feat(ir): add typed builder for AzureKeyVault@2

[github-actions]

Summary

Adds a typed builder struct for AzureKeyVault@2 to the ado-aw IR.

Motivation

Previously, any code that needed to emit an AzureKeyVault@2 step had to hand-craft TaskStep::new(...) with raw string input keys. This PR introduces a typed builder struct (new(<required>) + typed optional setters + into_step()) so required inputs are positional, optional inputs are type-checked, and call sites stop using stringly-typed keys.

AzureKeyVault@2 is one of the most commonly used enterprise ADO tasks — it downloads secrets from Azure Key Vault into pipeline variables so subsequent steps can reference them via $(secret-name). Having a typed builder makes it easy to emit this step from ado-aw compiler extensions and runtime code without error-prone string literals.

Changes

• src/compile/ir/tasks/azure_key_vault.rs: new AzureKeyVault builder struct and its #[cfg(test)] mod tests
• src/compile/ir/tasks/mod.rs: pub mod azure_key_vault; declaration (alphabetical order)

Builder API

use crate::compile::ir::tasks::azure_key_vault::AzureKeyVault;
use crate::compile::ir::step::Step;

// Minimal — downloads all secrets (ADO default "*")
Step::Task(AzureKeyVault::new("my-arm-connection", "my-key-vault").into_step())

// Filtered — only specific secrets
Step::Task(
    AzureKeyVault::new("my-arm-connection", "prod-vault")
        .secrets_filter("DEPLOY_TOKEN,DB_PASSWORD")
        .run_as_pre_job(true)
        .with_display_name("Download production secrets")
        .into_step()
)

ADO Task Reference

• Task: AzureKeyVault@2
• Docs: (https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/azure-key-vault-v2-task)
• Required inputs: ConnectedServiceName, KeyVaultName
• Optional inputs: SecretsFilter (ADO default *), RunAsPreJob (ADO default false)

Validation

• cargo build --all-targets
• cargo test
• cargo clippy --all-targets --all-features --workspace -- -D warnings

---

Created by the ado-task-ir-contributor workflow.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• spsprodeus21.vssps.visualstudio.com
• spsprodweu4.vssps.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "spsprodeus21.vssps.visualstudio.com"
    - "spsprodweu4.vssps.visualstudio.com"

See Network Configuration for more information.

Generated by ADO Task IR Contributor · 754.1 AIC · ⌖ 29.3 AIC · ⊞ 38.4K · ◷

[jamesadevine]

@copilot resolve merge conflicts.

[Copilot]

@copilot resolve merge conflicts.

Addressed in f02a040.