fix: require azure devops credentials for work item linking (#92)

* chore: empty commit to sync branch

* feat: validate Azure DevOps org and PAT when link-commits-to-pull-request is true

Co-authored-by: joshjohanning <19912012+joshjohanning@users.noreply.github.com>

* refactor: lint

* chore: bump version to 3.0.7

---------

Co-authored-by: Josh Johanning <joshjohanning@github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: joshjohanning <19912012+joshjohanning@users.noreply.github.com>

Author: Copilot

__tests__/index.test.js

@@ -206,6 +206,81 @@ describe('Azure DevOps Commit Validator', () => {
 
       expect(mockSetFailed).not.toHaveBeenCalled();
     });
+
+    it('should fail when link-commits-to-pull-request is true but azure-devops-organization is missing', async () => {
+      mockGetInput.mockImplementation(name => {
+        const defaults = {
+          'check-pull-request': 'false',
+          'check-commits': 'true',
+          'fail-if-missing-workitem-commit-link': 'true',
+          'link-commits-to-pull-request': 'true',
+          'azure-devops-token': 'test-token',
+          'azure-devops-organization': '', // Missing org
+          'github-token': 'github-token',
+          'comment-on-failure': 'true',
+          'validate-work-item-exists': 'false'
+        };
+        return defaults[name] || '';
+      });
+
+      await run();
+
+      expect(mockSetFailed).toHaveBeenCalledWith(
+        'Azure DevOps organization is required when link-commits-to-pull-request is true'
+      );
+    });
+
+    it('should fail when link-commits-to-pull-request is true but azure-devops-token is missing', async () => {
+      mockGetInput.mockImplementation(name => {
+        const defaults = {
+          'check-pull-request': 'false',
+          'check-commits': 'true',
+          'fail-if-missing-workitem-commit-link': 'true',
+          'link-commits-to-pull-request': 'true',
+          'azure-devops-token': '', // Missing token
+          'azure-devops-organization': 'test-org',
+          'github-token': 'github-token',
+          'comment-on-failure': 'true',
+          'validate-work-item-exists': 'false'
+        };
+        return defaults[name] || '';
+      });
+
+      await run();
+
+      expect(mockSetFailed).toHaveBeenCalledWith(
+        'Azure DevOps token is required when link-commits-to-pull-request is true'
+      );
+    });
+
+    it('should pass when link-commits-to-pull-request is false even if azure-devops config is missing', async () => {
+      mockGetInput.mockImplementation(name => {
+        const defaults = {
+          'check-pull-request': 'false',
+          'check-commits': 'true',
+          'fail-if-missing-workitem-commit-link': 'true',
+          'link-commits-to-pull-request': 'false', // Linking disabled
+          'azure-devops-token': '',
+          'azure-devops-organization': '',
+          'github-token': 'github-token',
+          'comment-on-failure': 'true',
+          'validate-work-item-exists': 'false'
+        };
+        return defaults[name] || '';
+      });
+
+      mockOctokit.paginate.mockResolvedValueOnce([
+        {
+          sha: '1234567890abcdef',
+          commit: { message: 'Fix: AB#123' }
+        }
+      ]);
+
+      await run();
+
+      // Should not call setFailed for missing Azure DevOps config since linking is disabled
+      expect(mockSetFailed).not.toHaveBeenCalled();
+    });
   });
 
   describe('Commit validation', () => {
@@ -1175,7 +1250,7 @@ describe('Azure DevOps Commit Validator', () => {
   });
 
   describe('Edge cases - Work item linking with missing credentials', () => {
-    it('should attempt linking without failing when credentials are present', async () => {
+    it('should fail when linking is enabled but credentials are missing', async () => {
       mockGetInput.mockImplementation(name => {
         if (name === 'check-commits') return 'true';
         if (name === 'check-pull-request') return 'false';
@@ -1202,8 +1277,12 @@ describe('Azure DevOps Commit Validator', () => {
 
       await run();
 
-      // Should still call linkWorkItem even with empty credentials
-      expect(mockLinkWorkItem).toHaveBeenCalled();
+      // Should fail due to missing Azure DevOps organization
+      expect(mockSetFailed).toHaveBeenCalledWith(
+        'Azure DevOps organization is required when link-commits-to-pull-request is true'
+      );
+      // Should not call linkWorkItem since validation failed
+      expect(mockLinkWorkItem).not.toHaveBeenCalled();
     });
   });
 

badges/coverage.svg

@@ -1,6 +1,6 @@
 {
   "name": "azure-devops-work-item-link-enforcer-and-linker",
-  "version": "3.0.6",
+  "version": "3.0.7",
   "private": true,
   "type": "module",
   "description": "GitHub Action to enforce that each commit in a pull request be linked to an Azure DevOps work item and automatically link the pull request to each work item ",

package-lock.json

@@ -56,6 +56,18 @@ export async function run() {
       return;
     }
 
+    // Validate Azure DevOps configuration if linking is enabled
+    if (linkCommitsToPullRequest) {
+      if (!azureDevopsOrganization) {
+        core.setFailed('Azure DevOps organization is required when link-commits-to-pull-request is true');
+        return;
+      }
+      if (!azureDevopsToken) {
+        core.setFailed('Azure DevOps token is required when link-commits-to-pull-request is true');
+        return;
+      }
+    }
+
     const octokit = github.getOctokit(githubToken);
 
     // Store work item to commit mapping and validation results