Skip to content

Stop ViteApps (build only containers) from getting Azure managed identities and roles#14474

Merged
eerhardt merged 2 commits intodotnet:release/13.2from
eerhardt:FixViteAppManagedIdentity
Feb 12, 2026
Merged

Stop ViteApps (build only containers) from getting Azure managed identities and roles#14474
eerhardt merged 2 commits intodotnet:release/13.2from
eerhardt:FixViteAppManagedIdentity

Conversation

@eerhardt
Copy link
Member

These resources don't get deployed, so they should be filtered from getting role assignments and managed identities added for them.

…tities and roles

These resources don't get deployed, so they should be filtered from getting role assignments and managed identities added for them.
@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 14474

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 14474"

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Filters publish-time managed identity / role-assignment derivation so build-only container resources (e.g., ViteApps that are not deployed) don’t receive Azure identities or role assignments.

Changes:

  • Update AzureResourcePreparer to derive role assignments only for compute resources (excluding build-only containers) plus explicitly-declared user-assigned identities.
  • Add a regression test ensuring a ViteApp does not get a managed identity during publish preparation.
  • Reference Aspire.Hosting.JavaScript from the Azure test project to enable ViteApp usage in tests.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File Description
tests/Aspire.Hosting.Azure.Tests/AzureResourcePreparerTests.cs Adds coverage to ensure ViteApps (build-only containers) don’t get managed identities/role assignments.
tests/Aspire.Hosting.Azure.Tests/Aspire.Hosting.Azure.Tests.csproj Adds JavaScript hosting project reference needed for AddViteApp in tests.
src/Aspire.Hosting.Azure/AzureResourcePreparer.cs Switches role-assignment derivation to use GetComputeResources() (excludes build-only containers) and includes identity resources.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@eerhardt eerhardt enabled auto-merge (squash) February 12, 2026 23:20
@eerhardt eerhardt merged commit 715a77f into dotnet:release/13.2 Feb 12, 2026
674 of 677 checks passed
@eerhardt eerhardt deleted the FixViteAppManagedIdentity branch February 12, 2026 23:22
@dotnet-policy-service dotnet-policy-service bot added this to the 13.2 milestone Feb 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants