Add Repo Radius GHCR state end-to-end workflow by brooke-hamilton · Pull Request #12476 · radius-project/radius

brooke-hamilton · 2026-07-18T00:55:39Z

Summary

This PR adds a scheduled daily end-to-end workflow that tests the ability to run a control plane, serialize state to GHCR, then create a new control plane instance that rehydrates state from GHCR. If the workflow fails it adds an issue tagged with test-failure (the same as our other scheduled tests). There is already a functional test for GHCR state storage, and this adds an end-to-end test scenario that includes deployments to a local cluster.

add a scheduled and manually dispatchable Repo Radius GHCR state rehydration test
exercise state persistence across replacement control planes while preserving a workload on a separate target cluster
add timeout-safe remote state cleanup, diagnostics, and scheduled failure issue reporting
document package provisioning and the standalone functional-test lifecycle
add the Radius application model used by the graph tooling

Testing

latest positive fork run

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8a31277c-6702-45f2-876b-013c8a0ec466 Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 29eb21e5-6540-4bbc-9e29-3ea5c1aeb994 Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>

codecov · 2026-07-18T01:10:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.41%. Comparing base (67c36c6) to head (60a2052).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #12476      +/-   ##
==========================================
- Coverage   53.42%   53.41%   -0.01%     
==========================================
  Files         762      762              
  Lines       50246    50246              
==========================================
- Hits        26845    26841       -4     
- Misses      20878    20880       +2     
- Partials     2523     2525       +2

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>

Copilot

Pull request overview

Adds a scheduled + manually-dispatchable GitHub Actions workflow that validates Radius OCI state persistence in GHCR by saving state, replacing the control plane, restoring state, and confirming an existing workload on a separate target cluster remains managed. This fits into the repo’s CI/validation story by providing an end-to-end durability signal for the GHCR-backed state archive that can’t run in per-PR CI due to packages: write + private package requirements.

Changes:

Adds repo-radius-state-e2e GitHub Actions workflow plus supporting shell scripts to provision/validate a private GHCR package, run the lifecycle, collect diagnostics, and ensure cleanup.
Adds a minimal Radius application model (Bicep) used by the workflow to deploy/update a workload that proves state rehydration.
Documents how to provision the GHCR package and how to run/troubleshoot the standalone scheduled workflow; links this into contributing + architecture docs.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`test/functional-portable/statestore/noncloud/testdata/repo-radius-state-app.bicep`	Adds the app/container Bicep model used by the E2E workflow to verify updates across restore.
`docs/contributing/contributing-code/contributing-code-tests/repo-radius-state-e2e.md`	New contributor doc explaining provisioning, running, and troubleshooting the state E2E workflow.
`docs/contributing/contributing-code/contributing-code-tests/README.md`	Links the new E2E workflow doc from the tests docs index.
`docs/architecture/state-archive.md`	Documents the existence/purpose of the dedicated E2E test for the OCI state archive.
`.github/workflows/repo-radius-state-e2e.yaml`	New scheduled + dispatchable workflow to run the state save/restore lifecycle against GHCR.
`.github/scripts/test-repo-radius-state-e2e.sh`	Implements the E2E lifecycle phases, diagnostics collection, and cleanup behavior.
`.github/scripts/precreate-repo-radius-state-package.sh`	Idempotent helper to create/verify the required private/internal, linked GHCR package bootstrap tag.

github-actions · 2026-07-18T18:41:37Z

Functional Tests - corerp-cloud

30 tests ±0 29 ✅ ±0 20m 32s ⏱️ - 2m 34s
2 suites ±0 1 💤 ±0
1 files ±0 0 ❌ ±0

Results for commit 60a2052. ± Comparison against base commit 67c36c6.

♻️ This comment has been updated with latest results.

Use vars.RADIUS_REPOSITORY in the state-rehydration job gate to match the report-failure job in the same workflow and the sibling functional-test workflows, instead of hardcoding the repository name. Reflow the new End-to-End Test section in state-archive.md to a single line per paragraph, per the repo Markdown convention (MD013 disabled). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>

Rename the workflow display name from "Repo Radius GHCR State E2E" to "Repo Radius State E2E" so it derives directly from the filename repo-radius-state-e2e.yaml, per the GitHub Workflows instructions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>

radius-functional-tests · 2026-07-18T18:55:43Z

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	brooke-hamilton/radius
Commit ref	`60a2052`
Unique ID	funce746412773
Image tag	pr-funce746412773

Dapr: 1.14.4
Azure KeyVault CSI driver: 1.4.2
Azure Workload identity webhook: 1.3.0
Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-funce746412773
Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-funce746412773
dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-funce746412773
controller test image location: ghcr.io/radius-project/dev/controller:pr-funce746412773
ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-funce746412773
deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting ucp-cloud functional tests...
⌛ Starting corerp-cloud functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting corerp-cloud functional tests...
⌛ Starting ucp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded

…es (radius-project#12493) ## Summary The OCI-backed Radius state archive authenticates to GHCR **only** via the runner's Docker credential store (`credentials.NewStoreFromDocker` in `pkg/statearchive/oci/oci.go` and `ghcr.go`). The Azure and AWS deploy workflow templates never ran a `docker login` to GHCR before `rad startup` (the `restore-state` action) or `rad shutdown` (the `teardown` action), so opening a private `radius-state` package produced an **anonymous** token request that GHCR rejected: ``` Error: failed to open state archive: failed to resolve OCI archive "radius-state": HEAD ".../manifests/radius-state": GET ".../token?scope=repository%3A...%3Apull...": response status code 401: unauthorized: authentication required ``` The registry credentials that already exist in the templates (`github.actor` / `secrets.GITHUB_TOKEN`) were passed only to the later `run-rad-commands` action, where they create a Kubernetes secret for the containerImages recipe — they never logged the runner into GHCR. ## Change Add a `docker/login-action` step (`ghcr.io`, `github.actor` / `secrets.GITHUB_TOKEN`) early in the `deploy` job of both `run-rad-commands-azure.yml` and `run-rad-commands-aws.yml`, before `Set up control plane` / `Restore Radius state` / `Teardown`. `docker login` writes `~/.docker/config.json`, which persists for the whole job, so `rad startup` and `rad shutdown` both authenticate. `packages: write` is already granted at the job level. This mirrors the GHCR auth setup in the `repo-radius-state-e2e.yaml` workflow (radius-project#12476), which logs into GHCR the same way before its state save/restore steps. ## Note on package provisioning The login is necessary but not always sufficient: the GHCR state package must also be **private/internal and linked to the repository** for `GITHUB_TOKEN` to authenticate, and Radius' visibility guard refuses public packages for state. Provisioning the package with that visibility/linkage is the responsibility of the per-environment deploy tooling that sets `RADIUS_STATE_REGISTRY` (analogous to the `precreate-repo-radius-state-package.sh` step in radius-project#12476), not these templates. ## Testing - YAML of both templates validated with `yaml.safe_load`. - `docker/login-action` pinned to `af1e73f918a031802d376d3c8bbc3fe56130a9b0` (v4.4.0), consistent with the other pins under `.github/workflows/`. Signed-off-by: sk593 <shruthikumar@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

sk593 · 2026-07-23T17:11:59Z

+        args: ['-c', 'while true; do echo ${deploymentPhase}; sleep 10; done']
+      }
+    }
+    connections: {}


nit: do we need connections?

brooke-hamilton added 4 commits July 17, 2026 15:06

Add Repo Radius state E2E workflow

f8567c8

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8a31277c-6702-45f2-876b-013c8a0ec466 Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>

Wait for k3d API readiness

57df88c

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8a31277c-6702-45f2-876b-013c8a0ec466 Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>

Ensure Repo Radius state cleanup after timeout

6b6f132

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8a31277c-6702-45f2-876b-013c8a0ec466 Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>

Add Repo Radius application model

222e4fb

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 29eb21e5-6540-4bbc-9e29-3ea5c1aeb994 Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>

brooke-hamilton added the pr:standard label Jul 18, 2026

brooke-hamilton added 2 commits July 18, 2026 10:23

remove extra .radius folder files

27c1a27

Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>

doc updates

29744db

Signed-off-by: Brooke Hamilton <45323234+brooke-hamilton@users.noreply.github.com>

brooke-hamilton requested a review from Copilot July 18, 2026 18:30

Copilot started reviewing on behalf of brooke-hamilton July 18, 2026 18:30 View session

Copilot AI reviewed Jul 18, 2026

View reviewed changes

Comment thread .github/workflows/repo-radius-state-e2e.yaml Outdated

Comment thread .github/workflows/repo-radius-state-e2e.yaml

Comment thread .github/workflows/repo-radius-state-e2e.yaml

Comment thread docs/architecture/state-archive.md Outdated

brooke-hamilton and others added 2 commits July 18, 2026 11:50

brooke-hamilton marked this pull request as ready for review July 18, 2026 19:01

brooke-hamilton requested review from a team as code owners July 18, 2026 19:01

sk593 mentioned this pull request Jul 20, 2026

Log in to GHCR before rad startup/shutdown in deploy workflow templates #12493

Merged

lakshmimsft requested a review from sk593 July 20, 2026 18:18

sk593 reviewed Jul 23, 2026

View reviewed changes

nithyatsu requested a review from DariuszPorowski July 27, 2026 18:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add Repo Radius GHCR state end-to-end workflow - #12476

Add Repo Radius GHCR state end-to-end workflow#12476
brooke-hamilton wants to merge 8 commits into
radius-project:mainfrom
brooke-hamilton:brooke-hamilton-repo-radius-state-e2e

brooke-hamilton commented Jul 18, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

radius-functional-tests Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

sk593 Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

brooke-hamilton commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Uh oh!

codecov Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Functional Tests - corerp-cloud

Uh oh!

radius-functional-tests Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Radius functional test overview

Test Status

Uh oh!

sk593 Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

brooke-hamilton commented Jul 18, 2026 •

edited

Loading

codecov Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

radius-functional-tests Bot commented Jul 18, 2026 •

edited

Loading