merge dev

Author: calvinhzy

build_scripts/windows/scripts/build.cmd

@@ -30,7 +30,7 @@ if "%ARCH%"=="x86" (
     echo Please set ARCH to "x86" or "x64"
     goto ERROR
 )
-set PYTHON_VERSION=3.13.7
+set PYTHON_VERSION=3.13.9
 
 set WIX_DOWNLOAD_URL="https://azurecliprod.blob.core.windows.net/msi/wix310-binaries-mirror.zip"
 set PYTHON_DOWNLOAD_URL="https://www.python.org/ftp/python/%PYTHON_VERSION%/python-%PYTHON_VERSION%-embed-%PYTHON_ARCH%.zip"

scripts/release/debian/build.sh

@@ -15,7 +15,7 @@ set -exv
 ls -Rl /mnt/artifacts
 
 WORKDIR=`cd $(dirname $0); cd ../../../; pwd`
-PYTHON_VERSION="3.13.7"
+PYTHON_VERSION="3.13.9"
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 # Update APT packages

src/azure-cli-core/azure/cli/core/breaking_change.py

@@ -15,7 +15,7 @@
 
 logger = get_logger()
 
-NEXT_BREAKING_CHANGE_RELEASE = '2.79.0'
+NEXT_BREAKING_CHANGE_RELEASE = '2.80.0'
 NEXT_BREAKING_CHANGE_DATE = 'Nov 2025'
 DEFAULT_BREAKING_CHANGE_TAG = '[Breaking Change]'
 

src/azure-cli/azure/cli/command_modules/acr/_archive_utils.py

@@ -66,13 +66,21 @@ def _pack_source_code(source_location, tar_file_path, docker_file_path, docker_f
     original_docker_file_name = os.path.basename(docker_file_path.replace("\\", os.sep))
     ignore_list, ignore_list_size = _load_dockerignore_file(source_location, original_docker_file_name)
     common_vcs_ignore_list = {'.git', '.gitignore', '.bzr', 'bzrignore', '.hg', '.hgignore', '.svn'}
+    # Directories that should be completely excluded (no recursive descent) for performance reasons.
+    # These typically contain large numbers of files that are not needed for container build context.
+    build_ignore_dirs = {'.venv'}
 
     def _ignore_check(tarinfo, parent_ignored, parent_matching_rule_index):
-        # ignore common vcs dir or file
-        if tarinfo.name in common_vcs_ignore_list:
+        # Ignore common VCS dirs/files by basename so nested instances are handled.
+        if os.path.basename(tarinfo.name) in common_vcs_ignore_list:
             logger.warning("Excluding '%s' based on default ignore rules", tarinfo.name)
             return True, parent_matching_rule_index
 
+        # Exclude performance-heavy directories entirely (no traversal) regardless of .dockerignore.
+        if tarinfo.isdir() and os.path.basename(tarinfo.name) in build_ignore_dirs:
+            logger.warning("Excluding '%s' directory for performance", os.path.basename(tarinfo.name))
+            return True, parent_matching_rule_index
+
         if ignore_list is None:
             # if .dockerignore doesn't exists, inherit from parent
             # eg, it will ignore the files under .git folder.
@@ -100,7 +108,8 @@ def _ignore_check(tarinfo, parent_ignored, parent_matching_rule_index):
                                   arcname="",
                                   parent_ignored=False,
                                   parent_matching_rule_index=ignore_list_size,
-                                  ignore_check=_ignore_check)
+                                  ignore_check=_ignore_check,
+                                  build_ignore_dirs=build_ignore_dirs)
 
         # Add the Dockerfile if it's specified.
         # In the case of run, there will be no Dockerfile.
@@ -182,7 +191,8 @@ def _load_dockerignore_file(source_location, original_docker_file_name):
     return ignore_list, len(ignore_list)
 
 
-def _archive_file_recursively(tar, name, arcname, parent_ignored, parent_matching_rule_index, ignore_check):
+def _archive_file_recursively(tar, name, arcname, parent_ignored, parent_matching_rule_index,
+                              ignore_check, build_ignore_dirs):
     # create a TarInfo object from the file
     tarinfo = tar.gettarinfo(name, arcname)
 
@@ -201,12 +211,13 @@ def _archive_file_recursively(tar, name, arcname, parent_ignored, parent_matchin
         else:
             tar.addfile(tarinfo)
 
-    # even the dir is ignored, its child items can still be included, so continue to scan
-    if tarinfo.isdir():
+    # Even if a dir is ignored by .dockerignore, its children might still be included (Docker semantics),
+    # so we continue scanning unless it is in our build_ignore_dirs set (performance skip list).
+    if tarinfo.isdir() and os.path.basename(tarinfo.name) not in build_ignore_dirs:
         for f in os.listdir(name):
             _archive_file_recursively(tar, os.path.join(name, f), os.path.join(arcname, f),
                                       parent_ignored=ignored, parent_matching_rule_index=matching_rule_index,
-                                      ignore_check=ignore_check)
+                                      ignore_check=ignore_check, build_ignore_dirs=build_ignore_dirs)
 
 
 def check_remote_source_code(source_location):

src/azure-cli/azure/cli/command_modules/acs/_consts.py

@@ -93,8 +93,8 @@
 CONST_PRIVATE_DNS_ZONE_NONE = "none"
 
 # role assignment for kubelet
-CONST_MANAGED_IDENTITY_OPERATOR_ROLE = 'Managed Identity Operator'
-CONST_MANAGED_IDENTITY_OPERATOR_ROLE_ID = 'f1a07417-d97a-45cb-824c-7a7467783830'
+CONST_MANAGED_IDENTITY_OPERATOR_ROLE = "Managed Identity Operator"
+CONST_MANAGED_IDENTITY_OPERATOR_ROLE_ID = "f1a07417-d97a-45cb-824c-7a7467783830"
 
 # role assignment for vnet subnet
 CONST_NETWORK_CONTRIBUTOR_ROLE_ID = "4d97b98b-1d4f-4787-a291-c67834d212e7"
@@ -134,6 +134,11 @@
 CONST_NETWORK_POLICY_CALICO = "calico"
 CONST_NETWORK_POLICY_NONE = "none"
 
+# ACNS advanced network policies
+CONST_ADVANCED_NETWORKPOLICIES_NONE = "None"
+CONST_ADVANCED_NETWORKPOLICIES_FQDN = "FQDN"
+CONST_ADVANCED_NETWORKPOLICIES_L7 = "L7"
+
 # network pod ip allocation mode
 CONST_NETWORK_POD_IP_ALLOCATION_MODE_DYNAMIC_INDIVIDUAL = "DynamicIndividual"
 CONST_NETWORK_POD_IP_ALLOCATION_MODE_STATIC_BLOCK = "StaticBlock"
@@ -190,15 +195,15 @@
 
 # all supported addons
 ADDONS = {
-    'http_application_routing': CONST_HTTP_APPLICATION_ROUTING_ADDON_NAME,
-    'monitoring': CONST_MONITORING_ADDON_NAME,
-    'virtual-node': CONST_VIRTUAL_NODE_ADDON_NAME,
-    'kube-dashboard': CONST_KUBE_DASHBOARD_ADDON_NAME,
-    'azure-policy': CONST_AZURE_POLICY_ADDON_NAME,
-    'ingress-appgw': CONST_INGRESS_APPGW_ADDON_NAME,
+    "http_application_routing": CONST_HTTP_APPLICATION_ROUTING_ADDON_NAME,
+    "monitoring": CONST_MONITORING_ADDON_NAME,
+    "virtual-node": CONST_VIRTUAL_NODE_ADDON_NAME,
+    "kube-dashboard": CONST_KUBE_DASHBOARD_ADDON_NAME,
+    "azure-policy": CONST_AZURE_POLICY_ADDON_NAME,
+    "ingress-appgw": CONST_INGRESS_APPGW_ADDON_NAME,
     "confcom": CONST_CONFCOM_ADDON_NAME,
-    'open-service-mesh': CONST_OPEN_SERVICE_MESH_ADDON_NAME,
-    'azure-keyvault-secrets-provider': CONST_AZURE_KEYVAULT_SECRETS_PROVIDER_ADDON_NAME,
+    "open-service-mesh": CONST_OPEN_SERVICE_MESH_ADDON_NAME,
+    "azure-keyvault-secrets-provider": CONST_AZURE_KEYVAULT_SECRETS_PROVIDER_ADDON_NAME,
     "web_application_routing": CONST_WEB_APPLICATION_ROUTING_KEY_NAME,
 }
 
@@ -249,8 +254,8 @@
 
 # consts for decorator pattern
 class DecoratorMode(Enum):
-    """Enumerations used to distinguish whether to handle creation or update.
-    """
+    """Enumerations used to distinguish whether to handle creation or update."""
+
     CREATE = 1
     UPDATE = 2
 
@@ -259,6 +264,7 @@ class AgentPoolDecoratorMode(Enum):
     """Enumerations used to distinguish whether to deal with the default system agentpool in the context of the cluster
     or any specific agentpool.
     """
+
     MANAGED_CLUSTER = 1
     STANDALONE = 2