WIP: add Spring Boot extension

[Weidong Xu (weidongxu-microsoft)]

Summary

• Add azure.springboot and azd spring init for trusted, single-module Maven Spring Boot applications without an existing azure.yaml.
• Infer active Spring profiles, datasource engine, and authentication from application configuration. Supported databases are in-memory, MySQL password, PostgreSQL password, and PostgreSQL managed identity.
• Generate extension-owned azure.yaml, container build assets, Bicep, and database bootstrap hooks. Core azd is unchanged.
• Include extension tests and independent Petclinic generation scenarios for MySQL password and PostgreSQL managed identity.

Validation

• Extension tests, vet, build, initialization, and Bicep compilation passed.
• Both independent generation scenarios pass locally against the pinned extension commit.
• H2 and PostgreSQL password deployments passed live write/read and restart checks.
• The extension-generated PostgreSQL managed-identity flow passed live deployment, Entra-only authentication, exact SQL grant checks, write/read, restart persistence, fresh-session verification, and credential non-disclosure checks. Disposable Azure resources were removed.

Deferred scope

• MySQL managed identity, restrictive networking, Gradle, and multi-module projects.
• Live MySQL password deployment validation; generation is covered.
• Handling credentials already present in application-owned configuration or packaged resources remains under review.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Weidong Xu (weidongxu-microsoft)]

Inherited core behavior and current limitations

This extension reuses the published azd Go module v1.34.2; the links below pin that release's source.

1. MySQL live provisioning is blocked. Core pins MySQL AVM 0.6.1. Initialization/compilation pass, but the live attempt fails ARM validation: Microsoft.KeyVault/vaults/dummyVault/keys/dummyKey is not defined. This PR does not replace that module or work around the failure.

2. SQL generation adds Key Vault alongside ACA password secrets. Core already supplies the database password through an ACA secret, but also creates Key Vault to store an additional copy. The app reads the ACA secret-backed environment variable, not Key Vault. This is an inherited scaffold design choice: reusing the generator unchanged does not offer a vault-free MySQL/PostgreSQL configuration.

3. Managed-identity database authentication is not supported by this init flow. The generated SQL setup uses administrator credentials and password authentication, as shown in the PostgreSQL parameters. Managed-identity database authentication remains follow-up work. Detected passwordless intent is rejected, not silently downgraded.

4. Database network defaults allow all public IP addresses. The PostgreSQL firewall configuration uses an all-IP rule; MySQL has the same broad default. Restrictive firewall rules and private networking/DNS are separate follow-up work, independent of the database authentication method.

H2 and PostgreSQL passed full live write/read and restart checks; MySQL is not claimed as live-validated.

[Copilot]

🟡 Changes recommended

External credentials can be embedded in images, MySQL is knowingly undeployable, and configuration analysis has correctness gaps.

6 open findings

• External credentials remain recoverable in the final image · New
• Execution-level Maven repackage settings are ignored · New
• MySQL initialization enables a known-broken scaffold path · New
• Profile-specific external configuration is omitted from the runtime image · New
• CRLF separators break multi-document properties parsing · New
• Extension pipeline filters omit shared release files · New

What changed in this PR

Adds the azure.springboot extension to initialize single-module Maven Spring Boot applications for azd deployment.

Changes:

• Adds Spring configuration, profile, Maven, and datasource analysis.
• Generates azure.yaml, Bicep infrastructure, and container assets.
• Adds tests, documentation, and CI/release wiring.

File	Description
eng/​pipelines/​release-ext-azure-springboot.yml	Adds extension release pipeline.
cli/​azd/​extensions/​azure.springboot/​version.txt	Sets initial version.
cli/​azd/​extensions/​azure.springboot/​README.md	Documents usage, scope, and limitations.
cli/​azd/​extensions/​azure.springboot/​main.go	Adds extension entry point.
internal/​spring/​profiles.go	Parses Spring profile expressions.
internal/​spring/​profiles_test.go	Tests profile expressions.
internal/​spring/​model.go	Resolves and validates Maven metadata.
internal/​spring/​generation.go	Generates deployment files and infrastructure.
internal/​spring/​generation_test.go	Tests generation and safe writes.
internal/​spring/​configuration.go	Resolves Spring configuration precedence.
internal/​spring/​analysis.go	Infers application and datasource requirements.
internal/​spring/​analysis_test.go	Tests application analysis.
internal/​cmd/​version.go	Adds version command.
internal/​cmd/​root.go	Defines command tree.
internal/​cmd/​metadata.go	Adds extension metadata command.
internal/​cmd/​init.go	Implements spring init.
internal/​cmd/​init_test.go	Tests initialization preflight.
go.sum	Records dependency checksums.
go.mod	Defines the extension module.
extension.yaml	Declares extension metadata.
cspell.yaml	Configures extension spelling checks.
ci-test.ps1	Adds CI test script.
ci-build.ps1	Adds CI build script.
CHANGELOG.md	Records the initial release.
build.sh	Adds Unix cross-platform build script.
build.ps1	Adds PowerShell cross-platform build script.
.golangci.yaml	Configures Go linting.
.gitignore	Ignores Go build artifacts.
cli/​azd/​.vscode/​cspell.yaml	Adds Spring terminology.
.github/​workflows/​lint-ext-azure-springboot.yml	Adds GitHub lint workflow.
.github/​CODEOWNERS	Assigns extension ownership.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Weidong Xu (weidongxu-microsoft)]

Core context (azd v1.34.2): init --from-code generates project/tooling assets without rewriting Spring configuration. Core's Maven packaging also copies the built archive to staging without sanitizing embedded application configuration.

That is not a reason to dismiss this finding: our Dockerfile explicitly copies external configuration into the runtime image, and runtime overrides do not remove embedded credentials. Keeping this item open. Any fix should preserve the user's app source and address the generated deployment artifacts; we should not claim the entire application image is automatically sanitized.

[Copilot]

🟡 Changes recommended

Unresolved credential-handling, TLS verification, and configuration-to-deployment defects can expose secrets or produce failing deployments.

9 open findings

• Preserve TLS certificate verification in password mode · New
• Sanitize timeout errors to prevent password leakage · New
• External credentials remain recoverable in the final image
• Handle Hikari-specific credential overrides · New
• Resolve profile includes from each property source · New
• Expand profile groups in Spring activation order · New
• Validate service names against Azure Container App limits · New
• Preserve embedded datasource bindings in runtime configuration · New
• Honor or reject custom Maven build directories · New

5 resolved since last review

• Execution-level Maven repackage settings are ignored
• Extension pipeline filters omit shared release files
• CRLF separators break multi-document properties parsing
• Profile-specific external configuration is omitted from the runtime image
• MySQL initialization enables a known-broken scaffold path

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Unresolved security, configuration handling, and deployment correctness issues block approval.

8 open findings

• Reject existing dockerignore under no-adoption policy · New
• Honor Spring Boot repackage outputDirectory · New
• External credentials remain recoverable in the final image
• Avoid rejecting injection-only DataSource beans · New
• Accept numeric and boolean scalar lists · New
• Preserve validated JDBC driver during generation · New
• Validate Azure CLI login during prepare · New
• Preserve embedded datasource bindings in runtime configuration

7 resolved since last review

• Sanitize timeout errors to prevent password leakage
• Preserve TLS certificate verification in password mode
• Honor or reject custom Maven build directories
• Validate service names against Azure Container App limits
• Expand profile groups in Spring activation order
• Resolve profile includes from each property source
• Handle Hikari-specific credential overrides

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Unresolved datasource detection and container binding issues can reject supported applications or produce nonworking deployments.

4 open findings

• Detect builder-created concrete datasources and their properties · New
• Reject Hikari pool-specific driver class override · New
• Loopback server address prevents Container Apps ingress · New
• External credentials remain recoverable in the final image

3 resolved since last review

• Check inherited table ownership through role membership
• Reject or override unsupported Tomcat datasource bindings
• Merge driver trace into embedded datasource evidence

Previously missed (1)

In code that hasn't changed since last review

Check resolved runtime dependencies for JDBC drivers

cli/​azd/​extensions/​azure.springboot/​internal/​spring/​model.go:315

The effective POM lists declared/inherited dependencies, not the resolved transitive runtime graph. An otherwise supported application that receives its JDBC driver through a starter or shared library therefore fails the “no runtime JDBC driver” checks even though Maven packages that driver. Resolve the runtime dependency graph before checking driver availability, and cover a transitively supplied driver.

🧠 Review effort: Balanced

[Weidong Xu (weidongxu-microsoft)]

Also addressed the review-body finding about transitive JDBC drivers in 7bdcd71: Maven dependency:list now supplies the resolved compile/runtime graph to driver and packaged-dependency checks, with resolver coverage in 1ec0998.

[Copilot]

🔵 Needs a closer look

Compiler selection needs correction, and privileged database bootstrap requires human review while integrated managed-identity validation remains incomplete.

2 open findings

• Compiler configuration ignores Maven release property fallback · New
• External credentials remain recoverable in the final image

3 resolved since last review

• Loopback server address prevents Container Apps ingress
• Reject Hikari pool-specific driver class override
• Detect builder-created concrete datasources and their properties

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Infrastructure and administrator-run SQL bootstrap need human review, with integrated managed-identity validation incomplete and a dependency-parsing defect unresolved.

1 open finding

• External credentials remain recoverable in the final image

1 resolved since last review

• Compiler configuration ignores Maven release property fallback

Previously missed (1)

In code that hasn't changed since last review

Parse Maven dependency coordinates before module annotations

cli/​azd/​extensions/​azure.springboot/​internal/​spring/​model.go:446

Maven dependency:list can append Java module annotations such as :runtime -- module org.postgresql.jdbc [auto], including in its output file. The scope comparison below rejects that entire field, silently dropping the dependency. Applications whose JDBC driver is only transitive can then fail initialization because analysis reports the driver as missing. Parse the coordinate token before whitespace annotations, and add a regression covering module-decorated entries.

🧠 Review effort: Balanced

[Weidong Xu (weidongxu-microsoft)]

Addressed the review-body finding about module-decorated Maven dependency output in cbb01a4. The parser now isolates the coordinate token before scope validation, with parser and resolver regressions covering runtime -- module ... [auto] entries.

[Copilot]

🔵 Needs a closer look

The generated infrastructure and SQL identity bootstrap need human review because integrated managed-identity deployment validation remains incomplete.

1 open finding

• External credentials remain recoverable in the final image

Previously missed (1)

In code that hasn't changed since last review

Update PR description to reflect templates and managed identity implementation

cli/​azd/​extensions/​azure.springboot/​internal/​spring/​generation.go:46

The PR description still says generation reuses core serialization/Bicep APIs and managed identity is out of scope, but this implementation owns the templates and generates PostgreSQL managed-identity hooks. Its MySQL validation note also describes the replaced core scaffold. Update Summary, Validation, and WIP to match the implementation and README, including the incomplete integrated managed-identity validation, so reviewers see the actual scope.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Datasource validation and Maven configuration inference still allow incorrect deployment bindings and failing container builds.

4 open findings

• Reject DBCP2-specific bindings that override Azure datasource settings · New
• Resolve test-specific compiler releases when selecting the analysis JDK · New
• Honor spring-boot.repackage.skip property when plugin skip is unspecified · New
• External credentials remain recoverable in the final image

Previously missed (1)

In code that hasn't changed since last review

Match excluded datasource auto-configuration classes individually

cli/​azd/​extensions/​azure.springboot/​internal/​spring/​analysis.go:280

This substring also matches JndiDataSourceAutoConfiguration and XADataSourceAutoConfiguration. Excluding either leaves ordinary datasource auto-configuration enabled, but a supported app with a JDBC URL is rejected here as invalid. Match individual excluded class names instead, and add regressions for these independent exclusions.

🧠 Review effort: Balanced

[Weidong Xu (weidongxu-microsoft)]

Addressed the latest review findings in 3a85a0bd4:

• Reject DBCP2 URL, username, password, and driver overrides, including explicitly empty values.
• Skip Maven test compilation and execution in deployment image builds with maven.test.skip=true; a main Java 17/test Java 21 regression confirms the production image remains on Java 17.
• Honor spring-boot.repackage.skip when plugin and execution settings are unspecified, while preserving explicit plugin/execution precedence.
• Match only the exact DataSourceAutoConfiguration exclusion, preserving JNDI- and XA-only exclusions.
• Update the PR description to reflect extension-owned templates and completed PostgreSQL managed-identity live validation.

The application-owned credential-retention thread remains open for a separate scope decision.

[Copilot]

🟡 Changes recommended

Accepted application configurations can produce incompatible datasource bindings or unusable HTTP deployments.

4 open findings

• Reject builder-based profile activation · New
• Reject explicitly non-web applications · New
• Reject HTTPS-only server configurations · New
• External credentials remain recoverable in the final image

3 resolved since last review

• Honor spring-boot.repackage.skip property when plugin skip is unspecified
• Resolve test-specific compiler releases when selecting the analysis JDK
• Reject DBCP2-specific bindings that override Azure datasource settings

🧠 Review effort: Balanced