fix(ado-script): read auto-injected collection URI in getWebApi#1311
Merged
Conversation
conclusion.js could not file the pipeline_failure work item because the Conclusion step never injected ADO_COLLECTION_URI, which the shared getWebApi() auth helper required. ADO does not auto-inject that renamed var, and the Conclusion step builder only set SYSTEM_ACCESSTOKEN. Align ado-script with the Rust `ado-aw execute` path by reading ADO's auto-injected collection URI directly: SYSTEM_COLLECTIONURI, falling back to SYSTEM_TEAMFOUNDATIONCOLLECTIONURI. This removes the collection URI from the per-step injection contract entirely, so no compiler-emitted step can forget it again (fixes already-compiled locks too). Also drop the now-redundant ADO_COLLECTION_URI exports from the gate and synthetic-PR step builders, update gate_e2e to set SYSTEM_COLLECTIONURI, refresh docs, and add auth.test.ts precedence coverage. Fixes #1307 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Every ado-script bundle is a build artifact shipped via the release ado-script.zip and downloaded to /tmp at pipeline runtime; the in-repo copies are gitignored. conclusion.js was the sole exception — PR #1076 added the bundle but omitted it from scripts/ado-script/.gitignore, so the built file was committed and tracked by accident. Nothing consumes the repo copy (only the /tmp runtime path is referenced), so untrack it and ignore it alongside the other bundles. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #1307. The Conclusion job could not file the
pipeline_failurework item —conclusion.jsfailed withADO_COLLECTION_URI env var is missing, soAW_REPORT_FAILURE_AS_WORK_ITEMsilently produced nothing (the step iscontinueOnError: true).Root cause
All ado-script bundles authenticate through the single
getWebApi()chokepoint inscripts/ado-script/src/shared/auth.ts, which read the non-auto-injectedADO_COLLECTION_URI. The compiler emitted that renamed var for the gate and synthetic-PR steps, butbuild_conclusion_jobonly setSYSTEM_ACCESSTOKEN— soconclusion.jshad no org URL. Meanwhile the Rustado-aw executepath reads the auto-injectedSYSTEM_TEAMFOUNDATIONCOLLECTIONURI, so the two code paths disagreed.Fix
Align ado-script with the Rust path by reading ADO's auto-injected collection URI directly in
getWebApi():SYSTEM_COLLECTIONURI->SYSTEM_TEAMFOUNDATIONCOLLECTIONURI. This removes the collection URI from the per-step injection contract entirely, so no compiler-emitted step can forget it again — and it fixes already-compiled.lock.ymlfiles without recompilation (ADO auto-injects the var regardless of theenv:block).auth.ts— new precedence; dropADO_COLLECTION_URI.auth.test.ts— precedence coverage (prefersSYSTEM_COLLECTIONURI, falls back toSYSTEM_TEAMFOUNDATIONCOLLECTIONURI, errors when both missing).filter_ir.rs+extensions/ado_script.rs— drop the now-redundantADO_COLLECTION_URIexports from the gate and synthetic-PR step builders.tests/gate_e2e.rs— setSYSTEM_COLLECTIONURIinstead ofADO_COLLECTION_URI.docs/ado-script.md,docs/filter-ir.md,site/.../ado-script.mdx.Drive-by cleanup
scripts/ado-script/conclusion.jswas tracked by accident (PR #1076 added the bundle but omitted it fromscripts/ado-script/.gitignore). Every ado-script bundle is a build artifact shipped via the releaseado-script.zipand downloaded to/tmpat runtime; the repo copy is never consumed. This PR untracks it and gitignores it alongside the other bundles.Validation
vitest run— 441/441 pass.cargo build,cargo test(2460+ across suites),cargo clippy --all-targets --all-features— all clean.Follow-up (not in this PR)
The deeper issue is that the
getWebApiauth-env contract is hand-rolled across ~10 compiler step builders (gate, synth-PR, conclusion, executor, every exec-context contributor), which is how the Conclusion step drifted. A follow-up will introduce a shared auth-env applier and a general contract for per-bundle env-var requirements between compiler-emitted steps and ado-script tasks.