chore: Dev to Main

[PadhiAjit-Microsoft]

Purpose

• This pull request updates how Azure credentials are selected and used in both application code and tests, with a particular focus on differentiating behavior based on the APP_ENV environment variable. The main change is to ensure that in production, the code prefers user-assigned or system-assigned managed identities, and only falls back to AsyncDefaultAzureCredential in development. Additionally, the way credentials are retrieved in async functions has been adjusted, and tests have been updated to reflect the new logic.

Azure credential selection logic:

• src/ContentProcessor/src/libs/utils/azure_credential_utils.py: Changed get_async_azure_credential() to check APP_ENV; in production, it now uses user-assigned or system-assigned managed identity, and only falls back to AsyncDefaultAzureCredential in other environments. Improved logging to clarify credential selection.

Async credential retrieval:

• src/ContentProcessor/src/libs/utils/azure_credential_utils.py and src/ContentProcessor/src/libs/utils/credential_util.py: Updated get_async_bearer_token_provider() to call get_async_azure_credential() synchronously instead of awaiting it, reflecting that the credential function is no longer async. [1] [2]

Test updates:

• src/tests/ContentProcessor/utils/test_azure_credential_utils.py: Updated tests to set APP_ENV to "dev" to match the new credential selection logic.
• src/tests/ContentProcessor/utils/test_azure_credential_utils_extended.py: Set APP_ENV to "dev" in relevant tests and updated mocks to match the new (non-async) credential retrieval. [1] [2]

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
libs/utils
azure_credential_utils.py	105	6	94%	196–198, 202–203, 206
TOTAL	1225	167	86%

Tests	Skipped	Failures	Errors	Time
244	0 💤	0 ❌	0 🔥	3.702s ⏱️

[Copilot]

Pull request overview

This pull request updates Azure credential selection for the ContentProcessor utilities, aiming to differentiate production vs. development behavior using APP_ENV, and aligns async token-provider creation and tests with the updated (non-async) credential factory.

Changes:

• Updated async bearer token provider helpers to call get_async_azure_credential() synchronously (no await).
• Modified get_async_azure_credential() to prefer managed identity when APP_ENV=prod, and fall back to AsyncDefaultAzureCredential otherwise, with updated logging.
• Updated unit tests to set APP_ENV=dev and to patch the (now non-async) credential factory appropriately.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/ContentProcessor/src/libs/utils/azure_credential_utils.py	Adjusts async credential selection logic based on APP_ENV and updates fallback/logging behavior.
src/ContentProcessor/src/libs/utils/credential_util.py	Removes await when retrieving the async credential factory for token-provider creation.
src/tests/ContentProcessor/utils/test_azure_credential_utils.py	Updates environment setup to set APP_ENV=dev to match new fallback behavior.
src/tests/ContentProcessor/utils/test_azure_credential_utils_extended.py	Updates environment setup and mocking to match the non-async credential factory behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

src/tests/ContentProcessor/utils/test_azure_credential_utils_extended.py:112

• This test tries to clear all Azure-environment indicator variables to force the local-dev credential path, but it misses CONTAINER_REGISTRY_LOGIN (which is part of azure_env_indicators in the production code). If that env var is set in CI, the test can become flaky by taking the managed-identity branch instead.

        for key in ["WEBSITE_SITE_NAME", "AZURE_CLIENT_ID", "MSI_ENDPOINT",
                    "IDENTITY_ENDPOINT", "KUBERNETES_SERVICE_HOST"]:
            monkeypatch.delenv(key, raising=False)
        monkeypatch.setenv("APP_ENV", "dev")

src/ContentProcessor/src/libs/utils/azure_credential_utils.py:198

• APP_ENV is checked only after returning the first CLI credential (lines 188–192), so APP_ENV=prod can still return AsyncAzureCliCredential/AsyncAzureDeveloperCliCredential. Also, the current if app_env == "prod" means values like staging/test fall back to AsyncDefaultAzureCredential, which contradicts the stated intent of using managed identity outside development (and differs from the API-side logic that treats only dev specially).

    app_env = os.getenv("APP_ENV", "prod").lower()
    if app_env == "prod":
        client_id = os.getenv("AZURE_CLIENT_ID")
        if client_id:
            logging.info(