From c13cb8c0f8eced9fce12093c84fe9d21bf6cd69e Mon Sep 17 00:00:00 2001
From: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Date: Sat, 1 Aug 2026 17:27:05 -0700
Subject: [PATCH 1/3] Fix rad deploy resolving Radius.Core environment ID in
 the wrong group
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Motivation:
When a workspace's default environment is stored as a full Radius.Core
resource ID (e.g. created via `rad init` in preview mode), running
`rad deploy <template> -g <group>` against a resource group other than
the environment's own group failed with "The environment ... does not
exist in scope ...", even though `rad deploy --help` and the `rad group`
command's own documentation state that an application's resources do
not have to live in the same resource group as the environment they
reference, and that passing a full environment ID is the documented way
to use an environment from a different group.

Approach:
`FetchEnvironment` in pkg/cli/cmd/deploy/deploy.go already handled this
correctly for Applications.Core environments (it passes the full ID
through to GetEnvironment, which extracts scope from the ID). The
Radius.Core branch instead discarded the full ID's own resource group
and re-queried using only the environment name against
`r.Workspace.Scope` (the `--group`-overridden scope), so a Radius.Core
environment could never be reused across resource groups. This change
brings the Radius.Core branch in line with the Applications.Core branch:
when the environment reference is a full resource ID, the lookup now
uses the scope encoded in that ID (`envID.RootScope()`) instead of the
deploy-time `--group` scope. The "environment does not exist" error
message in Validate() is also updated to report the scope that was
actually checked, instead of always reporting the `--group` scope,
which was misleading in this case.

Note: user-visible behavior for the common case (deploying into the
same group as the environment) is unchanged; this only affects
deployments that use `-g`/`--group` with an environment stored/passed
as a full Radius.Core resource ID belonging to a different group.

Validation:
- go build ./...
- go test ./pkg/cli/cmd/deploy/... ./pkg/cli/cmd/run/... -count=1 (both ok)
- CGO_ENABLED=1 go test ./pkg/cli/cmd/... ./cmd/rad/... -timeout 600s
  (the command run by the documented `make test-validate-cli` target
  per docs/contributing/contributing-code/contributing-code-tests/README.md)
  — all packages pass
- Added Test_FetchEnvironment_RadiusCoreEnvironmentUsesOwnGroup, which
  reproduces the reported failure with a fake Radius.Core environment
  server that 404s unless queried with the environment ID's own scope;
  confirmed this test fails against the pre-fix code and passes with
  the fix by temporarily reverting the scope-selection change and
  rerunning it.

Report: https://github.com/radius-project/radius/issues/12573
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
---
 pkg/cli/cmd/deploy/deploy.go      | 21 +++++++++--
 pkg/cli/cmd/deploy/deploy_test.go | 61 ++++++++++++++++++++++++++++++-
 2 files changed, 77 insertions(+), 5 deletions(-)

diff --git a/pkg/cli/cmd/deploy/deploy.go b/pkg/cli/cmd/deploy/deploy.go
index ac5b735b217..9e9c921d6bc 100644
--- a/pkg/cli/cmd/deploy/deploy.go
+++ b/pkg/cli/cmd/deploy/deploy.go
@@ -266,7 +266,14 @@ func (r *Runner) Validate(cmd *cobra.Command, args []string) error {
 			return err
 		}
 		if envResult == nil {
-			return clierrors.Message("The environment %q does not exist in scope %q. Run `rad env create` first. You could also provide the environment ID if the environment exists in a different group.", r.EnvironmentNameOrID, r.Workspace.Scope)
+			// If a full environment ID was provided (or came from the workspace default),
+			// report the scope encoded in that ID rather than the possibly-different
+			// --group scope, since that's the scope that was actually checked.
+			errScope := r.Workspace.Scope
+			if envID, parseErr := resources.Parse(r.EnvironmentNameOrID); parseErr == nil {
+				errScope = envID.RootScope()
+			}
+			return clierrors.Message("The environment %q does not exist in scope %q. Run `rad env create` first. You could also provide the environment ID if the environment exists in a different group.", r.EnvironmentNameOrID, errScope)
 		}
 		r.EnvResult = envResult
 	}
@@ -551,7 +558,7 @@ func (r *Runner) getApplicationsCoreEnvironment(ctx context.Context, id string)
 }
 
 // getRadiusCoreEnvironment retrieves environment using Radius Core client and returns as Applications.Core format
-func (r *Runner) getRadiusCoreEnvironment(ctx context.Context, name string) (*v20250801preview.EnvironmentResource, error) {
+func (r *Runner) getRadiusCoreEnvironment(ctx context.Context, scope, name string) (*v20250801preview.EnvironmentResource, error) {
 	if r.RadiusCoreClientFactory == nil {
 		clientFactory, err := cmd.InitializeRadiusCoreClientFactory(ctx, r.Workspace)
 		if err != nil {
@@ -561,7 +568,7 @@ func (r *Runner) getRadiusCoreEnvironment(ctx context.Context, name string) (*v2
 	}
 
 	environmentClient := r.RadiusCoreClientFactory.NewEnvironmentsClient()
-	env, err := environmentClient.Get(ctx, r.Workspace.Scope, name, nil)
+	env, err := environmentClient.Get(ctx, scope, name, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -629,14 +636,20 @@ func (r *Runner) FetchEnvironment(ctx context.Context, envNameOrID string) (*Env
 		}
 	}
 	if fetchRadiusCoreEnv {
+		// If it's a full ID, look it up in the scope encoded in the ID itself (which may
+		// differ from the workspace/--group scope, e.g. when the environment lives in a
+		// different resource group than the one being deployed into). Otherwise, resolve
+		// the name within the current workspace scope.
 		var radCoreEnvName string
+		radCoreScope := r.Workspace.Scope
 		if isID {
 			radCoreEnvName = envID.Name()
+			radCoreScope = envID.RootScope()
 		} else {
 			radCoreEnvName = envNameOrID
 		}
 
-		radiusCoreEnv, err := r.getRadiusCoreEnvironment(ctx, radCoreEnvName)
+		radiusCoreEnv, err := r.getRadiusCoreEnvironment(ctx, radCoreScope, radCoreEnvName)
 		if err != nil {
 			if !clients.Is404Error(err) {
 				return nil, err
diff --git a/pkg/cli/cmd/deploy/deploy_test.go b/pkg/cli/cmd/deploy/deploy_test.go
index 3b4bf88f03d..ab01d8c4f05 100644
--- a/pkg/cli/cmd/deploy/deploy_test.go
+++ b/pkg/cli/cmd/deploy/deploy_test.go
@@ -1942,7 +1942,7 @@ func Test_getRadiusCoreEnvironment(t *testing.T) {
 				},
 			}
 
-			env, err := runner.getRadiusCoreEnvironment(t.Context(), tc.environmentName)
+			env, err := runner.getRadiusCoreEnvironment(t.Context(), scope, tc.environmentName)
 
 			if tc.shouldError {
 				require.Error(t, err)
@@ -1961,6 +1961,65 @@ func Test_getRadiusCoreEnvironment(t *testing.T) {
 	}
 }
 
+// Test_FetchEnvironment_RadiusCoreEnvironmentUsesOwnGroup is a regression test for
+// https://github.com/radius-project/radius/issues/12573: a Radius.Core environment
+// referenced by full ID (e.g. the workspace's stored default environment) must be looked
+// up in the resource group encoded in that ID, not in the (possibly different)
+// --group-overridden workspace scope used for the deployment itself.
+func Test_FetchEnvironment_RadiusCoreEnvironmentUsesOwnGroup(t *testing.T) {
+	envScope := "/planes/radius/local/resourceGroups/default"
+	envID := envScope + "/providers/Radius.Core/environments/default"
+	deployScope := "/planes/radius/local/resourceGroups/test"
+
+	// Only succeed when queried in the environment's own scope; 404 for any other scope
+	// (such as the --group-overridden deploy scope) to catch a regression.
+	envServer := corerpfake.EnvironmentsServer{
+		Get: func(
+			_ context.Context,
+			rootScope string,
+			environmentName string,
+			_ *v20250801preview.EnvironmentsClientGetOptions,
+		) (resp azfake.Responder[v20250801preview.EnvironmentsClientGetResponse], errResp azfake.ErrorResponder) {
+			// The fake HTTP transport strips the leading slash from the rootScope path
+			// segment, so compare against the trimmed form.
+			if rootScope != strings.TrimPrefix(envScope, "/") {
+				errResp.SetError(fmt.Errorf("environment not found"))
+				errResp.SetResponseError(404, "Not Found")
+				return
+			}
+			resp.SetResponse(200, v20250801preview.EnvironmentsClientGetResponse{
+				EnvironmentResource: v20250801preview.EnvironmentResource{
+					Name: to.Ptr(environmentName),
+					ID:   to.Ptr(envID),
+				},
+			}, nil)
+			return
+		},
+	}
+
+	factory, err := test_client_factory.NewRadiusCoreTestClientFactory(
+		deployScope,
+		func() corerpfake.EnvironmentsServer { return envServer },
+		nil,
+	)
+	require.NoError(t, err)
+
+	runner := &Runner{
+		RadiusCoreClientFactory: factory,
+		Workspace: &workspaces.Workspace{
+			// Simulates `-g test` overriding the deploy scope while the workspace's
+			// default environment still lives in the "default" resource group.
+			Scope: deployScope,
+		},
+	}
+
+	result, err := runner.FetchEnvironment(context.Background(), envID)
+	require.NoError(t, err)
+	require.NotNil(t, result, "environment should resolve using the ID's own resource group, not the --group-overridden workspace scope")
+	require.False(t, result.UseApplicationsCore)
+	require.Equal(t, envID, runner.EnvironmentNameOrID)
+}
+
 func Test_constructApplicationsCoreEnvironmentID(t *testing.T) {
 	runner := &Runner{
 		Workspace: &workspaces.Workspace{

From 74b0cae5056a08a39ea70e9248d860c2845dec8c Mon Sep 17 00:00:00 2001
From: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Date: Fri, 7 Aug 2026 19:31:59 -0700
Subject: [PATCH 2/3] Address Copilot review: extract scope/name from resource
 ID in Test_getRadiusCoreEnvironment

Test_getRadiusCoreEnvironment was passing a full Radius.Core resource ID
directly as the environmentName argument to getRadiusCoreEnvironment,
which doesn't reflect how the real EnvironmentsClient.Get API or the
production caller (FetchEnvironment) use it. Extract scope/name from the
ID before calling, matching FetchEnvironment's own envID.RootScope() /
envID.Name() usage, and update the expected environment name to the bare
name.

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
---
 pkg/cli/cmd/deploy/deploy_test.go | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkg/cli/cmd/deploy/deploy_test.go b/pkg/cli/cmd/deploy/deploy_test.go
index ab01d8c4f05..ad48f11ace6 100644
--- a/pkg/cli/cmd/deploy/deploy_test.go
+++ b/pkg/cli/cmd/deploy/deploy_test.go
@@ -41,6 +41,7 @@ import (
 	"github.com/radius-project/radius/pkg/corerp/api/v20250801preview"
 	corerpfake "github.com/radius-project/radius/pkg/corerp/api/v20250801preview/fake"
 	"github.com/radius-project/radius/pkg/to"
+	"github.com/radius-project/radius/pkg/ucp/resources"
 	"github.com/radius-project/radius/test/radcli"
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/require"
@@ -1922,7 +1923,7 @@ func Test_getRadiusCoreEnvironment(t *testing.T) {
 			command:         &cobra.Command{},
 			args:            []string{"template.bicep"},
 			expectedEnv: &v20250801preview.EnvironmentResource{
-				Name: new("/planes/radius/local/resourceGroups/test/providers/Radius.Core/environments/myenv"),
+				Name: new("myenv"),
 			},
 			shouldError: false,
 		},
@@ -1942,7 +1943,15 @@ func Test_getRadiusCoreEnvironment(t *testing.T) {
 				},
 			}
 
-			env, err := runner.getRadiusCoreEnvironment(t.Context(), scope, tc.environmentName)
+			// The Radius Core EnvironmentsClient.Get API takes (scope, environmentName), not a
+			// full resource ID. Callers (e.g. FetchEnvironment) extract scope/name from a full
+			// ID before calling getRadiusCoreEnvironment, so mirror that here.
+			callScope, callName := scope, tc.environmentName
+			if parsedID, parseErr := resources.Parse(tc.environmentName); parseErr == nil {
+				callScope, callName = parsedID.RootScope(), parsedID.Name()
+			}
+
+			env, err := runner.getRadiusCoreEnvironment(t.Context(), callScope, callName)
 
 			if tc.shouldError {
 				require.Error(t, err)

From 9215a87333760f16467c6126c51711cca77de163 Mon Sep 17 00:00:00 2001
From: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Date: Tue, 18 Aug 2026 10:02:21 -0700
Subject: [PATCH 3/3] Fix golangci-lint usetesting: use t.Context() in
 Test_FetchEnvironment_RadiusCoreEnvironmentUsesOwnGroup

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
---
 pkg/cli/cmd/deploy/deploy_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cli/cmd/deploy/deploy_test.go b/pkg/cli/cmd/deploy/deploy_test.go
index ad48f11ace6..0b87f571e5f 100644
--- a/pkg/cli/cmd/deploy/deploy_test.go
+++ b/pkg/cli/cmd/deploy/deploy_test.go
@@ -2022,7 +2022,7 @@ func Test_FetchEnvironment_RadiusCoreEnvironmentUsesOwnGroup(t *testing.T) {
 		},
 	}
 
-	result, err := runner.FetchEnvironment(context.Background(), envID)
+	result, err := runner.FetchEnvironment(t.Context(), envID)
 	require.NoError(t, err)
 	require.NotNil(t, result, "environment should resolve using the ID's own resource group, not the --group-overridden workspace scope")
 	require.False(t, result.UseApplicationsCore)