Split roundtrip workflow into phases with auth refresh

Author: Copilot

.github/workflows/integration-test.yml

@@ -144,6 +144,8 @@ jobs:
         if: success()
         uses: azure/login@v2
         with:
+          # Phase 1 can run for a long time while APIM activates; refresh login
+          # before extract/publish so apiops receives a fresh federated session.
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
@@ -182,4 +184,4 @@ jobs:
             -SourceResourceGroup '${{ env.SOURCE_RG }}' `
             -TargetResourceGroup '${{ env.TARGET_RG }}' `
             -Location '${{ inputs.location }}' `
-            -HardDelete
+            -HardDelete $true

tests/integration/all-resource-types/run-roundtrip-phase1-deploy.ps1

@@ -215,8 +215,8 @@ $state = [ordered]@{
 }
 
 $stateDir = Split-Path -Parent $StateFile
-if (-not [string]::IsNullOrWhiteSpace($stateDir) -and -not (Test-Path $stateDir)) {
-    New-Item -ItemType Directory -Path $stateDir -Force | Out-Null
+if (-not [string]::IsNullOrWhiteSpace($stateDir)) {
+    New-Item -ItemType Directory -Path $stateDir -Force -ErrorAction SilentlyContinue | Out-Null
 }
 
 $state | ConvertTo-Json -Depth 5 | Set-Content -Path $StateFile -Encoding utf8

tests/integration/all-resource-types/run-roundtrip-phase2-roundtrip.ps1

@@ -39,6 +39,9 @@ function Get-ApiopsLogLevel([string]$ScriptLogLevel) {
 }
 
 function Get-ApiopsAuthArgs {
+    # In CI, we explicitly pass client/tenant to apiops so DefaultAzureCredential
+    # can use the intended federated identity after long-running deploy phases.
+    # If env vars are unset (local runs), apiops falls back to default credential chain.
     $authArgs = @()
 
     if (-not [string]::IsNullOrWhiteSpace($env:AZURE_CLIENT_ID)) {
@@ -121,6 +124,19 @@ $targetAiResourceId = az monitor app-insights component list --resource-group $t
 $targetAiKey = az monitor app-insights component list --resource-group $targetRg --query "[0].instrumentationKey" -o tsv
 $targetEhNs = az eventhubs namespace list --resource-group $targetRg --query "[0].name" -o tsv
 
+if (-not $targetKvUri) {
+    Write-Host "❌ Could not resolve target Key Vault URI in $(Protect-ResourceGroupName -Value $targetRg)"
+    exit 2
+}
+if (-not $targetAiResourceId -or -not $targetAiKey) {
+    Write-Host "❌ Could not resolve target Application Insights details in $(Protect-ResourceGroupName -Value $targetRg)"
+    exit 2
+}
+if (-not $targetEhNs) {
+    Write-Host "❌ Could not resolve target Event Hub namespace in $(Protect-ResourceGroupName -Value $targetRg)"
+    exit 2
+}
+
 $targetEhConnStr = az eventhubs namespace authorization-rule keys list `
     --resource-group $targetRg `
     --namespace-name $targetEhNs `

tests/integration/all-resource-types/run-roundtrip-phase3-teardown.ps1

@@ -12,7 +12,7 @@ param(
 
     [switch]$SkipTeardown,
 
-    [switch]$HardDelete = $true
+    [bool]$HardDelete = $true
 )
 
 $ErrorActionPreference = 'Stop'

tests/integration/all-resource-types/run-roundtrip-test.ps1

@@ -5,6 +5,15 @@
 .DESCRIPTION
   Single entry point that orchestrates phase scripts for deploy, round-trip, and
   teardown. Works both locally and in CI.
+
+.EXAMPLE
+  .\run-roundtrip-test.ps1 -PublisherEmail admin@contoso.com
+
+.EXAMPLE
+  .\run-roundtrip-test.ps1 -PublisherEmail admin@contoso.com -SkipTeardown
+
+.EXAMPLE
+  .\run-roundtrip-test.ps1 -PublisherEmail admin@contoso.com -HardDelete
 #>
 
 #requires -Version 7.0