Set-AzureADMSTrustFrameworkPolicy在GHA报错但本地正常的问题

问题描述 #

在Azure AD B2C中创建服务主体后，试图通过GitHub Actions（GHA）的PowerShell执行Set-AzureADMSTrustFrameworkPolicy上传TrustFrameworkExtensions.xml文件，其余步骤均正常完成（已成功安装并导入AzureADPreview模块），但该cmdlet被提示未识别。此操作在本地Windows PowerShell可正常运行，仅在GHA环境中报错。

错误信息：

Set-AzureADMSTrustFrameworkPolicy : The term 'Set-AzureADMSTrustFrameworkPolicy' is not recognized as the name of a 
cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify 
that the path is correct and try again.
At D:\a\_temp\e4c3721f-2770-44f1-897e-b9434474d966.ps1:23 char:1
+ Set-AzureADMSTrustFrameworkPolicy -Id B2C_1A_TrustFrameworkExtensions ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Set-AzureADMSTrustFrameworkPolicy:String) [], ParentContainsErrorRecord 
   Exception
    + FullyQualifiedErrorId : CommandNotFoundException
 
Error: Process completed with exit code 1.

GHA配置代码：

run-script:
  runs-on: windows-latest  # Run on Windows for PowerShell compatibility

  steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Azure login
      uses: azure/login@v2
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}

    - name: Upload Files to Azure AD B2C
      run: |
        Install-Module -Name AzureADPreview -Scope CurrentUser -Force -AllowClobber
        Import-Module AzureADPreview
        if (Get-Module -Name AzureADPreview -ListAvailable) {
                Write-Host "AzureADPreview module is installed."
        } else {
                Write-Host "AzureADPreview module is not installed."
        }
        az login --service-principal --username $service-principal-clientId --password $service-principal-password --tenant $tenantId --allow-no-subscriptions
        $aadToken = az account get-access-token --resource-type aad-graph | ConvertFrom-Json
        $graphToken = az account get-access-token --resource-type ms-graph | ConvertFrom-Json
        Connect-AzureAD -AadAccessToken $aadToken.accessToken -AccountId $service-principal-clientId -TenantId $tenantId -MsAccessToken $graphToken.accessToken
        Set-AzureADMSTrustFrameworkPolicy -Id B2C_1A_TrustFrameworkExtensions -InputFilePath .\Templates\TrustFrameworkExtensions.xml
      shell: powershell

可能原因及解决方案 #

1. AzureADPreview模块版本不匹配 #

本地能正常运行的模块版本与GHA中自动安装的最新版本可能存在差异，部分新版本可能移除或重命名了该cmdlet。

解决步骤：

• 在本地Windows PowerShell中执行以下命令，获取当前使用的模块版本：

  Get-Module AzureADPreview | Select-Object Version
  

• 在GHA的脚本中指定安装该版本的模块，替换原有的Install-Module和Import-Module命令：

  # 替换为本地的版本号，例如2.0.2.157
  $moduleVersion = "2.0.2.157"
  Install-Module -Name AzureADPreview -RequiredVersion $moduleVersion -Scope CurrentUser -Force -AllowClobber
  Import-Module AzureADPreview -RequiredVersion $moduleVersion
  

2. 模块导入未生效或环境加载问题 #

GHA的PowerShell环境可能存在模块加载延迟，可添加额外验证步骤确保模块已正确导入：

修改脚本：
在Import-Module后添加以下命令，确认模块中的cmdlet是否存在：

# 检查目标cmdlet是否存在
if (Get-Command -Name Set-AzureADMSTrustFrameworkPolicy -ErrorAction SilentlyContinue) {
    Write-Host "Set-AzureADMSTrustFrameworkPolicy cmdlet is available."
} else {
    Write-Host "Set-AzureADMSTrustFrameworkPolicy cmdlet not found in imported module."
    # 列出模块中的所有cmdlet，用于排查
    Get-Command -Module AzureADPreview | Select-Object Name
}

3. Connect-AzureAD登录方式问题 #

当前使用token登录的方式可能存在权限或环境适配问题，可尝试直接使用服务主体凭据登录：

替换登录命令：
将原有的az login和Connect-AzureAD部分替换为以下代码（需确保已在secrets中存储服务主体密码）：

$securePassword = ConvertTo-SecureString ${{ secrets.SERVICE_PRINCIPAL_PASSWORD }} -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential(${{ secrets.SERVICE_PRINCIPAL_CLIENTID }}, $securePassword)
Connect-AzureAD -TenantId ${{ secrets.TENANT_ID }} -Credential $credential

4. PowerShell执行策略或环境权限 #

GHA的Windows环境中，PowerShell执行策略可能限制模块加载，可在脚本开头添加：

Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force

最终修改后的GHA脚本示例 #

run-script:
  runs-on: windows-latest

  steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Upload Files to Azure AD B2C
      run: |
        Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force
        # 指定与本地一致的模块版本
        $moduleVersion = "2.0.2.157"
        Install-Module -Name AzureADPreview -RequiredVersion $moduleVersion -Scope CurrentUser -Force -AllowClobber
        Import-Module AzureADPreview -RequiredVersion $moduleVersion

        # 验证模块和cmdlet
        if (Get-Module -Name AzureADPreview) {
            Write-Host "AzureADPreview module version $moduleVersion imported successfully."
        }
        if (Get-Command -Name Set-AzureADMSTrustFrameworkPolicy -ErrorAction SilentlyContinue) {
            Write-Host "Target cmdlet is available."
        } else {
            Write-Host "Cmdlet not found. Listing all module cmdlets:"
            Get-Command -Module AzureADPreview | Select-Object Name
            exit 1
        }

        # 使用服务主体凭据登录
        $securePassword = ConvertTo-SecureString ${{ secrets.SERVICE_PRINCIPAL_PASSWORD }} -AsPlainText -Force
        $credential = New-Object System.Management.Automation.PSCredential(${{ secrets.SERVICE_PRINCIPAL_CLIENTID }}, $securePassword)
        Connect-AzureAD -TenantId ${{ secrets.TENANT_ID }} -Credential $credential

        # 执行上传操作
        Set-AzureADMSTrustFrameworkPolicy -Id B2C_1A_TrustFrameworkExtensions -InputFilePath .\Templates\TrustFrameworkExtensions.xml
      shell: powershell

内容的提问来源于stack exchange，提问作者Ashwin Agarkhed