Skip to content

Conversation

@SteveL-MSFT
Copy link
Member

@SteveL-MSFT SteveL-MSFT commented Aug 12, 2025

PR Summary

While working with AzCLI team to produce secret extension, it became obvious that the extension should just emit the secret as-is to STDOUT without being wrapped in JSON as it provides no value and just needs to be deserialized. In the future, if there are properties to the secret, we can add a schema and add to SecretMethod definition to have something like kind to indicate the type of output expected. However, with this change ALL secret extensions MUST emit just the secret as plaintext to STDOUT with trailing newline. Multiple lines to STDOUT is an error.

While fixing that, I also noticed that the $schema for some extensions was using the resource schema instead of the extension schema, so fixed those as well. Also reformatted the use statement to make it more readable.

Manually tested with prototype azcli extension manifest:

{
    "$schema": "https://aka.ms/dsc/schemas/v3/bundled/extension/manifest.json",
    "type": "Microsoft.Azure.CLI/KeyVault",
    "version": "1.0.0",
    "description": "Retrieve secrets from Azure KeyVault",
    "secret": {
        "executable": "az.cmd",
        "args": [
            "keyvault",
            "secret",
            "show",
            {
                "vaultArg": "--vault-name"
            },
            {
                "nameArg": "--name"
            },
            "--query",
            "value",
            "--output",
            "tsv"
        ]
    }
}

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR changes secret extensions to emit secrets directly as plaintext to STDOUT instead of being wrapped in JSON format. This simplifies the secret handling workflow and eliminates unnecessary serialization/deserialization steps.

  • Removes JSON wrapping from secret extension output, requiring all secret extensions to emit plaintext directly
  • Fixes schema references in extension manifests to use the correct extension schema instead of resource schema
  • Updates test secret extensions to output plaintext instead of JSON-wrapped objects

Reviewed Changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
extensions/test/secret/testSecret2.dsc.extension.json Updates schema reference and description to reflect extension usage
extensions/test/secret/testSecret.dsc.extension.json Updates schema reference and description to reflect extension usage
extensions/test/secret/secret.ps1 Removes JSON wrapping and outputs secret directly
extensions/bicep/bicep.dsc.extension.json Fixes schema reference to use extension manifest schema
dsc_lib/src/extensions/secret.rs Removes SecretResult struct as JSON wrapping is no longer needed
dsc_lib/src/extensions/dscextension.rs Updates secret handling to process plaintext output directly and reformats use statements

@SteveL-MSFT SteveL-MSFT added this pull request to the merge queue Aug 13, 2025
Merged via the queue into PowerShell:main with commit 0ea091c Aug 13, 2025
4 checks passed
@SteveL-MSFT SteveL-MSFT deleted the secret-plain branch August 13, 2025 23:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants