From b2b99e78b4629dfd4e7010dea872f47910fa443b Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Fri, 17 Jul 2026 11:00:10 +0200 Subject: [PATCH] fix(ci): tolerate leading '?' in SAS token secrets First real run of build-agent.yml failed the counter CAS write with "AuthenticationFailed ... sp is mandatory": the AZURE_BLOB_AGENT_SAS_TOKEN secret stores the query with its leading '?', and the workflow prepends another one, so Azure saw '?sp' as the first parameter name. The pre-existing upload step had the same latent bug -- it had just never run. Normalize with TrimStart('?') at all three usage sites (counter, blob upload, table merge). Co-Authored-By: Claude Fable 5 --- .github/workflows/build-agent.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-agent.yml b/.github/workflows/build-agent.yml index ce54ac3c..7da91c2f 100644 --- a/.github/workflows/build-agent.yml +++ b/.github/workflows/build-agent.yml @@ -73,7 +73,8 @@ jobs: run: | $counterBlob = "buildcounter-v$env:LINE_MAJOR.txt" $counterUrl = "https://autopilotmonitor.blob.core.windows.net/agent/$counterBlob" - $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}" + # Tolerate both secret formats ("sp=cw&..." and "?sp=cw&...") -- the URL below adds the '?'. + $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?') $override = "${{ inputs.build_number }}" function Get-Counter { @@ -263,7 +264,7 @@ jobs: shell: pwsh run: | $containerUrl = "https://autopilotmonitor.blob.core.windows.net/agent" - $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}" + $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?') function Send-Blob { param([string]$Local, [string]$BlobName, [string]$ContentType) @@ -299,7 +300,7 @@ jobs: # Update AdminConfiguration LatestAgentV2* -- ONLY on stable cutover. The hash-oracle # must never point at a build that is not actually in the stable namespace. - $tableSasToken = "${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}" + $tableSasToken = "${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}".TrimStart('?') if ('${{ inputs.publish_as_stable }}' -ne 'true') { Write-Host "SKIPPED: AdminConfiguration update (versioned-only run -- stable namespace unchanged)" } elseif ([string]::IsNullOrEmpty($tableSasToken) -or $tableSasToken -eq "XXX") {