[Resource] Prevent IndexError in az policy assignment list --scope parsing

[Copilot]

Related command
az policy assignment list --scope <scope>

Description
az policy assignment list --scope <resource-group> could crash with IndexError when --scope was not in an expected ARM ID shape. This change hardens scope parsing so invalid shapes produce a normal argument validation error instead of an unhandled exception.

• Scope parser hardening

  • Guard index access in Common.ResolveScopeForList with length checks before reading scope segments.
  • Keep existing behavior for valid management group and subscription scopes.
  • Only set resource_group when the segment is explicitly resourceGroups (case-insensitive).

• Behavioral test coverage

  • Added focused unit tests for:
    • malformed/short scope -> InvalidArgumentValueError
    • valid subscription/resource-group scope parsing
    • valid management-group scope parsing

scope_parts = ctx.args.scope._data.split('/')
if len(scope_parts) > 4 and scope_parts[1] == 'providers':
    ...
elif len(scope_parts) > 2 and scope_parts[1] == 'subscriptions':
    ...

Testing Guide

# Repro path this PR addresses
az policy assignment list --scope <malformed-scope>

# Expected with this change:
# command returns InvalidArgumentValueError instead of IndexError traceback

History Notes
[Resource] az policy assignment list: Prevent IndexError for malformed --scope by validating scope segment access

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

• Fixes Running az policy assignment list gives an IndexError #33786

[azure-client-tools-bot-prd]

Hi @copilot,
Since the current milestone time is less than 7 days, this pr will be reviewed in the next milestone.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-client-tools-agent]

Live test results — azdev test --live --series (changed test files only)

✅ PASS

Selectors: test_resource_validators (module)
PR head ref: copilot/fix-az-policy-assignment-index-error
PR head sha: 28c569e9ffc7c7b08315fa23d08283adf22dbabb
PR base ref: dev
New test files in PR: false

Changed test files run

src/azure-cli/azure/cli/command_modules/resource/tests/latest/test_resource_validators.py

Workflow run: https://github.com/Azure/issue-sentinel/actions/runs/30100594031

Last 80 lines of azdev output

=============
| Run Tests |
=============


=====================
| Discovering Tests |
=====================

/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli/azure/cli/command_modules/identity/tests/latest/test_identity.py:18: SyntaxWarning: invalid escape sequence '\{'
  'resource_restriction_compute': '\{"providers":\["Microsoft.Compute"\]\}',
/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli/azure/cli/command_modules/identity/tests/latest/test_identity.py:19: SyntaxWarning: invalid escape sequence '\{'
  'resource_restriction_empty': '\{"providers":\[\]\}'
/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py:13533: SyntaxWarning: invalid escape sequence '\]'
  self.cmd('vmss application set -g {rg} -n {vmss} --app-version-ids {vid1} {vid2} --enable-automatic-upgrade True\]', checks=[

test index updated: /home/runner/.azdev/env_config/home/runner/work/issue-sentinel/issue-sentinel/.venv/test_index/latest.json

Test on modules: test_resource_validators

WARNING: RUNNING TESTS LIVE
The tests are set to run against current profile "latest"
============================= test session starts ==============================
platform linux -- Python 3.12.13, pytest-9.1.1, pluggy-1.6.0 -- /home/runner/work/issue-sentinel/issue-sentinel/.venv/bin/python
cachedir: .pytest_cache
rootdir: /home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli
plugins: xdist-3.8.0, forked-1.6.0
collecting ... collected 6 items

azure-cli/src/azure-cli/azure/cli/command_modules/resource/tests/latest/test_resource_validators.py::TestResourceValidators::test_generate_deployment_name_from_file PASSED [ 16%]
azure-cli/src/azure-cli/azure/cli/command_modules/resource/tests/latest/test_resource_validators.py::TestResourceValidators::test_validate_lock_params PASSED [ 33%]
azure-cli/src/azure-cli/azure/cli/command_modules/resource/tests/latest/test_resource_validators.py::TestResourceValidators::test_validate_lock_params_invalid PASSED [ 50%]
azure-cli/src/azure-cli/azure/cli/command_modules/resource/tests/latest/test_resource_validators.py::TestPolicyCommon::test_resolve_scope_for_list_raises_for_short_scope PASSED [ 66%]
azure-cli/src/azure-cli/azure/cli/command_modules/resource/tests/latest/test_resource_validators.py::TestPolicyCommon::test_resolve_scope_for_list_sets_management_group_for_mg_scope PASSED [ 83%]
azure-cli/src/azure-cli/azure/cli/command_modules/resource/tests/latest/test_resource_validators.py::TestPolicyCommon::test_resolve_scope_for_list_sets_resource_group_for_subscription_scope PASSED [100%]

- generated xml file: /home/runner/work/issue-sentinel/issue-sentinel/test-output/results.xml -
============================== 6 passed in 0.26s ===============================

Posted by agent-assist live-test workflow.

[azure-client-tools-agent]

CI Review — Changes Requested

The Azure DevOps validation pipeline for this PR has 2 failing checks (Build #20260724.16):

• ❌ Azure.azure-cli — build/lint/test job failed. See the Azure DevOps build results: https://dev.azure.com/azclitools/5147fa83-336e-44ef-bbe0-c86b8ae86cbb/_build/results?buildId=332511
• ❌ Azure.azure-cli (Test Homebrew Formula) — Homebrew formula test failed, tied to the same build (buildId=332511).

The live-test workflow (live-test.yml) for the changed test file(s) passed successfully, so the regression is isolated to the ADO build/lint/homebrew-formula checks above, not the live functional test.

@copilot please investigate the failing Azure.azure-cli build and Test Homebrew Formula checks linked above (open the ADO build to see the exact failing step/log), fix the root cause, and push an update to this PR.

---

Posted by agent-assist (autonomous bug-fix pipeline).

[a0x1ab]

@copilot the automated CI and live-test review on this PR found failures. Please look into the requested changes here: #33787 (review) and push a fix.

---

Posted by agent-assist (autonomous bug-fix pipeline).