Provision command doesn`t work in Pipelines because it always asks for login

[bastianveltin]

Describe the bug
We wanna do the whole build and deployment process within a Github Actions Pipeline.
But The 'teamsapp provision' command is always asking for a login via Link:

'Log in to your Microsoft 365 account - opening default web browser at ....'

The 'deploy' step works fine without asking for a login.

To Reproduce
This is the github Action:
`

steps:
  - name: "Checkout GitHub Action"
    uses: actions/checkout@v4
  - name: "Setup Node ${{ env.NODE_VERSION }}"
    uses: actions/setup-node@v4
    with:
      node-version: ${{ env.NODE_VERSION }}

  - name: "Install CLI"
    run: |
      npm install @microsoft/teamsapp-cli@${{ env.TEAMSAPP_CLI_VERSION }}

  - name: "Azure Login as Service Principal"
    run: |
      npx teamsapp auth login azure --username ${{ vars.GA_WORKFLOW_CLIENT_ID }}  \
      --service-principal true \
      --tenant ${{ vars.AZURE_TENANT_ID }} \
      --password ${{ secrets.GA_WORKFLOW_CLIENT_SECRET }} \
      --interactive false

  - name: "Provision resources to hosting environment"
    run: |
      npx teamsapp provision --env ${{ inputs.environment }} --verbose --interactive false
  - name: "Deploy to hosting environment"
    run: |
      npx teamsapp deploy --env ${{ inputs.environment }} --verbose --interactive false

`

Expected behavior
Execute the provision step without user interaction.

Screenshots

VS Code Extension Information (please complete the following information):

• OS: [e.g. iOS]
• Version [e.g. 22]

CLI Information (please complete the following information):

• OS: [e.g. iOS8.1]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

[teams-toolkit-assistant]

👋 Hi @bastianveltin,

Thank you for reporting this issue! We want to let you know that:

⏱️ Our team will personally review your issue
🎯 You can expect a response within 2 business days

✨ This is an AI-generated initial response
🤖 AI-Generated Preliminary Analysis:

The issue you are encountering is due to the teamsapp provision command prompting for login during the provisioning step, despite using the --interactive false flag. This is likely because the Teams Toolkit CLI requires authentication to Microsoft 365, which isn't being handled correctly in the non-interactive mode.

Here are some steps and suggestions to resolve this issue:

1. Set Environment Variables for M365 Login: Ensure that you set the environment variables for M365 account name and password. This can help in bypassing the login prompt.

- name: "Azure Login as Service Principal"
  run: |
    npx teamsapp auth login azure --username ${{ vars.GA_WORKFLOW_CLIENT_ID }}  \
    --service-principal true \
    --tenant ${{ vars.AZURE_TENANT_ID }} \
    --password ${{ secrets.GA_WORKFLOW_CLIENT_SECRET }} \
    --interactive false
  env:
    M365_ACCOUNT_NAME: ${{ secrets.M365_ACCOUNT_NAME }}
    M365_ACCOUNT_PASSWORD: ${{ secrets.M365_ACCOUNT_PASSWORD }}
    CI_ENABLED: true
    M365_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}

2. Check for 2FA: If your M365 account has two-factor authentication (2FA) enabled, the environment variables method might not work. You may need to use a service principal or another method that does not require interactive login.

3. Refer to Documentation: Refer to the GitHub issue and documentation that discuss this problem. They provide insights and potential solutions. Here is a link to the relevant GitHub issue and the Microsoft documentation.

4. Example Workflow: Here is an example of a GitHub Actions workflow with the required environment variables and steps:

name: CI/CD Pipeline

on: [push]

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    
    steps:
      - name: "Checkout GitHub Action"
        uses: actions/checkout@v4

      - name: "Setup Node ${{ env.NODE_VERSION }}"
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: "Install CLI"
        run: |
          npm install -g @microsoft/teamsapp-cli@${{ env.TEAMSAPP_CLI_VERSION }}

      - name: "Azure Login as Service Principal"
        run: |
          npx teamsapp auth login azure --username ${{ vars.GA_WORKFLOW_CLIENT_ID }}  \
          --service-principal true \
          --tenant ${{ vars.AZURE_TENANT_ID }} \
          --password ${{ secrets.GA_WORKFLOW_CLIENT_SECRET }} \
          --interactive false
        env:
          M365_ACCOUNT_NAME: ${{ secrets.M365_ACCOUNT_NAME }}
          M365_ACCOUNT_PASSWORD: ${{ secrets.M365_ACCOUNT_PASSWORD }}
          CI_ENABLED: true
          M365_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}

      - name: "Provision resources to hosting environment"
        run: |
          npx teamsapp provision --env ${{ inputs.environment }} --verbose --interactive false

      - name: "Deploy to hosting environment"
        run: |
          npx teamsapp deploy --env ${{ inputs.environment }} --verbose --interactive false

Following these steps and incorporating the necessary environment variables should help you bypass the login prompt during the teamsapp provision command in your CI/CD pipeline. If you continue to face issues, please provide additional details or error messages for further assistance.

---

Note: This is an automated first response generated by AI. A human team member will review your issue and provide a more detailed response soon. We appreciate your patience!

[Nivedipa-MSFT]

@bastianveltin - Thank you for bringing this issue to our attention. Could you please share the document you are following for this?

[yukun-dong]

Hi @bastianveltin ,
The "provision" command involves steps such as creating a Teams app ID, which requires your Microsoft 365 account. Since logging into a Microsoft 365 account requires disable 2FA, we recommend only including the deploy step in the pipeline.

If you really want to include the "provision" step in pipeline, you can disable 2FA for your m365 account and set these in the env:
M365_ACCOUNT_NAME
M365_ACCOUNT_PASSWORD
CI_ENABLED: true

[bastianveltin]

I understand the point with the App Creation.

What we wanna do is to update the App Registration after changes in the aad.manifest.json automatically in our pipeline.

If this is not possible to do within the provision step, we will try to update the app registration via cli.

[yukun-dong]

@bastianveltin If that's the case, you can follow my last reply to include "provision" step in pipeline:

If you really want to include the "provision" step in pipeline, you can disable 2FA for your m365 account and set these in the env: M365_ACCOUNT_NAME M365_ACCOUNT_PASSWORD CI_ENABLED: true

I will close this issue for now. Please reopen if you need more help.