Repository navigation
Scheduled functional test failed - Run ID: 37251883349 #13206
Description
Bug information
This issue is automatically generated if the scheduled functional test fails. The Radius functional test operates on a schedule of every 4 hours during weekdays and every 12 hours over the weekend. It's important to understand that the test may fail due to workflow infrastructure issues, like network problems, rather than the flakiness of the test itself. For the further investigation, please visit here.
Activity
nicolejms commentedon Oct 14, 2026
Reviewed this failure against the recent merged flaky-test fixes. Keeping this issue open: none of those fixes covers the failed Azure login.
Evidence: In run 37251883349, the core-resource cloud job failed in
Login to AzurewithFailed to get ID Token. Tests did not start. The lateraz login, missing-cluster, and missing-log errors followed that failure. This is a CI authentication/setup failure. The log does not establish whether the token failure was temporary or caused by configuration.Frequency: On 2026-10-05 UTC, 1 of 3 scheduled cloud workflow runs had this Azure login failure. This is a workflow-run proxy, not a test execution rate. Sample command:
gh run list --repo radius-project/radius --workflow functional-test-cloud.yaml --branch main --event schedule --created 2026-10-05 --limit 200 --json databaseId,conclusion,createdAt. The matching failed run is linked above. A second run, 37361423697, also had a failed workflow result but no failed job in the current job data; it is not counted as the same error.#13199 handles Go module downloads; #13276 handles Docker image pulls; #13189 handles curl-based tool installers. The recent UCP and managed-secret fixes (#13277 and #13278) run after authentication and do not affect token acquisition.
Recommendation: Investigate the OIDC token request and Azure login action at the failing boundary. Do not infer a product or test defect, or add a test retry, from this setup failure.
nicolejms commentedon Oct 14, 2026
The full log now identifies the failed boundary: the GitHub OIDC token request timed out. This was not an Azure federated credential propagation error.
In run 37251883349, job
111582267515started the token request at01:40:16.604Z. At01:40:21.620Z, it reportedFailed to get ID Token, withError Code: undefinedandError Message: Request timeout. No Azure token exchange or test execution had occurred. The job already hadid-token: write. These details can be read withgh run view 37251883349 --repo radius-project/radius --job 111582267515 --log.The pinned Azure login action calls
core.getIDToken. Its bundled HTTP client retries selected HTTP responses, but a rejected request exits before the response retry logic. Thus its retry setting does not cover this timeout. The action does not accept a token input or expose a setting for request timeout retries.Frequency: One confirmed matching failure among the three scheduled cloud workflow runs on 2026-10-05 UTC. This is a workflow-run proxy, not a test failure rate. The failed run is linked above. Both cloud login steps passed in run 37315499287. Run 37361423697 has a failed workflow result but no failed job in the current job data; it is not counted as the same error. Reproduce the sample with
gh run list --repo radius-project/radius --workflow functional-test-cloud.yaml --branch main --event schedule --created 2026-10-05 --limit 200 --json databaseId,conclusion,createdAt.Fix: PR #13287 adds a shared login script for the two Azure login steps in the cloud functional workflow. It retries only the GitHub token request on timeouts, selected connection errors, and HTTP 408, 429, 500, 502, 503, or 504. It limits this to three attempts, each with a 30-second timeout, with two- and four-second delays. Permission, certificate, invalid-response, Azure login, and subscription errors are not retried. The identity, audience, cloud, subscription, and OIDC permissions are unchanged. The script masks the ID token before passing it to Azure CLI, and does not write it to a file or step output. It clears the Azure account cache at the end of each job.
Retrying tests cannot fix a failure before tests start. Retrying all login errors could hide a bad trust or permission setting. Changing Azure trust has no basis in this log. The selected fix targets only the confirmed request boundary.
Checks:
node --test .github/scripts/azure-oidc-login_test.mjspassed all 43 cases. The full suite passed 100 times (4,300 passing checks), including a real local HTTP request timeout followed by recovery. Actionlint passed with its ShellCheck integration disabled; a separate ShellCheck run passed for every added shell command. The full workflow has 17 ShellCheck findings, all also present in the unchanged base version. Markdown lint, table format, CSpell, andgit diff --checkpassed. Live Azure login and cloud functional tests were not run locally because this session has no runner OIDC credentials.No existing open fix was found by issue search or linked PR history. The issue remains open until a fix merges.
fix(ci): retry GitHub OIDC request timeouts before Azure login (radiu…