DEV Community: samconibear

No Certs, No Secrets: Microsoft Graph on Azure using Entra Workload Identity Federation and Amazon Cognito (OIDC)

samconibear — Tue, 24 Mar 2026 14:24:22 +0000

I recently needed to authenticate a server side only app with Microsoft Graph, without the requirements for client secrets or certificates (which require manual rotation in a enterprise security context).

The solution is to use Microsoft Entra Workload Identity Federation (WIF) with Open ID Connect (OIDC) so that an app can obtain tokens by trusting an external OIDC identity provider, in this case Microsoft Azure AD.

I could not find a good guide for this online so I decided to write my own.

There are a number of steps required to make this solution a possible, as follows:

Create an Identity Pool in Amazon Cognito
Create an IAM Policy to allow access to said Pool
Request a JWT from Amazon Cognito to create an identity
Create an Azure AD app registration
Configure the Azure AD app to trust the Identity Pool as an OIDC provider
Exchange a JWT from Amazon Cognito with Microsoft for an Azure JWT

1. Create an Identity Pool in Amazon Cognito

Amazon Cognito Identity Pools is a service that issues federated, temporary AWS-based identities. We will use our identity pool to generate OpenID Connect (OIDC) JWT tokens.
We will create an identity pool for authenticated access, with the identity source being an OIDC provider.

CDK:

const DEVELOPER_PROVIDER_NAME = 'my.dev.provider'
// This can be whatever you want but must be dot delimited

const identityPool = new cdk.aws_cognito.CfnIdentityPool(this, 'myIdentityPool', {
    allowUnauthenticatedIdentities: false,
    developerProviderName: DEVELOPER_PROVIDER_NAME,
    identityPoolName: 'my-identity-pool', // Up to you
});

2. Create an IAM Policy to allow access to said Pool

We will need to create a policy to allow access to this identity pool from other services, for this demo we will use the default created role "Create a new IAM role"

We will skip the other steps creation steps in the console.

CDK:

we will manually create the policy, and can assign it to a role later.

const policy = new cdk.aws_iam.PolicyStatement({
      effect: cdk.aws_iam.Effect.ALLOW,
      actions: [
        'cognito-identity:GetOpenIdTokenForDeveloperIdentity',
        'cognito-identity:GetId',
      ],
      resources: [ identityPoolArn ],
    });

3. Request a JWT from Amazon Cognito to create an identity

Now we've created our Cognito Identity Pool, we can request a identity federation token from it. We will need to know the ID of our identity pool - This is the "audience" for our Azure identity federation.
We can get this from the AWS console under "Identity Pool ID" or from CDK by accessing the ref property of our identityPool

to do this we must assume a role with the above policy assigned. I will do this by creating a AWS lambda function and assigning said role.

CDK:

const fn = new lambda.Function(this, 'GetToken', {
      runtime: lambda.Runtime.PYTHON_3_14,
      handler: 'index.handler',
      code: lambda.Code.fromInline(`
from boto3 import client
DEVELOPER_USER_NAME = 'my_user_id' # Note this down
DEVELOPER_PROVIDER_NAME = '${ DEVELOPER_PROVIDER_NAME }' # From earlier definition
IDENTITY_POOL_ID = '${ identityPool.ref }'
def handler(event, context):
    cognito_client = client('cognito-identity')
    return cognito_client.get_open_id_token_for_developer_identity(
        IdentityPoolId = IDENTITY_POOL_ID ,
        Logins={
            DEVELOPER_PROVIDER_NAME: DEVELOPER_USER_NAME
        },
        TokenDuration=60, # s
    )
`
});
fn.addToRolePolicy(policy)

it is important to note the chosen DEVELOPER_PROVIDER_NAME & DEVELOPER_USER_NAME as the same values must be used to request tokens in the future.
After running the lambda we should receive a base64 encoded JWT of the shape:

{
  "iss": "https://cognito-identity.amazonaws.com",
  "sub": "REGION:GUID",                // <-- Subject
  "aud": "REGION:IDENTITY_POOL_GUID",  // <-- Audience
  "amr": ["authenticated", "my.dev.provider", "my.dev.provider-<region>:<pool>:<user>"],
  "iat": 1686577419,
  "exp": 1686581019
}

note down the subject and audience. If you don't want to decode the token then you can also obtain the values from observing the newly created identity in the AWS console:

4. Create an Azure AD app registration

For registering an app in enterprise cloud, refer to the official instructions from your enterprise company governance to create this app

5. Configure the Azure AD app to trust the Identity Pool as an OIDC provider

In your app, navigate to Manage > Certificates & secrets
Select Federated credentials and Add credential

for Federated credential scenario select Other issuer
for Issuer, enter https://cognito-identity.amazonaws.com
for type select Explicit subject identifier
for the Value use the use the 'Subject' obtained earlier
Under Credential details, enter a Name and Description of whatever you want
for the Audience use the 'Audience' obtained earlier (the Identity Pool ID)

6. Exchange a JWT from Amazon Cognito with Microsoft for an Azure JWT

That's it! We can now use the client credentials flow with a federated credential.

Lastly, we need to note the tenant & client id's for the App, we can see these in the 'Overview' of our app in Azure portal:

Now let's call Entra's /token endpoint and pass the Cognito ID token as the client_assertion:

Python Code:

from boto3 import client
from urllib3 import PoolManager

DEVELOPER_PROVIDER_NAME = 'my.dev.provider'
DEVELOPER_USER_NAME = 'my_user_id'
IDENTITY_POOL_ID = '<REGION>:<ID>' # get from AWS or pass as env var from cdk

AZURE_APP_TENANT_ID = '<TENANT-ID-FROM-STEP-ABOVE>'
AZURE_APP_CLIENT_ID = '<CLIENT-ID-FROM-STEP-ABOVE>'

cognito_client = client('cognito-identity')
cognito_resp = cognito_client.get_open_id_token_for_developer_identity(
      IdentityPoolId = IDENTITY_POOL_ID ,
      Logins={ DEVELOPER_PROVIDER_ID: DEVELOPER_USER_NAME },
      TokenDuration=120, # s
)

client_assertion_jwt = cognito_resp['Token']

url = f'https://login.microsoftonline.com/{AZURE_APP_TENANT_ID }/oauth2/v2.0/token'
payload = {
      'client_id': AZURE_APP_CLIENT_ID ,
      'scope': 'https://graph.microsoft.com/.default',
      'client_assertion_type': "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
      'client_assertion': client_assertion_jwt ,
      'grant_type': 'client_credentials',
}
headers = {
      'Content-Type': 'application/x-www-form-urlencoded',
}
http = PoolManager()
r = http.request('POST', url, body=urlencode(payload), headers=headers)
data = json.loads(r.data.decode('utf-8'))

if 'access_token' not in data:
    raise Exception(f"access token not in graph response: {data}")

print(data['access_token'])

Test by calling Graph API

curl -sS https://graph.microsoft.com/v1.0/applications?$top=1 \
  -H "Authorization: Bearer <ACCESS_TOKEN>"

(Your app must have the corresponding Application permissions approved - e.g., Application.Read.All for the call above.)

Building Robust Python Data Models with Pydantic Validators

samconibear — Wed, 12 Mar 2025 13:09:06 +0000

What is Pydantic?

Pydantic is a powerful data validation library for Python that leverages Python’s type hints. It is particularly useful for ensuring data integrity and consistency in complex applications, helping to catch errors in development.

What are Validators?

Validators in Pydantic ensure that data conforms to specific rules beyond basic type checking, enabling the enforcement of sophisticated validation logic.

Working Example

Let's take the example of a % discount on a product. With pydantic, we can define the model of a Product and ensure that the discount value will be a float

from pydantic import BaseModel

class Product(BaseModel):
  name: str
  discount: float

Unfortunatly, this description of the product does not give us full control over the data structure. The discount is enforced to be a floating point number, but it could be 0.1, 999.1 or -3.14, which does not make sense in the context of a percentage.

Where Validators come in

Using Pydantic Validators, we can enforce custom type checking! In this case let's set the bounds of discount to be between 0 and 1.
There are 2 ways of defining a custom validator:

Using the `@field_validator` Decorator

we define a decorated function used to validate the discount field, where we return a ValueError if the validation criteria is not met.

from pydantic import BaseModel, field_validator

class Product(BaseModel):
    name: str
    discount: float

    @field_validator('discount')
    def bounded_0_1(value: float) -> float:
      if  0. <= value and value <= 1.:
        return value
      raise ValueError(f'{value} is not between 0 and 1')

Using `Annotated` from the `typing` module

You can also define a validator by providing a metadata function to the standard library's Annotated. This is especialy useful if you have a commonly used validator that resides somewhere else in the code base, allowing you to import it when needed:

from pydantic import BaseModel, AfterValidator
from typing import Annotated # Avaliable from typing_extensions in python versions older than 3.9
from validators import bounded_0_1

class Product(BaseModel):
    name: str
    discount: Annotated[float, AfterValidator(bounded_0_1)]

AfterValidator runs after Pydantic's internal validation. I would almost always advocate for using this over other types of validators, as they are generally more type safe.

Builtin Validators

Pydantic also provides a number of built in validation via the Field class, which allows us to acheive the same result using a shorter inline notation:

from pydantic import BaseModel, Field

class Product(BaseModel):
    name: str
    discount: Annotated[float, Field(strict=True, ge=0, le=1)

Conclusion

Pydantic validators provide a flexible and powerful way to enforce custom validation logic in your data models. By leveraging these validators, you can ensure that your data is accurate and consistent, reducing the likelihood of errors and improving the overall robustness of your applications.

Validators are just one of many powerful Pydantic features that transform python into a more reliable programming language for large scale projects.

Pythonic Peculiarities

samconibear — Tue, 19 Sep 2023 17:42:47 +0000

I recently had what I described to some friends as a 'revelation'. Thinking I'd had some kind of spiritual awakening or deep philosophical discovery they were slightly underwhelmed when I told them Id developed a deeper level of understanding of another one of Python's unique quirks.

In this post I wanted to address some of the features of the language that make it so unique compared to other programming languages.

Exceptions as Part of Logic

While in any other language throwing an error is a resource intensive procedure and as such should never be used to control the flow of a program. This is not true with python, as throwing is both less costly, and the sluggishness of the language in general means alternatives flow control methods are no quicker.

There are many in the python community that advocate for using exceptions as part of control logic, and there are some scenarios where it could improve readability. For example, consider the scenario of obtaining an item nested deep within a dictionary, where a key/value may or may not exist at any level of the nested structure:

d = {"a": {"b": {"c": {"d": {"e": "exists"}}}}}

Traditional Style:

if "a" in d \
   and "b" in d["a"] \
   and "c" in d["a"]["b"] \
   and "d" in d["a"]["b"]["c"] \
   and "d" in d["a"]["b"]["c"] \
   and "e" in d["a"]["b"]["c"]["d"]:
      return d["a"]["b"]["c"]["d"]["e"]
else:
   return "does not exist"

Using the Exception style reduces the code to:

try: 
   return d["a"]["b"]["c"]["d"]["e"]
except (KeyError):
   return "does not exist"

Complex Index Slicing

Python makes slicing very syntactically simple through the use of negative slice parameters allowing you to index counting from the end of the array, and when provided as a step, re-index from the back of the array:

a[-1]       # get the last element
a[-5:-1]    # get the last 5 elements
a[-5:-1:-1] # same as above, but reversed
a[::-1]     # Cheeky one liner to reverse a string / list.

It's clear that this feature is much appreciated by developers, as javascript implemented the .at() method in ECMAScript 2022, allowing js devs to finally mimic this functionality.

List, Set & Generator Comprehensions

This wouldn't be a python feature list without including the famous list comprehension. Without going into too much detail, comprehensions can be used to re-write common iterative behaviors in one liners.

Comprehension can be used in place of the map function, for example:

# Find the transpose of a matrix
m = [[1,2,3], [4,5,6], [7,8,9]]
transpose = [[r[i] for r in m] for i in range(3)]

# Find primes under 100
{x for x in range(2, 100) if all(x % y for y in range(2, x))}

# Update an existing dictionary
d = {'a': 1, 'b': 2, 'c': 3}
{ k: v+1 for (k, v) in d.items() }

# Square number generator
(i * i for i in range(100))

Using Indentation for Scope

I've added this as a joke, however I think most python devs would agree that using indentation to define scope slows development and makes the language feel clunky.

I have had this post sitting in my drafts for ages, but I am tempted to make this into a series, as there are still some other python features I'd like to discuss.

Checking a URI string is valid in JavaScript

samconibear — Wed, 15 Feb 2023 22:06:43 +0000

I recently needed a way of checking if the syntax of a URL is valid, you'd think that JavaScript (a language designed for the web) would have an easy way of doing so. I found that the answer is not so simple.

What makes a URI valid or invalid? As specified in RFC 3986 - URI Generic Syntax (Berners Lee, et al. 2005) there are a set of rules and allowed characters making up a URI. here I will discuss the methods of validating a URI in JavaScript:

URL Constructor
DOM Element
RegEx
Complete Method

URL Constructor

The most simple and obvious method, try to create an instance of JavaScript's native URL object using the string.

new URL('https://url-with-invalid-[chars].com/');
  > Uncaught TypeError: Failed to construct 'URL': Invalid URL

However if it is invalid it will throw an error. Generally throwing Errors as flow control is bad practice in most programming languages as it is a resource intensive operation. However as you will see later, this is not such an issue.

Wrapping the constructor function in a try/catch it becomes more usable:

function isUriValid(string) {
  try { 
    new URL (string);
    return true;
  } catch {
    return false;
  }
}

Based on my tests this seems to take < 0.2 ms to compute.

Pro's:

Simple & easy to read / understand.

Con's:

Throwing Errors as flow control is bad practice.
Does not throw if invalid characters are used (EG: http://£*(){}.com/).

DOM Element

Improves on the previous method by natively returning true/false instead of throwing an error, but still has many of the same shortcomings. It works by taking advantage of the fact that the href of an element defaults to the window hostname if you try to manually set it to an invalid URL.

function isUriValid(string) {
  let a  = document.createElement('a');
  a.href = 'invalid url';
  return (a.host && a.host != window.location.host);
}

In my tests this took 0.2 - 0.6 ms to complete.

Pro's:

No Error throwing.

Con's:

returns false if protocol is missing (EG: https:// or ftp://).
does not return false when invalid characters are used (EG: http://*£){.com).

RegEx

Using a good old Regular Expression, all be it a rather lengthy one. The benefit of this method is that it can handle all characters, however I would not recommend it due to the fact that it is VERY slow for long URLs, and the compute time scales with the length of the string. It's worth noting that you could modify it to make it quicker if you only want to validate the hostname for example. Here is an example of one written by somebody else.

function isUriValid(string) {
  let re = new RegExp('^([a-z]*:\\/\\/)?'+ // protocol
    '((([a-z\\d]([a-z\\d-]*[a-z\\d])*)\\.)+[a-z]{2,}|'+ // hostname
    '((\\d{1,3}\\.){3}\\d{1,3}))'+ // or ipv4 address
    '(\\:\\d+)?(\\/[-a-z\\d%_.~+]*)*'+ // port and path
    '(\\?[;&a-z\\d%_.~+=-]*)?'+ // query string
    '(\\#[-a-z\\d_]*)?$','i' // hash
  );
  return re.test(string);

In my tests this took 1100 - 1300 ms with a 30 character string.

Pro's:

Handles all domains and invalid characters.
Flexibility to be modified for custom use cases.

Con's:

Hard to read.
Very slow.

Conclusion

None of these methods are ideal in my opinion, but if I had to pick one I'd go for the URL class constructor, however this doesn't give you 100% validation as it doesn't check for some invalid characters.

The best way to truly validate a URL is use a combination of the URL constructor with RegEx. Below I have detailed a function that should handle all possible URL cases.

Complete Method

function isUriValid(url) {
  let uri;
  try { uri = new URL(url); } 
  catch { return false; }

  // Validate the Protocol:
  if (!/[a-z]+\:\/\/$/.test(uri.protocol)) { return false; }

  // Now Validate the Hostname:
  if (uri.hostname !== '') {
    if (!/^[a-zA-Z\d]+[a-zA-Z\d-.@]*[a-zA-Z\d]+$/.test(uri.hostname)) { return false; }
  }

  // The Port:
  if (uri.port!== '') {
    if (!/^([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$/.test(uri.pathname)) { return false; }
  }

  // Now the Path:
  if (uri.pathname !== '/') {
    if (!/^\/[-a-zA-Z\d%_.~+]+$/.test(uri.pathname)) { return false; }
  }

  // Search Parameters:
  if (uri.search !== '') {
    if (!/^[?;&a-zA-Z\d%_.~+=-]+$/.test(uri.pathname)) { return false; }
  }

  // Lastly the URI Fragment:
  if (uri.hash !== '') {
    if (!/^\#[-a-z\d_]+$/.test(uri.pathname)) { return false; }
  }

  return true;
}

If you know of any other methods of validating URL's other than those stated above, please leave a comment on this post as I'd love to hear some other options.

AWS S3 - SAA Cheat Sheet

samconibear — Mon, 14 Nov 2022 18:08:27 +0000

This page contains information I have collated on Amazon S3. If you know the basics of S3 and how it is used, this cheat sheet should cover the specific areas that could come up in the Solutions Architect Associate exam.

Naming Convention

MUST BE:
- Globally Unique
- 3 -63 characters
- All lowercase
- No_underscore
- Not an IP-address
- Not start with xn- or end with -s3alias

Security

An object can be accessed if allowed by IAM OR bucket policy / ACL
Security can be controlled using:
- IAM - always takes priority.
- Bucket Policy - can be cross account.
- Object ACL - fine grain control (can be disabled).
- Bucket ACL - less common (can be disabled).

Encryption

You can force Encryption using Bucket policies or use S3 'default encryption'
The types of encryption are:
- SSE-S3 - Key managed by aws.
- SSE-KMS - Key controlled by user within aws.
- SSE-C - Key fully controlled by user (not stored in aws).
- Client-Side-Encryption - Self explanatory.

Replication

Versioning must be enabled for replication.
There are 2 types:
1. CRR (Cross Region Replication)
2. SRR (Same Region Replication)
Only new objects will be replicated after replication is enabled.
For old objects, use S3 BATCH REPLICATION.

Storage Classes

It is possible to move an object to any storage class below it in this table:

 ______________________________________________________
|        NAME        | RETRIVAL FEE | MINIMUM DURATION |
|____________________|______________|__________________|
|S3 Standard         | None         | None             |
|Infrequent Access   | per GB       | 30 days          |
|Intelligent Tiering | None         | None             |
|One Zone IA         | per GB       | 90 days          |
|Glacier Instant     | per GB       | 90 days          |
|Glacier Flexible    | per GB       | 90 days          |
|Deep Archive        | per GB       | 180 days         |

Lifecycle Rules

Used to automate the moving of objects.
Types:
- Transition action: Move tier after a certain time.
- Expiration action: Delete after time / old version / incomplete multi-part upload.

Versioning

Enabling versioning on a bucket with existing items will give them the version number: null.

Multi Part Upload

Required for files over 5GB.
Recommended for files over 100MB.

S3 Event Notifications

Integrate S3 events with: SNS, SQS, Lambda, Event Bridge

CORS (Cross Origin Resource Sharing)

If accessing an S3 bucket from another origin, you need to allow Access-Control-Allow-Origin in the bucket policy for that or all origins.

Requester Pays Buckets

The requester of the data pays for the networking cost of downloading the object instead of the bucket owner.
As a result the requester cannot be anonymous.

Transfer Acceleration

Transfer to S3 via edge location to utilise speed of private AWS network.

Byte Range Fetch

Retrieve a specific no. of bytes.
Multiple fetch can be done in parallel.

S3 Select

Use SQL to filter S3.

S3 Batch

Perform bulk operations with a single request.

Pre Signed URLs

The user that receives the URL inherits the permissions of the user who generated it.

S3 Vault Lock

Block object version from deleting.
Must set a fixed period.
Versioning must be enabled.
Retention Modes:
- Compliance - No Admins
- Governance - Admins
- Legal Hold - Protect indefinitely - Admins

Glacier Vault Lock

The object can never be deleted.
WORM - Write Once Read Many.

S3 Access Points

Manage permissions through "access points" which can be assigned to multiple user groups.

S3 Object Lambda

Modify data requested by S3 via a Access Point.
Can use data from AWS managed databases.

Useful Git Commands

samconibear — Wed, 25 May 2022 20:06:46 +0000

Git is a fantastic technology that not only provides historical tracking of source code throughout development, but also enables multiple developers to work on the same project without stepping on each others feet.

I wanted to create a sort of cheat sheet for git commands that I find myself using often. I will continue to update this post as I discover other handy git commands.

Starter Git Commands:

1. Create and checkout a new branch

git checkout -b <branch>

2. Discard changes to a file.

git checkout -- <file>

3. Rename a local branch

git branch -m <oldName> <newName>

4. Merge a specified branch into the currently checked out branch.

git merge <branch>

More Git Commands:

1. Stage all changes

git add -A

stage all new, modified or removed files to the working tree. Note this is different to git add . which only stages new and existing files.

2. Review all changes

git diff HEAD

The same as git diff but reviews all changes rather than just those unstaged.

3. Remove a file from the repo but keep it in your project directory

git rm --cached <filename>

Very useful when you have files you don't want tracked that you forgot to specify in .gitignore that have previously committed. After adding them to .gitignore run this command to ensure they are removed from the repo without deleting them from your local project directory.

4. Reset all local files to the last commit

git reset --hard

DANGER - exercise caution when using this command as it has the potential to throw away hours of work.

I often find I have uncommitted changes in a branch I've been messing around in (whitespace, print statements) git doesn't let you checkout another branch with uncommitted changes so this is a quick way to reset your project directory to the HEAD.

5. Undo the last commit

git reset --hard HEAD^

DANGER - Can also cause unintentional loss of work.

We've all made commits we immediately regret... Use this command to destroy the changes from the last commit.

6. Modify the previous commit

git commit --amend -m <newMsg>

Adding the -m option allows you modify the previous commit message. You can also stage new changes to the commit and the previous commit will inherit them.

7. Remove all branches that no longer exist on remote

git branch --merged | egrep -v "(^\*|master|main|<branchToSave>)" | xargs git branch -d

DANGER - this will delete any newly created branches that have not yet been pushed to the remote repo. be sure to specify special cases as in `<branchToSave>`.

This can be used to clean up your local repository if you have lots of old branches that have since been merged. If you want to learn how this works see this great stack overflow post.

8. Cache git credentials for a set amount of time

git config credential.helper 'cache --timeout 28800' # 8hrs

This saves you entering your git user/password every time you want to push/pull
The --global flag can be added to do this across all repositories.

9. Remove a committed file from a branch / PR

git checkout <main_branch> -- <path_to_file>

10. Delete a number of previous pushed commits

git reset --hard <sha-id-of-last-good-commit>
git push origin HEAD --force

DEV Community: samconibear

No Certs, No Secrets: Microsoft Graph on Azure using Entra Workload Identity Federation and Amazon Cognito (OIDC)

1. Create an Identity Pool in Amazon Cognito

CDK:

2. Create an IAM Policy to allow access to said Pool

CDK:

3. Request a JWT from Amazon Cognito to create an identity

CDK:

4. Create an Azure AD app registration

5. Configure the Azure AD app to trust the Identity Pool as an OIDC provider

6. Exchange a JWT from Amazon Cognito with Microsoft for an Azure JWT

Python Code:

Test by calling Graph API

Building Robust Python Data Models with Pydantic Validators

What is Pydantic?

What are Validators?

Working Example

Where Validators come in

Using the @field_validator Decorator

Using Annotated from the typing module

Builtin Validators

Conclusion

Pythonic Peculiarities

Exceptions as Part of Logic

Complex Index Slicing

List, Set & Generator Comprehensions

Using Indentation for Scope

Checking a URI string is valid in JavaScript

URL Constructor

Pro's:

Con's:

DOM Element

Pro's:

Con's:

RegEx

Pro's:

Con's:

Conclusion

Complete Method

AWS S3 - SAA Cheat Sheet

Naming Convention

Security

Encryption

Replication

Storage Classes

Lifecycle Rules

Versioning

Multi Part Upload

S3 Event Notifications

CORS (Cross Origin Resource Sharing)

Requester Pays Buckets

Transfer Acceleration

Byte Range Fetch

S3 Select

S3 Batch

Pre Signed URLs

S3 Vault Lock

Glacier Vault Lock

S3 Access Points

S3 Object Lambda

Useful Git Commands

Starter Git Commands:

1. Create and checkout a new branch

2. Discard changes to a file.

3. Rename a local branch

4. Merge a specified branch into the currently checked out branch.

More Git Commands:

1. Stage all changes

2. Review all changes

3. Remove a file from the repo but keep it in your project directory

4. Reset all local files to the last commit

DANGER - exercise caution when using this command as it has the potential to throw away hours of work.

5. Undo the last commit

DANGER - Can also cause unintentional loss of work.

6. Modify the previous commit

7. Remove all branches that no longer exist on remote

DANGER - this will delete any newly created branches that have not yet been pushed to the remote repo. be sure to specify special cases as in <branchToSave>.

8. Cache git credentials for a set amount of time

9. Remove a committed file from a branch / PR

10. Delete a number of previous pushed commits

Using the `@field_validator` Decorator

Using `Annotated` from the `typing` module

DANGER - this will delete any newly created branches that have not yet been pushed to the remote repo. be sure to specify special cases as in `<branchToSave>`.