test: add ShellSpec coverage for init-aks-cloud.sh

[Devinwong]

No functional behavior change in init-aks-cloud.sh; this PR adds/adjusts ShellSpec coverage and testability wiring.

This updates and extends test coverage after the script consolidation work from #8096.

Related: ADO#36479419

Changes

Script restructuring for testability

• Keeps helper function definitions above the ${__SOURCED__:+return 0} guard to allow safe sourcing in ShellSpec.
• Adds determine_cert_endpoint_mode() coverage and script-level wiring assertions for ca-refresh mode.
• Uses test-only path/env overrides in helper tests (APT_*, YUM_REPOS_DIR, etc.) while preserving runtime defaults.

ShellSpec coverage added/expanded

• Structural wiring tests for ca-refresh flow and location-to-mode mapping.
• Functional tests for:
  • determine_cert_endpoint_mode
  • init_ubuntu_main_repo_depot
  • init_ubuntu_pmc_repo_depot
  • check_url
  • init_mariner_repo_depot
  • init_azurelinux_repo_depot
• Cloud/location cases include legacy (ussec*, usnat*) and rcv1p paths (e.g., fairfax/mooncake/bleu/empty).

[Copilot]

Pull request overview

This PR makes parts/linux/cloud-init/artifacts/init-aks-custom-cloud.sh safe to source (so ShellSpec can Include it) and adds ShellSpec coverage for key repo-depot and URL-checking helpers used in custom-cloud node boot.

Changes:

• Refactors init-aks-custom-cloud.sh to be source-safe by moving execution-only logic below an __SOURCED__ guard and gating set -x when sourced.
• Makes several paths/env inputs overridable (e.g., apt sources/keyrings locations, wireserver endpoint) to enable hermetic tests.
• Adds/expands ShellSpec tests: keeps grep-based “wiring” checks and adds functional tests for init_ubuntu_main_repo_depot, init_ubuntu_pmc_repo_depot, and check_url.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
spec/parts/linux/cloud-init/artifacts/init_aks_custom_cloud_spec.sh	Adds wiring + functional ShellSpec coverage for repo-depot helpers and URL checking.
parts/linux/cloud-init/artifacts/init-aks-custom-cloud.sh	Refactors for source-safety and testability (guarded execution, env-overridable paths/endpoints).

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

parts/linux/cloud-init/artifacts/init-aks-cloud.sh:17

• validate-shell runs an additional ShellCheck pass with --shell=sh for every *.sh not in .pipelines/scripts/verify_shell.sh’s BASH_ONLY_LIST (verify_shell.sh:31-35, 99-103). This script isn’t currently in that allowlist, but the new __SOURCED__ block adds more bash-only constructs (BASH_SOURCE[0], return at top-level) on top of existing bashisms (e.g., ${var,,}, [[ ... ]], arrays). Unless the lint configuration is updated, this is likely to break the POSIX ShellCheck gate.

# Dependency note: `jq` is guaranteed to be present on every AKS VHD (baked in
# by vhdbuilder/packer/install-dependencies.sh and shipped in the Azure Linux
# base image), so functions in this script use it without an explicit install
# step. Do not flag jq usage here as "used before install" — matches the

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

parts/linux/cloud-init/artifacts/init-aks-cloud.sh:477

• init_ubuntu_pmc_repo_depot implicitly depends on the global ubuntuRel variable (it’s not set or validated inside the function). This makes the helper non-self-contained for ShellSpec and risks generating an invalid RepoDepot URL like .../ubuntu//prod if a caller ever invokes it before ubuntuRel is set.

Consider making ubuntuRel an explicit parameter (e.g. init_ubuntu_pmc_repo_depot <endpoint> <ubuntuRel>) or deriving it inside the function (e.g. via lsb_release --release) with a clear fatal error if it can’t be determined.

function init_ubuntu_pmc_repo_depot {
    local repodepot_endpoint="$1"
    # Add Microsoft packages source to the azure specific sources.list.
    echo "Adding the packages.microsoft.com Ubuntu-$ubuntuRel repo..."

    local microsoftPackageSource="$repodepot_endpoint/microsoft/ubuntu/$ubuntuRel/prod"

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

spec/parts/linux/cloud-init/artifacts/init_aks_cloud_spec.sh:83

• This spec Includes init-aks-cloud.sh without setting __SOURCED__. The common pattern in this repo’s ShellSpec tests (e.g. cse_main_spec.sh) is to set __SOURCED__=1 before sourcing so the included script can reliably skip its top-level execution and so test-only overrides (like OS_RELEASE_FILE) can be honored without depending on the runner’s real /etc/os-release.

Setting __SOURCED__=1 here also makes the test resilient if the script follows the established __SOURCED__ convention for sourced-vs-executed behavior.

Describe 'init-aks-cloud.sh functional tests'
    # Include sources the file and loads function definitions only; top-level provisioning
    # logic is skipped when sourced.
    # without this Include would fall through into the top-level provisioning path
    # (wireserver calls, cron install, exit) and cause side effects. Matches the
    # sourcing convention documented in the script header and used in cse_main_spec.sh.
    Include "./parts/linux/cloud-init/artifacts/init-aks-cloud.sh"

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

parts/linux/cloud-init/artifacts/init-aks-cloud.sh:475

• init_ubuntu_pmc_repo_depot implicitly depends on a global ubuntuRel variable being set by the caller (top-level code sets it, but the function itself doesn’t). This makes the helper non-self-contained for sourcing/tests and could generate an invalid RepoDepot URL if ubuntuRel is unset.

Consider making the function derive ubuntuRel when missing (while still honoring a pre-set value) so the helper can be called safely in isolation.

    local repodepot_endpoint="$1"
    # Add Microsoft packages source to the azure specific sources.list.
    echo "Adding the packages.microsoft.com Ubuntu-$ubuntuRel repo..."

    local microsoftPackageSource="$repodepot_endpoint/microsoft/ubuntu/$ubuntuRel/prod"

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

parts/linux/cloud-init/artifacts/init-aks-cloud.sh:3

• Header comment has an extraneous trailing "-" and reads awkwardly ("tested in -"). This looks like a typo and can confuse readers trying to find the referenced spec file.

# functions defined until "${__SOURCED__:+return}" are sourced and tested in -
# spec/parts/linux/cloud-init/artifacts/init_aks_cloud_spec.sh.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

parts/linux/cloud-init/artifacts/init-aks-cloud.sh:302

• init_ubuntu_main_repo_depot now allows OS_RELEASE_FILE to override the file that gets sourced (. "$os_release_file"). Since this script runs as root, sourcing a path influenced by environment enables arbitrary code execution if the environment can be manipulated. To keep testability without changing production behavior, only honor OS_RELEASE_FILE when the script is being sourced for ShellSpec (i.e., __SOURCED__ is set).

    local sources_list="${APT_SOURCES_LIST:-/etc/apt/sources.list}"
    local sources_list_d="${APT_SOURCES_LIST_D_DIR:-/etc/apt/sources.list.d}"
    local os_release_file="${OS_RELEASE_FILE:-/etc/os-release}"