[Network] Fix #27579: az network dns zone export: Fix export of empty TXT record sets

[Aditya Pujara (a0x1ab)]

🤖 PR Validation — ️✔️ All clear

Breaking Changes	Tests
️✔️ None	️✔️ 130/130

Related command

az network dns zone export

Description

Fixes #27579.

Correct DNS zone export so empty TXT record sets serialize without indexing a nonexistent value.

Expected behavior: exporting a zone containing an empty TXT record set must not crash, while retaining valid TXT data and the existing zone-file conventions. Both console output and optional file output should work.

Testing Guide

• Run az network dns zone export --resource-group <resource-group> --name <dns-zone> --file-name zone.txt.
• Focused regression coverage: src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py.
• Repository CI and the authorized live-test workflow validate the published revision.

History Notes

[Network] az network dns zone export: Fix export of empty TXT record sets

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[Yong Zhang (yonzhan)]

Network

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟢 Approval recommended

The reviewed changes are fully covered and no blocking issues were identified.

Pull request overview

Fixes az network dns zone export for empty TXT record sets and preserves them during import.

Changes:

• Emits TXT "" for empty TXT record sets.
• Preserves empty TXT values during parsing.
• Adds export, import, and round-trip regression tests.

File summaries

File	Changes
src/azure-cli/azure/cli/command_modules/network/zone_file/parse_zone_file.py	Preserves empty TXT fragments.
src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py	Adds TXT export/import regression coverage.
src/azure-cli/azure/cli/command_modules/network/custom.py	Emits empty TXT values during export.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-quality-productivity-squad.

[Aditya Pujara (a0x1ab)]

@Azure/x-engineering-agent The remediation execution for the current agent review was canceled by the agent deployment before model work began. Retry the existing live-test remediation against the unchanged current head without expanding its scope.

[x-engineering-agent]

Automated processing requires maintainer follow-up for this request.

[x-engineering-agent]

Automated processing requires maintainer follow-up for this request.

[Yong Zhang (yonzhan)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[x-engineering-agent]

Live test results — azdev test --live --series (changed test files only)

✅ PASS

Selectors: network.DnsZoneExportTest (module)
PR head ref: agent-assist/azure-azure-cli-issue-27579-5acb833b4854
PR head sha: 9bb49410164281e36dcbfea9eb2db2f31199a13d
PR base ref: dev
New test files in PR: false

Changed test files run

src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py

Workflow run: https://github.com/Azure/issue-sentinel/actions/runs/37916791082

Last 80 lines of azdev output

=============
| Run Tests |
=============


test index found: /home/runner/.azdev/env_config/home/runner/work/issue-sentinel/issue-sentinel/.venv/test_index/latest.json

Test on modules: network.DnsZoneExportTest

WARNING: RUNNING TESTS LIVE
The tests are set to run against current profile "latest"
============================= test session starts ==============================
platform linux -- Python 3.12.15, pytest-9.1.1, pluggy-1.6.0 -- /home/runner/work/issue-sentinel/issue-sentinel/.venv/bin/python
cachedir: .pytest_cache
rootdir: /home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli
plugins: platformdirs-4.12.4, forked-1.7.5, xdist-3.8.0
collecting ... collected 6 items

azure-cli/src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py::DnsZoneExportTest::test_export_empty_txt_collections PASSED [ 16%]
azure-cli/src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py::DnsZoneExportTest::test_export_import_and_reexport_txt PASSED [ 33%]
azure-cli/src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py::DnsZoneExportTest::test_export_malformed_nonempty_txt_is_not_masked PASSED [ 50%]
azure-cli/src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py::DnsZoneExportTest::test_export_mixed_records_and_import_supported_types PASSED [ 66%]
azure-cli/src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py::DnsZoneExportTest::test_export_valid_txt_values PASSED [ 83%]
azure-cli/src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py::DnsZoneExportTest::test_parse_empty_txt_fragments_and_naptr_regexp PASSED [100%]

- generated xml file: /home/runner/work/issue-sentinel/issue-sentinel/test-output/results.xml -
============================== 6 passed in 6.64s ===============================

Posted by the X Engineering Agent live-test workflow.

[x-engineering-agent]

Aditya Pujara (@a0x1ab)

Review

Upstream CI and the Agent live run passed at 9bb49410164281e36dcbfea9eb2db2f31199a13d. No code defects were confirmed by the seven review tools and changed-line inspection. Required-scenario coverage still needs owning-squad confirmation before human approval; this is not an all-clear.

Upstream CI

All 50/50 checks passed; the current-head snapshot last completed at 2026-10-09T11:02:07Z.

Test validation

• Live test: Passed. Workflow run
• Regression coverage: For network: 1 focused test file(s) changed. Scenario coverage is unverified; review the issue's required conditions, test setup, and assertions before approval. No linked issue was found in the PR timeline; inspect the source issue and its required scenario manually.

Manual scenario inspection: The body-linked issue #27579 reports KeyError: 'txt' during zone-file serialization. custom.py now supplies the missing TXT field for an empty record set. parse_zone_file.py preserves empty TXT strings without applying NAPTR's EMPTY convention.

The submitted DnsZoneExportTest cases in src/azure-cli/azure/cli/command_modules/network/tests/latest/test_dns_commands.py assert missing/null/empty TXT collections, exact console and optional-file output, valid/multiple/long values, export-import-reexport preservation, and propagation of malformed nonempty records. They mock the AAZ boundary and exercise the actual serializer/parser. This is substantive author-supplied deterministic evidence, distinct from the Agent workflow's passing result; neither the changed filename nor the workflow summary alone maps the reported service conditions to an executed scenario.

Coverage confirmation: Before approval, verify the required preconditions and output against DnsZoneExportTest.test_export_empty_txt_collections and DnsZoneExportTest.test_export_import_and_reexport_txt: quoted empty TXT output, original record name/TTL, identical console/file content, and preserved nonempty values. If an additional service-shaped condition from the report is uncovered, add it in that same test file. Rerun the authorized live-test workflow scoped to test_dns_commands after any test update.

Recording impact: No recording changed. The production edits affect local zone-file output/parsing, not service endpoints or HTTP request fields. If a service-backed scenario is added, refresh its cassette under src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/; an existing unrelated cassette is not evidence that the empty-TXT conditions were exercised.

Risk assessment

45/100 · Medium · High confidence

The Medium rating is driven by security-sensitive behavior, public CLI behavior.

• Change scope: 3 changed files, 309 changed lines (+309 / -0), including 2 production files.
• Affected components: network
• Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
• Regression evidence: Changed regression tests are included, reducing risk.
• Confidence: High because changed-line patches were available for every production file.
• Required review: Owning-squad review is required for network before merge.

Posted by x-engineering-agent (Reviewer)