fix(execute): don't overwrite env-derived ADO context with None CLI args (#413)

* fix(execute): don't overwrite env-derived ADO context with None CLI args

build_execution_context unconditionally replaced ado_org_url and
ado_project (resolved by ExecutionContext::default() from
SYSTEM_TEAMFOUNDATIONCOLLECTIONURI / SYSTEM_TEAMPROJECT) with the CLI
argument values — which are None when the flags are omitted.  This
caused 'AZURE_DEVOPS_ORG_URL not set' errors for every safe output
that needs an org URL during pipeline execution.

Only override the env-derived values when the CLI flags are explicitly
provided, and re-derive ado_organization when the URL is overridden.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* refactor(safeoutputs): extract org_from_url helper to eliminate duplication

Agent-Logs-Url: https://github.com/githubnext/ado-aw/sessions/d1969572-fd31-4c6f-85f0-cf5878796285

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: 3 people

src/main.rs

@@ -245,8 +245,16 @@ async fn build_execution_context(
         .collect();
 
     let mut ctx = crate::safeoutputs::ExecutionContext::default();
-    ctx.ado_org_url = ado_org_url;
-    ctx.ado_project = ado_project;
+    // Only override env-derived values when CLI args are explicitly provided;
+    // otherwise keep the defaults from SYSTEM_TEAMFOUNDATIONCOLLECTIONURI /
+    // SYSTEM_TEAMPROJECT that ExecutionContext::default() already resolved.
+    if let Some(url) = ado_org_url {
+        ctx.ado_organization = crate::safeoutputs::org_from_url(&url);
+        ctx.ado_org_url = Some(url);
+    }
+    if let Some(project) = ado_project {
+        ctx.ado_project = Some(project);
+    }
     ctx.working_directory = safe_output_dir.clone();
     ctx.tool_configs = front_matter.safe_outputs.clone();
     ctx.allowed_repositories = allowed_repositories;

src/safeoutputs/mod.rs

@@ -288,6 +288,7 @@ pub use report_incomplete::*;
 pub use resolve_pr_thread::*;
 pub use result::{
     ExecutionContext, ExecutionResult, Executor, ToolResult, Validate, anyhow_to_mcp_error,
+    org_from_url,
 };
 pub use submit_pr_review::*;
 pub use update_pr::*;

src/safeoutputs/result.rs

@@ -129,6 +129,20 @@ impl ExecutionContext {
     }
 }
 
+/// Extract the organization name from an Azure DevOps org URL.
+///
+/// Handles both hosted (`https://dev.azure.com/myorg`) and on-prem
+/// (`https://server/tfs/myorg`) URLs, with or without a trailing slash.
+///
+/// Returns `None` if the URL is empty or has no meaningful last segment.
+pub fn org_from_url(url: &str) -> Option<String> {
+    url.trim_end_matches('/')
+        .rsplit('/')
+        .next()
+        .filter(|s| !s.is_empty())
+        .map(|s| s.to_string())
+}
+
 impl ExecutionContext {
     /// Build an `ExecutionContext` from an arbitrary env-var lookup function.
     ///
@@ -144,13 +158,7 @@ impl ExecutionContext {
             .or_else(|| env("SYSTEM_TEAMFOUNDATIONCOLLECTIONURI"));
 
         // Extract organization name from URL (e.g., "https://dev.azure.com/myorg/" -> "myorg")
-        let ado_organization = ado_org_url.as_ref().and_then(|url| {
-            url.trim_end_matches('/')
-                .rsplit('/')
-                .next()
-                .filter(|s| !s.is_empty())
-                .map(|s| s.to_string())
-        });
+        let ado_organization = ado_org_url.as_ref().and_then(|url| org_from_url(url));
 
         // Source directory is where git repos are checked out (BUILD_SOURCESDIRECTORY)
         let source_directory = env("BUILD_SOURCESDIRECTORY")