CI: let the managed-environment probe run in Cloud Shell too

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: xuming-ms

.github/scripts/check_managed_environment.py

@@ -4,15 +4,15 @@
 # Licensed under the MIT License. See License.txt in the project root for license information.
 # --------------------------------------------------------------------------------------------
 
-"""Assert the plaintext fallback warning is suppressed on a real platform-managed agent.
+"""Assert the plaintext fallback warning is suppressed on a real platform-managed host.
 
-Meant to be run on an Azure Pipelines or GitHub Actions agent, and needs no sign-in: the warning is
-decided by build_persistence and warn_if_encryption_unavailable alone.
+Meant to be run on an Azure Pipelines agent, a GitHub Actions runner or in Cloud Shell, and needs no
+sign-in: the warning is decided by build_persistence and warn_if_encryption_unavailable alone.
 
-The unit tests mock the environment, so they cannot show that an agent really sets TF_BUILD or
-GITHUB_ACTIONS. This runs the same code against whatever the agent actually provides, then repeats
-it with those variables removed, so a pass means the gate is what silenced the warning and not a
-fallback that never happened.
+The unit tests mock the environment, so they cannot show that a real host sets TF_BUILD,
+GITHUB_ACTIONS or ACC_CLOUD. This runs the same code against whatever the host actually provides,
+then repeats it with those variables removed, so a pass means the gate is what silenced the warning
+and not a fallback that never happened.
 """
 
 import logging
@@ -21,9 +21,10 @@
 import tempfile
 
 from azure.cli.core.auth import persistence
-from azure.cli.core.util import in_ci, in_managed_environment
+from azure.cli.core.util import in_ci, in_cloud_console, in_managed_environment
 
-CI_VARIABLES = ('TF_BUILD', 'GITHUB_ACTIONS', 'CI')
+# Every variable in_managed_environment() consults, so the control below can take them all away.
+MANAGED_VARIABLES = ('TF_BUILD', 'GITHUB_ACTIONS', 'CI', 'ACC_CLOUD')
 
 
 def _collect(level):
@@ -60,24 +61,23 @@ def _warnings_from_sign_in():
 
 
 def main():
-    seen = {name: os.environ.get(name) for name in CI_VARIABLES}
-    print('agent environment: ' + ', '.join(
+    seen = {name: os.environ.get(name) for name in MANAGED_VARIABLES}
+    print('host environment: ' + ', '.join(
         f'{name}={value!r}' if value is not None else f'{name}=<unset>' for name, value in seen.items()))
-    print(f'in_ci()={in_ci()}, in_managed_environment()={in_managed_environment()}')
+    print(f'in_ci()={in_ci()}, in_cloud_console()={bool(in_cloud_console())}, '
+          f'in_managed_environment()={in_managed_environment()}')
 
     failures = []
-    if not in_ci():
-        failures.append('this agent sets none of the variables in_ci() looks for, so the gate this '
-                        'checks would never apply here')
     if not in_managed_environment():
-        failures.append('in_managed_environment() is False on a CI agent')
+        failures.append('this host sets none of the variables in_managed_environment() looks for, '
+                        'so the gate this checks would never apply here')
 
     # The fallback itself has to happen, or there would be no warning to suppress and a pass would
     # mean nothing.
     store, debug = _fall_back()
     if store.is_encrypted:
         failures.append('the persistence reports itself as encrypted, so there was no fallback to '
-                        'observe on this agent')
+                        'observe on this host')
     if not isinstance(store, persistence.FilePersistence):
         failures.append(f'expected a plaintext FilePersistence, got {type(store).__name__}')
     if not persistence._encryption_fallback:  # pylint: disable=protected-access
@@ -86,12 +86,12 @@ def main():
         failures.append('the reason libsecret was unusable never reached the debug log')
 
     if _warnings_from_sign_in():
-        failures.append('sign-in warned about plaintext storage on a platform-managed agent, where '
+        failures.append('sign-in warned about plaintext storage on a platform-managed host, where '
                         'the user cannot act on it')
 
-    # Same process, same fallback, with only the CI variables taken away. Without this a silent
+    # Same process, same fallback, with only those variables taken away. Without this a silent
     # warning path would pass just as happily as a working gate.
-    removed = {name: os.environ.pop(name) for name in CI_VARIABLES if name in os.environ}
+    removed = {name: os.environ.pop(name) for name in MANAGED_VARIABLES if name in os.environ}
     try:
         if not _warnings_from_sign_in():
             failures.append(f'with {", ".join(removed)} removed the sign-in still said nothing, so '
@@ -105,7 +105,7 @@ def main():
         return 1
 
     print('the fallback happened, was explained in the debug log, and the warning was suppressed '
-          'only because this is a platform-managed agent')
+          'only because this is a platform-managed host')
     return 0