CI/CD deployment to SaaS fails

[pzentner]

I am asking this as a question, because I am fairly certain that this is something on my end. While we had no problems deploying apps to SaaS via CI/CD's deployto environment, it has started causing issues recently - probably a month or two ago.

We haven't changed a thing when it comes to authentication or the Entra App config in BC or even in GitHub (I think).

We have a AUTHCONTEXT secret defined for two environments (UAT, TEST).

in AL-Go-Settings.json, we have the following defined:

  "deployToUAT": {
    "EnvironmentName": "UAT",
    "DependencyInstallMode": "install",
    "Branches": [
      "main"
    ]
  },
  "deployToTEST": {
    "EnvironmentName": "TEST",
    "DependencyInstallMode": "install",
    "Branches": [
      "feature/*"
    ]
  },

When it's running through the CI/CD deployment, it comes up with the following:

Attempting authentication to https://api.businesscentral.dynamics.com/.default using clientCredentials...
Authenticated as app ***
EnvironmentUrl: https://businesscentral.dynamics.com/a09a9c86-f287-4cc1-911a-0e3a6a92280e/UAT
Installing unknown dependencies: 1a1ba2fc-5ea9-456d-be99-2240a85d926a:NAV-X_NAV-X Library_3.2.0.0.app
Dependency app NAV-X_NAV-X Library_3.2.0.0.app is not installed.
Install-BcAppFromAppSource Telemetry Correlation Id: b0f4a5a2-c48e-40e5-b31d-3e7577c0bbba
Unknown dependencies installed or upgraded
Error: Deploying to UAT failed.  The remote server returned an error: (401) Unauthorized. Unauthorized  (ms-correlation-x = b0a16e4d-7c08-c388-fdc8-bf7824a04c94)

What are we doing wrong? Thank you

[freddydk]

What other settings do you have?
You might just need a setting called generateDependencyArtifact: true

[pzentner]

This did not work, at least not, if it's defined as an org setting. The "NAV-X Library" is an app that is sitting as a library app in AppSource - not as a published app, but as a library app for all published apps.

Here are all the settings we have:

org settings:

{
	"conditionalSettings": [
		{
			"workflows": [ "Test Next Major" ],
			"settings": {
				"workflowSchedule": {
					"cron": "0 0 1 * *"
				}
			}
		},
		{
			"workflows": [ "Test Next Minor" ],
			"settings": {
				"workflowSchedule": {
					"cron": "0 1 1 * *"
				}
			}
		},
		{
			"workflows": [ "Update AL-Go System Files" ],
			"settings": {
				"workflowSchedule": {
					"cron": "0 4 * * 0"
				}
			}
		}
	],
  "gitHubRunner": "self-hosted",
  "runs-on": "self-hosted",
  "keyVaultName": [xxx],
  "ghTokenWorkflowSecretName": [xxx],
  "storageContextSecretName": "StorageContext",
  "keyVaultCodesignCertificateName": [xxx],
  "appSourceContextSecretName": "AppSourceContext",
  "generateDependencyArtifact": true
}

AL-Go-Settings.json:

{
  "type": "PTE",
  "templateUrl": "https://github.com/microsoft/AL-Go-PTE@main",
  "UseProjectDependencies": true,
  "installOnlyReferencedApps": false,
  "installApps": [],
  "appDependencyProbingPaths": [
    {
      "repo": "https://github.com/nav-x-llc/nav-x-library",
      "version": "latest",
      "release_status": "release",
      "projects": "*",
      "AuthTokenSecret": "githubToken"
    }
  ],
  "deployToUAT": {
    "EnvironmentName": "UAT",
    "DependencyInstallMode": "install",
    "Branches": [
      "main"
    ]
  },
  "deployToTEST": {
    "EnvironmentName": "TEST",
    "DependencyInstallMode": "install",
    "Branches": [
      "feature/*"
    ]
  },
  "templateSha": "a91a50b7fa2a88d8fa0b8eab99a66b9032ac476d"
}

{
  "country": "us",
  "appFolders": [
    "xxx"
  ],
  "testFolders": [
    "xxx.Test"
  ],
  "bcptTestFolders": []
}

[freddydk]

What version of AL-Go are you running?

[freddydk]

Just tried the same here and the conditionalsettings in GitHub variables and it works fine.
At first I thought it didn't - but I get the workflow schedule applied.

My ALGoOrgSettings variable looks like:

{
 "conditionalSettings": [
    {
      "workflows": [
        "Test Next Minor"
      ],
      "settings": {
        "workflowSchedule": {
          "cron": "0 0 1 * *"
        }
      }
    }
  ]
}

[freddydk]

But - this was implemented in 6.4 or 7.0 - so the question is really what version you are on?

[pzentner]

Looking at the fact that the Update AL-Go System Files process ran just over the weekend, we are currently running 7.0 - that's also what I can confirm after looking at the output from the Initialize step, I guess:

Download action repository 'microsoft/AL-Go-Actions@v7.0' (SHA:cbf0216a3a753dc4cd1dfdf71f5d90500d98999a)

From what I can see, the actual processes work and grab the right information.

However the "Deploy to UAT" step still fails:

Downloading BcContainerHelper latest version from Blob Storage
Import from C:\ProgramData\BcContainerHelper\6.1.4\BcContainerHelper\BcContainerHelper.ps1
BcContainerHelper version 6.1.4
Ignoring unchanged config setting useCompilerFolder
Ignoring unchanged config setting SendExtendedTelemetryToMicrosoft
Ignoring unchanged config setting PartnerTelemetryConnectionString
Setting MicrosoftTelemetryConnectionString = InstrumentationKey=cd2cc63e-0f37-4968-b99a-532411a314b8;IngestionEndpoint=https://northeurope-2.in.applicationinsights.azure.com/
BC.HelperFunctions emits usage statistics telemetry to Microsoft
Running on Windows, PowerShell 5.1.20348.2849
project '*'
Processing app: NAV-X_xxx Customizations_1.0.9.0.app
App NAV-X_xxx Customizations_1.0.9.0.app with id 806f982c-d7bb-4cf5-9d2d-fc0152244375 included in deployment
Processing app: NAV-X_xxx Reports_1.0.9.0.app
App NAV-X_xxx Reports_1.0.9.0.app with id 217f0a43-b69f-4d2e-ad06-d6d92e88ca58 included in deployment
Apps to deploy
- NAV-X_xxx Customizations_1.0.9.0.app
- NAV-X_xxx Reports_1.0.9.0.app
Dependencies to install
- NAV-X_NAV-X Library_3.2.[113](https://github.com/nav-x-llc/xxx/actions/runs/14714265642/job/41295240444#step:7:115).0.app
- NAV-X_NAV-X Library_3.2.113.0.app
Attempting authentication to https://api.businesscentral.dynamics.com/.default using clientCredentials...
Authenticated as app ***
EnvironmentUrl: https://businesscentral.dynamics.com/a09a9c86-f287-4cc1-911a-0e3a6a92280e/UAT
Dependency app NAV-X Library is not installed.
Install-BcAppFromAppSource Telemetry Correlation Id: cdeed93a-4cfb-4518-99cc-099fa45b863b
Error: Deploying to UAT failed.  The remote server returned an error: (401) Unauthorized. Unauthorized  (ms-correlation-x = eff9fc21-5e52-38da-11be-2f82790ae59e)
Applying settings from C:\2\_work\xxx\xxx\.github\AL-Go-Settings.json
No settings found in C:\2\_work\xxx\xxx\.AL-Go\settings.json
No settings found in C:\2\_work\xxx\xxx\.github\CICD.settings.json
No settings found in C:\2\_work\xxx\xxx\.AL-Go\CICD.settings.json
No settings found in C:\2\_work\xxx\xxx\.AL-Go\pzentner.settings.json
Enabling Microsoft telemetry...
Error: Process completed with exit code 1.

If I understand this correctly, It can authenticate against the BC environment (it says "authenticated as app ***"), but then it throws an 401 error when actually trying to install the app dependency.

The question here is - why does it do that? Is this due to the Library app (dependency) is an app that is actually in "AppSource" (it is automatically installed when any of our AppSource apps are installed and has a 7x object range), but it's trying to install it as a PTE? Or is that something else that we are doing wrong?

This has been working before, it just recently stopped working and I first thought that credentials or whatever expired, but that's not the case.

[freddydk]

Sorry, I mixed this up with another issue.
QQ - this app: NAV-X_NAV-X Library_3.2.113.0.app is that installed in the UAT environment? and if so, in which version?
We have fixed a few bugs in this area in v7.0, currently in preview - will ship in v7.1 - could you retry this the preview version?
Thanks

[pzentner]

I have updated the repo to the preview.

During the "Check for updates" step, I am now getting an error (has nothing to do with this thing, just wanted to let you know - it's running on a self hosted runner).

Run microsoft/AL-Go/Actions/CheckForUpdates@5cfd7e2ceab0ade7a7b6e46a59a25cd49d3ff3ba
Run C:\2\_work\_actions\microsoft\AL-Go\5cfd7e2ceab0ade7a7b6e46a59a25cd49d3ff3ba\Actions/CheckForUpdates/../Invoke-AlGoAction.ps1 -ActionName "CheckForUpdates" -Action {
Downloading BcContainerHelper preview version from Blob Storage
Import from C:\ProgramData\BcContainerHelper\6.1.5-preview1322\BcContainerHelper\BcContainerHelper.ps1
BcContainerHelper version 6.1.5-preview1322
Ignoring unchanged config setting useCompilerFolder
Ignoring unchanged config setting SendExtendedTelemetryToMicrosoft
Ignoring unchanged config setting PartnerTelemetryConnectionString
Setting MicrosoftTelemetryConnectionString = InstrumentationKey=cd2cc63e-0f37-4968-b99a-532411a314b8;IngestionEndpoint=https://northeurope-2.in.applicationinsights.azure.com/
BC.HelperFunctions emits usage statistics telemetry to Microsoft
Running on Windows, PowerShell 5.1.20348.2849
Applying settings from C:\2\_work\xxx\xxx\.github\AL-Go-Settings.json
No settings found in C:\2\_work\xxx\xxx\.AL-Go\settings.json
No settings found in C:\2\_work\xxx\xxx\.github\CICD.settings.json
No settings found in C:\2\_work\xxx\xxx\.AL-Go\CICD.settings.json
No settings found in C:\2\_work\xxx\xxx\.AL-Go\nav-x-github-operations.settings.json
Enabling Microsoft telemetry...
Error: Unexpected error when running action. Error Message: The response content cannot be parsed because the Internet Explorer engine is not available, or Internet Explorer's first-launch configuration is not complete. Specify the UseBasicParsing parameter and try again. , StackTrace: at <ScriptBlock>, C:\2\_work\_actions\microsoft\AL-Go\5cfd7e2ceab0ade7a7b6e46a59a25cd49d3ff3ba\Actions\CheckForUpdates\CheckForUpdates.ps1: line 51 <- at <ScriptBlock>, C:\2\_work\_temp\05efafda-cec3-491e-801e-2082dcb322a7.ps1: line 3 <- at <ScriptBlock>, C:\2\_work\_actions\microsoft\AL-Go\5cfd7e2ceab0ade7a7b6e46a59a25cd49d3ff3ba\Actions\Invoke-AlGoAction.ps1: line 17 <- at <ScriptBlock>, C:\2\_work\_temp\05efafda-cec3-491e-801e-2082dcb322a7.ps1: line 2 <- at <ScriptBlock>, <No file>: line 1
Error: Process completed with exit code 1.

The actual build completes, but then, the "Deploy to UAT" step doesn't work again with the same error:

Run microsoft/AL-Go/Actions/Deploy@5cfd7e2ceab0ade7a7b6e46a59a25cd49d3ff3ba
Run C:\2\_work\_actions\microsoft\AL-Go\5cfd7e2ceab0ade7a7b6e46a59a25cd49d3ff3ba\Actions/Deploy/../Invoke-AlGoAction.ps1 -ActionName "Deploy" -Action {
Downloading BcContainerHelper preview version from Blob Storage
Import from C:\ProgramData\BcContainerHelper\6.1.5-preview1322\BcContainerHelper\BcContainerHelper.ps1
BcContainerHelper version 6.1.5-preview1322
Ignoring unchanged config setting useCompilerFolder
Ignoring unchanged config setting SendExtendedTelemetryToMicrosoft
Ignoring unchanged config setting PartnerTelemetryConnectionString
Setting MicrosoftTelemetryConnectionString = InstrumentationKey=cd2cc63e-0f37-4968-b99a-[53](https://github.com/nav-x-llc/xxx/actions/runs/14738173882/job/41375742773#step:7:54)2411a314b8;IngestionEndpoint=https://northeurope-2.in.applicationinsights.azure.com/
BC.HelperFunctions emits usage statistics telemetry to Microsoft
Running on Windows, PowerShell 5.1.20348.2849
project '*'
Processing app: NAV-X_xxx Customizations_1.0.10.1.app
App NAV-X_xxx Customizations_1.0.10.1.app with id 806f982c-d7bb-4cf5-9d2d-fc0152244375 included in deployment
Processing app: NAV-X_xxx Reports_1.0.10.1.app
App NAV-X_xxx Reports_1.0.10.1.app with id 217f0a43-b69f-4d2e-ad06-d6d92e88ca58 included in deployment
Apps to deploy
- NAV-X_xxx Customizations_1.0.10.1.app
- NAV-X_xxx Reports_1.0.10.1.app
Dependencies to install
- NAV-X_NAV-X Library_3.2.[113](https://github.com/nav-x-llc/xxx/actions/runs/14738173882/job/41375742773#step:7:115).0.app
- NAV-X_NAV-X Library_3.2.113.0.app
Attempting authentication to https://api.businesscentral.dynamics.com/.default using clientCredentials...
Authenticated as app ***
EnvironmentUrl: https://businesscentral.dynamics.com/a09a9c86-f287-4cc1-911a-0e3a6a92280e/UAT
Dependency app NAV-X Library is not installed.
Install-BcAppFromAppSource Telemetry Correlation Id: 7767283f-2a3c-4fda-a41c-f425957a372f
Error: Deploying to UAT failed.  The remote server returned an error: (401) Unauthorized. Unauthorized  (ms-correlation-x = 931fcd74-850d-3e1c-b93d-5773e699377f)
Applying settings from C:\2\_work\xxx\xxx\.github\AL-Go-Settings.json
No settings found in C:\2\_work\xxx\xxx\.AL-Go\settings.json
No settings found in C:\2\_work\xxx\xxx\.github\CICD.settings.json
No settings found in C:\2\_work\xxx\xxx\.AL-Go\CICD.settings.json
No settings found in C:\2\_work\xxx\xxx\.AL-Go\nav-x-github-operations.settings.json
Enabling Microsoft telemetry...
Error: Process completed with exit code 1.

The library app is not installed in the environment. If I go and deploy the PTE manually, the dependency (NAV-X Library) is installed without a problem automatically from the AppSource repository. From what I see in the behavior, I would think that it's trying to install the dependency via this Deployment step and that would fail, because it's not a PTE. I also can't install it manually as a PTE due to the object range. This, however, has worked before, so I am not sure why it now changed.

[freddydk]

It isn't installing the dependency as a PTE - in the stack trace it says:
Install-BcAppFromAppSource Telemetry Correlation Id: 7767283f-2a3c-4fda-a41c-f425957a372f
which is when it failed trying to install this as an AppSource app.

The problem here might be that the S2S app you are using for installing the PTE doesn't have permissions in Admin Center:

When installing AppSource apps - this is done through the Admin Center API (and not the Automation API as is the case with PTEs) - I would expect that this problem would fail in other places though - but could you verify that your Client Id has access to the Admin Center API?

[pzentner]

Well, that was it. Which is extremely weird, since we always had this not configured (configured with different app ID actually) and it worked before. Did anything change in the functionality?

Well, anyway, it does work now. Thank you very much.

[freddydk]

Yes, something did change - we install AppSource dependencies ourselves now - we didn't do that before.
In some cases - it would work before (when installing PTEs), but when installing AppSource apps or PTEs using impersonation - it wouldn't work.