fix(ci): isolate Azure live-test resources - #873
Merged
Merged
Conversation
Xuanwo
marked this pull request as ready for review
September 9, 2026 06:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Azure live tests fail across providers when the shared
probe.txtdisappears. The CI storage account has a lifecycle policy that deletes blobs older than one day, so a persistent probe cannot be a prerequisite for running tests. Each live-test job now creates its own private probe and removes it after the test command exits. SAS cases receive a short-lived, read-only token for that object. GitHub owns the Azure Pipelines probe through completion or cancellation, preserving the pipeline identity's existing Blob Reader access. A run variable carries the probe URL without requiring new parameters in the deployed bootstrap YAML. The pipeline definition explicitly permits overriding this non-secret variable at queue time; other queue-time variable restrictions remain enabled.IMDS deployment retries also use distinct resource names and clean up partially created NICs and disks. This prevents a failed deployment in
eastusfrom blocking theeastus2fallback withInvalidResourceLocation. The AWS IMDS VM also gets temporary swap for Docker installation, which previously exited with status 137 ont3.nano.Manual validation on
460239b: live Azure Shared Key and SAS reads passed through static/environment providers and signing tests; probe deletion was verified after both successful tests and a command exiting with status 42. The Azure IMDS live job passed in GitHub Actions. Actual Azure Pipelines execution at37c9713passed in run 24, including probe cleanup. YAML previews alone do not validate permission to override queue-time variables. All 63 GitHub checks passed on2b7cab4, including the complete Azure live-test workflow and AWS live-test workflow. The AWS IMDS bootstrap completed successfully with temporary swap.