Repository navigation
Use Trusted Publishing for CloudTest E2E Test execution - #141
Merged
Merged
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The managed-identity request uses an invalid bare resource scope instead of the required /.default scope.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Adds managed-identity trusted publishing for CloudTest while retaining API keys for local runs.
Changes:
- Exchanges Entra tokens for short-lived Gallery publishing keys.
- Initializes and shares authentication through test fixtures.
- Adds configuration validation and provider tests.
| File | Description |
|---|---|
E2EPublishingKeyProviderTests.cs |
Tests acquisition, validation, concurrency, and failures. |
Test .csproj |
Includes the new provider tests. |
TestSettings.cs |
Loads trusted-publishing settings and initializes keys. |
E2EPublishingKeyProvider.cs |
Implements managed-identity token exchange. |
TrustedPublishingSettings.cs |
Defines deployment authentication settings. |
GalleryConfiguration.cs |
Centralizes service URL selection. |
CommonFixture.cs |
Initializes publishing authentication. |
GalleryClient.cs |
Uses centralized Gallery URL selection. |
AssemblyInfo.cs |
Exposes internals to tests. |
Source .csproj |
Adds source files and Azure Identity dependency. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| try | ||
| { | ||
| var credential = _createCredential(clientId.ToString()); | ||
| var request = new TokenRequestContext(new[] { context.ResourceUri }); |
Contributor
Author
There was a problem hiding this comment.
Azure.Identity 1.12.0 supports a bare resource URI for managed identity. Its IMDS implementation calls ScopesToResource(), which strips /.default when present and otherwise passes the resource through unchanged.
agr
reviewed
Oct 2, 2026
agr
reviewed
Oct 2, 2026
agr
reviewed
Oct 2, 2026
agr
previously approved these changes
Oct 2, 2026
agr
approved these changes
Oct 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates CloudTest E2E tests to use managed-identity trusted publishing instead of a stored API key.
Uses Azure.Identity.ManagedIdentityCredential to acquire an Entra token with the CloudTest VM’s identity and exchange it with Gallery for a short-lived publishing key. Authentication happens during test fixture initialization, and the key is shared in memory without being written to configuration or logs.
CloudTest has no static-key fallback, while local execution continues to support manually supplied API keys.