{Packaging} harden launcher against cwd module loading

[Naga Nandyala (naga-nandyala)]

🤖 PR Validation — ❌ Action needed

Breaking Changes	Tests
❌ 2	️✔️ 130/130

❌AzureCLI-BreakingChangeTest

❌acs

rule	cmd_name	rule_message	suggest_message
❌ 1007 - ParaRemove	aks create	cmd aks create removed parameter enable_upstream_kubescheduler_user_configuration	please add back parameter enable_upstream_kubescheduler_user_configuration for cmd aks create
❌ 1007 - ParaRemove	aks update	cmd aks update removed parameter disable_upstream_kubescheduler_user_configuration	please add back parameter disable_upstream_kubescheduler_user_configuration for cmd aks update
❌ 1007 - ParaRemove	aks update	cmd aks update removed parameter enable_upstream_kubescheduler_user_configuration	please add back parameter enable_upstream_kubescheduler_user_configuration for cmd aks update

❌vm

rule	cmd_name	rule_message	suggest_message
❌ 1007 - ParaRemove	capacity reservation group create	cmd capacity reservation group create removed parameter reservation_type	please add back parameter reservation_type for cmd capacity reservation group create
❌ 1007 - ParaRemove	capacity reservation group update	cmd capacity reservation group update removed parameter reservation_type	please add back parameter reservation_type for cmd capacity reservation group update
❌ 1007 - ParaRemove	vm create	cmd vm create removed parameter disable_capacity_reservation_assignment	please add back parameter disable_capacity_reservation_assignment for cmd vm create
❌ 1007 - ParaRemove	vm update	cmd vm update removed parameter disable_capacity_reservation_assignment	please add back parameter disable_capacity_reservation_assignment for cmd vm update

Please submit your Breaking Change Pre-announcement ASAP if you haven't already. Please note:

• Breaking changes can only be merged during the designated breaking change window
• A pre-announcement must be released at least one month in advance

For more details on how to introduce breaking changes, refer to the documentation: azure-cli/doc/how_to_introduce_breaking_changes.md

Description

python -m adds the current working directory to the start of sys.path, so running az from an untrusted directory can load a local azure.py before the real package.

This change hardens the launcher in src/azure-cli/az to avoid that cwd import path.

Changes

• Replaced os.execl(sys.executable, sys.executable, '-m', 'azure.cli', *sys.argv[1:]) with runpy.run_module(...).
• Explicitly prepended the launcher src directory to sys.path before module execution to preserve local launcher import behavior.
• Used run_name='__main__' and alter_sys=True for closer -m semantics while avoiding -m cwd import behavior.

Security context

This addresses the cwd import vector described in Debian bug #1005251 while keeping launcher behavior stable.

Related

• Original PR: {az} use runpy instead of os.execl #21261

[azure-client-tools-bot-prd]

Hi Naga Nandyala (@naga-nandyala),
Since the current milestone time is less than 7 days, this pr will be reviewed in the next milestone.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Yong Zhang (yonzhan)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Yong Zhang (yonzhan)]

Thank you for your contribution! We will review the pull request and get back to you soon.

[Copilot]

Pull request overview

This PR hardens the az Python launcher against importing azure modules from an untrusted current working directory by avoiding python -m azure.cli re-exec and instead executing the CLI module in-process.

Changes:

• Replaces os.execl(..., '-m', 'azure.cli', ...) with runpy.run_module(...) to avoid -m semantics that put the current working directory first on sys.path.
• Prepends a launcher-derived path to sys.path before executing the CLI module.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[azure-client-tools-agent]

Live test skipped

⏭️ Skipping the live test for this revision because no new test file was added (tests/**/test_*.py).

The live-test pipeline runs only the test files a PR changes, so there is nothing to execute for this commit. This is informational — a regression test is encouraged where it makes sense, but not required. If a test file is added in a later commit, the live test will run automatically.

[azure-client-tools-agent]

CI Review Summary

Automated CI check for this PR shows failures that need attention before merge:

Check	Result
Azure.azure-cli (Build)	❌ Failed — Build #20260724.3 failed
Azure.azure-cli (Test Homebrew Formula)	❌ Failed — Test Homebrew Formula failed

93/95 checks passed overall. Please review the failing checks below and push a fix:

• Build: https://github.com/Azure/azure-cli/runs/89389219399
• Homebrew Formula test: https://github.com/Azure/azure-cli/runs/89377866534

No live-test was applicable for this PR (no runnable test file changes detected), so this summary reflects upstream CI only.

[Cooper Cox (coopercox-ms)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).