[Steve Lee (SteveL-MSFT)]

PR Summary

• Add new ExpressionArg as valid arg type within a resource manifest (including Actions), only supported for get, set, test, and export
• Created helper function to process ExpressionArg used for both resources and actions
• Add new properties() function to retrieve the current properties which is used with an ExpressionArg
• Since the current properties are stored within the current context, move target_resource and execution_type to be retrieved from context and update all internal functions that used to have them as separate parameters to simply pass and use the context (this is the bulk of the changes across the many files)
• cleanup DscManager noticing that the resource functions aren't being used since if you have the DscResource, you can invoke it directly so removed them.
• cleanup some commented out code from the Actions PR that is not needed
• separate out is_secure_value() and contains_secure_value() for different purposes

Because a property can be optional, if the expression evaluation fails (like due to dot accessing an optional property that wasn't specified), then if that arg is NOT mandatory, then this error is written as a debug message and ignored.

PR Context

Fix #1722

[Copilot]

🟡 Changes recommended

Unresolved critical defects can execute real changes during what-if runs and bypass adapted-resource security requirements.

7 open issues

• Preserve the context execution type when invoking actions · New
• Enable what-if support only when a WhatIf argument exists · New
• Set the adapted resource as the target before dispatch · New
• Populate context properties from each operation's input · New
• Evaluate manifest arguments for full-input adapters · New
• Correct the function documentation to describe properties behavior · New
• Test named expression arguments with correctly cased manifest fields · New

What changed in this PR

Adds expression-based command arguments to DSC resource and action manifests, addressing #1722 by letting manifests derive arguments from resource properties without JSON-processing wrappers.

Changes:

• Adds expression argument types, shared evaluation logic, and the properties() function.
• Passes operation context through resource, action, adapter, CLI, server, and Bicep invocation paths.
• Adds test fixtures and coverage, and removes unused manager wrappers and commented-out code.

File	Description
tools/​test_group_resource/​src/​main.rs	Updates fixtures for target-resource state relocation.
tools/​dsctest/​src/​main.rs	Dispatches expression-argument tests and schema output.
tools/​dsctest/​src/​expression_arg.rs	Defines the expression-argument test model.
tools/​dsctest/​src/​args.rs	Adds expression-related test command arguments.
tools/​dsctest/​src/​action.rs	Returns evaluated expression values in action output.
tools/​dsctest/​dsctest.dsc.manifests.json	Adds resource and action expression fixtures.
lib/​dsc-lib/​src/​resources/​resource_invoke.rs	Updates invocation interfaces and adds shared expression evaluation.
lib/​dsc-lib/​src/​lib.rs	Removes unused manager invocation wrappers.
lib/​dsc-lib/​src/​functions/​properties.rs	Implements properties().
lib/​dsc-lib/​src/​functions/​mod.rs	Registers the new function.
lib/​dsc-lib/​src/​dscresources/​resource_manifest.rs	Adds expression variants to resource argument types.
lib/​dsc-lib/​src/​dscresources/​dscresource.rs	Passes context through resource and adapter operations.
lib/​dsc-lib/​src/​dscresources/​command_resource.rs	Evaluates expression arguments and consumes operation context.
lib/​dsc-lib/​src/​configure/​mod.rs	Stores evaluated properties and forwards context.
lib/​dsc-lib/​src/​configure/​context.rs	Adds properties and target-resource fields.
lib/​dsc-lib/​src/​actions/​dscaction.rs	Integrates context and action argument evaluation.
lib/​dsc-lib/​src/​actions/​action_manifest.rs	Adds action expression arguments.
lib/​dsc-lib/​locales/​en-us.toml	Adds function descriptions and expression diagnostics.
dsc/​tests/​other/​dsc_actions.tests.ps1	Tests action expression arguments.
dsc/​tests/​functions/​dsc_functions.tests.ps1	Tests properties() output.
dsc/​tests/​expressions/​dsc_command_expressions.tests.ps1	Tests resource expressions and optional arguments.
dsc/​src/​subcommand.rs	Passes context to configuration validation.
dsc/​src/​server/​show_dsc_resource.rs	Passes context to schema retrieval.
dsc/​src/​server/​invoke_dsc_resource.rs	Passes context to server resource operations.
dsc/​src/​server/​invoke_dsc_action.rs	Passes context to server action invocation.
dsc/​src/​resource_command.rs	Updates CLI resource calls to use context.
dsc-bicep-ext/​src/​main.rs	Updates Bicep resource calls to use context.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Property-dependent schemas can reuse an incorrect cached schema, supported array export filters are rejected, and the new set test does not exercise set-expression argument handling.

3 open issues

• Preserve array-form export filters · New
• Include schema expression arguments in cache key · New
• Ensure the config set test reaches the command · New

7 resolved since last review

• Set the adapted resource as the target before dispatch
• Enable what-if support only when a WhatIf argument exists
• Preserve the context execution type when invoking actions
• Evaluate manifest arguments for full-input adapters
• Populate context properties from each operation's input
• Test named expression arguments with correctly cased manifest fields
• Correct the function documentation to describe properties behavior

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Expression evaluation can expose nested secure property values in trace logs even when only a non-sensitive property is accessed.

No open issues 🎉

6 previously missed issues

In code that hasn't changed since last review

Recursively redact secure values in expression trace logs

lib/​dsc-lib/​src/​functions/​properties.rs:32

This returns the entire properties object to the expression evaluator, whose pre-accessor trace logging in parser/expressions.rs:131–135 only recognizes top-level secure wrappers. For properties such as {name: "public", password: {secureString: "secret"}}, even evaluating properties().name logs the password before applying the accessor. Apply recursive redaction to the evaluator's logged values, including accessor results, while preserving the actual values returned to the command.

Pass resource properties to config validation

dsc/​src/​subcommand.rs:534

config validate now supplies a context, but it never sets the resource-block properties. When a manifest implements validation using an expression argument such as mandatory [properties().name], validate_properties forwards this empty context to the validate command, rejecting a configuration that supplies name. Populate the context with this block's properties before validating it.

Allow expression-only actions to opt out of stdin

lib/​dsc-lib/​src/​actions/​dscaction.rs:281

Expression-only actions still receive the full input JSON on stdin, even when their executable reads only command arguments. With sufficiently large input and output, this can deadlock because run_process_async finishes writing stdin before draining stdout. Add an explicit stdin opt-out while preserving actions that intentionally combine expression arguments with stdin.

Clear filtered properties from the export expression context

lib/​dsc-lib/​src/​configure/​mod.rs:137

When export filtering is handled by the engine, resource_input is cleared but context.properties still contains the filter. An export argument such as [properties().name] therefore receives the engine-only filter even for a resource declaring supportsFiltering: false, while JSON-input arguments correctly receive no input. Clear properties in a scoped export context when stripping the filter, so expression arguments cannot pass it back to the resource.

Preserve copy-loop state during manifest argument evaluation

lib/​dsc-lib/​src/​configure/​mod.rs:612

Manifest arguments using [string(copyIndex())] fail for resources inside copy loops because get_properties clears the restored loop state before resource invocation. Preserve that state in an invocation-scoped context through manifest-argument evaluation, then clear it before processing the next resource.

Detect native what-if support without swallowing expression errors

lib/​dsc-lib/​src/​dscresources/​command_resource.rs:118

An evaluation error is treated as absence of native what-if support, even when the manifest contains a whatIfArg. A failing mandatory expression therefore selects the dedicated/synthetic fallback instead of propagating the error; with a successful synthetic test, the dry run can report success for a broken native invocation. Detect support by inspecting the argument variants, then let processing the selected operation propagate mandatory-expression errors.

3 resolved since last review

• Ensure the config set test reaches the command
• Include schema expression arguments in cache key
• Preserve array-form export filters

_{Review effort: Balanced}