From 40fba8f43ba75005cc9b63c9cd40768ef5520ed8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 5 May 2026 22:11:01 +0000
Subject: [PATCH 1/2] Initial plan


From e00ed0952d9a0fc4bcc75b33e2752b877eb8eb91 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 5 May 2026 22:13:16 +0000
Subject: [PATCH 2/2] Fix E2E workflow: guard token step on secrets, skip
 message, gate downstream steps; harden Acquire-BearerToken.ps1 param
 validation

Agent-Logs-Url: https://github.com/microsoft/Agent365-Samples/sessions/39cf2346-86ab-4967-9c7f-6472420af3a7

Co-authored-by: gwharris7 <96964444+gwharris7@users.noreply.github.com>
---
 .../workflows/e2e-dotnet-semantic-kernel.yml  | 14 ++++++++++++
 scripts/e2e/Acquire-BearerToken.ps1           | 22 +++++++++++++++----
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/e2e-dotnet-semantic-kernel.yml b/.github/workflows/e2e-dotnet-semantic-kernel.yml
index 1736e848..4a6c928b 100644
--- a/.github/workflows/e2e-dotnet-semantic-kernel.yml
+++ b/.github/workflows/e2e-dotnet-semantic-kernel.yml
@@ -58,6 +58,8 @@ jobs:
 
       - name: Acquire Bearer Token (ROPC)
         id: token
+        # Only run when all required secrets are present (skipped on fork PRs where secrets are unavailable)
+        if: ${{ secrets.MCP_CLIENT_ID != '' && secrets.MCP_TENANT_ID != '' && secrets.MCP_TEST_USERNAME != '' && secrets.MCP_TEST_PASSWORD != '' }}
         shell: pwsh
         run: |
           $token = & "${{ env.SCRIPTS_PATH }}/Acquire-BearerToken.ps1" `
@@ -68,6 +70,13 @@ jobs:
           echo "BEARER_TOKEN=$token" >> $env:GITHUB_OUTPUT
           echo "::add-mask::$token"
 
+      - name: Skip E2E (missing secrets)
+        # Runs when any required secret is absent (e.g. fork PRs) to provide a clear explanation
+        if: ${{ secrets.MCP_CLIENT_ID == '' || secrets.MCP_TENANT_ID == '' || secrets.MCP_TEST_USERNAME == '' || secrets.MCP_TEST_PASSWORD == '' }}
+        shell: pwsh
+        run: |
+          Write-Host "E2E secrets (MCP_CLIENT_ID, MCP_TENANT_ID, MCP_TEST_USERNAME, MCP_TEST_PASSWORD) are not available for this run (e.g. fork PR). Skipping token acquisition and E2E steps." -ForegroundColor Yellow
+
       - name: Copy ToolingManifest.json
         shell: pwsh
         run: |
@@ -94,6 +103,8 @@ jobs:
 
       - name: Start Agent
         id: start-agent
+        # Only run when the bearer token was successfully acquired
+        if: ${{ steps.token.outputs.BEARER_TOKEN != '' }}
         shell: pwsh
         run: |
           $agentPid = & "${{ env.SCRIPTS_PATH }}/Start-Agent.ps1" `
@@ -106,6 +117,7 @@ jobs:
           echo "AGENT_PID=$agentPid" >> $env:GITHUB_OUTPUT
 
       - name: Verify Agent Running
+        if: ${{ steps.token.outputs.BEARER_TOKEN != '' }}
         shell: pwsh
         run: |
           $agentPid = "${{ steps.start-agent.outputs.AGENT_PID }}"
@@ -122,9 +134,11 @@ jobs:
           Write-Host "Health: $($response.StatusCode)" -ForegroundColor Green
 
       - name: Restore E2E Test Dependencies
+        if: ${{ steps.token.outputs.BEARER_TOKEN != '' }}
         run: dotnet restore "${{ env.E2E_TESTS_PATH }}/Agent365.E2E.Tests.csproj"
 
       - name: Run .NET E2E Tests
+        if: ${{ steps.token.outputs.BEARER_TOKEN != '' }}
         shell: pwsh
         run: |
           dotnet test "${{ env.E2E_TESTS_PATH }}/Agent365.E2E.Tests.csproj" `
diff --git a/scripts/e2e/Acquire-BearerToken.ps1 b/scripts/e2e/Acquire-BearerToken.ps1
index 9ee6d361..9c2575cb 100644
--- a/scripts/e2e/Acquire-BearerToken.ps1
+++ b/scripts/e2e/Acquire-BearerToken.ps1
@@ -33,16 +33,19 @@
 #>
 
 param(
-    [Parameter(Mandatory = $true)]
+    # Parameters are non-mandatory so PowerShell does not emit a binding error when
+    # called with empty strings (e.g. from a fork PR where GitHub secrets are absent).
+    # Explicit validation below provides a clear, actionable error message instead.
+    [Parameter(Mandatory = $false)]
     [string]$ClientId,
     
-    [Parameter(Mandatory = $true)]
+    [Parameter(Mandatory = $false)]
     [string]$TenantId,
     
-    [Parameter(Mandatory = $true)]
+    [Parameter(Mandatory = $false)]
     [string]$Username,
     
-    [Parameter(Mandatory = $true)]
+    [Parameter(Mandatory = $false)]
     [string]$Password,
     
     [Parameter(Mandatory = $false)]
@@ -51,6 +54,17 @@ param(
 
 $ErrorActionPreference = "Stop"
 
+# Validate required parameters before attempting the token request
+$missingParams = @()
+if ([string]::IsNullOrEmpty($ClientId))  { $missingParams += 'ClientId' }
+if ([string]::IsNullOrEmpty($TenantId))  { $missingParams += 'TenantId' }
+if ([string]::IsNullOrEmpty($Username))  { $missingParams += 'Username' }
+if ([string]::IsNullOrEmpty($Password))  { $missingParams += 'Password' }
+if ($missingParams.Count -gt 0) {
+    Write-Error "Cannot acquire bearer token: the following required parameters are missing or empty: $($missingParams -join ', '). Ensure the required secrets (MCP_CLIENT_ID, MCP_TENANT_ID, MCP_TEST_USERNAME, MCP_TEST_PASSWORD) are configured for this workflow run."
+    exit 1
+}
+
 Write-Host "Acquiring bearer token for MCP servers using ROPC flow..." -ForegroundColor Cyan
 Write-Host "MCP servers require delegated (user) tokens, not service principal tokens" -ForegroundColor Gray