[Steve Lee (SteveL-MSFT)]

PR Summary

Add Actions type of resource which implements a single invoke operation but declares if it's supported for get, set, test, and/or export`. Input schema required if input taken. Optional output schema if output returned and differs from input schema.

Moved some of the common types from dscresource into new resource folder.

ResourceInvoke trait abstracts resources, actions, and adapters. This resulted in wide code changes which used to take a DscResource. Functions added to trait for common properties across these types and also as_dsc_resource() and as_action() to make it easier to use.

ManifestKind extended with as_action_manifest() and as_resource_manifest() to easily access their respective manifests.

Consolidated the different DiscoveryCache into a single type since they all implement ResourceInvoke which also caused lots of code change.

Other specific changes:

• path and directory in dscresource, extension, and action are now Option
• remove use of unstable feature on config.toml since it's now stable
• add new DscResourceKind that encapulates DscResource and DscAction, this resulted in many changes that formally only expected a DscResource
• add new dsc action list to list actions, did not implement dsc action invoke since expectation is apps use the server apis
• add invoke_dsc_action(), list_dsc_actions(), and show_dsc_action() server APIs
• add tests for new server apis and using actions in configuration
• add test actions that also cover security context and versioning
• command discovery looks separately for actions and caches them separately
• instead of relying on resources cache empty empty to perform discovery, add a flag since there's now 2 types of resources to be discovered

PR Context

Fix #1470

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved moderate issues affect MCP contracts, input validation, configuration behavior, and discovery caching.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 6 · 1

Open (7)

• Action tool contract omits the advertised operation field and Delete variant · New
• Action tool metadata incorrectly describes listing DSC resources · New
• Missing action input bypasses schema validation · New
• Action test path checks Set instead of the executed operation · New
• Resource discovery incorrectly relies on the action cache · New
• Action lookup lacks independent per-type discovery readiness · New
• Action table uses hard-coded untranslated status strings · New

What changed in this PR

Adds DSC action manifests, discovery, configuration support, CLI listing, MCP APIs, schemas, and test coverage.

Changes:

• Adds action discovery, caching, invocation, and validation.
• Adds dsc action list and MCP action tools.
• Integrates actions with configuration and resource dispatch.
• Adds fixtures, tests, localization, and stable Cargo configuration.

File	Summary
tools/​dsctest/​src/​main.rs	Adds action test support and schemas.
tools/​dsctest/​src/​args.rs	Adds action arguments.
tools/​dsctest/​src/​action.rs	Implements test action input/output.
tools/​dsctest/​dsctest.dsc.manifests.json	Adds action manifests.
tools/​dsctest/​dsctest.dsc.action.json	Adds an action fixture.
tools/​dsctest/​.project.data.json	Includes the action fixture.
lib/​dsc-lib/​src/​lib.rs	Exposes action support and resource kinds.
lib/​dsc-lib/​src/​extensions/​dscextension.rs	Corrects directory documentation.
lib/​dsc-lib/​src/​extensions/​discover.rs	Discovers action extensions.
lib/​dsc-lib/​src/​dscresources/​dscresource.rs	Handles resource/action distinctions.
lib/​dsc-lib/​src/​dscresources/​command_resource.rs	Adds action security validation.
lib/​dsc-lib/​src/​discovery/​mod.rs	Adds action caching and lookup; cache readiness needs correction.
lib/​dsc-lib/​src/​discovery/​discovery_trait.rs	Extends discovery APIs for actions.
lib/​dsc-lib/​src/​discovery/​command_discovery.rs	Loads action manifests; resource cache guarding needs correction.
lib/​dsc-lib/​src/​configure/​mod.rs	Executes actions during configuration; test/set operation selection needs correction.
lib/​dsc-lib/​src/​actions/​mod.rs	Registers action modules.
lib/​dsc-lib/​src/​actions/​dscaction.rs	Implements action loading and invocation; missing inputs can bypass validation.
lib/​dsc-lib/​src/​actions/​action_manifest.rs	Defines action schemas; schema transforms need alignment with resource manifests.
lib/​dsc-lib/​locales/​en-us.toml	Adds action messages.
dsc/​tests/​dsc_server.tests.ps1	Tests MCP action tools.
dsc/​tests/​dsc_actions.tests.ps1	Tests action CLI and configuration behavior.
dsc/​src/​subcommand.rs	Adds action listing and validation; required null inputs and localization need correction.
dsc/​src/​server/​show_dsc_resource.rs	Separates actions from resources.
dsc/​src/​server/​show_dsc_action.rs	Adds action details API.
dsc/​src/​server/​mod.rs	Registers action server modules.
dsc/​src/​server/​mcp_server.rs	Registers action tool routers.
dsc/​src/​server/​list_dsc_resources.rs	Restricts listing to resources.
dsc/​src/​server/​list_dsc_actions.rs	Adds action listing; metadata incorrectly describes resources.
dsc/​src/​server/​invoke_dsc_resource.rs	Restricts invocation to resources.
dsc/​src/​server/​invoke_dsc_action.rs	Adds action invocation; metadata does not match the request contract.
dsc/​src/​resource_command.rs	Separates action and resource CLI operations.
dsc/​src/​main.rs	Dispatches the action subcommand.
dsc/​src/​args.rs	Defines action CLI arguments.
dsc/​locales/​en-us.toml	Adds CLI action strings.
dsc-bicep-ext/​src/​main.rs	Rejects actions in Bicep resource operations.
.cargo/​config.toml	Removes obsolete unstable Cargo configuration.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Unresolved critical correctness and compilation issues remain in action handling, discovery, resource invocation, and configuration validation.

15 open issues

• Exporter resources are incorrectly rejected · New
• No-input actions fail unconditional property validation · New
• Support documented output fallback and empty stdout · New
• Unsupported get incorrectly returns null success · New
• Unsupported set incorrectly reports success · New
• Unsupported test incorrectly reports success · New
• Unsupported export returns fabricated output · New
• Match borrowed DiscoveryKind without moving it · New
• Discovery ignores requested kind and misses actions · New
• Add action-specific discovery filter · New
• Track action and resource discovery separately · New
• Avoid moving Kind from borrowed self · New
• Avoid reloading already-resolved action schemas · New
• Locale keys do not match server handler lookups · New
• Tool schema misrepresents action input and what-if support · New

7 resolved since last review

• Action lookup lacks independent per-type discovery readiness
• Resource discovery incorrectly relies on the action cache
• Action test path checks Set instead of the executed operation
• Missing action input bypasses schema validation
• Action tool metadata incorrectly describes listing DSC resources
• Action tool contract omits the advertised operation field and Delete variant
• Action table uses hard-coded untranslated status strings

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

Unresolved invocation deadlocks, metadata handling, discovery gaps, and schema publication defects block reliable action support.

2 open issues

• Avoid passing JSON action input through stdin when using argv · New
• Preserve action manifests through extension discovery · New

6 previously missed issues

In code that hasn't changed since last review

Mark generic action tools as non-idempotent

dsc/​src/​server/​invoke_dsc_action.rs:44

This tool can execute arbitrary action commands, and neither the manifest nor the handler guarantees idempotency. Repeating a restart, notification, or other imperative action can produce additional effects, so advertising every invocation as idempotent gives MCP clients an incorrect retry contract. Mark the generic action tool as non-idempotent unless idempotency is explicitly guaranteed.

Use a distinct export base name for SchemaArgKind

lib/​dsc-lib/​src/​actions/​action_manifest.rs:116

SchemaArgKind and ArgKind share definitions/commandArgs.action.json, although only the latter accepts JSON-input and what-if argument objects. Exporting both will fail the exporter's duplicate-path check and cannot publish their distinct contracts. Give schema-command arguments their own base name.

Skip metadata injection for schema-less action input

lib/​dsc-lib/​src/​configure/​mod.rs:292

For a no-input action with resource metadata, including metadata added by a copy loop, this helper injects _metadata into otherwise empty input. The action then rejects that input with SchemaNotAvailable. Skip metadata injection when an action has no input schema and no properties were supplied.

Reject native actions when require_adapter is specified

lib/​dsc-lib/​src/​discovery/​mod.rs:197

For an action, as_dsc_resource() returns None, so this condition falls through to true even when the filter specifies require_adapter. A configuration that pins an adapter can therefore select a native action that does not require that adapter, violating the filter contract used by filter_resources(). Reject non-resource candidates when an adapter requirement is present.

Populate DscResource.author from resource manifests

lib/​dsc-lib/​src/​dscresources/​resource_manifest.rs:68

The new author field is accepted in resource manifests, but load_resource_manifest() never copies it into DscResource.author, which defaults to None. Consequently, dsc resource list reports a null author and show_dsc_resource omits it even when the manifest supplies one. Copy the field while constructing the discovered resource, as the action loader does.

Register action schemas in the explicit export list

xtask/​src/​schemas/​export.rs:113

The explicit schema export list contains no action types, so schema generation never produces bundled/action/manifest.json, which the new fixtures reference. Deriving DscRepoSchema does not register these types automatically. Register the action manifest, output, and supporting schemas after resolving their conflicting export paths.

15 resolved since last review

• Avoid moving Kind from borrowed self
• Track action and resource discovery separately
• Add action-specific discovery filter
• Discovery ignores requested kind and misses actions
• Match borrowed DiscoveryKind without moving it
• Unsupported export returns fabricated output
• Unsupported test incorrectly reports success
• Unsupported set incorrectly reports success
• Unsupported get incorrectly returns null success
• Support documented output fallback and empty stdout
• No-input actions fail unconditional property validation
• Exporter resources are incorrectly rejected
• Avoid reloading already-resolved action schemas
• Tool schema misrepresents action input and what-if support
• Locale keys do not match server handler lookups

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unresolved action execution, manifest loading, schema export, and discovery-cache defects prevent approval.

2 open issues

• Use a valid directory for inline action manifests · New
• Register action manifest schemas for export · New

5 previously missed issues

In code that hasn't changed since last review

Do not advertise arbitrary actions as idempotent

dsc/​src/​server/​invoke_dsc_action.rs:44

An arbitrary action is not guaranteed to be idempotent: this handler executes its command on every call without a convergence check, so repeating an action can repeat side effects. Advertising idempotent_hint = true incorrectly tells MCP clients that repeated invocations have no additional effect. Use false for this generic invocation tool unless idempotence is explicitly established for every action it can invoke.

Load actions from ManifestList content

lib/​dsc-lib/​src/​discovery/​command_discovery.rs:58

The ManifestList branch of load_manifest_content ignores the new actions member, so an extension returning manifestContent: {"actions": [...]} silently loses those actions. Add condition evaluation and action loading to that branch, using a valid directory context for inline manifests.

Persist discovery readiness across manager requests

lib/​dsc-lib/​src/​discovery/​command_discovery.rs:576

Each new DscManager creates a fresh CommandDiscovery with resources_discovered = false, so successive server requests rescan paths and rerun extension discovery and command-backed action schema providers despite the populated static cache. Keep readiness state at the cache's lifetime, or reuse the discovery instance, while preserving explicit refresh behavior.

Reject input for schema-less actions

lib/​dsc-lib/​src/​dscresources/​dscresource.rs:808

This unconditional success accepts properties for schema-less actions even though invocation rejects every nonempty input string. It also lets add_metadata inject _metadata, causing a no-input action with even metadata: {} to fail with SchemaNotAvailable. Reject supplied input during validation and keep configuration metadata out of the payload, preserving an empty input string when properties are absent.

Copy manifest author into discovered resources

lib/​dsc-lib/​src/​dscresources/​resource_manifest.rs:68

The new author field is never copied into the discovered DscResource, so dsc resource list reports a null author and show_dsc_resource omits it even when the manifest supplies one. Assign resource.author = manifest.author.clone() alongside the description in load_resource_manifest (lib/dsc-lib/src/discovery/command_discovery.rs:1094).

2 resolved since last review

• Avoid passing JSON action input through stdin when using argv
• Preserve action manifests through extension discovery

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unresolved discovery failures, cache handling errors, and action input handling defects prevent reliable action execution.

9 open issues

• Provide fallback paths for inline schema loading · New
• Avoid empty working directories for inline actions · New
• Preserve pathless inline adapted-resource manifests · New
• Enforce adapter requirements for native actions · New
• Keep engine metadata out of no-input action payloads · New
• Load actions from inline manifest content · New
• Share discovery readiness with process-wide caches · New
• Track discovery coverage for requested version filters · New
• Reject properties when no input schema exists · New

2 resolved since last review

• Register action manifest schemas for export
• Use a valid directory for inline action manifests

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Adapter invocation, validation, cache identity, and action API contracts have unresolved correctness issues.

3 open issues

• Preserve boolean JSON schemas in input schema accessors · New
• Include adapter identity when deduplicating fallback candidates · New
• Emit resource path value only when adapted path exists · New

3 previously missed issues

In code that hasn't changed since last review

Do not advertise idempotence for action invocations

dsc/​src/​server/​invoke_dsc_action.rs:44

Action invocation always executes the command, and the manifest provides no idempotency guarantee. Advertising idempotent_hint = true tells MCP clients that repeating a call has no additional effects, which is unsafe for actions such as restarting a service and can repeat disruptive side effects on retries. Set this hint to false unless the action explicitly guarantees idempotence.

Allow boolean schemas in show_dsc_action responses

dsc/​src/​server/​show_dsc_action.rs:16

The manifest accepts boolean JSON Schemas, and get_schema preserves them, so show_dsc_action can return inputSchema: true or outputSchema: false. This response schema excludes both values, causing schema-validating MCP clients to reject an otherwise successful response. Allow booleans alongside objects and null.

Preserve adapter schema validation for action resources

dsc/​src/​subcommand.rs:532

validate_properties requires a local schema or manifest before it tries schema(). Resources returned by an adapter's list command, such as Adapted/One, have neither, so this unconditional call makes valid adapted configurations fail with a missing-manifest error; the previous ImplementedAs::Command guard skipped them. Preserve that behavior while including actions, or extend the helper to validate through the adapter-provided schema.

9 resolved since last review

• Enforce adapter requirements for native actions
• Preserve pathless inline adapted-resource manifests
• Avoid empty working directories for inline actions
• Provide fallback paths for inline schema loading
• Reject properties when no input schema exists
• Track discovery coverage for requested version filters
• Share discovery readiness with process-wide caches
• Load actions from inline manifest content
• Keep engine metadata out of no-input action payloads

_{Review effort: Balanced}