[ACR] az acr import: Fix regional endpoint source resolution for multi-label sovereign suffixes

[lizMSFT]

Related command
az acr import

Description
az acr import resolves the --source registry to a login server in the CLI before the request reaches the RP. When the source is a regional endpoint (<registry>.<region>.geo<suffix>), _regional_endpoint_uri_to_login_server normalizes it back to the global login server so import can use the fast resource-id (blob copy) path.

The old implementation assumed a fixed 5-part hostname:

parts = uri_lower.split('.')
if len(parts) == 5 and parts[2] == 'geo' and uri_lower.endswith(suffix_lower):
    return f"{parts[0]}{login_server_suffix}"

This only holds when the login-server suffix is exactly two labels (azurecr.io). Sovereign clouds use multi-label suffixes — e.g. delos azurecr.sovcloud-azure.de, bleu azurecr.sovcloud-azure.fr — so a regional endpoint like myregistry.germanycentral.geo.azurecr.sovcloud-azure.de has 6 parts, the check fails, and the URI is returned unchanged. Import then falls back to a registryUri source, which the RP pulls anonymously over HTTP across the source registry's firewall, failing with:

StatusCode: 403, Reason: Forbidden ... "code":"DENIED","message":"client with IP '...' is not allowed access"

This PR strip the known .geo<suffix> tail and take the remaining <registry>.<region> (require exactly 2 prefix parts). This is suffix-length-agnostic, so it works for public and sovereign clouds while leaving global/non-regional login servers unchanged.

Testing Guide
Added unit cases in test_regional_endpoint_utils.py covering sovereign suffixes (delos .de, bleu .fr), DNL registries, and global/non-geo pass-through.

History Notes
[ACR] az acr import: Fix regional endpoint source resolution for sovereign clouds with multi-label login-server suffixes

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

🤖 PR Validation — ️✔️ All clear

Breaking Changes	Tests
️✔️ None	️✔️ 130/130

[azure-client-tools-bot-prd]

Hi @lizMSFT,
Since the current milestone time is less than 7 days, this pr will be reviewed in the next milestone.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR updates az acr import to correctly normalize regional endpoint source registries back to the global login server when the login-server suffix contains multiple DNS labels (common in sovereign clouds). This ensures the command continues to use the fast resource-id based import path instead of falling back to anonymous registryUri pulls that can fail behind firewalls.

Changes:

• Updated _regional_endpoint_uri_to_login_server to strip the .geo<suffix> tail instead of assuming a fixed dot-part count.
• Added unit tests covering multi-label sovereign suffixes (e.g., .azurecr.sovcloud-azure.de/.fr) and DNL registry names.
• Extended non-regional pass-through test coverage for sovereign-style hostnames.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/azure-cli/azure/cli/command_modules/acr/import.py	Makes regional endpoint normalization suffix-length-agnostic by stripping .geo<suffix> rather than relying on fixed hostname part counts.
src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_regional_endpoint_utils.py	Adds/extends tests to validate regional endpoint conversion for multi-label sovereign suffixes and ensure non-regional URIs remain unchanged.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[yonzhan]

ACR

[yanzhudd]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).