{Branch Management} Fix merge-base: Merge release 2.89.1 hotfixes back to dev

[Naga Nandyala (naga-nandyala)]

Fix merge-base between release and dev

After the 2.89.1 hotfix train landed on release (PR #33861), the hotfix commits need to come back to dev so the two branches stay in sync and future scans/CI on dev do not drift.

Commits being merged back

#	Commit	PR	Description
1	2e67654b4b	#33860 / #33861	[Ssh] az ssh: Allow SSH certificate flow in Cloud Shell (code already in dev via #33860)
2	4af9e3aea1	#33861	{Release} Upgrade to Azure CLI 2.89.1
3	d3d81d5007	#33861	Merge pull request #33861 (hotfix merge commit)

State before this PR

upstream/release HEAD	d3d81d5007
upstream/dev HEAD	60a6b14db9
merge-base	0ff7e508d6 (2.89.0)
Commits in release not in dev	3
Files changed	13

What this PR does

This PR satisfies the azure-production-ruleset pull-request requirement and uses a GitHub merge commit to link release history into dev. Squash or rebase must not be used because they do not preserve release as an ancestor of dev.

Note: the SSH _profile.py change was already present in dev via #33860, so it contributed no net diff. The substantive incoming change was the 2.89.1 version bump and HISTORY entries.

Repository configuration required

1. In Settings > General > Pull Requests, enable Allow merge commits.
2. In Settings > Rules > Rulesets > Copilot review, add the repository role that will perform the merge to the bypass list with Always allow:
   • Add Repository admins for admin merges.
   • Add Repository maintainers too if maintainers must perform this operation.

The bypass is required because the Copilot review ruleset otherwise permits only squash merges for dev.

How to merge future release backports

1. Open a PR from release to dev.
2. Obtain approval and wait for all required checks to pass.
3. Select Create a merge commit. Do not select squash or rebase.
4. Select Merge without waiting for requirements to be met (bypass rules).
5. Merge the PR.

CLI equivalent for a repository admin:

gh pr merge <PR_NUMBER> --repo Azure/azure-cli --merge --admin

Do not merge locally and push directly to dev; branch protection and the organization ruleset require the change to be merged through the PR.

Result

PR #33869 was merged as 9a2c8e0bee95f1a954bc397b4f229d1db8ae128f with two parents:

• 60a6b14db9e6fd2fc7ed1d7c291fae936c5c3416 (dev before the merge)
• d3d81d5007da1688e8dc1e65d852151176fad757 (release)

The dev/release merge-base is now d3d81d5007da1688e8dc1e65d852151176fad757.

Reference

Related historical processes: PR #33305 and PR #33283.

[Yong Zhang (yonzhan)]

Thank you for your contribution! We will review the pull request and get back to you soon.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR merges the release branch’s 2.89.1 hotfix train back into dev to re-align branch history (merge-base) and keep dev in sync for future CI/scans.

Changes:

• Bump Azure CLI and azure-cli-core version references from 2.89.0 to 2.89.1 across packaging, requirements pins, and command/help index metadata.
• Add 2.89.1 release notes entries to both azure-cli and azure-cli-core HISTORY files.
• Update VM SSH get_msal_token() behavior to allow Cloud Shell SSH certificate flow (while keeping managed identity unsupported) and adjust/extend related unit tests.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/azure-cli/setup.py	Bumps CLI package version to 2.89.1 (and keeps setup validation aligned).
src/azure-cli/requirements.py3.windows.txt	Pins azure-cli / azure-cli-core to 2.89.1 for Windows.
src/azure-cli/requirements.py3.Linux.txt	Pins azure-cli / azure-cli-core to 2.89.1 for Linux.
src/azure-cli/requirements.py3.Darwin.txt	Pins azure-cli / azure-cli-core to 2.89.1 for macOS.
src/azure-cli/HISTORY.rst	Adds 2.89.1 release notes entry (Core).
src/azure-cli/azure/cli/main.py	Updates CLI runtime __version__ to 2.89.1.
src/azure-cli-core/setup.py	Bumps core package version to 2.89.1.
src/azure-cli-core/HISTORY.rst	Adds 2.89.1 release notes entry.
src/azure-cli-core/azure/cli/core/tests/test_profile.py	Updates tests to reflect Cloud Shell SSH-cert support and new MI-only error text.
src/azure-cli-core/azure/cli/core/helpIndex.latest.json	Updates help index version metadata to 2.89.1.
src/azure-cli-core/azure/cli/core/commandIndex.latest.json	Updates command index version metadata to 2.89.1.
src/azure-cli-core/azure/cli/core/_profile.py	Allows Cloud Shell SSH certificate flow in get_msal_token(); keeps MI blocked.
src/azure-cli-core/azure/cli/core/init.py	Updates core __version__ to 2.89.1.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Naga Nandyala (naga-nandyala)]

Superseded by #33878, which uses a dedicated integration branch based on the latest dev and merges release with a two-parent merge commit.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.