adding automatic authorization of pipelines to environments

Author: EMaher

src/templates/shared/identity-setup-azure-devops-core.md

@@ -397,6 +397,40 @@ done
 rm -f env-body.json
 ```
 
-**Note:** Environment approvals and checks must be configured via the Azure DevOps UI.
+Authorize each environment for all pipelines (prevents first-run permission prompts):
+
+**PowerShell:**
+```powershell
+$ADO_RESOURCE = "499b84ac-1321-427f-aa17-267ca6975798"
+$TOKEN = az account get-access-token --resource $ADO_RESOURCE --query accessToken -o tsv
+
+foreach ($env in $ENVIRONMENTS) {
+    $envId = az devops invoke --area environments --resource environments --route-parameters project=$AZDO_PROJECT --query-parameters "api-version=7.1" --query "value[?name=='$env'].id | [0]" -o tsv
+    if ($envId) {
+        $url = "$AZDO_ORG/$AZDO_PROJECT/_apis/pipelines/pipelinePermissions/environment/$envId?api-version=7.1-preview.1"
+        $body = '{"allPipelines":{"authorized":true}}'
+        Invoke-RestMethod -Method Patch -Uri $url -Headers @{ Authorization = "Bearer $TOKEN" } -ContentType "application/json" -Body $body | Out-Null
+    }
+}
+```
+
+**Git Bash:**
+```bash
+ADO_RESOURCE="499b84ac-1321-427f-aa17-267ca6975798"
+TOKEN=$(az account get-access-token --resource "$ADO_RESOURCE" --query accessToken -o tsv)
+
+for env in "${ENVIRONMENTS[@]}"; do
+    env_id=$(az devops invoke --area environments --resource environments --route-parameters project="$AZDO_PROJECT" --query-parameters "api-version=7.1" --query "value[?name=='$env'].id | [0]" -o tsv)
+    if [[ -n "$env_id" ]]; then
+        curl -sS -X PATCH \
+          -H "Authorization: Bearer $TOKEN" \
+          -H "Content-Type: application/json" \
+          "$AZDO_ORG/$AZDO_PROJECT/_apis/pipelines/pipelinePermissions/environment/$env_id?api-version=7.1-preview.1" \
+          -d '{"allPipelines":{"authorized":true}}' >/dev/null
+    fi
+done
+```
+
+**Note:** Environment approvals and checks still must be configured via the Azure DevOps UI.
 
 ---

tests/unit/services/identity-guide-service.test.ts

@@ -143,8 +143,7 @@ describe('identity-guide-service', () => {
 
     it('should render all template placeholders', () => {
       const guide = identityGuideService.generateAzureDevOpsGuide(['dev']);
-      expect(guide).not.toContain('{{');
-      expect(guide).not.toContain('}}');
+      expect(guide).not.toMatch(/\{\{[^}]+\}\}/);
     });
 
   });

tests/unit/templates/copilot/identity-setup-prompt.test.ts

@@ -150,8 +150,7 @@ describe('copilot/identity-setup-prompt', () => {
 
     it('should render all template placeholders', () => {
       const prompt = generateIdentitySetupPrompt({ environments: ['dev', 'prod'] });
-      expect(prompt).not.toContain('{{');
-      expect(prompt).not.toContain('}}');
+      expect(prompt).not.toMatch(/\{\{[^}]+\}\}/);
     });
 
     it('should generate Azure DevOps instructions when ciProvider is azure-devops', () => {
@@ -219,6 +218,15 @@ describe('copilot/identity-setup-prompt', () => {
       expect(prompt).toContain('for env in "${ENVIRONMENTS[@]}"; do');
     });
 
+    it('should authorize environments for pipeline access in ADO prompt', () => {
+      const prompt = generateIdentitySetupPrompt({
+        environments: ['dev', 'prod'],
+        ciProvider: 'azure-devops',
+      });
+      expect(prompt).toContain('pipelinePermissions/environment');
+      expect(prompt).toContain('"allPipelines":{"authorized":true}');
+    });
+
     it('should render environment arrays for PowerShell and Git Bash in ADO prompt', () => {
       const prompt = generateIdentitySetupPrompt({
         environments: ['dev', 'prod'],
@@ -233,8 +241,7 @@ describe('copilot/identity-setup-prompt', () => {
         environments: ['dev', 'prod'],
         ciProvider: 'azure-devops',
       });
-      expect(prompt).not.toContain('{{');
-      expect(prompt).not.toContain('}}');
+      expect(prompt).not.toMatch(/\{\{[^}]+\}\}/);
     });
   });
 });