Database names with spaces cause firewall detection to fail - sqlcmd argument not quoted

[jnpoyser]

When the connection string contains a database name with a space (e.g. Initial Catalog=MyDatabase Live), the firewall IP detection step fails because the database name is not properly quoted when passed to sqlcmd.

Error:

Failed to add firewall rule. Unable to detect client IP Address. Sqlcmd: 'Live': Unknown command. Enter '--help' for command help.

Debug output:

##[debug]Validating if client has access to 'MyDatabase Live' on 'myserver.database.windows.net'.
##[debug]The process 'sqlcmd' failed with exit code 1
##[debug]SqlCmd stderr: Sqlcmd: 'Live': Unknown command. Enter '--help' for command help.

The action correctly parses the database name as MyDatabase Live, but fails to quote it when executing sqlcmd.

Environment:

• azure/sql-action@v2.3
• runs-on: ubuntu-latest
• Azure SQL Database with Authentication=Active Directory Default

Connection string:

Server=myserver.database.windows.net;Initial Catalog=MyDatabase Live;Authentication=Active Directory Default;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;

Attempted workarounds (none worked):

• Single quotes: Initial Catalog='MyDatabase Live'
• Double quotes: Initial Catalog="MyDatabase Live"

Potential root cause:

The detectIPAddress function extracts the database name correctly but may pass it to sqlcmd as the -d argument without quoting, resulting in:

sqlcmd -S myserver.database.windows.net -d MyDatabase Live -Q "select getdate()"

Expected behaviour:

sqlcmd -S myserver.database.windows.net -d "MyDatabase Live" -Q "select getdate()"