[Bug] AZ Devops CLI commands in ADO Devops Pipelines: Warnings cause fatal errors

[JoelMiller74]

Is your feature request related to a problem? Please describe.
I tried to open a bug or issue report here as I was directed to in this issue: Azure/azure-cli#31591 (comment). However, the interface only allows submitting a feature and not a issue/bug.
The issue I am having is the use of AZ CLI using the azure-devops extension. When using the task: AzureCLI@2 in Azure Devops YAML pipelines, I am now receiving the following fatal error when using AZ CLI commands. Although this is a UserWarning, it causes the pipeline to fatally fail at the end of the run. This is just a warning and this warning just started happening (to a lot of people) when it did not happen before. It is a deprecation warning and should not be treated as a fatal error.

/opt/az/azcliextensions/azure-devops/azext_devops/dev/__init__.py:5: **UserWarning:** pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources
**##[error]/**opt/az/azcliextensions/azure-devops/azext_devops/dev/__init__.py:5: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.

Example Azure DevOps Task:
I have had the same issue this week. In my case I am also using the hosted Unbuntu 24.04 image and the 'warning' is bubbling up as a terminal error when using an AzureCLI task with failOnStandardError: true. This is a UserWarning, but creates an ##[error] as seen below.

- task: AzureCLI@2
  inputs:
    azureSubscription: 'mySubscription'
    ScriptType: 'pscore'
    scriptLocation: 'inlineScript'
    visibleAzLogin: false
    **failOnStandardError: true**

Example Output:

Starting: Get Pipeline Execution Count
==============================================================================
Task         : Azure CLI
Description  : Run Azure CLI commands against an Azure subscription in a PowerShell Core/Shell script when running on Linux agent or PowerShell/PowerShell Core/Batch script when running on Windows agent.
Version      : 2.256.0
Author       : Microsoft Corporation
Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/deploy/azure-cli
==============================================================================
/usr/bin/az --version
azure-cli                         2.74.0

core                              2.74.0
telemetry                          1.1.0

Extensions:
azure-devops                       1.0.1

Dependencies:
msal                              1.32.3
azure-mgmt-resource               23.3.0

Python location '/opt/az/bin/python3'
Config directory '/home/vsts/.azure'
Extensions directory '/opt/az/azcliextensions'

Python (Linux) 3.12.10 (main, May 27 2025, 09:12:37) [GCC 13.3.0]

Legal docs and information: aka.ms/AzureCliLegal


Your CLI is up-to-date.
Setting AZURE_CONFIG_DIR env variable to: /home/vsts/work/_temp/.azclitask
Setting active cloud to: AzureCloud
/usr/bin/az cloud set -n AzureCloud
/opt/az/azcliextensions/azure-devops/azext_devops/dev/__init__.py:5: **UserWarning:** pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources
**##[error]/**opt/az/azcliextensions/azure-devops/azext_devops/dev/__init__.py:5: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.

Example commands and failures:

$ReposArrayList = [System.Collections.ArrayList]($(az repos list -o json | convertfrom-json | where-object { $_.name -like '�df-*' }).name)
/opt/az/azcliextensions/azure-devops/azext_devops/dev/__init__.py:5: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources

$PRArrayList = $(az repos pr list --repository adf-aac --creator --status active -o json | convertfrom-json | where-object { .title -eq 'Update ADO pipeline from adf-standards' }).codeReviewId
/opt/az/azcliextensions/azure-devops/azext_devops/dev/__init__.py:5: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources

$Branches = $(az repos ref list --repository $Repo --filter 'heads/update-pipeline-branch-' -o json | convertfrom-json)
/opt/az/azcliextensions/azure-devops/azext_devops/dev/__init__.py:5: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources

Describe the solution you'd like
I am not sure how this can be properly handled, but an internal command that we we do not have access to edit is writing a warning deprecation to the output. That output is automatically being interpreted as a fatal error and quitting. When an actual error happens, I want to ensure we quit with a fatal error. However, a warning should just be displayed so we are aware. Having the option to show warnings (like deprecations) in the pipeline Summary page is helpful for visibility.

Additional context
Related tickets:
Azure/azure-cli#31591
Azure/azure-cli-extensions#8833
Azure/azure-cli#31616
Azure/azure-cli#30276
actions/runner-images#12403
actions/runner-images#12361
Azure/azure-cli#26330

[JJ-towerswatson]

We're experiencing the same issue in our project. The pkg_resources is deprecated as an API... error is causing our pipelines to fail.

For time being, we are using this as a temporary solution: https://stackoverflow.com/questions/51426000/azure-cli-exception-handling/72032761#72032761

[robpow]

From the original issue linked in the opening comments, the problem is triggered from setuptools and there is a workaround to downgrade it, eg:
pip install setuptools==80.8.0 --force-reinstall

[JoelMiller74]

I was using the workaround for pip install to downgrade but I was worried about 2 things.

• My pipelines need to run that downgrade each time the pipeline runs.
• Once Microsoft made changes to resolve the issue, most likely I would not know and this 'downgrade' (or install if it is no longer there) would still be running in many pipelines throughout my environment.

I was also told that using using failOnStandardError: true is not reliable and should not really be used.

One last recommendation is to use a Powershell experimental feature to better handle receiving errors from CLI calls. However, that post is older and that feature went GA in Powershell 7.3. The preference variable is $psnativecommanduseerroractionpreference.
The release notes calling this out are here:
https://learn.microsoft.com/en-us/powershell/scripting/whats-new/what-s-new-in-powershell-73?view=powershell-7.5

The Docs for this preference variable are here:
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_preference_variables?view=powershell-7.5#psnativecommanduseerroractionpreference

Now, when I am running an AzureCLI@2 task and using ScriptType: 'pscore', I am removing this input as it is no longer needed or suggested:
failOnStandardError: true

and then within my PowerShell script I add these 2 Variable Preferences:
$ErrorActionPreference = 'Stop'
$PSNativeCommandUseErrorActionPreference = $true

This ensures that if there is a PowerShell Error, the action taken is to display the error and fatally quit (don't keep going) and then if there is a CLI command like 'az devops login' and the exit code of that CLI command is non-zero, the same thing will happen: the action taken is to display the error and fatally quit as set in $ErrorActionPreference

This works as a workaround but I wish I had a way to set these items globally so each AzureARM@2 task did not have to have these 2 lines. The issue above still appears to be a regression and I feel this should be resolved, but I can work around that issue by using the 2 items above so I can continue work.

[sheldonhull]

This works as a workaround but I wish I had a way to set these items globally so each AzureARM@2 task did not have to have these 2 lines. The issue above still appears to be a regression and I feel this should be resolved, but I can work around that issue by using the 2 items above so I can continue work.

@JoelMiller74 Not ideal, but if you do this, consider wrapping the pwsh task with the changes you desire as a template, then whenever the behavior changes you can change in your template repo and ever calling project that has this template invoked would be good to go.

Not something I typically do with built in tasks, but might be a life saver if you have to change this across many places at once. 👍

example generated template

example code

# PowerShell Task Template for Azure Pipelines
# This template wraps the default PowerShell task with configurable parameters and sensible defaults

parameters:
  # Required parameters
  - name: script
    type: string
    displayName: 'PowerShell Script'
    
  # Optional parameters with defaults
  - name: displayName
    type: string
    default: 'PowerShell Script'
    displayName: 'Task Display Name'
    
  - name: errorActionPreference
    type: string
    default: 'stop'
    displayName: 'Error Action Preference'
    values:
      - stop
      - continue
      - silentlyContinue
      
  - name: failOnStderr
    type: boolean
    default: true
    displayName: 'Fail on Standard Error'
    
  - name: ignoreLASTEXITCODE
    type: boolean
    default: false
    displayName: 'Ignore Last Exit Code'
    
  - name: pwsh
    type: boolean
    default: true
    displayName: 'Use PowerShell Core (pwsh)'
    
  - name: workingDirectory
    type: string
    default: '$(System.DefaultWorkingDirectory)'
    displayName: 'Working Directory'
    
  - name: condition
    type: string
    default: 'succeeded()'
    displayName: 'Condition'
    
  - name: continueOnError
    type: boolean
    default: false
    displayName: 'Continue on Error'
    
  - name: enabled
    type: boolean
    default: true
    displayName: 'Enabled'
    
  - name: timeoutInMinutes
    type: number
    default: 0
    displayName: 'Timeout (minutes, 0 = no timeout)'

steps:
  - task: PowerShell@2
    displayName: ${{ parameters.displayName }}
    inputs:
      targetType: 'inline'
      script: |
		$PSNativeCommandUseErrorActionPreference = $true
        ${{ parameters.script }}
      errorActionPreference: ${{ parameters.errorActionPreference }}
      failOnStderr: ${{ parameters.failOnStderr }}
      ignoreLASTEXITCODE: ${{ parameters.ignoreLASTEXITCODE }}
      pwsh: ${{ parameters.pwsh }}
      workingDirectory: ${{ parameters.workingDirectory }}
    condition: ${{ parameters.condition }}
    continueOnError: ${{ parameters.continueOnError }}
    enabled: ${{ parameters.enabled }}
    ${{ if ne(parameters.timeoutInMinutes, 0) }}:
      timeoutInMinutes: ${{ parameters.timeoutInMinutes

then invoked in your other places with:

# Reference the templates repository
resources:
  repositories:
    - repository: templates
      type: git
      name: proj/azure-pipeline-templates
      ref: refs/heads/main
stages:
  - stage: Build
    displayName: 'Build Stage'
    jobs:
      - job: BuildJob
        displayName: 'Build Job'
        steps:
          # Example 1: Basic usage with placeholder script
          - template: templates/powershell-task.yml@templates
            parameters:
              script: |
                Write-Host "=== Build Script Placeholder ==="
                Write-Host "Build started at: $(Get-Date)"
                Write-Host "Working directory: $(Get-Location)"
                Write-Host "Available environment variables:"
                Get-ChildItem Env: | Where-Object Name -like "*BUILD*" | Format-Table Name, Value
                Write-Host "Build completed successfully!"

Not a perfect solution, but for anyone who isn't familiar with templating, figured an example like this might be useful to show how you could update in one place and avoid having to refactor everywhere.

[v-soujanya]

we have published the new version 1.0.2 of azure-devops-cli-extension which should fix the issue for customers.

[Albert0sans]

Still getting this issue in a powershell@5 Task pipeline

[robpow]

If you run az --version you can see if you have the new devops extension 1.0.2, if not run az upgrade

[AndrewEhlo]

@robpow still getting this in AzureCLI@2 task using devops extension v1.0.2

***the log has been edited to hide sensitive data

[jenshnielsen]

@AndrewEhlo Looking at the traceback I think that is coming from https://github.com/Azure/azure-multiapi-storage-python Looking at the changelog it seems that the issue has also been resolved in version 1.4.1 / 1.5.0 of that package, Not sure how to best update that thou