docs: update README for documentation freshness

[dlevy-msft-sql]

Summary

Updates the README.md to fix documentation freshness issues and improve accuracy.

Changes

Fixed Issues

1. Discussion link typo: Fixed link text from Require --password-encryption for add-user #293 to Prioritize implementation of back-compat flags #292 (the link URL was correct but display text was wrong)

2. Updated 'Switches not available' section: Reflects current implementation state

   • Most switches from the original discussion have now been implemented: -e, -f, -g, -k, -t, -z, -Z, -r, -X\
   • Only -j\ (raw error messages) and -p[1]\ (print statistics) remain unimplemented
   • Changed from vague text to a clear table of remaining items

3. Fixed ActiveDirectoryIntegrated description: Removed outdated text saying it falls back to ActiveDirectoryDefault (it's now fully implemented)

4. Added missing authentication methods to :Connect documentation:

   • \ActiveDirectoryInteractive\
   • \ActiveDirectoryAzCli\
   • \ActiveDirectoryDeviceCode\

5. Documented additional authentication methods that are available via --authentication-method:

   • \ActiveDirectoryWorkloadIdentity\
   • \ActiveDirectoryClientAssertion\
   • \ActiveDirectoryAzurePipelines\
   • \ActiveDirectoryEnvironment\
   • \ActiveDirectoryAzureDeveloperCli\
   • \ActiveDirectoryServicePrincipalAccessToken\
   • \SqlPassword\

Related

This addresses documentation freshness issues identified when comparing the README with the actual implementation in \cmd/sqlcmd/sqlcmd.go\ and the Microsoft Learn documentation.

Testing

Documentation-only change - no functional changes.

[Copilot]

Pull request overview

This PR updates the README.md to improve documentation freshness and accuracy by correcting outdated information and adding missing details.

Changes:

• Fixed discussion link typo from #293 to #292
• Updated "Switches not available" section to reflect current implementation (most switches now implemented, only -j and -p[1] remain)
• Corrected ActiveDirectoryIntegrated authentication description (removed outdated fallback text)
• Added missing authentication methods to documentation (ActiveDirectoryInteractive, ActiveDirectoryAzCli, ActiveDirectoryDeviceCode, and additional methods via --authentication-method)

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

[Copilot]

SqlAuthentication is not a supported value in this repo (the code and help text use SqlPassword). Listing SqlAuthentication under :Connect -G will cause users to pass an auth method that the implementation treats as AAD, likely resulting in a connection error. Replace it with SqlPassword (or remove SQL auth from the -G list and document that SQL auth is selected by using -U/-P without -G).

Suggested change

- `:Connect` now has an optional `-G` parameter to select one of the authentication methods for Azure SQL Database - `SqlAuthentication`, `ActiveDirectoryDefault`, `ActiveDirectoryIntegrated`, `ActiveDirectoryServicePrincipal`, `ActiveDirectoryManagedIdentity`, `ActiveDirectoryPassword`, `ActiveDirectoryInteractive`, `ActiveDirectoryAzCli`, `ActiveDirectoryDeviceCode`. If `-G` is not provided, either Integrated security or SQL Authentication will be used, dependent on the presence of a `-U` username parameter.

- `:Connect` now has an optional `-G` parameter to select one of the authentication methods for Azure SQL Database - `SqlPassword`, `ActiveDirectoryDefault`, `ActiveDirectoryIntegrated`, `ActiveDirectoryServicePrincipal`, `ActiveDirectoryManagedIdentity`, `ActiveDirectoryPassword`, `ActiveDirectoryInteractive`, `ActiveDirectoryAzCli`, `ActiveDirectoryDeviceCode`. If `-G` is not provided, either Integrated security or SQL Authentication will be used, dependent on the presence of a `-U` username parameter.

[Copilot]

The PR description says the outdated fallback behavior for ActiveDirectoryIntegrated was removed because it is now fully implemented, but the updated README text still states it "falls back to ActiveDirectoryDefault". Please align the README with the actual intended behavior (or adjust the PR description if fallback is still expected).

[Copilot]

This section says ActiveDirectoryServicePrincipalAccessToken works by setting SQLCMDPASSWORD to the access token, but the current implementation never includes the provided password in the connection string for this auth method (so the token is not passed into GetTokenBasedConnection). Either update the documentation to match current behavior, or update the implementation to propagate the token for this method.

Suggested change

	- `ActiveDirectoryServicePrincipalAccessToken` - Uses a pre-obtained bearer token; set `SQLCMDPASSWORD` to the access token value
	- `ActiveDirectoryServicePrincipalAccessToken` - Uses a pre-obtained bearer token; `SQLCMDPASSWORD` is not currently used to pass the access token for this method

[Copilot]

The bullets for ActiveDirectoryWorkloadIdentity / ActiveDirectoryAzurePipelines mention extra "connection parameters" like tokenfilepath, serviceconnectionid, and systemtoken, but the legacy sqlcmd CLI only accepts -S in the server[\\instance][,port] form and doesn't expose a way to supply arbitrary query parameters. Clarify how users are expected to provide these values (e.g., via specific environment variables only), or remove the parameter mentions to avoid implying unsupported inputs.

Suggested change

	- `ActiveDirectoryWorkloadIdentity` - Uses federated token authentication for Kubernetes or GitHub Actions workloads; optionally provide `client_id@tenant_id` as username and `tokenfilepath` parameter (defaults to `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, `AZURE_FEDERATED_TOKEN_FILE` env vars)
	- `ActiveDirectoryClientAssertion` - Authenticates with a signed JWT assertion instead of a client secret
	- `ActiveDirectoryAzurePipelines` - Authenticates using an Azure Pipelines service connection; requires `client_id@tenant_id` as username, plus `serviceconnectionid` and `systemtoken` connection parameters (or `AZURESUBSCRIPTION_CLIENT_ID`, `AZURESUBSCRIPTION_SERVICE_CONNECTION_ID`, `SYSTEM_ACCESSTOKEN` env vars)
	- `ActiveDirectoryWorkloadIdentity` - Uses federated token authentication for Kubernetes or GitHub Actions workloads; optionally provide `client_id@tenant_id` as username, and use `AZURE_FEDERATED_TOKEN_FILE` to specify the token file path (`AZURE_CLIENT_ID` and `AZURE_TENANT_ID` are also used when username is not provided)
	- `ActiveDirectoryClientAssertion` - Authenticates with a signed JWT assertion instead of a client secret
	- `ActiveDirectoryAzurePipelines` - Authenticates using an Azure Pipelines service connection; requires `client_id@tenant_id` as username, and uses `AZURESUBSCRIPTION_SERVICE_CONNECTION_ID` and `SYSTEM_ACCESSTOKEN` environment variables (`AZURESUBSCRIPTION_CLIENT_ID` can also be used when username is not provided)