Add --recipe-pack-group flag to rad env create/update --preview

[pujitha24]

Summary

Adds a --recipe-pack-group flag to rad env create --preview and
rad env update --preview. When a bare recipe pack name is passed via
--recipe-packs, it is now resolved against the resource group named by
--recipe-pack-group (if set) instead of always being resolved against the
environment's own resource group.

Reason for change

Fixes #12425

Before this change, rad env create/rad env update had no way to
reference a Recipe Pack that lives in a different resource group than the
environment, other than passing the pack's full Radius resource ID (an
undocumented workaround). A bare recipe pack name was always resolved
against the environment's own workspace scope, so:

rad env update default --preview --recipe-packs test-recipes

fails with Recipe pack "test-recipes" does not exist... whenever
test-recipes lives in a different resource group.

How to test

rad env create myenv --preview --recipe-packs pack1 --recipe-pack-group other-group
rad env update myenv --preview --recipe-packs pack1 --recipe-pack-group other-group

Both bare pack1 references now resolve against other-group instead of
myenv's own resource group.

Automated coverage:

go build ./pkg/cli/...
make test-validate-cli

make test-validate-cli is this repo's documented test tier for rad CLI
command changes (runs ./pkg/cli/cmd/... and ./cmd/rad/...); all 1271
tests pass, including new targeted tests in create_test.go and
update_test.go that assert a bare recipe pack name resolves to the
--recipe-pack-group scope instead of the workspace's own scope, and that
--recipe-pack-group is rejected when passed without --recipe-packs.

File change summary

File	Summary of change
pkg/cli/cmd/env/create/preview/create.go	Add --recipe-pack-group flag, parse it in Validate, and use it (when set) to scope bare recipe pack name resolution in resolveRecipePacks.
pkg/cli/cmd/env/create/preview/create_test.go	Add tests for the new flag: validation parsing, the "requires --recipe-packs" guard, and Run()-level resolution against the specified group.
pkg/cli/cmd/env/update/preview/update.go	Add --recipe-pack-group flag, parse it in Validate, and use it (when set) to scope bare recipe pack name resolution in Run.
pkg/cli/cmd/env/update/preview/update_test.go	Add tests for the new flag: validation parsing, the "requires --recipe-packs" guard, and Run()-level resolution against the specified group.

[Copilot]

Pull request overview

This PR adds a --recipe-pack-group flag to the rad env create --preview and rad env update --preview commands so that bare recipe pack names provided via --recipe-packs can be resolved against a different resource group than the environment’s own scope (addressing #12425).

Changes:

• Added --recipe-pack-group flag and validation guard requiring it be used with --recipe-packs.
• Updated recipe pack ID resolution logic to use the specified group for bare pack names.
• Added targeted unit tests covering parsing, validation, and run-time resolution behavior for both create/update.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
pkg/cli/cmd/env/create/preview/create.go	Adds flag and uses it to scope bare recipe-pack resolution during create.
pkg/cli/cmd/env/create/preview/create_test.go	Adds coverage for validation and run-time resolution when --recipe-pack-group is set.
pkg/cli/cmd/env/update/preview/update.go	Adds flag and uses it to scope bare recipe-pack resolution during update.
pkg/cli/cmd/env/update/preview/update_test.go	Adds coverage for validation and run-time resolution when --recipe-pack-group is set.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[zachcasper]

Tested. Working as advertised. Thanks for the contribution!

[codecov]

Codecov Report

❌ Patch coverage is 78.94737% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.37%. Comparing base (415ea7c) to head (ee58f23).

Files with missing lines	Patch %	Lines
pkg/cli/cmd/env/create/preview/create.go	77.77%	2 Missing and 2 partials ⚠️
pkg/cli/cmd/env/update/preview/update.go	80.00%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #12634      +/-   ##
==========================================
+ Coverage   54.36%   54.37%   +0.01%     
==========================================
  Files         770      770              
  Lines       51263    51299      +36     
==========================================
+ Hits        27867    27895      +28     
- Misses      20788    20792       +4     
- Partials     2608     2612       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[lakshmimsft]

@pujitha24 Thanks again for contributing. Pls update pr for the comments logged by copilot and myself above and then we will be able to merge it in.

[pujitha24]

086515c addresses all of these:

• update.go now rejects an explicitly-provided-but-empty --recipe-packs (e.g. ","), matching create.go's existing behavior.
• recipePackScope in both create.go and update.go now derives the plane portion from r.Workspace.Scope via resources.ParseScope(...).PlaneScope() instead of hard-coding /planes/radius/local.
• --recipe-pack-group is now validated with common.ValidateResourceGroupName in Validate() before it's interpolated into the scope, in both files, so a malformed value fails with a clean CLI message instead of an internal resource-ID error.

Added test coverage for the empty --recipe-packs rejection and the --recipe-pack-group validation in both files. The plane-derivation fix isn't independently covered by a new test — all existing/new tests still use the /planes/radius/local plane, so it's verified by inspection rather than a regression test. go build ./pkg/cli/... and the package tests pass locally.

The one CI failure (Run upgrade-noncloud functional tests, Test_PreflightContainer/Disabled) looks unrelated to this change — it's a 503/"control plane did not become available within timeout" during Radius install, not something touched by the CLI flag parsing in this diff.

[pujitha24]

Heads up @zachcasper — rebasing this onto the current base to clear a merge conflict dismissed your approval. The branch is now at 023f1f6. Could you take another look and re-approve when you have a moment? Sorry for the extra round trip.

[github-actions]

Functional Tests - corerp-cloud

32 tests  ±0   31 ✅ ±0   19m 23s ⏱️ - 1m 19s
 2 suites ±0    1 💤 ±0 
 1 files   ±0    0 ❌ ±0 

Results for commit ee58f23. ± Comparison against base commit 415ea7c.

♻️ This comment has been updated with latest results.

[brooke-hamilton]

Hi @pujitha24, thank you for the update. This PR is ready to merge, but every commit must have a GitHub Verified signature. Please follow our commit-signing guide to configure GPG, SSH, or S/MIME signing. Afterward, re-sign all existing commits in this PR and force-push the rewritten branch with --force-with-lease. Please note that cryptographic signing is separate from the DCO Signed-off-by line; both are required.

[pujitha24]

Thanks @brooke-hamilton. I don't have GPG/SSH commit signing configured in this environment, so I can't re-sign the history and force-push from here right now. I'll get signing set up on my account and push a rewritten, signed branch once that's done. Separately — the earlier comments from Copilot and @lakshmimsft (empty --recipe-packs validation, hard-coded plane prefix, and validating --recipe-pack-group) were already addressed a few commits back, so those should be all set.

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	pujitha24/radius
Commit ref	ee58f23
Unique ID	func6c7e82a170
Image tag	pr-func6c7e82a170

• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-func6c7e82a170
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-func6c7e82a170
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-func6c7e82a170
• controller test image location: ghcr.io/radius-project/dev/controller:pr-func6c7e82a170
• ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-func6c7e82a170
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting corerp-cloud functional tests...
⌛ Starting ucp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
❌ corerp-cloud functional test failed. Please check the logs for more details
⌛ Starting corerp-cloud functional tests...
✅ corerp-cloud functional tests succeeded