* Add warning-only skill Eval coverage checks
Add deterministic changed-skill coverage checks and trusted PR comments with dashboard links. Preserve blocking Vally lint and cover discovery, fork safety, stale updates, and unknown-scope behavior. Related to #16345.
* Isolate coverage test output and report build details
* Fix coverage lint selection and multi-turn validation
* Use Node 24 throughout skill coverage workflows
* Use workflow dependency locks for readable skill check action versions
Onboard only the two skill coverage workflows to the official generated Actions lockfile while preserving the current checkout/setup-node commits and repository identities. Add scoped read-only frozen verification, regression contracts and maintenance documentation. Keep Node 24, independent blocking lint, trusted reporting, centralized links and all repository policies unchanged.
* Announce November 9 skill Eval coverage enforcement checkpoint
Add a prominent grace-period notice to missing-coverage comments and summaries, allowing authors to proceed only when other required checks pass. Keep coverage warning-only; do not add automatic date-based enforcement. Extend existing renderer, reporter and CLI regressions and document follow-up issue #17402.
* Discover skill-local Eval presence and address workflow review feedback
Remove pipeline discovery requirements from the presence checker and configuration. Preserve warning-only behavior, current lint scope, immutable GitHub reads, and the November 9 enforcement notice. Restore direct action SHA pins, use frozen standalone pnpm installs, separate script tests, and sparse-checkout the trusted reporter. Remove obsolete shared glob and lockfile tooling. Document semantic coverage as a separate advisory follow-up.
* Use Eval dashboard short link
* Keep skill Eval coverage tests portable across synced repositories
Move Tools workflow assertions to eng/common-tests, run the full shared suite in an isolated consumer, and remove README links to unsynced files. Preserve read-only test workflow permissions and frozen dependency installs.
---------
Co-authored-by: helen229 <gaoh@microsoft.com>
Fix auto-release eligibility for shared CI triggers
Require original PR file changes under each package directory before marking artifacts releasable or updating release plans. Preserve validation detection and cover shared triggers, deleted and renamed paths, and path boundaries.
Co-authored-by: Ray Chen <raychen@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Refresh Fabric REST API specifications and item definitions
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Prepare for Fabric MCP Server 1.7.0 release
Compile and curate synchronized Fabric release notes, preserving version 1.7.0 and consuming five pending fragments. Attribute resource refresh to #4078 and omit internal-only file I/O infrastructure.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Include shipped Fabric namespace concurrency fix in release notes
Attribute the user-visible namespace cache fix to #4057. Remote registry-only changes do not affect the shipped Fabric empty registry.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Keep merged resource refresh fragment consumed
Remove the fragment reintroduced by the squash-ancestry merge; its attributed release note is already present in both 1.7.0 changelogs.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Handle registry.json tool listing time-to-live and paging
* Few updates for paging and cache time handling
* Fix failing test
* Retain name filtering update
* Fix failing test
* Add opt-in source data for Search knowledge base retrieval
Preserve service defaults when the option is omitted, map all supported knowledge source kinds, and cover binding and SDK requests with focused tests.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Clean up bits of text
* Improve Search knowledge source lookup performance
Resolve knowledge sources concurrently and cache source-type metadata using the existing cache service.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* PR feedback
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: alzimmermsft <48699787+alzimmermsft@users.noreply.github.com>
* Add Azure IoT Hub routing endpoint health and diagnostics tools
Provide a current endpoint-health snapshot and historical routing evidence, including downstream resource existence and per-metric availability without inferring overall hub health.
Use a dedicated routing service with cloud-aware ARM validation, SDK-default retries, bounded operations, and cancellation handling. Include command documentation, registration, unit tests, recorded tests, and routing test infrastructure.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Tighten IoT Hub routing metric fallback and ARM link validation
Only retry batched target metrics individually when Azure Monitor rejects
the batch with 400, the incompatible-metric case. Throttling and server
errors now fail the batch after SDK retries instead of fanning out into
per-metric requests that consume the operation budget.
Validate each ARM request URI, including nextLink continuations, before
resolving the tenant or credential so untrusted destinations fail before
any authentication work.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Use IAzureService endpoint validation for IoT Hub routing ARM requests
#3884 removed the static EndpointValidator overload that took an executing tool namespace, so the routing service no longer compiles against main (CS1739). Validate ARM request and nextLink URIs through IAzureService.ValidateAzureServiceEndpoint, as IoTHubDeviceService now does. Tests use AzureServiceTestHelpers so endpoint validation stays real and shared ARM clients route through the test handler.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Resolve IoT Hub routing targets only from the endpoint URI
Key-based endpoints have no endpointUri, and IoT Hub endpoint ids are opaque GUIDs rather than ARM resource IDs. The mapper fell back to the entity path or container name as the namespace or account name, so diagnostics checked a resource that does not exist and reported an existing target as notFound. Derive the target name only from the endpoint URI host so these endpoints report an unresolved target, and use opaque ids in the mapper fixture to match service responses.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Document unresolved IoT Hub routing targets for key-based endpoints
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Configure IoT Hub live test routing and devices in the post script
The live pipeline failed in test-resources-post.ps1 because the azure-iot CLI extension it used cannot be installed on network-isolated agents. Seed the test devices through the IoT Hub registry REST API with Microsoft Entra ID instead, and grant the test principal IoT Hub Data Contributor.
Also add the identity-based Service Bus routing endpoints in the post script rather than the template. IoT Hub validates those endpoints when they are created and rejects them (IH400117) until the routing identity's Service Bus Data Sender assignment takes effect. ARM cannot wait for that, so the post script retries until it does.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Validate IoT Hub resource names before building ARM resource IDs
Hub and resource group names were interpolated into ARM resource IDs. ResourceIdentifier accepts traversal segments, and URI normalization then sent the request elsewhere: rg1/../rg2 and rg1\..\rg2 read the hub from resource group rg2, and .. escaped to the subscription scope.
Reject names outside the Azure naming rules before any credential or network work. The check runs in the shared routing service path used by both routing commands, and in IoTHubService.GetIoTHub, which serves hub get and, through the hostname resolver, the device and query tools. Resource group names follow the documented rule: 1-90 letters or digits (Char.IsLetterOrDigit), underscores, hyphens, periods, or parentheses, not ending with a period. Routing targets built from the hub's endpoint configuration are reported as unresolved unless every name is a single path segment.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Adds logic to fix JSON with control characters.
* - Update README.
* Add support for secrets.
* Add script for updating.
* Update README.md
* Update to publish metadata during release build.
* Add variables for ingestion
* Update README.
* Update exporter tool into a job file.
* Only create paths/directories when successful
* Accept whiteline characters within JSON string.
* Add query support for multiple servers.
* Update binary search to include file extension
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Add support for Template.Mcp.Server as IsDryRun
* Update comments.
* Do not fail the release stage.
* Throw when more than one server or runtime is found.
* Remove overlapping.
* Make child directory if it does not exist.
* Add Kusto to networkpolicy isolation
* Make binary executable on linux.
* Add Kusto to common.yml
* Code review comments
* Adding fetchdepth: 1
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* [AzureBackup] Apply --storage-type when creating RSV vaults
RsvBackupOperations.CreateVaultAsync accepted storageType but never used it, so Recovery Services vaults were always created with the default GeoRedundant storage. After the vault PUT completes, apply the requested redundancy through the backupstorageconfig/vaultstorageconfig API (same path used by 'vault update --redundancy'). Invalid values are rejected before any ARM call, and storage-config failures report that the vault was created plus the 'vault update --redundancy' remediation.
Fixesmicrosoft/mcp#3981
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* [AzureBackup] Preserve RSV storage redundancy partial-failure guidance
Throw a dedicated VaultStorageRedundancyException (a RequestFailedException that keeps status and error code) when redundancy cannot be applied after an RSV vault is created. VaultCreateCommand surfaces its message ahead of the generic 409/403 mappings, so a storage-config conflict no longer reads as an existing-vault conflict. The retry command now includes --subscription and, when supplied, --tenant so it targets the vault just created.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Allow Azure Resource Graph Kusto endpoints in Kusto cluster URI validation
Add .arg.core.windows.net to KustoClient's domain suffix allow-list so the Kusto
tools can query Azure Resource Graph Kusto endpoints. The Kusto SDKs' well-known
endpoints already trust this suffix, and KustoClient already keeps the endpoint
path and requests the Kusto scope these endpoints use.
Fixes#4028
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: df5f4d96-6fea-431c-bc49-01af1461746b
* Make the KustoClient request test endpoint-agnostic
Rename the test and use neutral database and query arguments so it doesn't suggest
that Azure Resource Graph endpoints get special handling. Any cluster URI that
passes the allow-list works; this one includes a path to show it's preserved.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: df5f4d96-6fea-431c-bc49-01af1461746b
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: df5f4d96-6fea-431c-bc49-01af1461746b
* Add telemetry tags to Advisor tools
Emit subscription, service group, recommendation type ID, category and
sub-category values on the ToolExecuted activity from each Advisor command.
McpRuntime only captures a top-level `subscription` argument, so namespace
server mode (where arguments are nested in `parameters`) loses it today.
Null or blank values are skipped.
* Add impact, group-by and prioritized telemetry tags to Advisor tools
Tag `advisor/Impact` on recommendation list, summary and metadata list,
`advisor/Prioritized` on recommendation list and summary, and
`advisor/GroupBy` on recommendation summary. Null or blank values are skipped.
* Restrict Advisor telemetry tag values to known formats
Tag the subscription only when it is a GUID, the recommendation type ID only
when it is a GUID, and category, impact and group-by only when they match the
existing allow-lists, using their canonical casing. Sub-category is trimmed,
matching the existing filter normalization. Values that do not match are not
tagged.
* Hash the service group name in Advisor telemetry
Record a SHA-256 hash of the trimmed, lowercased service group name instead of
the raw name, following the Deploy project name pattern.
* Record the raw service group name in Advisor telemetry
Revert the SHA-256 hashing of `advisor/ServiceGroup`. The raw name is
recorded and will be classified in the GDPR inventory.
* Add azurebackup operation get tool
Adds the azurebackup operation get command to read asynchronous RSV backup operation status at vault scope or protected-item scope. Returns timestamps, sanitized errors, and actual job IDs when present, without treating operation IDs as job IDs. Includes unit tests, a recorded integration test, docs, changelog, and consolidated-tools registration.
* Map OperationCanceledException to 504 in operation get command
Override GetStatusCode so all cancellations (including TaskCanceledException) return GatewayTimeout, matching the canceled GetErrorMessage instead of falling through to 500. Adds unit coverage for both exception types.
* Wait for operation-get live update LRO to complete before final assertions
The re-submitted protected-item update now awaits WaitForCompletionResponseAsync so the final-state checks observe the settled write and no operation lingers into later tests or cleanup. Re-recorded (assets tag 59d31d946a).
* Address operation get review feedback and refresh recording
* Add package name and package version to logs.
* Pass dummy hash when no hash is provided.
* Revert "Pass dummy hash when no hash is provided."
This reverts commit 3449133ed429c799db553ea5e2a96a69aa7cc5ed.
---------
Co-authored-by: Travis Prescott <trpresco@microsoft.com>
azure-sdk-automation[bot]andazure-sdk
Amos HerschandCopilot App
Alan ZimmerandCopilot Autofix powered by AI
Amishi-PanwarandCopilot
msalamanandCopilot App
Vinay GeraandCopilot
Christian Stump
Chidozie Ononiwu
vineetkalkiandCopilot
ghcp4a-bot[bot]andgithub-actions[bot]
Copilotandmitsha-microsoft
Connie YauandCopilot Autofix powered by AI
Shraddha JainandCopilot
Karan SinghandCopilot
Alok Desai
KarishmaGhiya
Steven Vukelich
