Preserve Azure CLI user environment on POSIX

[Akın Soysal (akeensoysal)]

Summary

• Preserve HOME, XDG_CACHE_HOME, and AZURE_CONFIG_DIR in the restricted POSIX child environment used by AzureCliCredential.
• Prevent Azure CLI telemetry from creating ./None/.cache/... under the caller's working directory and preserve custom Azure CLI config locations.
• Add focused child-environment coverage and an Azure.Identity changelog entry.

Fixes #7316

Validation

• Regression before implementation: AzureCliCredential.PosixChildEnvironment failed with environment variables not propagated.
• ctest --test-dir build --output-on-failure -R 'azure-identity\.AzureCliCredential': 31/31 passed.
• ctest --test-dir build --output-on-failure -E 'LIVEONLY_' -j1: 192/192 passed; two tests skipped by their own runtime conditions.
• Live AzureCliCredential storage-token probe: token acquired; no relative None directory created.
• clang-format-11 --dry-run --Werror on both changed C++ files.
• git diff --check.

Pull Request Checklist

• C++ Guidelines
• Doxygen docs (no public API or header changes)
• Unit tests
• No unwanted commits/changes
• Descriptive title/description
  • PR is single purpose
  • Related issue listed
• Comments in source
• No typos
• Update changelog
• Not work-in-progress
• External references or docs updated (not applicable)
• Self review of PR done
• Any breaking changes? No

[github-actions]

Thank you for your contribution Akın Soysal (@akeensoysal)! We will review the pull request and get back to you soon.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
7 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This pull request updates AzureCliCredential on POSIX to preserve a small allowlist of user-environment variables (HOME, XDG_CACHE_HOME, AZURE_CONFIG_DIR) when spawning the restricted child process, preventing Azure CLI from writing telemetry/cache files into the caller’s working directory and ensuring custom Azure CLI config locations remain usable.

Changes:

• Propagate HOME, XDG_CACHE_HOME, and AZURE_CONFIG_DIR into the POSIX posix_spawn environment allowlist (while still not inheriting the full parent environment).
• Add a focused unit test validating the allowlisted variables are visible inside the POSIX child process.
• Add a changelog entry describing the bug fix.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
sdk/identity/azure-identity/src/azure_cli_credential.cpp	Extends the restricted POSIX child environment to include HOME, XDG_CACHE_HOME, and AZURE_CONFIG_DIR.
sdk/identity/azure-identity/test/ut/azure_cli_credential_test.cpp	Adds a POSIX-only unit test ensuring the allowlisted environment variables are propagated to the child process.
sdk/identity/azure-identity/CHANGELOG.md	Documents the fix under the unreleased version’s “Bugs Fixed” section.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.