Skip to content

[ContainerRegistry] Fix -ExposeToken only print token as secure string without login in Connect-AzContainerRegistry #29007

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
VeryEarly wants to merge 1 commit into
base: main
Choose a base branch
from
+15 −2
Draft

[ContainerRegistry] Fix -ExposeToken only print token as secure string without login in Connect-AzContainerRegistry #29007

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/ContainerRegistry/ContainerRegistry/ChangeLog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
- Additional information about change #1
-->
## Upcoming Release
* Fixed `-ExposeToken` with `Connect-AzContainerRegistry`
Copy link

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The ChangeLog entry needs to be more descriptive and user-facing. It should explain what the issue was and how it affects users, not just state that something was fixed. Additionally, it should reference the related GitHub issue if one exists. For example: "Fixed -ExposeToken parameter in Connect-AzContainerRegistry to properly return the access token without performing docker login" or similar.

Copilot generated this review using guidance from repository custom instructions.
* Updated Azure.Core from 1.47.3 to 1.50.0

## Version 5.0.0
Expand Down
4 changes: 2 additions & 2 deletions src/ContainerRegistry/ContainerRegistry/Commands/ConnectAzureContainerRegistry.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
// limitations under the License.
// ----------------------------------------------------------------------------------

using Microsoft.WindowsAzure.Commands.Common;
using Microsoft.WindowsAzure.Commands.Utilities.Common;
using Newtonsoft.Json;
using System;
Expand Down Expand Up @@ -67,9 +68,8 @@ public override void ExecuteCmdlet() {
WriteWarning("You can perform manual login using the provided access token, for example: 'docker login <loginServer> -u 00000000-0000-0000-0000-000000000000 -p <accessToken>'");
var cred = new
{
status = this.ExecuteScript<object>(LoginScript),
loginServer = Name + ".azurecr.io",
accessToken = this.RegistryDataPlaneClient.Authenticate()
accessToken = this.Password.ConvertToSecureString()
};
Comment on lines 69 to 73
Copy link

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The removal of the status field from the returned credential object is a breaking change. The previous implementation included a status field that contained the result of the docker login script execution. Removing this field without documentation could break existing scripts that depend on this return value. Consider whether this field should be retained for backward compatibility, or if this is an intentional breaking change, it should be clearly documented in the ChangeLog with the breaking change format.

Copilot uses AI. Check for mistakes.
WriteObject(cred);
} else
Expand Down
10 changes: 10 additions & 0 deletions src/ContainerRegistry/ContainerRegistry/help/Connect-AzContainerRegistry.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,16 @@ Connect-AzContainerRegistry -Name $RegistryName -UserName $ServicePrincipal -Pas

Login to ACR with service principal application ID and password.

### Example 4
```powershell
$cred = Connect-AzContainerRegistry -Name $RegistryName -ExposeToken
$token = ($cred.accessToken | ConvertFrom-SecureString -AsPlainText)
$loginServer = $cred.loginServer
docker login $loginServer -u 00000000-0000-0000-0000-000000000000 --password $token
```

Login to ACR with native containerize tool.

## PARAMETERS

### -DefaultProfile
Expand Down
2 changes: 2 additions & 0 deletions tools/StaticAnalysis/Exceptions/Az.ContainerRegistry/ExampleIssues.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
"Module","Cmdlet","Example","Line","RuleName","ProblemId","Severity","Description","Extent","Remediation"
"Az.ContainerRegistry","Connect-AzContainerRegistry","4","4","Capitalization_Conventions_Violated","5101","1","docker doesn't follow the Capitalization Conventions.","docker login $loginServer -u 00000000-0000-0000-0000-000000000000 --password $token","Check the Capitalization Conventions. Suggest format: docker.exe"