Depend on azure-keyvault-secrets directly, dropping unused Azure packages

[blaipr]

SUMMARY

The Azure Key Vault credential plugin (awx/main/credential_plugins/azure_kv.py) only uses azure.keyvault.secrets (SecretClient) and azure.identity (ClientSecretCredential, AzureAuthorityHosts). But requirements.in asked for the azure-keyvault meta-package, which also installs azure-keyvault-certificates and azure-keyvault-keys - neither of which is imported anywhere in the codebase. Those packages (at their old pins) plus the old azure-keyvault-secrets pin were the only things still pulling in the deprecated azure-common.

This replaces the meta-package with a direct azure-keyvault-secrets>=4.11.0 dependency. Re-compiling drops four packages from requirements.txt:

Package	Change
azure-keyvault (meta)	removed
azure-keyvault-certificates	removed (unused)
azure-keyvault-keys	removed (unused)
azure-common	removed (deprecated; was transitive-only)
azure-keyvault-secrets	4.7.0 → 4.11.0 (now a direct dep)

No change to azure-core, azure-identity, or msal. Also removes the four orphaned licenses/*.txt files and a stray azure-keyvault-secrets-4.8.0.tar.gz source tarball that was never required (the package is MIT, so no source distribution is needed).

The value of this change is surface reduction: fewer packages to install, audit, and maintain, and the removal of a deprecated transitive dependency.

The API surface the plugin uses (SecretClient(credential, vault_url), .get_secret(name, version), ClientSecretCredential(...)) is stable across the 4.x line, so the 4.7 → 4.11 bump is non-breaking.

ISSUE TYPE

• Bug, Docs Fix or other nominal change

COMPONENT NAME

• API

ASCENDER VERSION

awx: 25.4.1.dev21+g761ea17.d20260613

ADDITIONAL INFORMATION

requirements.txt regenerated with requirements/updater.sh run inside the awx container (pip-compile), per the documented process.

# inside tools_awx_1
py.test awx/main/tests/functional/test_licenses.py            # 1 passed
py.test awx/main/tests/functional/test_credential_plugins.py  # 6 azure tests pass (19 total in the two files)
python -c "from awx.main.credential_plugins.azure_kv import azure_keyvault_plugin"  # import OK

[Copilot]

Pull request overview

Updates Ascender’s Python dependency set to depend directly on the Azure Key Vault Secrets client library rather than the azure-keyvault meta-package, reducing the installed/audited surface area and removing a deprecated transitive dependency (azure-common).

Changes:

• Replace azure-keyvault meta-package with a direct azure-keyvault-secrets>=4.11.0 requirement (compiled to ==4.11.0 in requirements.txt).
• Drop unused Azure Key Vault subpackages (azure-keyvault-keys, azure-keyvault-certificates) and the deprecated transitive dependency azure-common.
• Remove now-orphaned license artifacts for the removed dependencies (and the stray azure-keyvault-secrets-4.8.0.tar.gz file).

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
requirements/requirements.in	Switches from azure-keyvault to azure-keyvault-secrets>=4.11.0 with explanatory comments.
requirements/requirements.txt	Regenerated pins: removes azure-keyvault* meta/subpackages and azure-common; adds azure-keyvault-secrets==4.11.0.
licenses/azure-keyvault.txt	Removes orphaned license file for removed meta-package.
licenses/azure-keyvault-keys.txt	Removes orphaned license file for removed unused dependency.
licenses/azure-keyvault-certificates.txt	Removes orphaned license file for removed unused dependency.
licenses/azure-common.txt	Removes orphaned license file for removed deprecated transitive dependency.
licenses/azure-keyvault-secrets-4.8.0.tar.gz	Removes unused/stray source tarball artifact.