Skip to main content

Browser authentication release check

CI verifies the supported provider-login handoffs and AWS authenticated-profile generation. Browser consent, MFA, OS keychains, and desktop URL handlers remain a manual boundary.

Run this check before a major CLI release, or after changing provider login code, on one fresh macOS account and one fresh Linux desktop account.

Preconditions​

  • Download https://get.anycloud.sh and run it with --version <release-version> so the check exercises the exact candidate.
  • Start outside the repository, with no provider credential environment variables set.
  • Use disposable provider accounts/projects and a unique credential name.
  • Keep a second terminal ready to remove any generated identity if the wizard is interrupted after cloud mutation.

Checklist​

For Azure and GCP, start only anycloud credentials new, enter the name, and select the provider in the menu.

  • AWS with no SSO profile: run aws configure sso and aws sso login --profile <name> yourself. Then run anycloud credentials new <credential> --provider aws --generate --profile <name> and verify it creates a usable IAM user without launching another login.
  • AWS with an existing SSO profile: run aws sso login --profile <name> yourself, then use the same explicit Anycloud generation command. Verify the selected profile is used and no ambient AWS identity is substituted.
  • Azure while logged out: complete the browser flow opened by az login, select the intended subscription, and verify the generated principal.
  • GCP while logged out: complete gcloud auth login, select the intended project, and verify the generated service-account key.

On both operating systems, also verify Ctrl-C during the Azure and GCP provider login returns control without saving a credential. Delete the saved API credential and every generated cloud identity/key before marking the check complete. Never paste tokens, private keys, or screenshots containing secrets into the release log.