Bump azure/cli from 2.2.0 to 3.0.0 - #14335
Conversation
Bumps [azure/cli](https://github.com/azure/cli) from 2.2.0 to 3.0.0. - [Release notes](https://github.com/azure/cli/releases) - [Changelog](https://github.com/Azure/cli/blob/master/ReleaseProcess.md) - [Commits](Azure/cli@9f7ce6f...9eb25b8) --- updated-dependencies: - dependency-name: azure/cli dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Pull request overview
This PR updates the pinned azure/cli GitHub Action used by the Python workflows from v2.2.0 to v3.0.0 (commit SHA bump), aligning the workflows with the latest major release of the action.
Changes:
- Bump
azure/cliaction pin fromv2.2.0tov3.0.0in the Python manual release workflow. - Bump
azure/cliaction pin fromv2.2.0tov3.0.0in the Python build workflow.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/python-manual-release.yml | Updates the azure/cli action pin used to trigger the ADO pipeline during manual Python releases. |
| .github/workflows/python-build.yml | Updates the azure/cli action pin used to trigger the ADO pipeline during Python build/release automation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: No findings
Scope: full PR (1 commit(s)): e480b3ee47d6
Model: claude-opus-4.8
Overview
This is a Dependabot bump of the SHA-pinned azure/cli GitHub Action from v2.2.0 to v3.0.0 in two Python release workflows. All four reviewers independently verified that the new pin 9eb25b8360668fb0ecbafa808d40e2197b2f5f52 is the authentic commit that the upstream Azure/cli v3.0.0 annotated tag dereferences to, that the full-SHA pin (and matching # v3.0.0 comment) is preserved, and that both usages were updated consistently with no stale references left behind. The only behavioral delta upstream is the action runtime moving node20->node24, which the ubuntu-latest runners support. Permissions, OIDC login, environment gating, and the inlineScript trust boundary are unchanged, so the bump introduces no new defect.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.
|
Looks like azure/cli is up-to-date now, so this is no longer needed. |
|
Superseded by #14385 |
### Motivation and Context Consolidates the currently open Dependabot updates into one reviewable dependency PR while preserving each source update's intent across GitHub Actions, .NET, Python, and JavaScript sample dependencies. ### Description Updates pinned GitHub Actions, central NuGet package versions, Python dependency constraints and uv lockfiles, and npm/Yarn lockfiles for the affected samples. Overlapping lockfile updates were regenerated or reconciled so that all compatible requested versions are retained together on the latest `main`. The incompatible MCP 2.x and Python 3.10 `onnxruntime-genai` updates are excluded, the private-feed-only `@humanfs/node` update is omitted, and the logging abstractions floor is aligned with the updated Azure AI Projects dependency. ### Related Issue Supersedes: - microsoft#14177 - microsoft#14179 - microsoft#14180 - microsoft#14190 - microsoft#14209 - microsoft#14230 - microsoft#14233 - microsoft#14254 - microsoft#14257 - microsoft#14259 - microsoft#14260 - microsoft#14261 - microsoft#14271 - microsoft#14272 - microsoft#14273 - microsoft#14274 - microsoft#14276 - microsoft#14280 - microsoft#14282 - microsoft#14299 - microsoft#14300 - microsoft#14335 - microsoft#14337 - microsoft#14338 - microsoft#14339 - microsoft#14357 - microsoft#14358 - microsoft#14361 - microsoft#14365 - microsoft#14366 - microsoft#14367 - microsoft#14368 - microsoft#14369 ### Contribution Checklist - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: rogerbarreto <19890735+rogerbarreto@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3c2550f-f129-4660-9461-af1288241064
Bumps azure/cli from 2.2.0 to 3.0.0.
Release notes
Sourced from azure/cli's releases.
Commits
9eb25b8Release v3.0.0 (#199)c1ad804Add changes (#198)41fca1bUpdated to use node24 (#197)cbea6ecchange the assignee (#191)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)