Azure CLI not installed error

[sib-elirud]

Trying to use this action on a self-hosted windows runner, following the example code, we're seeing the Azure CLI is not installed error. Running it on GitHub´s own windows-latest runner we don't see any issues, so it seems like something wrong with the configuration of our runner. The Azure Login action can log in just fine using OIDC, and a simple inline script step can find the Azure CLI. Running Invoke-ArtifactSigning manually on the runner, it also works. We're only seeing this when we're running it through this action, and on our own self-hosted runner.

It's installed to its default directory, and looking at AzureCliCredential that's where it will look by default. And considering the module works manually, I'm guessing we're missing something that GitHub does when running it.

Stack trace.

Submitting digest for signing...
Unhandled managed exception
Azure.Identity.CredentialUnavailableException: DefaultAzureCredential failed to retrieve a token from the included credentials. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/defaultazurecredential/troubleshoot
- EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot
- AzureCliCredential authentication failed: Azure CLI not installed
 ---> System.AggregateException: Multiple exceptions were encountered while attempting to authenticate. (EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot) (AzureCliCredential authentication failed: Azure CLI not installed)
 ---> Azure.Identity.CredentialUnavailableException: EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot
   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)
   at Azure.Identity.EnvironmentCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.EnvironmentCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] sources, TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) Azure.Identity.CredentialUnavailableException: AzureCliCredential authentication failed: Azure CLI not installed
 ---> Azure.Identity.CredentialUnavailableException: Azure CLI not installed
   at Azure.Identity.AzureCliCredential.RequestCliAccessTokenAsync(Boolean async, TokenRequestContext context, CancellationToken cancellationToken)
   at Azure.Identity.AzureCliCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)
   at Azure.Identity.AzureCliCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.AzureCliCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] sources, TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken)<---

   --- End of inner exception stack trace ---
   at Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] sources, TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken)
   at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)
   at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.DefaultAzureCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.SetResultOnTcsFromCredentialAsync(TokenRequestContext context, TaskCompletionSource`1 targetTcs, Boolean async, CancellationToken cancellationToken)
   at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.GetAuthHeaderValueAsync(HttpMessage message, TokenRequestContext context, Boolean async)
   at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.TokenRequestState.GetCurrentHeaderValue(Boolean async, Boolean checkForCompletion, CancellationToken cancellationToken)
   at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.GetAuthHeaderValueAsync(HttpMessage message, TokenRequestContext context, Boolean async)
   at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AuthenticateAndAuthorizeRequestAsync(HttpMessage message, TokenRequestContext context)
   at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.RedirectPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.CodeSigning.CertificateProfileRestClient.SignAsync(String codeSigningAccountName, String certificateProfileName, SignRequest body, String xCorrelationId, String clientVersion, CancellationToken cancellationToken)
   at Azure.CodeSigning.CertificateProfileClient.StartSignAsync(String codeSigningAccountName, String certificateProfileName, SignRequest body, String xCorrelationId, String clientVersion, CancellationToken cancellationToken)
   at Azure.CodeSigning.Dlib.Core.DigestSigner.SignAsync(UInt32 algorithm, Byte[] digest, SafeFileHandle safeFileHandle, CancellationToken cancellationToken)
   at Azure.CodeSigning.Dlib.Core.DigestSigner.Sign(UInt32 algorithm, Byte[] digest, SafeFileHandle safeFileHandle)
   at AuthenticodeDigestSignExWithFileHandleManaged(_CRYPTOAPI_BLOB* pMetadataBlob, UInt32 digestAlgId, Byte* pbToBeSignedDigest, UInt32 cbToBeSignedDigest, Void* hFile, _CRYPTOAPI_BLOB* pSignedDigest, _CERT_CONTEXT** ppSignerCert, Void* hCertChainStore)

SignTool Error: An unexpected internal error has occurred.
Error information: "Error: SignerSign() failed."

[Jaxelr]

Hi, please file an issue, since I think it's more appropriate for this.

[Jaxelr]

Actually, on second thought, I dont think this is an issue of the action? We simply leverage the credentials used on the login process. Could you please confirm if the az login is being properly installed and logging in on the self-hosted runner?

[sib-elirud]

Ye, felt like a discussion is more appropriate since it seems like the action doesn't have any problems, considering it runs just fine on windows-latest. The issue lies somewhere on our side with our runners configuration. The Azure/login@v3 manages to log in using OIDC, which seems to indicate that it can find az here.

Attempting Azure CLI login by using OIDC...
Subscription is set successfully.
Azure CLI login succeeds by using OIDC.

[Jaxelr]

Did you tried using enable-AzPSSession: true ?

[yudin-s]

Building on Jaxelr's enable-AzPSSession: true suggestion: if that still fails, I would verify the credential path from the exact same process that runs Invoke-ArtifactSigning.

The stack trace says DefaultAzureCredential tried only two useful options here:

• EnvironmentCredential was incomplete.
• AzureCliCredential could not find az.

So azure/login succeeding in an earlier step is necessary, but it does not prove that the PowerShell/.NET process used by Invoke-ArtifactSigning sees the same PATH and Azure CLI install.

Add a diagnostic step immediately before the signing step on the self-hosted runner:

Write-Host "Process PATH: $env:PATH"
Get-Command az -All | Format-List Source,Version
az account show
az account get-access-token --resource https://codesigning.azure.net/ --output json | Out-String | Write-Host
Write-Host "PSVersion: $($PSVersionTable.PSVersion)"
Write-Host "64-bit process: $([Environment]::Is64BitProcess)"

If Get-Command az fails there, add the Azure CLI directory to the job PATH, not just to the machine/user PATH. For example, after confirming the real install path:

"C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

If az account get-access-token works in that same step but Invoke-ArtifactSigning still says Azure CLI not installed, then the signing process is likely running under a different shell/bitness/environment than the diagnostic step. At that point the most useful comparison is Get-Command az -All and $env:PATH from both the working inline step and the failing signing step.

Also, if Azure CLI was installed after the self-hosted runner service was started, restart the runner service. Windows services often keep the old environment until restart.

[sib-elirud]

Okay, enable-AzPSSession: true started me down the correct path atleast, after getting some access denied problems. In the end it was as suspected, a poorly configured runner on our end, but seems it was nothing out of the ordinary really. Nuked everything and started from scratch, only difference was not trying to run the service as a specific user, but keeping it as the default NetworkService. The problems defenitely stemmed from my different overlapping fixes back and forth becoming a mess in the end. Thanks to both of you for your time though!