refactor(configure): replace az/gcloud CLI shell-outs with native SDK calls

Replace exec.Command shell-outs to cloud CLIs with native SDK calls where
the replacement is sound and does not require new heavyweight dependencies:

Azure (ci_cd_sanity_tests/):
- az account set/show -> armsubscriptions.Client.Get (programmatic CI path)
- az group list      -> armresources.ResourceGroupsClient.NewListPager
- az vm list         -> armcompute.VirtualMachinesClient.NewListAllPager

Azure (cmd/configure_azure.go):
- az account list    -> armsubscriptions.Client.NewListPager (with CLI fallback)

GCP (cmd/configure_gcp.go):
- gcloud projects list                 -> cloudresourcemanager/v1 Projects.List
- gcloud iam service-accounts create   -> iam/v1 Projects.ServiceAccounts.Create
- gcloud projects add-iam-policy-binding -> cloudresourcemanager/v1 SetIamPolicy
- gcloud iam service-accounts keys create -> iam/v1 SA Keys.Create (writes key
  data to file; key is base64-decoded from PrivateKeyData response field)

Calls left as CLI (documented in each function):
- az login / gcloud auth login: interactive browser OAuth; no SDK equivalent
  for an operator establishing an initial credential.
- gcloud config set project: writes to local gcloud config file; no API
  equivalent.
- az ad sp create-for-rbac: would require msgraph-sdk-go +
  armauthorization/v2, neither of which is in the module graph; the
  interactive wizard path does not justify adding two new heavy SDKs.

Auth model: DefaultAzureCredential (azure.go / configure_azure.go) picks up
the az login session via its AzureCLICredential leg. google.DefaultTokenSource
(configure_gcp.go) picks up gcloud application-default credentials; the wizard
now notes that operators must also run 'gcloud auth application-default login'
in addition to 'gcloud auth login' for the SDK steps to work.

go.mod: armcompute/v5 and armsubscriptions promoted from indirect to direct;
armresources v1.2.0 promoted from transitive to direct. No new SDK versions
or packages outside the existing module graph were added (google.golang.org/api
iam/v1 and cloudresourcemanager/v1 are sub-packages of the already-required
google.golang.org/api v0.274.0).

Removes the gosec G204 subprocess findings from ci_cd_sanity_tests/azure.go
(the only nolint-free exec.Command site in the CI path). The remaining
exec.Command calls in configure_azure.go and configure_gcp.go are in
interactive wizard paths where the CLI is intentionally required; those are
addressed separately.

Author: cristim

ci_cd_sanity_tests/pkg/sanity/azure/azure.go

@@ -5,10 +5,14 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
-	"os/exec"
 	"strings"
 	"time"
 
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
+	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v5"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions"
 	"github.com/LeanerCloud/CUDly/ci_cd_sanity_tests/pkg/sanity/report"
 )
 
@@ -19,6 +23,19 @@ type Options struct {
 	Timeout          time.Duration
 }
 
+// azureSubscriptionInfo holds the subscription/tenant fields extracted from the
+// armsubscriptions API response. This mirrors the fields previously parsed from
+// "az account show -o json" so that validateAccountExpectations is unchanged.
+type azureSubscriptionInfo struct {
+	ID       string
+	TenantID string
+	Name     string
+	State    string
+}
+
+// azAccountShow is the JSON shape produced by "az account show -o json". It is
+// retained only to support the existing validateAccountExpectations function
+// which the unit tests exercise via its JSON parsing path.
 type azAccountShow struct {
 	ID       string `json:"id"`
 	TenantID string `json:"tenantId"`
@@ -80,6 +97,194 @@ func validateAccountExpectations(opts Options, accountOut []byte) report.CheckRe
 	return check
 }
 
+// encodeAccountJSON serialises azureSubscriptionInfo into the same JSON shape
+// that "az account show -o json" produced so that validateAccountExpectations
+// can be reused without modification.
+func encodeAccountJSON(info azureSubscriptionInfo) []byte {
+	a := azAccountShow{
+		ID:       info.ID,
+		TenantID: info.TenantID,
+		Name:     info.Name,
+		State:    info.State,
+	}
+	b, _ := json.Marshal(a)
+	return b
+}
+
+// newCheckResult returns a CheckResult with name and timing already set.
+func newCheckResult(name string, start time.Time) report.CheckResult {
+	return report.CheckResult{
+		Name:      name,
+		StartedAt: start,
+		Details:   map[string]string{},
+	}
+}
+
+// checkPass records a passing check with an optional detail message and
+// returns it ready to be added to the report.
+func checkPass(cr *report.CheckResult, detail string) report.CheckResult {
+	cr.EndedAt = time.Now().UTC()
+	cr.Status = report.StatusPass
+	if detail != "" {
+		cr.Details["result"] = detail
+	}
+	return *cr
+}
+
+// checkFail records a failing check and returns it.
+func checkFail(cr *report.CheckResult, msg string) report.CheckResult {
+	cr.EndedAt = time.Now().UTC()
+	cr.Status = report.StatusFail
+	cr.Message = msg
+	return *cr
+}
+
+// runGroupListCheck lists up to 10 resource groups in the subscription.
+func runGroupListCheck(ctx context.Context, subscriptionID string, cred azcore.TokenCredential) report.CheckResult {
+	cr := newCheckResult("azure:group:list(sample)", time.Now().UTC())
+	cr.Details["subscriptionID"] = subscriptionID
+
+	rgClient, err := armresources.NewResourceGroupsClient(subscriptionID, cred, nil)
+	if err != nil {
+		return checkFail(&cr, fmt.Sprintf("failed to create resource-groups client: %v", err))
+	}
+
+	pager := rgClient.NewListPager(nil)
+	var names []string
+	for pager.More() && len(names) < 10 {
+		page, pageErr := pager.NextPage(ctx)
+		if pageErr != nil {
+			return checkFail(&cr, pageErr.Error())
+		}
+		for _, rg := range page.Value {
+			if rg.Name != nil && rg.Location != nil {
+				names = append(names, fmt.Sprintf("%s (%s)", *rg.Name, *rg.Location))
+			}
+			if len(names) >= 10 {
+				break
+			}
+		}
+	}
+	cr.Details["result"] = truncate(strings.Join(names, ", "), 2048)
+	return checkPass(&cr, "")
+}
+
+// resourceGroupFromID extracts the resource group name from an Azure resource ID.
+// The ID format is: .../resourceGroups/<name>/...
+func resourceGroupFromID(id string) string {
+	parts := strings.Split(id, "/")
+	for i, p := range parts {
+		if strings.EqualFold(p, "resourceGroups") && i+1 < len(parts) {
+			return parts[i+1]
+		}
+	}
+	return ""
+}
+
+// vmSummary returns a short display string for a virtual machine.
+func vmSummary(vm *armcompute.VirtualMachine) string {
+	name := ""
+	rg := ""
+	loc := ""
+	if vm.Name != nil {
+		name = *vm.Name
+	}
+	if vm.Location != nil {
+		loc = *vm.Location
+	}
+	if vm.ID != nil {
+		rg = resourceGroupFromID(*vm.ID)
+	}
+	return fmt.Sprintf("%s (rg:%s loc:%s)", name, rg, loc)
+}
+
+// runVMListCheck lists up to 10 virtual machines in the subscription.
+func runVMListCheck(ctx context.Context, subscriptionID string, cred azcore.TokenCredential) report.CheckResult {
+	cr := newCheckResult("azure:vm:list(sample)", time.Now().UTC())
+	cr.Details["subscriptionID"] = subscriptionID
+
+	vmClient, err := armcompute.NewVirtualMachinesClient(subscriptionID, cred, nil)
+	if err != nil {
+		return checkFail(&cr, fmt.Sprintf("failed to create virtual-machines client: %v", err))
+	}
+
+	pager := vmClient.NewListAllPager(nil)
+	var items []string
+	for pager.More() && len(items) < 10 {
+		page, pageErr := pager.NextPage(ctx)
+		if pageErr != nil {
+			return checkFail(&cr, pageErr.Error())
+		}
+		for _, vm := range page.Value {
+			items = append(items, vmSummary(vm))
+			if len(items) >= 10 {
+				break
+			}
+		}
+	}
+	cr.Details["result"] = truncate(strings.Join(items, ", "), 2048)
+	return checkPass(&cr, "")
+}
+
+// runAccountSetCheck verifies that the given subscription ID is reachable.
+func runAccountSetCheck(ctx context.Context, subscriptionID string, cred azcore.TokenCredential) report.CheckResult {
+	cr := newCheckResult("azure:account:set", time.Now().UTC())
+	cr.Details["subscriptionID"] = subscriptionID
+
+	subClient, err := armsubscriptions.NewClient(cred, nil)
+	if err != nil {
+		return checkFail(&cr, fmt.Sprintf("failed to create subscriptions client: %v", err))
+	}
+
+	if _, err := subClient.Get(ctx, subscriptionID, nil); err != nil {
+		return checkFail(&cr, err.Error())
+	}
+	return checkPass(&cr, "subscription reachable")
+}
+
+// runAccountShowCheck retrieves subscription identity information.
+// It returns the check result and the JSON-encoded account info (for use by
+// validateAccountExpectations). The JSON is empty on failure.
+func runAccountShowCheck(ctx context.Context, subscriptionID string, cred azcore.TokenCredential) (report.CheckResult, []byte) {
+	cr := newCheckResult("azure:account:show", time.Now().UTC())
+	cr.Details["subscriptionID"] = subscriptionID
+
+	subClient, err := armsubscriptions.NewClient(cred, nil)
+	if err != nil {
+		return checkFail(&cr, fmt.Sprintf("failed to create subscriptions client: %v", err)), nil
+	}
+
+	resp, err := subClient.Get(ctx, subscriptionID, nil)
+	if err != nil {
+		return checkFail(&cr, err.Error()), nil
+	}
+
+	sub := resp.Subscription
+	info := azureSubscriptionInfo{State: string(*sub.State)}
+	if sub.SubscriptionID != nil {
+		info.ID = *sub.SubscriptionID
+	}
+	if sub.TenantID != nil {
+		info.TenantID = *sub.TenantID
+	}
+	if sub.DisplayName != nil {
+		info.Name = *sub.DisplayName
+	}
+
+	cr.Details["id"] = info.ID
+	cr.Details["tenantId"] = info.TenantID
+	cr.Details["name"] = info.Name
+	cr.Details["state"] = info.State
+	return checkPass(&cr, "account info retrieved"), encodeAccountJSON(info)
+}
+
+// Run performs read-only Azure sanity checks using native SDK calls.
+//
+// Auth: DefaultAzureCredential is used throughout. In CI this resolves via the
+// AZURE_CLIENT_ID / AZURE_TENANT_ID / AZURE_CLIENT_SECRET environment
+// variables (service-principal flow). On an operator workstation it falls back
+// to AzureCLICredential (i.e. the session established by "az login"), so the
+// behaviour is identical to the previous CLI-based implementation.
 func Run(ctx context.Context, opts Options) (*report.Report, error) {
 	if opts.SubscriptionID == "" {
 		opts.SubscriptionID = os.Getenv("AZURE_SUBSCRIPTION_ID")
@@ -101,50 +306,27 @@ func Run(ctx context.Context, opts Options) (*report.Report, error) {
 		StartedAt: time.Now().UTC(),
 	}
 
-	runCmd := func(name string, args ...string) ([]byte, report.CheckResult) {
-		start := time.Now().UTC()
-		cmd := exec.CommandContext(rctx, "az", args...)
-		out, err := cmd.CombinedOutput()
-		end := time.Now().UTC()
-
-		cr := report.CheckResult{
-			Name:      name,
-			StartedAt: start,
-			EndedAt:   end,
-			Details: map[string]string{
-				"cmd":    "az " + strings.Join(args, " "),
-				"output": truncate(string(out), 2048),
-			},
-		}
-		if err != nil {
-			cr.Status = report.StatusFail
-			cr.Message = err.Error()
-		} else {
-			cr.Status = report.StatusPass
-		}
-		return out, cr
+	cred, err := azidentity.NewDefaultAzureCredential(nil)
+	if err != nil {
+		rep.EndedAt = time.Now().UTC()
+		return nil, fmt.Errorf("azure: failed to build DefaultAzureCredential: %w", err)
 	}
 
-	// Ensure subscription context (read-only)
-	_, cr := runCmd("azure:account:set", "account", "set", "--subscription", opts.SubscriptionID)
-	rep.Add(cr)
+	rep.Add(runAccountSetCheck(rctx, opts.SubscriptionID, cred))
 
-	// Read-only identity/subscription info (only call once; reuse output)
-	accountOut, cr := runCmd("azure:account:show", "account", "show", "-o", "json")
-	rep.Add(cr)
+	accountShowResult, accountOut := runAccountShowCheck(rctx, opts.SubscriptionID, cred)
+	rep.Add(accountShowResult)
 
-	if opts.ExpectedSubID != "" || opts.ExpectedTenantID != "" {
+	// --- azure:account:expected_checks ---
+	if (opts.ExpectedSubID != "" || opts.ExpectedTenantID != "") && len(accountOut) > 0 {
 		rep.Add(validateAccountExpectations(opts, accountOut))
 	}
 
-	// Read-only lists (sample)
-	_, cr = runCmd("azure:group:list(sample)", "group", "list",
-		"--query", "[0:10].{name:name, location:location}", "-o", "json")
-	rep.Add(cr)
+	// --- azure:group:list(sample) ---
+	rep.Add(runGroupListCheck(rctx, opts.SubscriptionID, cred))
 
-	_, cr = runCmd("azure:vm:list(sample)", "vm", "list",
-		"--query", "[0:10].{name:name, resourceGroup:resourceGroup, location:location}", "-o", "json")
-	rep.Add(cr)
+	// --- azure:vm:list(sample) ---
+	rep.Add(runVMListCheck(rctx, opts.SubscriptionID, cred))
 
 	rep.EndedAt = time.Now().UTC()
 	return rep, nil

ci_cd_sanity_tests/pkg/sanity/azure/azure_test.go

@@ -9,6 +9,45 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// TestEncodeAccountJSON verifies that encodeAccountJSON produces bytes that are
+// accepted by validateAccountExpectations without error, and that the ID /
+// TenantID fields survive the round-trip.  This guards the SDK->JSON->validate
+// path introduced when replacing the "az account show" CLI call.
+func TestEncodeAccountJSON(t *testing.T) {
+	info := azureSubscriptionInfo{
+		ID:       "aaaabbbb-1111-2222-3333-ccccddddeeee",
+		TenantID: "ffffgggg-5555-6666-7777-hhhh88889999",
+		Name:     "My Test Sub",
+		State:    "Enabled",
+	}
+
+	encoded := encodeAccountJSON(info)
+	require.NotEmpty(t, encoded, "encoded JSON must not be empty")
+
+	// Must parse back as azAccountShow without error.
+	var parsed azAccountShow
+	require.NoError(t, json.Unmarshal(encoded, &parsed))
+	assert.Equal(t, info.ID, parsed.ID)
+	assert.Equal(t, info.TenantID, parsed.TenantID)
+	assert.Equal(t, info.Name, parsed.Name)
+	assert.Equal(t, info.State, parsed.State)
+
+	// Round-trip through validateAccountExpectations with matching expectations.
+	opts := Options{
+		ExpectedSubID:    info.ID,
+		ExpectedTenantID: info.TenantID,
+	}
+	result := validateAccountExpectations(opts, encoded)
+	assert.Equal(t, report.StatusPass, result.Status, "expected PASS for matching IDs, got: %s", result.Message)
+}
+
+// TestTruncate verifies truncate boundary conditions.
+func TestTruncate(t *testing.T) {
+	assert.Equal(t, "ab", truncate("ab", 5))
+	assert.Equal(t, "abcde", truncate("abcde", 5))
+	assert.Equal(t, "abcde...(truncated)", truncate("abcdef", 5))
+}
+
 func accountJSON(id, tenantID, name, state string) []byte {
 	b, err := json.Marshal(azAccountShow{
 		ID:       id,