fix: add missing dry-run option for assign-role command

src/cli.ts

@@ -134,6 +134,7 @@ sharedOptions(
     .command('assign-role <domain>')
     .description('Assign Key Vault Certificate User and Secrets User roles to a principal for a domain certificate')
     .requiredOption('--principal-id <id>', 'Azure principal ID to assign roles to')
+    .option('--dry-run', 'Show what would be assigned without making changes')
 ).action(async (domain: string, options: Record<string, unknown>) => {
   applyOverrides(options);
   const config = loadConfig();
@@ -155,10 +156,15 @@ sharedOptions(
     { role: 'Key Vault Secrets User'     as const, scope: `${vaultBase}/secrets/${certName}` },
   ];
 
+  const dryRun = Boolean(options['dryRun']);
   for (const { role, scope } of assignments) {
-    const roleDefinitionId = `/subscriptions/${sub}/providers/Microsoft.Authorization/roleDefinitions/${ROLE_IDS[role]}`;
-    await authClient.roleAssignments.create(scope, randomUUID(), { roleDefinitionId, principalId });
-    console.log(`Assigned '${role}' to ${principalId} on ${scope}`);
+    if (dryRun) {
+      console.log(`[dry-run] Would assign '${role}' to ${principalId} on ${scope}`);
+    } else {
+      const roleDefinitionId = `/subscriptions/${sub}/providers/Microsoft.Authorization/roleDefinitions/${ROLE_IDS[role]}`;
+      await authClient.roleAssignments.create(scope, randomUUID(), { roleDefinitionId, principalId });
+      console.log(`Assigned '${role}' to ${principalId} on ${scope}`);
+    }
   }
 });