Set file upload at hub creation when certificate management is on

[Ewerton Scaboro da Silva (ewertons)]

Problem

provision-e2e-resources fails when enable-certificate-management and enable-file-upload are both 'true':

ERROR: ADR properties are only supported for Generation2 IoT Hub SKUs.
ERROR: "Updating Azure IoT Hub file upload settings" failed (exit code 1)

After the ADR link the S1 hub reports properties.deviceRegistry. The azure-iot CLI extension's az iot hub update rejects any non-GEN2 hub carrying it, client-side, before sending a request. Latest extension (0.33.0b1) has the same check. The action's --fileupload-notifications true update would fail the same way.

Fix (certificate management only)

• Storage account/container created before the hub; storageEndpoints.$default (PT1H SAS TTL) and enableFileUploadNotifications sent in the hub create PUT.
• After the ADR link, the hub is read back; provisioning fails unless storage account, container, SAS TTL and notifications all match.
• Both az iot hub update calls skipped.
• Hub and DPS create PUTs also retry IH400097 ("Unable to fetch credentials"), returned while a new system-assigned identity is being issued. Seen on DPS create in [.NET] Pin e2e provisioning action to fix file upload with certificate management azure-iot-sdk#340's first run.

Without certificate management the az calls are unchanged.

Tests

New tests/Test-FileUploadProvisioning.ps1 runs the action script and module with a stubbed az, now part of validate-actions:

• master: 14 failures, including the error above;
• this branch: passes; no-cert-mgmt az calls identical to master (24/24).

Validate-Module.ps1, validate-actions.mjs, actionlint: pass.

Azure: in Azure/azure-iot-sdk#340 the hub create PUT with storage settings succeeded; that run then hit the transient IH400097 on DPS create, now retried. Full end-to-end validation pending.

[Copilot]

Copilot review overview

🟡 Changes recommended

The post-link validation does not verify the storage connection string or SAS TTL.

Review effort: Balanced
Findings: 1

Open (1)

• Post-link check omits storage connection string and SAS TTL validation · New

What changed in this PR

Configures IoT Hub file upload before ADR linking to avoid rejected post-link CLI updates.

Changes:

• Adds file-upload settings to the certificate-management hub creation request.
• Skips incompatible post-link updates and validates resulting settings.
• Adds stub-based provisioning tests to CI.

File	Description
scripts/​AzIotSdkTest/​parts/​Provisioning.ps1	Moves storage setup into hub creation for ADR.
actions/​provision-e2e-resources/​action.yml	Skips the notification update for ADR hubs.
tests/​Test-FileUploadProvisioning.ps1	Tests ADR and non-ADR provisioning paths.
.github/​workflows/​validate-actions.yml	Runs the new provisioning test.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Azure control-plane behavior still needs full end-to-end validation, and one test assertion does not verify container creation.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Post-link check omits storage connection string and SAS TTL validation

Previously missed (1)

In code that hasn't changed since last review

Require container creation before hub update

tests/​Test-FileUploadProvisioning.ps1:256

This assertion does not require the container-create call to exist: Find-Call returns -1, and -1 -lt $HubPut still passes. A regression that omits container creation could therefore satisfy this ordering check even though the hub points to a nonexistent container. Require $Container -ge 0 as well.