refactor: remove secrets contract from called workflows, add validation step

Called workflows now access secrets via their environment declaration
instead of requiring the caller to pass them. Each called workflow
includes a 'Validate Required Secrets' step that fails fast with a
clear error if any secret is missing from the environment.

This eliminates the need for repo-level secret duplication.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: EMaher

.github/skills/integration-test-prerequisites/SKILL.md

@@ -21,7 +21,7 @@ These workflows expect:
 - GitHub environment `integration-test` (shared by all integration workflows)
 - Azure identity with enough permissions to deploy resources and create role assignments in test resource groups
 
-The `release-tests.yml` orchestrator calls `ci.yml` (no Azure prereqs), then `integration-test.yml` and `integration-redact-secrets.yml` (both use the `integration-test` environment). Secrets are passed through from the orchestrator's repo-level secrets to the called workflows' environment.
+The `release-tests.yml` orchestrator calls `ci.yml` (no Azure prereqs), then `integration-test.yml` and `integration-redact-secrets.yml`. The called workflows access secrets directly from the `integration-test` environment — no secret pass-through from the orchestrator is needed.
 
 Preferred identity model: user-assigned managed identity (UAMI).
 
@@ -146,29 +146,11 @@ gh secret set APIM_PUBLISHER_EMAIL \
   --body "${APIM_PUBLISHER_EMAIL}"
 ```
 
-### 6) Set Repo-Level Secrets (for release-tests orchestrator)
+### 6) Verify Called Workflows Can Access Environment Secrets
 
-The `release-tests.yml` orchestrator passes secrets to called workflows via explicit `secrets:` mapping. Since the orchestrator itself does not declare an `environment:`, it reads from **repo-level** secrets. Set the same values at the repo level:
+The `release-tests.yml` orchestrator does **not** pass secrets to called workflows. Instead, the called workflows (`integration-test.yml`, `integration-redact-secrets.yml`) access secrets directly via their `environment: integration-test` declaration. Each called workflow includes a "Validate Required Secrets" step that fails fast with a clear error if any secret is missing.
 
-```bash
-gh secret set AZURE_CLIENT_ID \
-  --repo "${GITHUB_OWNER}/${GITHUB_REPO}" \
-  --body "${IDENTITY_CLIENT_ID}"
-
-gh secret set AZURE_TENANT_ID \
-  --repo "${GITHUB_OWNER}/${GITHUB_REPO}" \
-  --body "${TENANT_ID}"
-
-gh secret set AZURE_SUBSCRIPTION_ID \
-  --repo "${GITHUB_OWNER}/${GITHUB_REPO}" \
-  --body "${SUBSCRIPTION_ID}"
-
-gh secret set APIM_PUBLISHER_EMAIL \
-  --repo "${GITHUB_OWNER}/${GITHUB_REPO}" \
-  --body "${APIM_PUBLISHER_EMAIL}"
-```
-
-> **Note:** If you only have environment-level secrets without matching repo-level secrets, the `release-tests.yml` workflow will fail because `${{ secrets.* }}` in the orchestrator resolves from repo scope. The called workflows still use the `integration-test` environment for OIDC token issuance.
+No repo-level secrets are required — all secrets are scoped to the `integration-test` environment.
 
 ## Verification
 

.github/workflows/integration-redact-secrets.yml

@@ -48,15 +48,6 @@ on:
         required: false
         type: string
         default: Verbose
-    secrets:
-      AZURE_CLIENT_ID:
-        required: true
-      AZURE_TENANT_ID:
-        required: true
-      AZURE_SUBSCRIPTION_ID:
-        required: true
-      APIM_PUBLISHER_EMAIL:
-        required: true
 
 permissions:
   id-token: write
@@ -84,6 +75,19 @@ jobs:
 
       - run: npm ci && npm run build
 
+      - name: Validate Required Secrets
+        shell: bash
+        run: |
+          missing=()
+          [[ -z "${{ secrets.AZURE_CLIENT_ID }}" ]] && missing+=("AZURE_CLIENT_ID")
+          [[ -z "${{ secrets.AZURE_TENANT_ID }}" ]] && missing+=("AZURE_TENANT_ID")
+          [[ -z "${{ secrets.AZURE_SUBSCRIPTION_ID }}" ]] && missing+=("AZURE_SUBSCRIPTION_ID")
+          [[ -z "${{ secrets.APIM_PUBLISHER_EMAIL }}" ]] && missing+=("APIM_PUBLISHER_EMAIL")
+          if [[ ${#missing[@]} -gt 0 ]]; then
+            echo "::error::Missing required secrets: ${missing[*]}"
+            exit 1
+          fi
+
       - name: Azure Login
         uses: azure/login@v3
         with:

.github/workflows/integration-test.yml

@@ -66,17 +66,6 @@ on:
         required: false
         type: string
         default: Verbose
-    secrets:
-      AZURE_CLIENT_ID:
-        required: true
-      AZURE_TENANT_ID:
-        required: true
-      AZURE_SUBSCRIPTION_ID:
-        required: true
-      APIM_PUBLISHER_EMAIL:
-        required: true
-      APIM_SKU:
-        required: false
 
 permissions:
   id-token: write
@@ -110,7 +99,18 @@ jobs:
 
       - run: npm ci && npm run build
 
-      - name: Resolve Workflow Settings
+      - name: Validate Required Secrets
+        shell: bash
+        run: |
+          missing=()
+          [[ -z "${{ secrets.AZURE_CLIENT_ID }}" ]] && missing+=("AZURE_CLIENT_ID")
+          [[ -z "${{ secrets.AZURE_TENANT_ID }}" ]] && missing+=("AZURE_TENANT_ID")
+          [[ -z "${{ secrets.AZURE_SUBSCRIPTION_ID }}" ]] && missing+=("AZURE_SUBSCRIPTION_ID")
+          [[ -z "${{ secrets.APIM_PUBLISHER_EMAIL }}" ]] && missing+=("APIM_PUBLISHER_EMAIL")
+          if [[ ${#missing[@]} -gt 0 ]]; then
+            echo "::error::Missing required secrets: ${missing[*]}"
+            exit 1
+          fi
         id: settings
         shell: pwsh
         run: |

.github/workflows/release-tests.yml

@@ -37,7 +37,6 @@ on:
         default: Verbose
 
 permissions:
-  id-token: write
   contents: read
 
 jobs:
@@ -53,11 +52,6 @@ jobs:
       sku: ${{ inputs.sku || 'StandardV2' }}
       location: ${{ inputs.location || 'centralus' }}
       log_level: ${{ inputs.log_level || 'Verbose' }}
-    secrets:
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      APIM_PUBLISHER_EMAIL: ${{ secrets.APIM_PUBLISHER_EMAIL }}
 
   redact-secrets-integration:
     name: Redact Secrets Integration Test
@@ -67,8 +61,3 @@ jobs:
       sku: ${{ inputs.sku || 'StandardV2' }}
       location: ${{ inputs.location || 'centralus' }}
       log_level: ${{ inputs.log_level || 'Verbose' }}
-    secrets:
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      APIM_PUBLISHER_EMAIL: ${{ secrets.APIM_PUBLISHER_EMAIL }}