AzureDevOpsGitHook

Git hook that authenticates Azure DevOps HTTPS remotes with Entra ID.

airflow.providers.git_azure.hooks.git_azure.AZURE_DEVOPS_RESOURCE = '499b84ac-1321-427f-aa17-267ca6975798'

Azure DevOps resource application ID — the token audience Azure DevOps accepts for Git-over-HTTPS authentication.

class airflow.providers.git_azure.hooks.git_azure.AzureDevOpsGitHook(git_conn_id: str = 'git_default', repo_url: str | None = None, *args: Any, **kwargs: Any)

Bases: GitHook

Transparent Git hook that adds Microsoft Entra ID auth for Azure DevOps.

Behaves exactly like the stock GitHook unless the repository URL is an Azure DevOps HTTPS URL (dev.azure.com or *.visualstudio.com), in which case an Entra ID access token is minted per git command from one of two credential sources:

  • Client secret — when the connection carries a login (client ID), a password (client secret), and a tenant_id extra, a ClientSecretCredential is used. Note: the password is treated as an Entra client secret here, not as a git password — it is never embedded in the remote URL.

  • Workload identity — when the connection carries no credential at all, WorkloadIdentityCredential (falling back to DefaultAzureCredential outside AKS, e.g. local development).

Everything else passes through to the stock behaviour untouched: GitHub (or other) URLs, SSH-key connections (private_key/key_file extras), and ADO connections whose password is a PAT (i.e. no tenant_id extra).

Independently of the auth mode, the connection extra tracking_ref can override the branch/tag the bundle tracks (exposed as tracking_ref_override, consumed by AzureDevOpsGitDagBundle).

azure-identity caches the token internally and transparently re-mints it when it nears expiry, so every git command gets a valid token even after the ~1 hour Entra token lifetime. The token is injected per git command as an http.extraHeader through GIT_CONFIG_* environment variables, so it is never embedded in the remote URL and never persisted to .git/config.

Parameters:

  • git_conn_id – Connection ID holding the repository URL as host

  • repo_url – Explicit Git repository URL to override the connection’s host.

configure_hook_env()

Yield with self.env set to inject a fresh Entra ID token for this git command.

In Azure mode a token is minted per invocation and passed via GIT_CONFIG_* so it never touches the remote URL or .git/config. Outside Azure mode, delegates to the stock ~airflow.providers.git.hooks.git.GitHook.configure_hook_env.

get_access_token() → str

Return a valid Entra ID access token for the Azure DevOps resource.

Retries on ClientAuthenticationError — see _TOKEN_MAX_ATTEMPTS.