[Chandni Patel (patelchandni)]

🤖 PR Validation — ️✔️ All clear

Breaking Changes	Tests	Suppressions
️✔️ None	️✔️ 130/130	️✔️ None

Related command

az functionapp deployment source config-zip

Description

• custom.py:
  • Updated _get_host_url() to use the service-provided default_host_name instead of the first Standard hostname.
  • Added hostname validation before fetching the host key, without falling back to custom domains.
  • Updated check_flex_app_after_deployment() to disable redirects and treat all 3xx responses as terminal unhealthy results.
  • Simplified the retry loop while preserving the existing 15-attempt limit and IP-restriction handling.
• test_functionapp_commands_thru_mock.py:
  • Added coverage for hostname selection and validation, redirect handling, retries, and TLS verification.
  • Added loopback-only tests using fake keys to verify custom domains and redirect targets do not receive the key.
  • Updated the existing success test to expect allow_redirects=False.

Testing Guide

Deploy a ZIP package to an existing Flex Consumption function app:

az functionapp deployment source config-zip --resource-group <resource-group-name> --name <function-app-name> --src <zip-file-path>

The post-deployment health check should use the app's default hostname and should not follow redirects.

History Notes

[App Service] az functionapp deployment source config-zip: Use the default hostname and disable redirects for Flex Consumption post-deployment health checks

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[Copilot]

🟢 Approval recommended

Static review found no blocking issues in the focused implementation and regression coverage; tests were not executed.

No open issues 🎉

What changed in this PR

This PR hardens Flex Consumption post-deployment health checks for az functionapp deployment source config-zip by restricting where the function host key is sent.

Changes:

• Uses and validates the service-provided default hostname without falling back to custom domains.
• Disables redirects and treats 3xx responses as terminal unhealthy results, preserving the 15-attempt limit and IP-restriction handling.
• Adds regression coverage for hostname validation, redirects, retries, TLS settings, and key isolation using loopback servers.

File	Description
src/​azure-cli/​azure/​cli/​command_modules/​appservice/​tests/​latest/​test_functionapp_commands_thru_mock.py	Adds health-check regression tests and updates the redirect expectation.
src/​azure-cli/​azure/​cli/​command_modules/​appservice/​custom.py	Validates the default hostname and prevents health-check redirects.

_{Review effort: Balanced}

[Yong Zhang (yonzhan)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[x-engineering-agent]

Chandni Patel (@patelchandni)

	Check	Status	Detail
	Agent live tests		This is a review-only PR.
	Regression coverage		For appservice: 1 focused test file(s) changed.
	Risk		Low; owner review recommended

Review details

Semantic review

No source-correctness defect confirmed; issue-scenario regression coverage remains unverified.

Changed behavior

In src/azure-cli/azure/cli/command_modules/appservice/custom.py:835-838, Flex Consumption config-zip returns the health-check result after deployment. Lines 6647-6654 select and validate default_host_name rather than the first standard SSL hostname; invalid values fail before host-key retrieval. The validation accepts sovereign-cloud and regional DNS names without hard-coding a public-cloud suffix.

Lines 879-888 send the keyed HTTPS GET to /admin/host/status with redirects disabled. A 3xx response now terminates polling and raises the unhealthy-app error rather than following its Location. Only HTTP 200 reports success; other 2xx responses remain errors. Non-success responses retain the 15-attempt bound, and 403 Ip Forbidden retains its specific deployment-success/health-check-warning result. TLS verification settings and exception propagation are preserved. The customer-facing [App Service] title covers these changes; no generated HISTORY edits or unrelated production changes appear.

Author regression evidence

src/azure-cli/azure/cli/command_modules/appservice/tests/latest/test_functionapp_commands_thru_mock.py:78-239 adds meaningful assertions for exact URL/header/options mapping, invalid hostname rejection before key retrieval, all 3xx statuses, retry bounds, key/TLS failures, and non-200 success statuses. Its loopback test exercises real Requests redirect handling and verifies that the second origin receives no request. Existing IP-restriction coverage remains at lines 494-515.

These tests directly exercise the health-check helper, not an end-to-end Flex config-zip invocation. Existing deployment-flow tests at lines 245-289 explicitly select non-Flex behavior. Upstream CI reports 54/54 passed, but that does not establish the required Flex command scenario or a separate author live run.

Test validation

• Agent live test: Not run; this is a review-only PR. Check author-provided test evidence and upstream CI separately.
• Regression coverage: For appservice: 1 focused test file(s) changed. Scenario coverage is unverified; review the issue's required conditions, test setup, and assertions before approval. No linked issue was found in the PR timeline; inspect the source issue and its required scenario manually.

Maintainer verification

Rerun TestFlexAppHealthCheck and the existing TestFunctionappMocked.test_check_flex_app_after_deployment_* cases in the focused file above. Separately verify Flex Consumption config-zip with a custom hostname preceding the default hostname: confirm the command's HTTP-200 success output, terminal 3xx error without following redirects, nonredirect failure/retry behavior, and IP-restriction warning.

No recordings changed. The changed request destination and redirect handling create integration-recording risk, not a requirement to record deterministic unit tests. For scenario evidence in src/azure-cli/azure/cli/command_modules/appservice/tests/latest/test_functionapp_commands.py, update any affected fixtures under src/azure-cli/azure/cli/command_modules/appservice/tests/latest/recordings/ if using recorded coverage, then verify playback. Current evidence does not establish those end-to-end outcomes.

Risk assessment

16/100 · Low

The Low rating is driven by public CLI behavior.

• Change scope: 2 changed files, 191 changed lines (+178 / -13), including 1 production file.
• Affected components: appservice
• Risk drivers: public CLI behavior (+18)
• Regression evidence: Changed regression tests are included, reducing risk.
• Confidence: High because changed-line patches were available for every production file.
• Required review: Owning-squad review is recommended for appservice before merge.

---

Ask the Agent

Tick a box to queue an action. Requires write access to this repository.

• Re-review this PR
• Run Agent live tests on this PR

_{X Engineering Agent · Reviewer · React with +1 or -1 to train the agent}