fix: scope tool middleware to workflow commands and add CI detection

- Add resource.IsRunningOnCI() check to both tool middlewares, matching
  the pattern used by LoginGuardMiddleware
- Change middleware predicates from blocklist to allowlist of workflow
  commands (init, up, deploy, provision, build, package, restore,
  publish, down, monitor, add)
- Utility commands (auth, config, env, show, etc.) no longer trigger
  the first-run experience or update notifications

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: wbreza

cli/azd/cmd/middleware/tool_first_run.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/azure/azure-dev/cli/azd/cmd/actions"
 	"github.com/azure/azure-dev/cli/azd/internal"
+	"github.com/azure/azure-dev/cli/azd/internal/tracing/resource"
 	"github.com/azure/azure-dev/cli/azd/pkg/config"
 	"github.com/azure/azure-dev/cli/azd/pkg/input"
 	"github.com/azure/azure-dev/cli/azd/pkg/output"
@@ -92,12 +93,17 @@ func (m *ToolFirstRunMiddleware) shouldSkip(ctx context.Context) bool {
 		return true
 	}
 
-	// 3. Non-interactive terminal (piped stdin/stdout).
+	// 3. CI/CD environment — never prompt in CI.
+	if resource.IsRunningOnCI() {
+		return true
+	}
+
+	// 4. Non-interactive terminal (piped stdin/stdout).
 	if m.console.IsNoPromptMode() {
 		return true
 	}
 
-	// 4. Already completed.
+	// 5. Already completed.
 	cfg, err := m.configManager.Load()
 	if err != nil {
 		log.Printf("tool first-run: failed to load user config: %v", err)

cli/azd/cmd/middleware/tool_update_check.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/azure/azure-dev/cli/azd/cmd/actions"
 	"github.com/azure/azure-dev/cli/azd/internal"
+	"github.com/azure/azure-dev/cli/azd/internal/tracing/resource"
 	"github.com/azure/azure-dev/cli/azd/pkg/input"
 	"github.com/azure/azure-dev/cli/azd/pkg/output"
 	"github.com/azure/azure-dev/cli/azd/pkg/tool"
@@ -104,6 +105,11 @@ func (m *ToolUpdateCheckMiddleware) shouldSkipNotification() bool {
 		return true
 	}
 
+	// CI/CD environment — no notifications.
+	if resource.IsRunningOnCI() {
+		return true
+	}
+
 	// Machine-readable output (JSON, table, etc.) — keep stdout clean.
 	if !m.console.IsUnformatted() {
 		return true
@@ -140,6 +146,11 @@ func (m *ToolUpdateCheckMiddleware) triggerBackgroundCheckIfNeeded(ctx context.C
 		return
 	}
 
+	// CI/CD environment — skip background checks.
+	if resource.IsRunningOnCI() {
+		return
+	}
+
 	if !m.manager.ShouldCheckForUpdates(ctx) {
 		return
 	}

cli/azd/cmd/root.go

@@ -459,18 +459,14 @@ func newRootCmd(
 			"toolFirstRun",
 			middleware.NewToolFirstRunMiddleware,
 			func(descriptor *actions.ActionDescriptor) bool {
-				cmd := descriptor.Options.Command
-				return !strings.HasPrefix(cmd.CommandPath(), "azd tool") &&
-					cmd.Name() != "version" && cmd.Name() != "config"
+				return isWorkflowCommand(descriptor)
 			},
 		).
 		UseMiddlewareWhen(
 			"toolUpdateCheck",
 			middleware.NewToolUpdateCheckMiddleware,
 			func(descriptor *actions.ActionDescriptor) bool {
-				cmd := descriptor.Options.Command
-				return !strings.HasPrefix(cmd.CommandPath(), "azd tool") &&
-					cmd.Name() != "version" && cmd.Name() != "config"
+				return isWorkflowCommand(descriptor)
 			},
 		)
 
@@ -547,6 +543,33 @@ func newRootCmd(
 	return cmd
 }
 
+// isWorkflowCommand reports whether the command is a primary workflow
+// command where a first-run tool check adds value.  Utility commands
+// (auth, config, env, show, etc.) are excluded so they are never
+// blocked by the first-run experience or update notifications.
+func isWorkflowCommand(descriptor *actions.ActionDescriptor) bool {
+	workflowCommands := map[string]bool{
+		"init":      true,
+		"up":        true,
+		"deploy":    true,
+		"provision": true,
+		"build":     true,
+		"package":   true,
+		"restore":   true,
+		"publish":   true,
+		"down":      true,
+		"monitor":   true,
+		"add":       true,
+	}
+
+	// Walk up to the root-level subcommand (first segment after "azd").
+	cmd := descriptor.Options.Command
+	for cmd.Parent() != nil && cmd.Parent().Parent() != nil {
+		cmd = cmd.Parent()
+	}
+	return workflowCommands[cmd.Name()]
+}
+
 func getCmdRootHelpFooter(cmd *cobra.Command) string {
 	return fmt.Sprintf("%s\n%s\n%s\n\n%s\n\n%s",
 		output.WithBold("%s", output.WithUnderline("Deploying a sample application")),