ci: report scheduled sample test failures from a dedicated job

[DariuszPorowski]

Summary

Scheduled sample-test failures stopped creating GitHub issues. This PR moves issue creation out of the test matrix job into a new report-failures job. That job is the only one with issues: write, and it runs only for failed scheduled runs.

• test keeps only contents: read. It runs pull request code, so it must not get issue-write access. On a failed scheduled run, each failed leg uploads a small failed-sample-<attempt>-<name> artifact with 1-day retention.
• report-failures (needs: test, if: failure() && github.event_name == 'schedule', permissions: issues: write) downloads those records and creates one issue per failed sample. Each issue keeps the same title (Samples deployment failed for <sample>), workflow-run link, and test-failure label as before.
• Issues are created through the REST POST /repos/{owner}/{repo}/issues endpoint (gh api), which needs only issues: write. The report-failure jobs in radius-project/radius use the same approach. Downloading artifacts from the same run does not need actions: read.
• If no sample records are found (for example, a record upload failed), the job still creates one generic Samples deployment failed issue, so the failure is not lost.
• Records are scoped to github.run_attempt, so re-running a scheduled run reports only the samples that failed in that attempt.

Reason for change

Fixes #2662

Root cause: #2431 added permissions: {} to the workflow and contents: read to the test job. Before that, the job inherited the repository's default token permissions (write), which included issues. In the representative run 34119803387, the token had only Contents: read and Metadata: read, and gh issue create failed with GraphQL: Resource not accessible by integration (createIssue). The repository's default (write) doesn't apply here because an explicit permissions block overrides it.

Scheduled workflows run only on the default branch, so the regression took effect when v0.55, the first release branch that includes #2431, became the default branch. The last issue created automatically was #2519 (2026-03-09, from v0.54). The 27 scheduled failures since then (v0.57: 1, v0.59: 4, v0.60: 22) created no issues.

Affected branches: edge and v0.55 through v0.60 all have the defect. Only the default branch runs the schedule, so after this merges, cherry-pick it to v0.60 to get nightly failures reported again. Release branches cut from edge later will include the fix automatically.

Note

edge is not the default branch, so merging this PR will not auto-close #2662. Close it after the v0.60 backport.

How to test

Validated locally:

• actionlint, zizmor, ghalint, and yamllint (repo config) report no new findings. The only findings are the ones already on edge.
• I ran the workflow's actual run: scripts with bash -e and a stubbed gh for three cases: two failed samples, one failed sample, and no records (fallback). Each case produced the expected titles, body, and test-failure label.
• I checked the gh api request payload ({"title": ..., "body": ..., "labels": ["test-failure"]}) against a repository that doesn't exist, so the call returned 404 and created nothing.

Controlled failure on GitHub (not run yet, because this path only runs on schedule from the default branch). After the v0.60 backport, either wait for a real nightly failure or push a throwaway branch where one leg has a failing step and the schedule checks are changed to workflow_dispatch, then run gh workflow run test.yaml --ref <branch>. Check that:

• the failed leg uploads failed-sample-1-<name>
• Set up job → GITHUB_TOKEN Permissions for report-failures lists only Issues: write (plus Metadata: read)
• one labeled issue is created per failed sample

On pull requests and pushes, report-failures should be skipped, and the test token should stay Contents: read / Metadata: read.

File change summary

File	Summary of change
.github/workflows/test.yaml	Replaced the in-matrix gh issue create step with steps that record and upload each failed sample. Added a report-failures job with issues: write that creates one test-failure issue per failed sample, or a single generic issue if no records are found.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/download-artifact	3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c	🟢 5.1	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches

Scanned Files

• .github/workflows/test.yaml