[Network] Fix #27579: az network dns zone export: Fix export of empty TXT record sets - #34088
Aditya Pujara (a0x1ab) wants to merge 18 commits into
Conversation
…f empty TXT record sets AI-generated by X Engineering Agent via Azure AI Foundry. Foundry-Job: 5acb833b4854a53d4787b397556ad96a6e6708ffb41eabf63a5392f72a400c69
x-engineering-agent
Bot
added
the
Request X Engineering Agent
microsoft-github-policy-service
Bot
added
Network
|
Network |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
There was a problem hiding this comment.
🟢 Approval recommended
The reviewed changes are fully covered and no blocking issues were identified.
Pull request overview
Fixes az network dns zone export for empty TXT record sets and preserves them during import.
Changes:
- Emits
TXT ""for empty TXT record sets. - Preserves empty TXT values during parsing.
- Adds export, import, and round-trip regression tests.
File summaries
| File | Changes |
|---|---|
src/azure-cli/azure/cli/command_modules/network/zone_file/parse_zone_file.py |
Preserves empty TXT fragments. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py |
Adds TXT export/import regression coverage. |
src/azure-cli/azure/cli/command_modules/network/custom.py |
Emits empty TXT values during export. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Live test results —
|
![x-engineering-agent[bot]](https://avatars.githubusercontent.com/in/4205534?s=60&v=4){kind=small}
There was a problem hiding this comment.
Reviewed e50e67811bc39eeab2e24be93e618cf6d62472ea from the managed a0x1ab/azure-cli fork and agent-assist/azure-azure-cli-issue-27579-5acb833b4854 branch. The live-test gate failed; this is not an all-green validation.
The bounded release-artifact, test-strength, scope-consistency, and domain-edge-case questions produced no additional confirmed semantic defect. The empty-TXT export branch supplies the missing txt field, and the TXT-specific parser change preserves quoted empty strings without changing NAPTR handling. The six added deterministic tests assert output, request mappings, round trips, empty/missing/null collections, multi-value and 255-character boundaries, and malformed-record exception propagation.
Upstream CI
All 53 completed upstream checks passed and matched current head e50e67811bc39eeab2e24be93e618cf6d62472ea in the completed one-shot gate. They do not override the separate live-test failure.
Test validation
- Live test: Failed with conclusion
failure. Workflow run - Regression coverage: Present for
network: 1 focused test file(s) changed.
Task-level evidence: Job azdev test --live (PR 34088), step 12, Run azdev test (live, series) — changed test files only, ran src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py::DnsZoneImportTest::test_dns_zone10_import. Its log reports 1 failed, 1 passed, 1 skipped in 45.81s and stopping after 1 failures. Step 12 captures the test exit status; step 18, Set workflow conclusion, then reports azdev tests failed (exit 1). and fails the workflow.
The failing operation is the second import after deleting the zone, reaching the SOA lookup. The diagnostic is azure.core.exceptions.ResourceNotFoundError: (ParentResourceNotFound) and Failed to perform 'read' on resource(s) of type 'dnszones/SOA'; the response is 404 Not Found. The first import reports 7/7 RECORDS IMPORTED SUCCESSFULLY.
Relevance: not PR-related to the TXT change. The path-based failure helper marks the test relevant because its file changed, but the actual src/azure-cli/azure/cli/command_modules/network/tests/latest/zone_files/zone10.txt and captured export contain only SOA, NS, DS, and TLSA records: neither new TXT branch applies. The failing delete/re-create/SOA-read path is unchanged. The logs establish the missing-parent failure, not its underlying service/lifecycle cause; they do not prove a DNS propagation race or a regression introduced by this PR.
Coverage details: src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py adds DnsZoneExportTest; the coverage helper reports no changed-file coverage gap. No recording changes are required merely for these mocked deterministic tests. The existing scenario recording src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_dns_zone10_import.yaml is unchanged. This live run stopped after the third of 38 collected items and provides no execution evidence for the new empty-TXT unit class or the remaining scenarios.
Required follow-up and focused verification: Investigate the existing DnsZoneImportTest._test_zone delete/re-create lifecycle and the zone-create/SOA-read responses before changing behavior. Reproduce the failure independently of TXT changes; fix only a confirmed lifecycle/readiness cause, without masking the 404, skipping the scenario, or changing unrelated TXT handling on speculation. If the scenario changes, refresh its recording after a successful authorized live run. Verify the six DnsZoneExportTest unit tests, then have the authorized tester rerun DnsZoneImportTest::test_dns_zone10_import live and the focused test_dns_commands.py selection. No test or rerun was started during this review. The agent-review iteration state is 0/3, so this feedback is eligible for one durable Foundry follow-up rather than an exhausted-cap handoff.
Risk assessment
45/100 · Medium · High confidence
The Medium rating is driven by security-sensitive behavior, public CLI behavior.
- Change scope: 3 changed files, 309 changed lines (
+309/-0), including 2 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
x-engineering-agent
Bot
added
the
X Engineering Agent Reviewed
|
🔔 Routing this PR to @Azure/act-quality-productivity-squad. |
|
@Azure/x-engineering-agent The remediation execution for the current agent review was canceled by the agent deployment before model work began. Retry the existing live-test remediation against the unchanged current head without expanding its scope. |
|
Automated processing requires maintainer follow-up for this request. |
Live test results —
|
There was a problem hiding this comment.
Live validation requires follow-up
Upstream CI passed, but live validation failed. This is not an all-green result; the observed failure does not exercise the changed TXT behavior.
Summary
- Reviewed head:
8190326d657a44c9973386c61b0594bdfebf16ec. - Upstream CI: 50/50 completed checks passed, with no pending or failed checks in the supplied snapshot.
- Remaining failure groups by relevance to this diff: 0 PR-related, 1 not PR-related, 0 uncertain. These counts classify relevance, not whether the underlying service/lifecycle cause is fully established.
- Static inspection found no evidence-confirmed semantic defect in the empty-TXT changes. The existing non-TXT scenario and its lifecycle helpers are unchanged from base
10f0350504f3911fd0955b1111093673efc136cb.
Test validation
-
Live test: Failed with conclusion
failure. Workflow run -
Regression coverage: Present for
network: 1 focused test file(s) changed. -
Executed coverage is incomplete: the task collected 38 tests, then stopped after one failure: 1 failed, 2 passed, 1 skipped. None of the six new
DnsZoneExportTestmethods ran in this live attempt. The failed wrapper conclusion is not an additional test failure. -
Recording attention: no recording file changed. The new tests mock service commands and exercise serialization, import arguments, empty/null/missing TXT collections, multiple values, round-trips and malformed input; they do not establish a live service round-trip. Because public TXT output/import behavior changes, the Network owner should review recording risk and require a focused re-recording plus playback if service integration evidence is needed.
-
Single failing live task — Not PR-related to the TXT diff: Run azdev test, step 12, followed by exit-code propagation, step 19. The failure is
DnsZoneImportTest::test_dns_zone11_import. Its unchangedzone_files/zone11.txtfixture contains SOA, NS and NAPTR, no TXT.- Smallest relevant task-log excerpts (capability diagnostic and terminal exception are distinct):
<<<UNTRUSTED:live-test-task-log>>>
(BadRequest) The feature NAPTR is not available.
Code: ParentResourceNotFound
Failed to perform 'read' on resource(s) of type 'dnszones/SOA'
1 failed, 2 passed, 1 skipped in 75.69s (0:01:15)
<<<END:live-test-task-log>>>
- Capability evidence: initial import logs the NAPTR service rejection, imports 5/7 records and exports SOA/NS. The existing importer catches that record-creation error; NAPTR unavailability is not the terminal exception.
- Terminal traceback: the unchanged import/export/delete/reimport helper, line 61 fails during its second import at
import_zone's SOA read, line 2832, because the parent zone cannot be found. - The additions only affect empty TXT export and TXT-token preservation; neither applies to this fixture or its SOA/NS export. The NAPTR rejection is a service-capability issue, not a TXT defect. The fatal missing-parent cause remains unproven: these logs do not distinguish service consistency from pre-existing lifecycle behavior, or establish that NAPTR caused the 404.
Bounded next action and focused verification
- Keep the empty-TXT scope intact. Do not add a speculative NAPTR/lifecycle fix, disable the existing scenario, weaken assertions, or change unrelated modules to make this run green.
- Foundry follow-up: verify the new deterministic export regression class separately and assess only evidence-backed remediation relevant to this PR. If the remaining failure is environmental or pre-existing, leave product source unchanged and return the precise blocker rather than inventing a source fix.
- In the configured repository test environment, run
python -m pytest src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py::DnsZoneExportTest -qseparately so fail-fast in the earlier scenario cannot hide its result. - Network/live-test owners: confirm NAPTR availability in the validation environment, reproduce
DnsZoneImportTest::test_dns_zone11_importat the base and reviewed head, and capture delete/create/SOA-read diagnostics if the parent-resource 404 persists. Escalate the capability/lifecycle evidence to the service or test-infrastructure owner as appropriate; do not assume an unawaited deletion. - After that prerequisite is resolved, the authorized test owner should rerun the existing changed-file validation (
azdev test test_dns_commands --live --series --discover). Verify the focused export class and the named import scenario; if recordings are updated, verify their playback without--livebefore publication. This review did not dispatch or rerun tests.
Automated follow-up
The agent_review cycle is below its cap (1/3 before this request). This COMMENT requests one bounded durable Foundry follow-up, not approval or a new live-test dispatch. It does not repeat the already-handled human-feedback request.
Risk assessment
45/100 · Medium · High confidence
The Medium rating is driven by security-sensitive behavior, public CLI behavior.
- Change scope: 3 changed files, 309 changed lines (
+309/-0), including 2 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
|
Automated processing requires maintainer follow-up for this request. |
There was a problem hiding this comment.
Focused review: unrelated DNS validation failure
Nonblocking review: no source change is requested for the observed failure. Live validation remains incomplete.
Summary
- Reviewed head:
8190326d657a44c9973386c61b0594bdfebf16ec. - Failed test cases: 0 PR-related, 1 not PR-related, 0 uncertain, in one workflow group.
- Upstream CI: 50/50 passed in the supplied snapshot; the separate live-test workflow failed.
- All seven repository review skills were considered; no deterministic or confirmed changed-line semantic finding was identified.
Test validation
- Live test: Failed with conclusion
failure. Workflow run - Regression coverage: Present for
network: 1 focused test file(s) changed. - Out-of-scope live-test failures:
src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py::DnsZoneImportTest::test_dns_zone11_import— Not PR-related: this existing SOA/NS/NAPTR-only scenario hit unavailable NAPTR and then a missing SOA parent during delete/reimport. Neither changed TXT-only branch is exercised by its fixture or captured export.- Task evidence: Run azdev test (live, series), step 12, log timestamp 16:36:57 UTC. The final “Set workflow conclusion” step propagates this same failure, not a second failure.
<<<UNTRUSTED:live-test-task-log>>> (BadRequest) The feature NAPTR is not available. Code: ParentResourceNotFound 1 failed, 2 passed, 1 skipped in 75.69s (0:01:15) <<<END_UNTRUSTED:live-test-task-log>>> - Attribution:
zone11.txt:1–8contains only SOA, NS and NAPTR; the captured export contains only SOA/NS. The traceback reaches the existing delete/reimport sequence,test_dns_commands.py:53–61, thencustom.py:2832, where the SOA read returns HTTP 404.import_zoneis unchanged from the PR base. The production additions are restricted to empty TXT export,custom.py:2672–2673, and TXT-only empty-token preservation,parse_zone_file.py:311–313. The logs do not establish the underlying cause of the missing parent; they do establish that these TXT changes are not on the failed path.
- Task evidence: Run azdev test (live, series), step 12, log timestamp 16:36:57 UTC. The final “Set workflow conclusion” step propagates this same failure, not a second failure.
- Execution gap: 38 tests were collected, but fail-fast stopped after four results (1 failed, 2 passed, 1 skipped), leaving 34 unexecuted. The six new
DnsZoneExportTestmethods were not reached. Playback verification and recording publication were skipped; this run is not evidence that the new tests passed. - Exact added tests: in
src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py::DnsZoneExportTest:test_export_empty_txt_collections,test_export_valid_txt_values,test_parse_empty_txt_fragments_and_naptr_regexp,test_export_mixed_records_and_import_supported_types,test_export_import_and_reexport_txt, andtest_export_malformed_nonempty_txt_is_not_masked. They cover console/file output, missing/null/empty collections, valid/multiple/chunked values, mixed/alias records, mocked import arguments, re-export and malformed-value exceptions. - Output/request/recording risk: empty TXT sets now export as
IN TXT ""; the parser preserves empty TXT values rather than converting them to the NAPTREMPTYmarker, affecting the TXT values sent on re-import. No transport, API-version or response-schema change is present. No recordings changed. The new tests mock service calls, so they do not verify live service acceptance. The failing scenario's existing cassette issrc/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_dns_zone11_import.yaml; it is unchanged and has no verified replacement from this run. Do not rewrite that cassette or change NAPTR/SOA code to hide this unrelated failure.
Focused validation and escalation
- In a prepared Azure CLI development environment, run
python -m unittest azure.cli.command_modules.network.tests.latest.test_dns_commands.DnsZoneExportTestindependently so the existing scenario cannot mask these regressions. - The live-test runner/Network DNS owners should rerun the existing workflow with NAPTR available, or run the focused TXT tests separately. If the SOA parent lookup still fails after zone recreation, escalate this job's diagnostics to those owners as a separate service/lifecycle investigation; do not broaden this PR.
- After restoring the live-test prerequisite, validate
azdev test test_dns_commands --live --series, thenazdev test test_dns_commands --seriesfor playback. This review has not dispatched a rerun or executed local tests.
Risk assessment
45/100 · Medium · High confidence
The Medium rating is driven by security-sensitive behavior, public CLI behavior.
- Change scope: 3 changed files, 309 changed lines (
+309/-0), including 2 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
Live test results —
|
Aditya Pujara (a0x1ab)
left a comment
Aditya Pujara (a0x1ab)
left a comment
There was a problem hiding this comment.
DNS TXT export review
Reviewed head a647bdfee61d2765c9b30aa06c40f782b6a1f526. No deterministic policy violations or confirmed semantic findings in the current changes.
Reviewed scope
Paths are under src/azure-cli/azure/cli/command_modules/network/:
custom.py:2708-2709: absent, null and empty TXT collections export asTXT "".zone_file/parse_zone_file.py:311-313: empty TXT fragments remain empty instead of becoming NAPTR'sEMPTYsentinel.tests/latest/test_dns_commands.py::DnsZoneExportTest: meaningful exact-output and command-argument assertions cover console/file output, TTL/names, multiple and long TXT values, literalEMPTY, NAPTR separation, aliases, malformed-record errors and import/re-export mappings.
Upstream CI
The supplied head-bound snapshot reports 50/50 checks passed. No outstanding human change request was found at posting. No tests were executed locally for this review.
Test validation
- Live test: Passed. Workflow run
- Regression coverage: Present for
network: 1 focused test file(s) changed. - Recording attention: No recordings changed. Export's service-list request is unchanged, but TXT zone-file output and subsequent empty-TXT import payloads change (
value: [""], not["EMPTY"]). The added unit tests mock service boundaries; they do not establish recording completeness. Network owners should check theDnsZoneImportTestimport/export scenarios and refresh affected fixtures if the changed empty-TXT payload appears there.
Risk assessment
45/100 · Medium · High confidence
The Medium rating is driven by security-sensitive behavior, public CLI behavior.
- Change scope: 3 changed files, 309 changed lines (
+309/-0), including 2 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
There was a problem hiding this comment.
Review
No actionable findings at a647bdfee61d2765c9b30aa06c40f782b6a1f526. Empty TXT record sets now export as TXT "", and TXT parsing preserves empty strings without changing NAPTR empty-field handling. The focused regression cases assert console/file output, import/re-export mappings, mixed record types and aliases, and propagation of malformed nonempty-record errors.
Upstream CI
The current-head snapshot has 50 completed passing checks, with no failed, pending, or canceled validation checks.
Test validation
- Live test: Passed. Workflow run
- Regression coverage: Present for
network: 1 focused test file(s) changed.
Risk assessment
45/100 · Medium · High confidence
The Medium rating is driven by security-sensitive behavior, public CLI behavior.
- Change scope: 3 changed files, 309 changed lines (
+309/-0), including 2 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
x-engineering-agent
Bot
added
the
Request X Engineering Agent
|
🔔 Routing this PR to @Azure/act-quality-productivity-squad. |
Aditya Pujara (a0x1ab)
added
X Engineering Agent Reviewed
|
🔔 Routing this PR to @Azure/act-quality-productivity-squad. |
Live test results —
|
There was a problem hiding this comment.
Review
No blocking findings in the changed code at 178ee4f93ed804b966343e8291458a7dd60bc7fe.
network/custom.py:2708-2709 supplies an empty TXT payload for missing, null or empty record collections, so zone export emits TXT "" rather than failing. network/zone_file/parse_zone_file.py:311-313 preserves empty TXT strings without applying NAPTR's EMPTY sentinel. The existing non-TXT and alias export paths are unchanged; the title and History Notes describe the customer-visible fix.
The new DnsZoneExportTest cases in network/tests/latest/test_dns_commands.py assert console/file output, one-shot record iteration, zero TTL, empty and literal EMPTY values, multiple/long TXT values, mixed records and aliases, import/re-export request mappings, and propagation of malformed nonempty TXT data. This covers both serialization and the affected import boundary, not just an isolated mapping.
Upstream CI
All 50 reported checks completed successfully for the reviewed head; no failed, pending or canceled validation remains.
Test validation
- Live test: Passed. Workflow run
- Regression coverage: Present for
network: 1 focused test file(s) changed.
Risk assessment
45/100 · Medium · High confidence
The Medium rating is driven by security-sensitive behavior, public CLI behavior.
- Change scope: 3 changed files, 309 changed lines (
+309/-0), including 2 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
|
Network |
Live test results —
|
There was a problem hiding this comment.
Non-blocking review
No source change is requested. No confirmed source defect was found; the supplied CI failures are unrelated infrastructure timeouts, not source-change blockers.
Source review
Reviewed all three changed files at 16faaed6d5a394696a70e96d2da632adac1897bc, including the bounded review targets and their export/parser/import context. No deterministic policy finding or evidence-confirmed semantic defect was found.
| Review skill | Result |
|---|---|
| Release artifact validator | The [Network] title and History Notes describe the empty-TXT export fix; no generated HISTORY.rst is edited. |
| Generated code ownership checker | Not applicable: changes are in handwritten network behavior and module tests, not generated output or shared test infrastructure. |
| Command and help convention checker | Not applicable: no command registration, parameter, help, or example changes. |
| Test semantic-strength reviewer | Six new unit tests contain concrete output, parser-result, command-argument, round-trip, and exception assertions; coverage details below. |
| No-silent-user-intent reviewer | No new accepted input is introduced. Existing resource-group, zone, TTL, TXT data, and optional file-output paths remain connected to their uses. |
| Scope-consistency reviewer | The export fix, companion empty-TXT parser preservation, and focused tests stay within network DNS scope; no API-version, endpoint, pipeline, or dependency changes. |
| Domain edge-case reviewer | Reviewed missing/null/empty collections, empty versus literal EMPTY, inherited/apex names, TTL zero, mixed/multiple TXT records, long values, and isolation from NAPTR empty-regexp handling. |
At src/azure-cli/azure/cli/command_modules/network/custom.py:2708-2709, the empty collection branch supplies the TXT field needed by the existing serializer. At src/azure-cli/azure/cli/command_modules/network/zone_file/parse_zone_file.py:311-313, TXT-specific empty-token preservation prevents the NAPTR EMPTY sentinel from becoming TXT data. The nonempty export mapping and non-TXT parser paths are unchanged.
Upstream CI
Snapshot: 50 completed checks; 47 passed, 1 failed aggregate build, 2 cancelled, and 0 pending. Failure groups: 0 PR-related, 1 Not PR-related (two timeout children), 0 uncertain. The cancelled children are not cancelled validation gates.
Azure.azure-cli
- Result: failure
- Failure details:
- Unit Test for Core Python312 (Not PR-related)
- Evidence: The job running on agent pool-ubuntu-2204 44 ran longer than the maximum time of 10 minutes. For more information, see https://go.microsoft.com/fwlink/?linkid=2077134
- Next action: Re-run the timed-out job. If it times out again at the same setup or checkout step, escalate to the pipeline owner instead of changing unrelated PR source.
- Verify: Re-run
Unit Test for Core Python312and confirm the job completes within its limit.
- Unit Test for Core Python314 (Not PR-related)
- Evidence: The job running on agent pool-ubuntu-2204 45 ran longer than the maximum time of 10 minutes. For more information, see https://go.microsoft.com/fwlink/?linkid=2077134
- Next action: Re-run the timed-out job. If it times out again at the same setup or checkout step, escalate to the pipeline owner instead of changing unrelated PR source.
- Verify: Re-run
Unit Test for Core Python314and confirm the job completes within its limit.
- Unit Test for Core Python312 (Not PR-related)
The changed scope is network DNS export/parser behavior and its tests, not CLI core tests or pipeline configuration. The quoted diagnostics report agent-job duration limits rather than a failing source assertion, supporting the Not PR-related classification. Re-run the two named jobs; if the same timeout recurs, escalate to the pipeline owner rather than modifying unrelated PR source.
Test validation
- Live test: Passed. Workflow run
- Regression coverage: Present for
network: 1 focused test file(s) changed. - Focused regression inspection:
src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py:934-1128covers missing/null/emptyTXTRecords, explicit empty strings, console/file parity, apex and TTL zero, ordinary/multiple/mixed/long TXT values, NAPTR isolation, supported non-TXT/alias records, import/re-export argument equality, and malformed nonempty input retaining its exception. The AAZ calls are mocked; these are deterministic unit assertions, not evidence of every service interaction. - Recording limitation — non-blocking human attention: No recording files changed.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_dns_zone1_import.yamlcontains nonempty TXT PUT/GET values;src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_dns_zone11_import.yamlcontains no TXT fields. These inspected recordings do not demonstrate the newly preserved empty-TXT import value. The new unit round-trip assertstxt_records=[{'value': ['']}]; the REST schema and API version are unchanged. The successful workflow does not by itself close this specific recorded-service evidence gap. - Focused recording follow-up: For recorded assurance of the empty/mixed TXT round-trip, the network owning squad can extend
src/azure-cli/azure/cli/command_modules/network/tests/latest/zone_files/zone1.txt, exerciseDnsZoneImportTest.test_dns_zone1_importinsrc/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py, and re-recordsrc/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_dns_zone1_import.yamlthrough the existing authorized focused live-test flow. Replay that scenario and verify emptyTXTRecords[].valuevalues in the PUT/GET and subsequent export, alongside the new unit tests' console/file assertions. This is an integration-evidence follow-up, not a confirmed source defect or a source-fix request.
Risk assessment
45/100 · Medium · High confidence
The Medium rating is driven by security-sensitive behavior, public CLI behavior.
- Change scope: 3 changed files, 309 changed lines (
+309/-0), including 2 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
Live test results —
|
There was a problem hiding this comment.
Review: automated validation passed
Reviewed b1d43a2426386be1abe52cadfd403b0fd29b0833. The supplied snapshot has 50/50 upstream CI checks passed and no blocking human reviews. The seven-skill review found no confirmed findings or deterministic regression-coverage gap.
Source tracing and DnsZoneExportTest in src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py cover missing/null/empty and multiple TXT values, console/file output, import/re-export mappings, literal EMPTY, long values, NAPTR isolation, and malformed-data propagation. No local tests were run.
Test validation
- Live test: Passed. Workflow run
- Regression coverage: Present for
network: 1 focused test file(s) changed.
Recording scope: No recordings changed. The added regressions exercise the real exporter/parser/writer with mocked Azure command boundaries. Owning-squad review should confirm DNS import/export recordings remain representative of corrected empty-TXT output and import payloads; this is not new service-side recording evidence.
Risk assessment
45/100 · Medium · High confidence
The Medium rating is driven by security-sensitive behavior, public CLI behavior.
- Change scope: 3 changed files, 309 changed lines (
+309/-0), including 2 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
Live test results —
|
There was a problem hiding this comment.
Review
No blocking findings in the changed code at 30f10848ec04ab6691bcf96e94ba0aced8614c19.
The empty-TXT fallback in network/custom.py:2692-2710 retains the record name and TTL and exports an empty quoted TXT value. The TXT-specific normalization in network/zone_file/parse_zone_file.py:311-315 preserves that empty value during import instead of turning it into the NAPTR EMPTY sentinel. Literal TXT EMPTY values and NAPTR empty-regexp handling remain distinct.
DnsZoneExportTest in network/tests/latest/test_dns_commands.py covers missing/null/empty collections, zero TTL, stdout/file output, multiple and long TXT values, empty fragments, NAPTR compatibility, mixed record types and aliases, exact import request arguments, export/import/re-export, and propagation of malformed nonempty-record errors. The title and History Notes describe the customer-visible fix; no generated history files were edited.
Upstream CI
50 checks passed for the reviewed head, with no failed or pending checks.
Test validation
- Live test: Passed. Workflow run
- Regression coverage: Present for
network: 1 focused test file(s) changed.
Risk assessment
45/100 · Medium · High confidence
The Medium rating is driven by security-sensitive behavior, public CLI behavior.
- Change scope: 3 changed files, 309 changed lines (
+309/-0), including 2 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
Live test results —
|
Live test results —
|
There was a problem hiding this comment.
Review
No actionable code or repository-policy findings were confirmed at head 08eda9020e0bd5f68fae3656d18166cc071c172e.
The empty-record fallback in network/custom.py:2708-2709 supplies the TXT field required by zone-file generation. In network/zone_file/parse_zone_file.py:311-314, matching the TXT record grammar preserves quoted empty values before serialization without changing NAPTR's existing EMPTY handling. The change remains within DNS zone export/import behavior; the title and History Notes describe the customer-visible fix, and no generated source or history artifact was edited.
Upstream CI
The current-head snapshot has 50 passed checks, zero failed checks, and zero pending checks.
Test validation
- Live test: Passed. Workflow run
- Regression coverage: Present for
network: 1 focused test file(s) changed.
Regression evidence and recording consideration
DnsZoneExportTest in src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py checks missing/null/empty TXT collections, console and file output, zero TTL, multiple and long TXT values, literal EMPTY, mixed record types and aliases, exact import arguments, export/import/re-export, NAPTR compatibility, and propagation of malformed nonempty data.
No recording files changed. The new round-trip assertions use production-shaped AAZ data with mocked service calls: they establish the local output and import mapping, not a newly recorded service-side round trip. The network owner should confirm the empty-TXT export/import scenario and its recording expectations before merge; this changes zone-file content and imported TXT values, not an API version or request schema.
Risk assessment
45/100 · Medium · High confidence
The Medium rating is driven by security-sensitive behavior, public CLI behavior.
- Change scope: 3 changed files, 309 changed lines (
+309/-0), including 2 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
🤖 PR Validation — ️✔️ All clear
Related command
az network dns zone exportDescription
Fixes #27579.
Correct DNS zone export so empty TXT record sets serialize without indexing a nonexistent value.
Expected behavior: exporting a zone containing an empty TXT record set must not crash, while retaining valid TXT data and the existing zone-file conventions. Both console output and optional file output should work.
Testing Guide
az network dns zone export --resource-group <resource-group> --name <dns-zone> --file-name zone.txt.src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py.History Notes
[Network]
az network dns zone export: Fix export of empty TXT record setsThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.