{"record":{"id":"b2038ee50609a54c","repo":"microsoft/aspire","slug":"roles-i-is-not-a-valid-azurecontainerregistryrole-value","errorCode":null,"errorMessage":"'{roles[i]}' is not a valid AzureContainerRegistryRole value.","messagePattern":"'(.+?)' is not a valid AzureContainerRegistryRole value\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.ContainerRegistry/AzureContainerRegistryExtensions.cs","lineNumber":299,"sourceCode":"        where T : IResource\n    {\n        if (roles is null || roles.Length == 0)\n        {\n            return builder.WithRoleAssignments(target, Array.Empty<ContainerRegistryBuiltInRole>());\n        }\n\n        var builtInRoles = new ContainerRegistryBuiltInRole[roles.Length];\n        for (var i = 0; i < roles.Length; i++)\n        {\n            builtInRoles[i] = roles[i] switch\n            {\n                AzureContainerRegistryRole.AcrDelete => ContainerRegistryBuiltInRole.AcrDelete,\n                AzureContainerRegistryRole.AcrImageSigner => ContainerRegistryBuiltInRole.AcrImageSigner,\n                AzureContainerRegistryRole.AcrPull => ContainerRegistryBuiltInRole.AcrPull,\n                AzureContainerRegistryRole.AcrPush => ContainerRegistryBuiltInRole.AcrPush,\n                AzureContainerRegistryRole.AcrQuarantineReader => ContainerRegistryBuiltInRole.AcrQuarantineReader,\n                AzureContainerRegistryRole.AcrQuarantineWriter => ContainerRegistryBuiltInRole.AcrQuarantineWriter,\n                _ => throw new ArgumentException($\"'{roles[i]}' is not a valid {nameof(AzureContainerRegistryRole)} value.\", nameof(roles))\n            };\n        }\n\n        return builder.WithRoleAssignments(target, builtInRoles);\n    }\n\n    private static string CreatePurgeTaskContent(string? filter, string ago, int keep)\n    {\n        return $\"\"\"\n            version: v1.1.0\n            steps:\n            - cmd: acr purge --filter '{filter ?? \".*:.*\"}' --ago {ago} --keep {keep}\n            \"\"\".ReplaceLineEndings(\"\\n\");\n    }\n\n    /// <summary>\n    /// Formats a <see cref=\"TimeSpan\"/> into a Go-style duration string compatible with <c>acr purge --ago</c>.\n    /// Valid units: <c>d</c> (days), <c>h</c> (hours), <c>m</c> (minutes).","sourceCodeStart":281,"sourceCodeEnd":317,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.ContainerRegistry/AzureContainerRegistryExtensions.cs#L281-L317","documentation":"WithRoleAssignments maps each AzureContainerRegistryRole enum value to an Azure Provisioning ContainerRegistryBuiltInRole; the switch's default arm throws ArgumentException naming the offending element when the roles array contains an undefined/out-of-range enum value.","triggerScenarios":"Passing an enum value not defined by AzureContainerRegistryRole (e.g. an invalid cast of an int) in the roles argument of WithRoleAssignments.","commonSituations":"Casting raw ints from config into the enum without validation; deserializing a role name that doesn't match any member; a stale enum value after a package version change.","solutions":["Pass only valid AzureContainerRegistryRole members (AcrPull, AcrPush, AcrDelete, AcrImageSigner, AcrQuarantineReader/Writer, etc.)","Validate with Enum.IsName/Enum.IsDefined before building the array","Fix the config or deserialization mapping that produced the bogus value"],"exampleFix":"// before\nvar role = (AzureContainerRegistryRole)999;\n.WithRoleAssignments(target, new[] { role })\n// after\nif (!Enum.IsDefined(role)) throw new InvalidOperationException($\"Unknown role {role}\");\n.WithRoleAssignments(target, new[] { AzureContainerRegistryRole.AcrPull })","handlingStrategy":"validation","validationCode":"foreach (var role in roles)\n    if (!Enum.IsDefined(typeof(AzureContainerRegistryRole), role))\n        throw new ArgumentException($\"'{role}' is not a valid {nameof(AzureContainerRegistryRole)} value.\");","typeGuard":"bool IsValidRole(AzureContainerRegistryRole role) => Enum.IsDefined(typeof(AzureContainerRegistryRole), role);","tryCatchPattern":"try { env.WithRoleAssignments(target, roles); }\ncatch (ArgumentException ex) when (ex.ParamName == \"roles\") { log.LogError(ex, \"Invalid role value\"); }","preventionTips":["Never cast raw ints to enums without Enum.IsDefined","Parse role names with Enum.TryParse<AzureContainerRegistryRole> (ignoreCase)","Re-validate role sets after dependency version changes"],"tags":["azure","container-registry","enum","role-assignments"],"backgroundTag":"invalid-enum-value","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}