Repository navigation
Python: [Breaking] Remove unsupported service auth mode from Copilot Studio agent - #14306
Conversation
Expand the inline justification so automated validation can recognize it. No runtime behavior changes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 25dd6e2a-f759-4148-a630-40110e90eff2
Keep the static analysis annotation on one line during automated formatting. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 25dd6e2a-f759-4148-a630-40110e90eff2
Keep the static analysis justification without an additional formatter directive. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 25dd6e2a-f759-4148-a630-40110e90eff2
There was a problem hiding this comment.
Pull request overview
This pull request updates a static-analysis suppression annotation in the Python Copilot Studio agent to provide clearer justification context, while preserving a single-line layout for formatting tools. It is intended as a comment/annotation-only change with no runtime behavior impact.
Changes:
- Expanded the inline justification text for the CodeQL suppression on the SHA-1 X.509
x5tthumbprint computation line. - Added a formatting directive to keep the annotation in a single line during automated formatting.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Python Test Coverage Report •
Python Unit Test Overview
|
|||||||||||||||||||||||||||||||||||
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: Findings reported
Scope: full PR (2 commit(s)): 857f871f5f4a, 06f669e96fbb
Model: claude-opus-4.8
Overview
This is a comment-only change to a single line: it expands the # CodeQL [SM02167]
suppression justification and appends # fmt: skip to the SHA-1 thumbprint call in
copilot_studio_agent.py. The runtime behavior is genuinely unchanged (the executable
expression is byte-identical to base) and the security posture is intact — the SHA-1 use
is a legitimate X.509 x5t thumbprint identifier with usedforsecurity=False, and the
[SM02167] scoping token still applies to exactly this one line. The # fmt: skip is
load-bearing: without it ruff format reflows the over-length line and detaches the CodeQL
annotation. The one residual issue is that expanding the comment pushed the line to 148
characters, newly violating the repo's configured 120-char limit (E501), which # fmt: skip
does not silence.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.
Affected areas: python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py
Split digest formatting from its calculation so the inline static analysis annotation remains within the configured line length. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 25dd6e2a-f759-4148-a630-40110e90eff2
The SERVICE auth mode was unreachable and its dormant credential handling triggered certificate-related static analysis alerts. The auth mode enum is kept with INTERACTIVE, the only supported mode. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 25dd6e2a-f759-4148-a630-40110e90eff2
SergeyMenshykh
changed the title
SergeyMenshykh
changed the title
github-project-automation
Bot
moved this from Sprint: In Review
to Sprint: Done
in Semantic Kernel
Motivation and Context
The Copilot Studio agent exposed a
SERVICEauthentication mode that was never reachable — it was guarded to always raise before its implementation ran. Its dormant credential handling also triggered certificate-related static analysis alerts.Description
Removes the service authentication path along with its settings, parameters, tests, and documentation.
CopilotStudioAgentAuthModeis kept with itsINTERACTIVEmember, which is the only supported mode. Interactive authentication is unchanged.Service authentication can be reintroduced later as a complete, tested feature.
Contribution Checklist