feat: ADR GA

.azure-devops/integration_tests.yml

@@ -137,7 +137,6 @@ stages:
           testADR: ${{ parameters.testADR }}
           maxParallelADT: 2
           maxParallelDPS: 2
-          maxParallelHub: 2
           maxParallelADU: 4
           maxParallelADR: 2
       - job: "evaluateCmdTable"

.azure-devops/merge.yml

@@ -123,8 +123,8 @@ jobs:
       vmImage: ${{ parameters.linuxImage }}
 
     steps:
-      - template: templates/install-azure-cli-released.yml
       - template: templates/setup-python.yml
+      - template: templates/install-azure-cli-released.yml
       - template: templates/download-install-local-azure-iot-cli-extension-with-pip.yml
 
       - script: "pylint azext_iot/ --rcfile=.pylintrc"

.azure-devops/templates/build-publish-azure-cli-test-sdk.yml

@@ -9,7 +9,9 @@ steps:
     displayName: "Install Azure CLI test SDK"
     workingDirectory: "../azure-cli/src/azure-cli-testsdk/"
 
-  - script: "python -m build"
+  - script: |
+      python -c "import shutil; shutil.rmtree('build', ignore_errors=True)"
+      python -m build
     displayName: "Build wheel for Azure CLI test SDK"
     workingDirectory: "../azure-cli/src/azure-cli-testsdk/"
 

.azure-devops/templates/install-azure-cli-released.yml

@@ -1,3 +1,3 @@
 steps:
-  - script: pip install azure-cli
+  - script: python -m pip install azure-cli
     displayName: "Install Azure CLI released"

.azure-devops/templates/run-tests-parallel.yml

@@ -24,6 +24,20 @@ parameters:
   - name: serviceConnection
     type: string
     default: ""
+  - name: hubSuite
+    type: string
+    # ADO allowed values cannot be empty; sentinel means no owned Hub suite.
+    default: "sentinel"
+    values: ["sentinel", "HubControl", "HubData"]
+  - name: hubSubscription
+    type: string
+    default: ""
+  - name: hubResourceGroup
+    type: string
+    default: cli-int-test-rg
+  - name: hubRegion
+    type: string
+    default: centraluseuap
   - name: num_threads
     type: number
     default: 6
@@ -49,7 +63,33 @@ steps:
       pythonVersion: ${{ parameters.pythonVersion }}
       azureCLIVersion: ${{ parameters.azureCLIVersion }}
 
-  - template: set-testenv-sentinel.yml
+  # Owned Hub phases must never inherit the legacy pinned-resource pytest.ini.
+  - ${{ if eq(parameters.hubSuite, 'sentinel') }}:
+      - template: set-testenv-sentinel.yml
+
+  - ${{ if ne(parameters.hubSuite, 'sentinel') }}:
+      - task: PythonScript@0
+        displayName: "Validate owned Hub scope and platform before Azure login"
+        inputs:
+          scriptSource: inline
+          script: |
+            import os
+            import runpy
+            import sys
+            from pathlib import Path
+            if sys.platform != "linux":
+                raise SystemExit("Hub live phases are unsupported on Windows; this job cannot qualify Hub coverage.")
+            scope = (os.environ["azext_iot_hub_subscription"], os.environ["azext_iot_testrg"],
+                     os.environ["azext_iot_testhub_location"])
+            if scope != ("a386d5ea-ea90-441a-8263-d816368c84a1", "cli-int-test-rg", "centraluseuap"):
+                raise SystemExit("Hub live phases require the authorized subscription, resource group and canary region.")
+            environment = runpy.run_path("azext_iot/tests/_hub_phase_runner.py")["environment"]
+            environment(dict(os.environ), "${{ parameters.hubSuite }}", "preflight",
+                        Path("test-result/hub-phases"), "preflight", scope[0], scope[1])
+        env:
+          azext_iot_hub_subscription: ${{ parameters.hubSubscription }}
+          azext_iot_testrg: ${{ parameters.hubResourceGroup }}
+          azext_iot_testhub_location: ${{ parameters.hubRegion }}
 
   # Fix for DNS resolution issues: https://github.com/actions/virtual-environments/issues/798
   - script: |
@@ -66,7 +106,17 @@ steps:
 
   - ${{ if eq(parameters.runIntTests, 'true') }}:
       - task: AzureCLI@2
-        continueOnError: true
+        ${{ if ne(parameters.hubSuite, 'sentinel') }}:
+          continueOnError: false
+          env:
+            azext_iot_hub_subscription: ${{ parameters.hubSubscription }}
+            azext_iot_testrg: ${{ parameters.hubResourceGroup }}
+            azext_iot_testhub_location: ${{ parameters.hubRegion }}
+        ${{ else }}:
+          continueOnError: true
+          # The product defaults to public ARM; these legacy suites target centraluseuap resources.
+          env:
+            AZURE_IOT_ADR_ARM_ENDPOINT: https://centraluseuap.management.azure.com
         displayName: "${{ parameters.name }} integration tests"
         inputs:
           azureSubscription: ${{ parameters.serviceConnection }}
@@ -81,32 +131,73 @@ steps:
             inlineScript: |
               export COVERAGE_FILE=.coverage.${{ parameters.name }}
               pytest -vv ${{ parameters.path }} -k "_int.py" --cov=azext_iot --cov-config .coveragerc --junitxml=junit/test-iotext-int.xml
-          ${{ if contains(parameters.path, 'azext_iot/tests/iothub') }}:
+          ${{ if ne(parameters.hubSuite, 'sentinel') }}:
             inlineScript: |
+              set -euo pipefail
               export COVERAGE_FILE=.coverage.${{ parameters.name }}
-              pytest -vv ${{ parameters.path }} -k "_int.py" --dist=loadfile -n ${{ parameters.num_threads }} --reruns ${{ parameters.num_reruns }} --reruns-delay ${{ parameters.reruns_delay }} --cov=azext_iot --cov-config .coveragerc --junitxml=junit/test-iotext-int.xml --deselect=azext_iot/tests/iothub/core/test_iothub_discovery_int.py::TestIoTHubDiscovery::test_iothub_targets --durations=0
+              subscription=$(az account show --query id -o tsv)
+              if [ "$subscription" != "$azext_iot_hub_subscription" ]; then
+                echo "Hub service connection subscription does not match the authorized scope." >&2
+                exit 2
+              fi
+              python -m azext_iot.tests._hub_phase_runner --suite "${{ parameters.hubSuite }}" \
+                --subscription "$azext_iot_hub_subscription" --resource-group "$azext_iot_testrg" \
+                --region "$azext_iot_testhub_location" --output test-result/hub-phases
           ${{ if contains(parameters.path, 'azext_iot/tests/dps') }}:
             inlineScript: |
               set -e
               export COVERAGE_FILE=.coverage.${{ parameters.name }}
-              pytest -vv ${{ parameters.path }} -k "_int.py" --ignore=azext_iot/tests/dps/core/test_dps_disable_local_auth_int.py --dist=loadfile -n ${{ parameters.num_threads }} --reruns ${{ parameters.num_reruns }} --reruns-delay ${{ parameters.reruns_delay }} --cov=azext_iot --cov-config .coveragerc --junitxml=junit/test-iotext-int.xml --durations=0
-              pytest -vv azext_iot/tests/dps/core/test_dps_disable_local_auth_int.py -n 0 --reruns ${{ parameters.num_reruns }} --reruns-delay ${{ parameters.reruns_delay }} --cov=azext_iot --cov-append --cov-config .coveragerc --junitxml=junit/test-iotext-dps-rbac-int.xml --durations=0
+              # This legacy service-connection/pinned-resource template also supports Windows
+              # and parallel matrix jobs; it does not supply the isolated controller's scope.
+              if [ -n "${azext_iot_dps_test_phase:-}${azext_iot_dps_phase_receipts:-}${azext_iot_dps_run_uid:-}${azext_iot_dps_test_subscription:-}${azext_iot_dps_test_resource_group:-}" ]; then
+                echo "Legacy Azure DevOps DPS coverage rejects isolated phase overrides; use the GitHub DPS controller with explicit scope." >&2
+                exit 2
+              fi
+              echo "DPS coverage: legacy partial regular only, not full qualification. Owned management, normal registration, CSR issuance, service-SAS and local-auth-toggle coverage require the GitHub DPS controller."
+              pytest -vv ${{ parameters.path }} -k "_int.py and not test_register_and_issue_certificate_contract and not test_register_without_csr_deadline_contract and not test_dps_management_happy_paths" --ignore=azext_iot/tests/dps/core/test_dps_disable_local_auth_int.py --dist=loadfile -n ${{ parameters.num_threads }} --reruns ${{ parameters.num_reruns }} --reruns-delay ${{ parameters.reruns_delay }} --cov=azext_iot --cov-config .coveragerc --junitxml=junit/test-iotext-int.xml --durations=0
           ${{ if contains(parameters.path, 'azext_iot/tests/adr') }}:
             inlineScript: |
               export COVERAGE_FILE=.coverage.${{ parameters.name }}
               pytest -vv ${{ parameters.path }} -k "_int.py" --dist=loadfile -n ${{ parameters.num_threads }} --reruns ${{ parameters.num_reruns }} --reruns-delay ${{ parameters.reruns_delay }} --cov=azext_iot --cov-config .coveragerc --junitxml=junit/test-iotext-int.xml --durations=0
+  - ${{ if ne(parameters.hubSuite, 'sentinel') }}:
+      - task: PublishBuildArtifacts@1
+        condition: succeededOrFailed()
+        displayName: "Publish Hub phase evidence and redacted logs"
+        inputs:
+          pathToPublish: test-result/
+          publishLocation: "Container"
+          artifactName: "hub-phases-${{ parameters.hubSuite }}-py${{ parameters.pythonVersion }}-$(Agent.OS)"
+
+      - task: PublishBuildArtifacts@1
+        condition: succeededOrFailed()
+        inputs:
+          pathToPublish: .coverage.${{ parameters.name }}
+          publishLocation: "Container"
+          artifactName: "coverage"
 
-  - task: PublishBuildArtifacts@1
-    inputs:
-      pathToPublish: .coverage.${{ parameters.name }}
-      publishLocation: "Container"
-      artifactName: "coverage"
+      - task: PublishTestResults@2
+        condition: succeededOrFailed()
+        displayName: "Publish sanitized Hub phase results"
+        inputs:
+          testResultsFormat: "JUnit"
+          testResultsFiles: "test-result/hub-phases/**/junit.xml"
+          testRunTitle: "${{ parameters.hubSuite }} Python ${{ parameters.pythonVersion }}"
+          failTaskOnFailedTests: true
+          failTaskOnMissingResultsFile: true
+          searchFolder: "$(System.DefaultWorkingDirectory)"
 
-  - task: PublishTestResults@2
-    condition: succeededOrFailed()
-    displayName: "Publish Test Results"
-    inputs:
-      testResultsFormat: "JUnit"
-      testResultsFiles: "**/test-*.xml"
-      testRunTitle: "Publish ${{ parameters.name }} test results for Python ${{ parameters.pythonVersion }} on OS $(Agent.OS)"
-      searchFolder: "$(System.DefaultWorkingDirectory)"
+  - ${{ if eq(parameters.hubSuite, 'sentinel') }}:
+      - task: PublishBuildArtifacts@1
+        inputs:
+          pathToPublish: .coverage.${{ parameters.name }}
+          publishLocation: "Container"
+          artifactName: "coverage"
+
+      - task: PublishTestResults@2
+        condition: succeededOrFailed()
+        displayName: "Publish Test Results"
+        inputs:
+          testResultsFormat: "JUnit"
+          testResultsFiles: "**/test-*.xml"
+          testRunTitle: "Publish ${{ parameters.name }} test results for Python ${{ parameters.pythonVersion }} on OS $(Agent.OS)"
+          searchFolder: "$(System.DefaultWorkingDirectory)"

.azure-devops/templates/setup-dev-test-env.yml

@@ -15,6 +15,12 @@ steps:
     parameters:
       pythonVersion: ${{ parameters.pythonVersion }}
 
+  - bash: |
+      source scripts/select-openssl.sh
+      echo "##vso[task.prependpath]$openssl_bin"
+    displayName: Select OpenSSL 3 for CSR signing
+    condition: and(succeeded(), eq(variables['Agent.OS'], 'Darwin'))
+
   - ${{ if eq(parameters.azureCLIVersion, 'min') }}:
       - template: install-azure-cli-min.yml
   - ${{ elseif eq(parameters.azureCLIVersion, 'released') }}:

.azure-devops/templates/trigger-tests.yml

@@ -33,9 +33,15 @@ parameters:
   - name: "maxParallelDPS"
     type: number
     default: 1
-  - name: "maxParallelHub"
-    type: number
-    default: 1
+  - name: hubSubscription
+    type: string
+    default: a386d5ea-ea90-441a-8263-d816368c84a1
+  - name: hubResourceGroup
+    type: string
+    default: cli-int-test-rg
+  - name: hubRegion
+    type: string
+    default: centraluseuap
   - name: "maxParallelADU"
     type: number
     default: 1
@@ -95,35 +101,42 @@ jobs:
           pythonVersion: $(python)
           serviceConnection: $(AzureServiceConnection)
 
-  - job: "testHub_job_1"
-    timeoutInMinutes: 120
-    displayName: "Test IoT Hub - certificate, config, core, jobs, state"
-    condition: and(succeeded(), eq('${{ parameters.testHub }}', true))
+  - job: "HubControl"
+    timeoutInMinutes: 140
+    displayName: "HubControl - owned control-plane"
+    dependsOn: [testCentral, testADT, testDPS, testADU, testADR]
+    condition: and(not(canceled()), eq('${{ parameters.testHub }}', true))
     strategy:
       matrix: $[ variables['pythonVersions'] ]
-      maxParallel: ${{ parameters.maxParallelHub }}
+      maxParallel: 1
     steps:
       - template: run-tests-parallel.yml
         parameters:
-          path: "azext_iot/tests/iothub/configurations azext_iot/tests/iothub/core azext_iot/tests/iothub/jobs azext_iot/tests/iothub/state"
-          name: "iot-hub-1"
-          num_threads: 7
+          hubSuite: HubControl
+          hubSubscription: ${{ parameters.hubSubscription }}
+          hubResourceGroup: ${{ parameters.hubResourceGroup }}
+          hubRegion: ${{ parameters.hubRegion }}
+          name: "HubControl"
           azureCLIVersion: ${{ parameters.azureCLIVersion }}
           pythonVersion: $(python)
           serviceConnection: $(AzureServiceConnection)
 
-  - job: "testHub_job_2"
+  - job: "HubData"
     timeoutInMinutes: 120
-    condition: and(succeeded(), eq('${{ parameters.testHub }}', true))
-    displayName: "Test IoT Hub - devices, message endpoints, messaging, and modules"
+    dependsOn: HubControl
+    condition: and(not(canceled()), eq('${{ parameters.testHub }}', true))
+    displayName: "HubData - owned Entra and SAS phases"
     strategy:
       matrix: $[ variables['pythonVersions'] ]
-      maxParallel: ${{ parameters.maxParallelHub }}
+      maxParallel: 1
     steps:
       - template: run-tests-parallel.yml
         parameters:
-          path: "azext_iot/tests/iothub/devices azext_iot/tests/iothub/messaging azext_iot/tests/iothub/modules azext_iot/tests/iothub/message_endpoint"
-          name: "iot-hub-2"
+          hubSuite: HubData
+          hubSubscription: ${{ parameters.hubSubscription }}
+          hubResourceGroup: ${{ parameters.hubResourceGroup }}
+          hubRegion: ${{ parameters.hubRegion }}
+          name: "HubData"
           azureCLIVersion: ${{ parameters.azureCLIVersion }}
           pythonVersion: $(python)
           serviceConnection: $(AzureServiceConnection)

.github/skills/generate-typespec-sdk/SKILL.md

@@ -34,7 +34,7 @@ Known control-plane mappings:
 | Service | Source directory | Entrypoint | Namespace | Client | Destination |
 | --- | --- | --- | --- | --- | --- |
 | IoT Hub | `specification/iothub/resource-manager/Microsoft.Devices/IoTHub` | `client.tsp` | `azext_iot.sdk.iothub.mgmt` | `IotHubClient` | `azext_iot/sdk/iothub/mgmt` |
-| DPS | `specification/deviceprovisioningservices/resource-manager/Microsoft.Devices/ProvisioningService` | `client.tsp` | `azext_iot.sdk.dps.mgmt` | `IotDpsClient` | `azext_iot/sdk/dps/mgmt` |
+| DPS | `specification/deviceprovisioningservices/resource-manager/Microsoft.Devices/DeviceProvisioningServices` | `client.tsp` | `azext_iot.sdk.dps.mgmt` | `IotDpsClient` | `azext_iot/sdk/dps/mgmt` |
 
 Do not guess data-plane mappings. Ask for explicit source directory, entrypoint, namespace, client, and destination.
 
@@ -168,6 +168,7 @@ Before touching the extension repository, assert:
 - the expected namespace directory exists;
 - the expected client class is exported by the package;
 - no `models/` directory exists;
+- `types.py` containing `TypedDict` and `Literal` annotations is allowed in modeless output;
 - no `aio/` directory exists;
 - operation methods use synchronous definitions;
 - generated Python files compile;
@@ -191,6 +192,7 @@ Compare the generated directory with the existing destination before replacement
 - operation method additions, removals, and signature changes;
 - default API-version and endpoint/base-URL changes;
 - generated package version changes;
+- runtime dependency minimums from generated `pyproject.toml` compared with extension `setup.py`;
 - imports and extension call sites that may become incompatible.
 
 Pay particular attention to:
@@ -203,6 +205,8 @@ Pay particular attention to:
 
 This report does not block replacement when generation checks pass, but compatibility warnings must be prominent.
 Do not edit call sites automatically.
+Report dependency increases for the separate compatibility task as well; copying only the namespace
+does not remove the generated SDK's runtime requirements.
 
 ## 7. Replace automatically with rollback
 

.github/workflows/azdev_linter.yml

@@ -17,17 +17,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # checkout source (for linter_exclusions)
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       # download built wheel (from ./release_build.yml)
       - name: Download Wheel
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: azure-iot-cli-ext
           path: ./extension
 
       # Install python
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         name: Setup python
         with:
           python-version: "3.13"

.github/workflows/ci_build.yml

@@ -8,17 +8,17 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Setup python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
       - name: Build Wheel
         run: |
           pip install -r dev_requirements
           python -m build
       - name: Upload Wheel Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           path: dist/*.whl
           name: azure-iot-cli-ext

.github/workflows/ci_workflow.yml

@@ -8,6 +8,13 @@ concurrency:
 on:
   pull_request:
   push:
+    branches:
+      - dev
+      - preview
+      - 1.1.0-preview
+      - "release/**"
+    tags:
+      - "**"
   workflow_dispatch:
 jobs:
   build:
@@ -17,3 +24,6 @@ jobs:
   linter:
     needs: [build]
     uses: ./.github/workflows/azdev_linter.yml
+  index-compatibility:
+    needs: [build]
+    uses: ./.github/workflows/index_compatibility.yml