Inject registry creds into app rad deploy instead of provisioning a control-plane Secret

[sk593]

Summary

The Radius.Compute/containerImages recipe moved from a Terraform recipe to a Bicep recipe. Under the new model, the app's .radius/app.bicep declares a Radius.Security/secrets resource named radius-ghcr-registry-creds (keys username/password) fed by two params: registryUsername (plain) and registryPassword (@secure()). That resource materializes the registry push/pull Secret on the target cluster, and the recipe reads it by the name the recipe pack registers.

So the credentials must now reach the app deploy as rad deploy parameters, valued from the runner identity — registryUsername = ${{ github.actor }} and registryPassword = ${{ secrets.GITHUB_TOKEN }} — instead of being provisioned as a Kubernetes Secret on the control-plane cluster.

Changes

.github/extension/actions/run-rad-commands/action.yml

• Append --parameters registryUsername=… and --parameters registryPassword=… to the app-file rad deploy invocations (the default deploy branch, and the custom-commands deploy branch only when the deploy target is APP_FILE). Built into the existing argv array so special characters aren't word-split, added only when non-empty and not already supplied via RADIUS_DEPLOY_PARAMS, and kept out of the recorded command string.
• Remove the Provision registry credentials on control plane step (kubectl create secret generic radius-ghcr-registry-creds …). The Secret is now created on the target cluster by the app's Radius.Security/secrets resource during rad deploy.
• Mask and scrub secret values so they never reach the logs or the uploaded rad-commands-result artifact.
• Refresh the action description, header comment, and input descriptions.

run-rad-commands-azure.yml / run-rad-commands-aws.yml

• Recipe-pack registration is functionally unchanged: Azure passes containerImagesRegistry / containerImagesRegistrySecretName=radius-ghcr-registry-creds; the AWS inline pack passes registry / registrySecretName=radius-ghcr-registry-creds. Only the now-stale comments that described control-plane provisioning were updated for accuracy.

.github/extension/README.md

• Updated the numbered flow: dropped the control-plane provisioning step and described the injected registryUsername/registryPassword runner credentials in the run step.

Notes

• These credentials belong only to the app deploy. They are not added to the recipe-pack rad deploy (radius-env.bicep), which does not declare them — doing so would make rad reject unknown parameters.
• registryPassword is secret: passed via an argv array, never echoed or written into the recorded/logged command string.
• Consistent across both the Azure and AWS provider workflows.

This is the upstream half of a change coordinated with radius-project/ai-extensions, which stops auto-generating registryUsername/registryPassword in the app bicep so the workflow can inject the runner values instead.

• The registry-push Secret is named radius-ghcr-registry-creds (the radius- prefix was added in a follow-up to this branch for parity with the ai-extensions radius-app-bicep skill). The name stays consistent across all three points: the workflow value → the recipe-pack parameter (containerImagesRegistrySecretName / registrySecretName) → the app's Radius.Security/secrets resource. No recipe-pack change in resource-types-contrib is needed since it takes the name as a parameter.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Pull request overview

Updates the GitHub Actions Radius extension workflows/composite action to stop provisioning registry credentials on the control-plane cluster and instead pass registry credentials into the app rad deploy as parameters, enabling the app’s Radius.Security/secrets resource to materialize the registry Secret on the target cluster.

Changes:

• Removes the control-plane kubectl create secret generic ghcr-registry-creds ... step from the shared run-rad-commands composite action.
• Injects registryUsername / registryPassword via --parameters on app deploy(s), while keeping secrets out of the recorded command string.
• Updates Azure/AWS provider workflow comments and the extension README to reflect the new model.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/extension/actions/run-rad-commands/action.yml	Removes control-plane Secret provisioning and injects registry credentials into rad deploy argv.
.github/extension/run-rad-commands-azure.yml	Updates comments and passes registry creds inputs to the shared action.
.github/extension/run-rad-commands-aws.yml	Updates comments and passes registry creds inputs to the shared action.
.github/extension/README.md	Updates documented workflow steps to match the new credential flow.

Comments suppressed due to low confidence (1)

.github/extension/actions/run-rad-commands/action.yml:201

• In the custom rad_commands path, registryUsername/registryPassword get appended to any deploy command, not just the app deploy. This can break supported custom command scenarios like deploying radius-env.bicep (unknown parameters) and it also silently skips injection when the required inputs are empty. Only inject these parameters when the deploy target is the app file (and fail fast if creds are missing for that case).

              fi
              if [ -n "${RADIUS_DEPLOY_PARAMS//[[:space:]]/}" ]; then
                while IFS= read -r _pname; do
                  [ -z "$_pname" ] && continue
                  _pval=$(printf '%s' "$RADIUS_DEPLOY_PARAMS" | jq -r --arg k "$_pname" '.[$k]')

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/extension/actions/run-rad-commands/action.yml:170

• add_secret echoes the secret value directly into the ::add-mask:: workflow command. If a secret contains %, \n, or \r, GitHub Actions requires escaping (otherwise masking can fail and multiline values can inject extra log lines/commands). Escape the value for the workflow command while still storing the raw value for artifact scrubbing.

        add_secret() {
          [ -n "$1" ] || return 0
          SECRET_VALUES+=("$1")
          # Mask one line at a time. GitHub reliably masks a single-line value, but
          # a multiline ::add-mask:: leaves the second and later lines unmasked (and

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/extension/actions/run-rad-commands/action.yml:195

• scrub_secrets is not literal-safe: in Bash ${var//pattern/repl} the pattern is always treated as a glob pattern, even when it comes from a quoted variable. Secrets containing glob metacharacters (notably [/], but also */?) may fail to match (or overmatch) and leak into the uploaded artifact. Update the comment (it currently claims quoting disables pattern matching) and escape glob metacharacters before doing the substitution (or switch to a literal-safe replacer).

        # the artifact never carries a credential that `rad` happened to echo. The
        # search value is double-quoted inside the substitution, which disables
        # pattern matching so it is compared as a literal string -- glob
        # metacharacters (* ? [ ] \) in a secret are matched verbatim, not as
        # patterns.

[github-actions]

Unit Tests

    2 files  ±0    457 suites  ±0   6m 26s ⏱️ - 1m 14s
6 075 tests ±0  6 073 ✅ ±0  2 💤 ±0  0 ❌ ±0 
7 294 runs  ±0  7 292 ✅ ±0  2 💤 ±0  0 ❌ ±0 

Results for commit d29c180. ± Comparison against base commit d86285e.

♻️ This comment has been updated with latest results.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.90%. Comparing base (d86285e) to head (d29c180).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #12510      +/-   ##
==========================================
- Coverage   53.91%   53.90%   -0.02%     
==========================================
  Files         765      765              
  Lines       50689    50689              
==========================================
- Hits        27328    27322       -6     
- Misses      20793    20796       +3     
- Partials     2568     2571       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[github-actions]

Functional Tests - corerp-noncloud

180 tests  ±0   178 ✅ ±0   1h 23m 26s ⏱️ - 7m 24s
  3 suites ±0     2 💤 ±0 
  1 files   ±0     0 ❌ ±0 

Results for commit 9d8ece7. ± Comparison against base commit ca1568e.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/extension/actions/run-rad-commands/action.yml:280

• The disallowed-command path (above this loop) records/logs the raw caller command string without passing it through scrub_string. If a disallowed command includes any value from REGISTRY_PASSWORD or RADIUS_DEPLOY_PARAMS inline, it can bypass redaction and end up in both logs and rad-commands-result.json. Scrub the command string before writing it to COMMANDS_JSON and stderr in that disallowed branch.

          for cmd in "${CLEAN[@]}"; do
            verb="${cmd%% *}"
            if [ "$verb" = "deploy" ]; then

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[github-actions]

Functional Tests - ucp-cloud

4 tests  ±0   4 ✅ ±0   35s ⏱️ ±0s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 56d695a. ± Comparison against base commit d86285e.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[github-actions]

Functional Tests - statestore-noncloud

2 tests  ±0   2 ✅ ±0   3m 10s ⏱️ +5s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit d29c180. ± Comparison against base commit d86285e.

♻️ This comment has been updated with latest results.

[sylvainsf]

Looks great, very well thought out.

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	d29c180
Unique ID	funcdffe6b75a7
Image tag	pr-funcdffe6b75a7

• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-funcdffe6b75a7
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-funcdffe6b75a7
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-funcdffe6b75a7
• controller test image location: ghcr.io/radius-project/dev/controller:pr-funcdffe6b75a7
• ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-funcdffe6b75a7
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting ucp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded