fix(azure-devops): use absolute URL and compound repository ID in pipeline permit action

[artificialvirus]

Hey, I just made a Pull Request!

Bug Fix: azure:pipeline:permit action — two issues resolved

Bug 1: Relative URL causes ECONNREFUSED

The azure:pipeline:permit action constructs a request URL as a relative path:

// Before (broken)
const requestUrl = `${project}/_apis/pipelines/pipelinepermissions/${resourceType}/${resourceId}?api-version=${apiVersion}`;

When passed to HttpClient.patch(), this relative URL resolves to http://localhost:80/... instead of the intended Azure DevOps API endpoint, causing ECONNREFUSED errors.

Fix: Prefix the URL with the full Azure DevOps base URL (${url}/):

// After (fixed)
const requestUrl = `${url}/${project}/_apis/pipelines/pipelinepermissions/${resourceType}/${resolvedResourceId}?api-version=${apiVersion}`;

Bug 2: Repository resources require compound resource ID

The Azure DevOps Pipeline Permissions API requires repository resource IDs in the compound format {projectId}.{repositoryId}. Passing only the repository GUID results in 400 Bad Request — "Invalid resource id".

Fix: For resourceType === 'repository', automatically resolve the project GUID via the Core API and construct the compound ID. If the provided resourceId already contains a dot (i.e., the caller already provided a compound ID), it is passed through unchanged.

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes) — N/A (backend-only change)
• All your commits have a Signed-off-by line in the message. (more info)

Test coverage (8 tests, all passing)

Test	Purpose
no credentials	Error path — throws when no token or integration configured
token auth + endpoint	Happy path with absolute URL
repository type	Verifies compound ID auto-resolution ({projectId}.{repositoryId})
request failure	Error propagation from HTTP client
NEW: compound repo ID	Verifies getCoreApi().getProject() called, compound ID constructed
NEW: dot passthrough	Repository ID already containing . skips resolution
NEW: non-repo type	getCoreApi NOT called for endpoint/variablegroup types
NEW: project lookup failure	Throws InputError when project not found

Files changed (3 files, +142 / -4)

• plugins/scaffolder-backend-module-azure-devops/src/actions/devopsPermitPipeline.ts — Both fixes
• plugins/scaffolder-backend-module-azure-devops/src/actions/devopsPermitPipeline.test.ts — Updated + 4 new tests
• .changeset/fix-pipeline-permit-url-and-repo-id.md — Patch changeset

[backstage-goalie]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@backstage-community/plugin-scaffolder-backend-module-azure-devops	workspaces/azure-devops/plugins/scaffolder-backend-module-azure-devops	patch	v0.22.1

[awanlin]

Hi @EsmerlinJM, as the initial author of this action can you give this PR a quick look, please?

[awanlin]

HI @artificialvirus, thanks for the contribution, I'm away at BackstageCon/KubeCon this week and won't have time to review this for a bit, if I have time it will be this Friday if not it won't be till the Friday after. Just wanted to give you a heads up. I also asked the initial author of this action to review as well. 👍

[awanlin]

Sorry this took as long as it did to review @artificialvirus, let's ship it 🚀