Add Repo Radius GHCR state end-to-end workflow - #12476
Open
brooke-hamilton wants to merge 8 commits into
Open
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8a31277c-6702-45f2-876b-013c8a0ec466 Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8a31277c-6702-45f2-876b-013c8a0ec466 Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8a31277c-6702-45f2-876b-013c8a0ec466 Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 29eb21e5-6540-4bbc-9e29-3ea5c1aeb994 Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #12476 +/- ##
==========================================
- Coverage 53.42% 53.41% -0.01%
==========================================
Files 762 762
Lines 50246 50246
==========================================
- Hits 26845 26841 -4
- Misses 20878 20880 +2
- Partials 2523 2525 +2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>
Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a scheduled + manually-dispatchable GitHub Actions workflow that validates Radius OCI state persistence in GHCR by saving state, replacing the control plane, restoring state, and confirming an existing workload on a separate target cluster remains managed. This fits into the repo’s CI/validation story by providing an end-to-end durability signal for the GHCR-backed state archive that can’t run in per-PR CI due to packages: write + private package requirements.
Changes:
- Adds
repo-radius-state-e2eGitHub Actions workflow plus supporting shell scripts to provision/validate a private GHCR package, run the lifecycle, collect diagnostics, and ensure cleanup. - Adds a minimal Radius application model (Bicep) used by the workflow to deploy/update a workload that proves state rehydration.
- Documents how to provision the GHCR package and how to run/troubleshoot the standalone scheduled workflow; links this into contributing + architecture docs.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
test/functional-portable/statestore/noncloud/testdata/repo-radius-state-app.bicep |
Adds the app/container Bicep model used by the E2E workflow to verify updates across restore. |
docs/contributing/contributing-code/contributing-code-tests/repo-radius-state-e2e.md |
New contributor doc explaining provisioning, running, and troubleshooting the state E2E workflow. |
docs/contributing/contributing-code/contributing-code-tests/README.md |
Links the new E2E workflow doc from the tests docs index. |
docs/architecture/state-archive.md |
Documents the existence/purpose of the dedicated E2E test for the OCI state archive. |
.github/workflows/repo-radius-state-e2e.yaml |
New scheduled + dispatchable workflow to run the state save/restore lifecycle against GHCR. |
.github/scripts/test-repo-radius-state-e2e.sh |
Implements the E2E lifecycle phases, diagnostics collection, and cleanup behavior. |
.github/scripts/precreate-repo-radius-state-package.sh |
Idempotent helper to create/verify the required private/internal, linked GHCR package bootstrap tag. |
Use vars.RADIUS_REPOSITORY in the state-rehydration job gate to match the report-failure job in the same workflow and the sibling functional-test workflows, instead of hardcoding the repository name. Reflow the new End-to-End Test section in state-archive.md to a single line per paragraph, per the repo Markdown convention (MD013 disabled). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>
Rename the workflow display name from "Repo Radius GHCR State E2E" to "Repo Radius State E2E" so it derives directly from the filename repo-radius-state-e2e.yaml, per the GitHub Workflows instructions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
brooke-hamilton
marked this pull request as ready for review
July 18, 2026 19:01
pull Bot
pushed a commit
to TheTechOddBug/radius
that referenced
this pull request
Jul 20, 2026
…es (radius-project#12493) ## Summary The OCI-backed Radius state archive authenticates to GHCR **only** via the runner's Docker credential store (`credentials.NewStoreFromDocker` in `pkg/statearchive/oci/oci.go` and `ghcr.go`). The Azure and AWS deploy workflow templates never ran a `docker login` to GHCR before `rad startup` (the `restore-state` action) or `rad shutdown` (the `teardown` action), so opening a private `radius-state` package produced an **anonymous** token request that GHCR rejected: ``` Error: failed to open state archive: failed to resolve OCI archive "radius-state": HEAD ".../manifests/radius-state": GET ".../token?scope=repository%3A...%3Apull...": response status code 401: unauthorized: authentication required ``` The registry credentials that already exist in the templates (`github.actor` / `secrets.GITHUB_TOKEN`) were passed only to the later `run-rad-commands` action, where they create a Kubernetes secret for the containerImages recipe — they never logged the runner into GHCR. ## Change Add a `docker/login-action` step (`ghcr.io`, `github.actor` / `secrets.GITHUB_TOKEN`) early in the `deploy` job of both `run-rad-commands-azure.yml` and `run-rad-commands-aws.yml`, before `Set up control plane` / `Restore Radius state` / `Teardown`. `docker login` writes `~/.docker/config.json`, which persists for the whole job, so `rad startup` and `rad shutdown` both authenticate. `packages: write` is already granted at the job level. This mirrors the GHCR auth setup in the `repo-radius-state-e2e.yaml` workflow (radius-project#12476), which logs into GHCR the same way before its state save/restore steps. ## Note on package provisioning The login is necessary but not always sufficient: the GHCR state package must also be **private/internal and linked to the repository** for `GITHUB_TOKEN` to authenticate, and Radius' visibility guard refuses public packages for state. Provisioning the package with that visibility/linkage is the responsibility of the per-environment deploy tooling that sets `RADIUS_STATE_REGISTRY` (analogous to the `precreate-repo-radius-state-package.sh` step in radius-project#12476), not these templates. ## Testing - YAML of both templates validated with `yaml.safe_load`. - `docker/login-action` pinned to `af1e73f918a031802d376d3c8bbc3fe56130a9b0` (v4.4.0), consistent with the other pins under `.github/workflows/`. Signed-off-by: sk593 <shruthikumar@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
sk593
reviewed
Jul 23, 2026
| args: ['-c', 'while true; do echo ${deploymentPhase}; sleep 10; done'] | ||
| } | ||
| } | ||
| connections: {} |
Contributor
There was a problem hiding this comment.
nit: do we need connections?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds a scheduled daily end-to-end workflow that tests the ability to run a control plane, serialize state to GHCR, then create a new control plane instance that rehydrates state from GHCR. If the workflow fails it adds an issue tagged with
test-failure(the same as our other scheduled tests). There is already a functional test for GHCR state storage, and this adds an end-to-end test scenario that includes deployments to a local cluster.Testing