Skip to content

Fix E2E .NET Semantic Kernel workflow failure when secrets are unavailable (fork PRs) #302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Copilot wants to merge 2 commits into from
Closed

Fix E2E .NET Semantic Kernel workflow failure when secrets are unavailable (fork PRs) #302

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
40fba8f
Initial plan
Copilot May 5, 2026
e00ed09
Fix E2E workflow: guard token step on secrets, skip message, gate dow…
Copilot May 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/e2e-dotnet-semantic-kernel.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,8 @@ jobs:

- name: Acquire Bearer Token (ROPC)
id: token
# Only run when all required secrets are present (skipped on fork PRs where secrets are unavailable)
if: ${{ secrets.MCP_CLIENT_ID != '' && secrets.MCP_TENANT_ID != '' && secrets.MCP_TEST_USERNAME != '' && secrets.MCP_TEST_PASSWORD != '' }}
shell: pwsh
run: |
$token = & "${{ env.SCRIPTS_PATH }}/Acquire-BearerToken.ps1" `
Expand All @@ -68,6 +70,13 @@ jobs:
echo "BEARER_TOKEN=$token" >> $env:GITHUB_OUTPUT
echo "::add-mask::$token"

- name: Skip E2E (missing secrets)
# Runs when any required secret is absent (e.g. fork PRs) to provide a clear explanation
if: ${{ secrets.MCP_CLIENT_ID == '' || secrets.MCP_TENANT_ID == '' || secrets.MCP_TEST_USERNAME == '' || secrets.MCP_TEST_PASSWORD == '' }}
shell: pwsh
run: |
Write-Host "E2E secrets (MCP_CLIENT_ID, MCP_TENANT_ID, MCP_TEST_USERNAME, MCP_TEST_PASSWORD) are not available for this run (e.g. fork PR). Skipping token acquisition and E2E steps." -ForegroundColor Yellow

- name: Copy ToolingManifest.json
shell: pwsh
run: |
Expand All @@ -94,6 +103,8 @@ jobs:

- name: Start Agent
id: start-agent
# Only run when the bearer token was successfully acquired
if: ${{ steps.token.outputs.BEARER_TOKEN != '' }}
shell: pwsh
run: |
$agentPid = & "${{ env.SCRIPTS_PATH }}/Start-Agent.ps1" `
Expand All @@ -106,6 +117,7 @@ jobs:
echo "AGENT_PID=$agentPid" >> $env:GITHUB_OUTPUT

- name: Verify Agent Running
if: ${{ steps.token.outputs.BEARER_TOKEN != '' }}
shell: pwsh
run: |
$agentPid = "${{ steps.start-agent.outputs.AGENT_PID }}"
Expand All @@ -122,9 +134,11 @@ jobs:
Write-Host "Health: $($response.StatusCode)" -ForegroundColor Green

- name: Restore E2E Test Dependencies
if: ${{ steps.token.outputs.BEARER_TOKEN != '' }}
run: dotnet restore "${{ env.E2E_TESTS_PATH }}/Agent365.E2E.Tests.csproj"

- name: Run .NET E2E Tests
if: ${{ steps.token.outputs.BEARER_TOKEN != '' }}
shell: pwsh
run: |
dotnet test "${{ env.E2E_TESTS_PATH }}/Agent365.E2E.Tests.csproj" `
Expand Down
22 changes: 18 additions & 4 deletions scripts/e2e/Acquire-BearerToken.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,16 +33,19 @@
#>

param(
[Parameter(Mandatory = $true)]
# Parameters are non-mandatory so PowerShell does not emit a binding error when
# called with empty strings (e.g. from a fork PR where GitHub secrets are absent).
# Explicit validation below provides a clear, actionable error message instead.
[Parameter(Mandatory = $false)]
[string]$ClientId,

[Parameter(Mandatory = $true)]
[Parameter(Mandatory = $false)]
[string]$TenantId,

[Parameter(Mandatory = $true)]
[Parameter(Mandatory = $false)]
[string]$Username,

[Parameter(Mandatory = $true)]
[Parameter(Mandatory = $false)]
[string]$Password,

[Parameter(Mandatory = $false)]
Expand All @@ -51,6 +54,17 @@ param(

$ErrorActionPreference = "Stop"

# Validate required parameters before attempting the token request
$missingParams = @()
if ([string]::IsNullOrEmpty($ClientId)) { $missingParams += 'ClientId' }
if ([string]::IsNullOrEmpty($TenantId)) { $missingParams += 'TenantId' }
if ([string]::IsNullOrEmpty($Username)) { $missingParams += 'Username' }
if ([string]::IsNullOrEmpty($Password)) { $missingParams += 'Password' }
if ($missingParams.Count -gt 0) {
Write-Error "Cannot acquire bearer token: the following required parameters are missing or empty: $($missingParams -join ', '). Ensure the required secrets (MCP_CLIENT_ID, MCP_TENANT_ID, MCP_TEST_USERNAME, MCP_TEST_PASSWORD) are configured for this workflow run."
exit 1
}

Write-Host "Acquiring bearer token for MCP servers using ROPC flow..." -ForegroundColor Cyan
Write-Host "MCP servers require delegated (user) tokens, not service principal tokens" -ForegroundColor Gray

Expand Down
Loading