Fix failing E2E - .NET Semantic Kernel workflow when secrets are unavailable (e.g., fork PRs) by preventing PowerShell token acquisition from being invoked with empty parameters.

Context

• Workflow: .github/workflows/e2e-dotnet-semantic-kernel.yml
• Failure observed in Actions logs: PowerShell error Cannot bind argument to parameter 'ClientId' because it is an empty string. when running token acquisition.
• The workflow calls scripts/e2e/Acquire-BearerToken.ps1 with secrets (MCP_CLIENT_ID, MCP_TENANT_ID, MCP_TEST_USERNAME, MCP_TEST_PASSWORD). On fork PRs, secrets are not provided, causing empty string arguments.

Required changes

1. Update .github/workflows/e2e-dotnet-semantic-kernel.yml to:

   • Add a guard so the "Acquire Bearer Token (ROPC)" step only runs when required secrets are present (non-empty).
   • Add a clear "Skip E2E (missing secrets)" step that runs when secrets are missing to explain why tests are skipped.
   • Gate downstream steps that depend on the bearer token (Start Agent, Verify Agent Running, Run .NET E2E Tests) so they only run when a bearer token is available.
   • Ensure cleanup / artifact steps that use if: always() still run and do not fail when E2E steps are skipped.

2. (Optional but preferred) Make the scripts more robust:

   • Update scripts/e2e/Acquire-BearerToken.ps1 (and/or any wrapper logic) so it validates parameters and emits a friendly error message if called with empty values, rather than a PowerShell parameter binding failure. If this script is not present or not used, skip.

Acceptance criteria

• On runs where secrets are not available, the workflow job should not fail at token acquisition; it should skip E2E execution with a clear message and complete successfully.
• On runs where secrets are provided, the workflow should behave exactly as before and still run full E2E.
• Keep changes minimal and well-commented.

Repository: microsoft/Agent365-Samples
Base branch: main

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: Please find a solution for this failing job. Use the logs, job definition, and any referenced files where the failure occurred. Keep your response focused on the solution and include code suggestions when appropriate.

Assistant: The job is failing because one of the PowerShell scripts is being invoked with an empty -ClientId argument:

Cannot bind argument to parameter 'ClientId' because it is an empty string.

This comes from the workflow step “Acquire Bearer Token (ROPC)” in .github/workflows/e2e-dotnet-semantic-kernel.yml at ref e442d7856ee43d49951ff6ec3daecb80be9552a9, which calls:

- name: Acquire Bearer Token (ROPC)
  run: |
    $token = & "scripts/e2e/Acquire-BearerToken.ps1" `
      -ClientId "${{ secrets.MCP_CLIENT_ID }}" `
      -TenantId "${{ secrets.MCP_TENANT_ID }}" `
      -Username "${{ secrets.MCP_TEST_USERNAME }}" `
      -Password "${{ secrets.MCP_TEST_PASSWORD }}"

On PR runs from forks (and in some repo setups), GitHub does not provide repository secrets to the workflow, so ${{ secrets.MCP_CLIENT_ID }} resolves to an empty string, which PowerShell rejects for a mandatory parameter.

Fix (recommended): Guard the step + skip E2E when secrets are unavailable

Update the workflow to only attempt token acquisition (and subsequent agent start/tests) when the required secrets exist, and otherwise skip with a clear message. Example patch:

      - name: Acquire Bearer Token (ROPC)
        id: token
        if: ${{ secrets.MCP_CLIENT_ID != '' && secrets.MCP_TENANT_ID != '' && secrets.MCP_TEST_USERNAME != '' && secrets.MCP_TEST_PASSWORD != '' }}
        shell: pwsh
        run: |
          $token = & "${{ env.SCRIPTS_PATH }}/Acquire-BearerToken.ps1" `
            -ClientId "${{ secrets.MCP_CLIENT_ID }}" `
            -TenantId "${{ secrets.MCP_TENANT_ID }}" `
            -Username "${{ secrets.MCP_TEST_USERNAME }}" `
            -Password "${{ secrets.MCP_TEST_PASSWORD }}"
          echo "BEARER_TOKEN=$token" >> $env:GITHUB_OUTPUT
          echo "::add-mask::$token"

      - name: Skip E2E (missing secrets)
        if: ${{ secrets.MCP_CLIENT_ID == '' || secrets.MCP_TENANT_ID == '' || secrets.MCP_TEST_USERNAME == '' || secrets.MCP_TEST_PASSWORD == '' }}
        shell: pwsh
        run: |
          Write-Host "E2E secrets are not available for this run (likely a fork PR). Skipping token acquisition and E2E steps."

Then gate the dependent steps (Start Agent / Verify Agent Running / Run .NET E2E Tests) so they only run when the token step ran successfully:

      - name: Start Agent
        id: start-agent
        if: ${{ steps.token.outputs.BEARER_TOKEN != '' }}
        shell: pwsh
        run: |
          $agentPid = & "${{ env.SCRIPTS_PATH }}/Start-Agent.ps1" `
            -AgentPath "${{ env.SAMPLE_PATH }}" `
            -StartCommand "dotnet run --no-build" `
            -Port ${{ env.AGENT_PORT }} `
 ...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

*This pull request was created from Copilot chat.*
>