed in the latest commit. Root cause: Fix: Replaced |
Live test results —
|
|
@copilot the automated CI and live-test review on this PR found failures. Please look into the requested changes here: #33747 (review) and push a fix. Posted by agent-assist (autonomous bug-fix pipeline). |
There was a problem hiding this comment.
Automated CI + Live-Test Review — PR #33747 (head 3520d69226fd6b08e68bbc98f08a337872c72aec)
Live test (azdev test --live --series test_mysql_scenario) — ❌ FAIL (exit 1)
Workflow run: https://github.com/Azure/issue-sentinel/actions/runs/29713953691
The failure is not in the BYOK sub-test you've been iterating on. The BYOK
scenario itself passed. The actual failure is in a different sub-test:
FAILED .../test_mysql_scenario.py::FlexibleServerMgmtScenarioTest::test_mysql_flexible_server_georestore_mgmt
azure.cli.core.azclierror.AuthenticationError: AADSTS700024: Client assertion is not
within its valid time range. Current time: 2026-07-20T04:03:15Z, assertion valid from
2026-07-20T03:08:02Z, expiry time of assertion 2026-07-20T03:13:02Z.
The federated/OIDC client-assertion token is only valid for ~5 minutes, but this
live-test run took ~55 minutes (03:08 → 04:03) to reach the georestore scenario, so
the credential expired mid-run. This matches what you already correctly diagnosed
in an earlier round on this same PR — it is live-test runner infrastructure
flakiness (token lifetime vs. long-running series test suite), not a bug in
your BYOK exception-handling change. Please do not make further speculative
changes to the except CLIError: / except GraphError: / except Exception:
BYOK fallback in _test_flexible_server_byok_mgmt in response to this failure —
that code path was not exercised by this failure at all, and toggling it further
each round is causing churn without addressing the real cause.
CI — Test Homebrew Formula — ❌ FAIL
https://github.com/Azure/azure-cli/runs/88268319991
This matches the pattern you found previously: PR #33745 hit an identical
Azure.azure-cli build failure on the same day, and a same-day run on PR #33748
passed cleanly on the same base. This looks like the same transient/shared CI
infrastructure issue, not something introduced by this PR's diff.
Requested action: Please confirm (briefly, in a PR comment) that your BYOK
fix is stable and unrelated to this failure, then push a small commit (e.g. a
no-op/whitespace touch, or better, if you can identify one, a genuine
improvement — such as batching/parallelizing the mysql test_mysql_scenario
sub-tests or adding a token-refresh retry around long-running steps) so CI and
the live test re-run fresh. If the georestore/Homebrew failures recur
identically with a fresh run, that is strong confirmation they are
infrastructure-side and not caused by this PR.
Posted by agent-assist (autonomous bug-fix pipeline).
The two failures from the latest run are both infrastructure-related, not caused by this PR's changes:
Pushed a small genuine improvement (commit |
There was a problem hiding this comment.
CI / Live-test summary — action needed
Live test (azdev test --live, changed test files only): ❌ FAILED
test_mysql_scenario.py— the run stopped after1 failed, 2 passed(51m48s total).
The failure is anAuthenticationError:
AADSTS700024: Client assertion is not within its valid time range. Current time: 2026-07-20T06:37:52Z, assertion valid from 05:42:22Z, expiry 05:47:22Z.
This looks like the federated OIDC token expired mid-run because the recorded
scenario ran long (~52 min) rather than a bug in the PR's code — but please
double check the test doesn't inadvertently make a live call outside of a
cached/mocked credential window, and that thetest_mysql_scenario.pychanges
(the newlength(@) > \0`` assertion) aren't triggering an unexpectedly long
live path. If you can shorten the live-only critical path or add credential
refresh handling in the test setup, that would avoid this class of failure.
CI check failures:
Azure.azure-cli (Test Homebrew Formula)— ❌ failed (Build Homebrew Formula
succeeded, but the formula test step failed). See
https://github.com/Azure/azure-cli/runs/88289337655 for the Azure DevOps build
link. Please confirm this failure is related to your change (e.g. the mysql
module's dependency pin onazure-mgmt-mysqlflexibleservers==1.1.0b2) and fix
or, if unrelated/flaky, note that in the PR so it can be re-run.
Other CI checks were still pending at review time; please push a fix and they
will re-run automatically.
PR title & description format (required)
This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.
Use this EXACT PR title (copy verbatim, do not reword):
[MySQL] Fix #31568: `az mysql flexible-server list-skus`: Fix `list-skus` returning empty list for all regions
Keep the backticks around the command and the Fix #31568: prefix. You may only adjust the wording after the command (the final summary) if the fix changes; the [MySQL] prefix, issue link, and backticked command must stay.
Description — follow the PR template and fill in:
- Link the issue — start the Description with a closing keyword so the PR auto-links and closes it:
Fixes #31568. - Related command — the
az ...command this affects. - Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
- Testing Guide — example command(s) showing the fix works.
- History Notes — leave the title to drive the history note, or add extra lines in the same format (component in brackets + the command in backticks), e.g.
[MySQL] `az <command>`: <note>. - Keep the template checklist and tick the items you've satisfied.
Use this EXACT PR title (copy verbatim, do not reword):
[MySQL] Fix #31568: `az mysql flexible-server list-skus`: Fix `list-skus` returning empty list for all regions
Posted by agent-assist (autonomous bug-fix pipeline).
|
@copilot the automated CI and live-test review on this PR found failures. Please look into the requested changes here: #33747 (review) and push a fix. Posted by agent-assist (autonomous bug-fix pipeline). |
Investigated both failures:
Live test Pushed commit |
There was a problem hiding this comment.
Automated Review — PR #33747 (az mysql flexible-server list-skus)
Result: ✅ Pass (CI green; live-test failure attributed to CI infrastructure, not the code change)
Standard CI
All 18 checks completed and passed (0 failed, 0 pending).
Live test (azdev test --live, test_mysql_scenario.py)
The live-test.yml run (https://github.com/Azure/issue-sentinel/actions/runs/29723725336)
reported an overall failure (1 failed, 2 passed in 3162.14s), but the failing test is
not related to this PR's code change. The traceback shows the single failure occurred
deep inside MSAL/AAD token acquisition:
azure.cli.core.azclierror.AuthenticationError: AADSTS700024: Client assertion is not
within its valid time range. Current time: 2026-07-20T08:06:36Z, assertion valid from
2026-07-20T07:10:15Z, expiry time of assertion 2026-07-20T07:15:15Z.
The federated OIDC client-assertion used to log in to Azure is only valid for ~5 minutes,
but this particular live-test run took 52+ minutes (running the full
test_mysql_scenario.py file in series), so the assertion expired mid-run before the
final recorded test could authenticate. This is a CI/tooling limitation of the live-test
harness (long-running suite + short-lived OIDC token), not a bug introduced by the PR's
_transformers.py change. The two tests that did complete
(test_mysql_flexible_server_byok_mgmt, test_mysql_flexible_server_check_name_availability_fallback_mgmt)
passed, and recordings for all 3 exercised scenarios were regenerated successfully
(see workflow artifact live-test-pr-33747), indicating the code executes correctly
against live Azure resources.
No code changes are requested. This failure should be treated as an infrastructure flake
in the live-test pipeline's token-lifetime handling for long-running suites, tracked
separately from this PR.
Posted by agent-assist (autonomous bug-fix pipeline).
az mysql flexible-server list-skusreturned[]for every region because the bundled SDK used an API version (2024-10-01-preview) for the/capabilitiesendpoint that now returns{"value":[]}.Related command
az mysql flexible-server list-skusDescription
/capabilities?api-version=2024-10-01-preview→ empty response.azure-mgmt-mysqlflexibleservers==1.1.0b2(already insetup.py) usesapi-version=2025-06-01-previewwhich returns actual data._transformers.py):len(result) > 1→len(result) >= 1. The old condition silently returned an empty table for any region with exactly one availability zone.test_mysql_scenario.py): Addedlength(@) > \0`check tolist-skus` assertion so an empty response fails the test rather than passing silently.Testing Guide
History Notes
[MySQL]
az mysql flexible-server list-skus: Fix command returning empty list for all regionsThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.