From 0e7a5158d7aee134d5580e83cc044548f016cad7 Mon Sep 17 00:00:00 2001
From: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Date: Mon, 17 Aug 2026 15:19:03 +1000
Subject: [PATCH 1/3] Add in dynamic version for telemetry using
 GITHUB_ACTION_REF

---
 src/common/Utils.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/common/Utils.ts b/src/common/Utils.ts
index 8d36b3cd7..ecd45df94 100644
--- a/src/common/Utils.ts
+++ b/src/common/Utils.ts
@@ -7,8 +7,9 @@ import { AzPSConstants, AzPSUtils } from '../PowerShell/AzPSUtils';
 export function setUserAgent(): void {
     let usrAgentRepo = crypto.createHash('sha256').update(`${process.env.GITHUB_REPOSITORY}`).digest('hex');
     let actionName = 'AzureLogin';
-    process.env.AZURE_HTTP_USER_AGENT = (!!process.env.AZURE_HTTP_USER_AGENT ? `${process.env.AZURE_HTTP_USER_AGENT} ` : '') + `GITHUBACTIONS/${actionName}@v3_${usrAgentRepo}_${process.env.RUNNER_ENVIRONMENT}_${process.env.GITHUB_RUN_ID}`;
-    process.env.AZUREPS_HOST_ENVIRONMENT = (!!process.env.AZUREPS_HOST_ENVIRONMENT ? `${process.env.AZUREPS_HOST_ENVIRONMENT} ` : '') + `GITHUBACTIONS/${actionName}@v3_${usrAgentRepo}_${process.env.RUNNER_ENVIRONMENT}_${process.env.GITHUB_RUN_ID}`;
+    let actionRef = process.env.GITHUB_ACTION_REF || 'unknown';
+    process.env.AZURE_HTTP_USER_AGENT = (!!process.env.AZURE_HTTP_USER_AGENT ? `${process.env.AZURE_HTTP_USER_AGENT} ` : '') + `GITHUBACTIONS/${actionName}@${actionRef}_${usrAgentRepo}_${process.env.RUNNER_ENVIRONMENT}_${process.env.GITHUB_RUN_ID}`;
+    process.env.AZUREPS_HOST_ENVIRONMENT = (!!process.env.AZUREPS_HOST_ENVIRONMENT ? `${process.env.AZUREPS_HOST_ENVIRONMENT} ` : '') + `GITHUBACTIONS/${actionName}@${actionRef}_${usrAgentRepo}_${process.env.RUNNER_ENVIRONMENT}_${process.env.GITHUB_RUN_ID}`;
 }
 
 export async function cleanupAzCLIAccounts(): Promise<void> {

From b08a41bbda4629cefd84251f5951069d9d8b70f8 Mon Sep 17 00:00:00 2001
From: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Date: Mon, 17 Aug 2026 07:45:16 +0100
Subject: [PATCH 2/3] Isolate live-test resource group per run; scope
 concurrency to the branch

The live-tests workflow used a fixed resource group name
(GitHubAction_CI_Group) plus a repo-wide concurrency group. Because the
test jobs run behind the Automation test approval gate, an unapproved run
sits in the 'waiting' state holding the shared concurrency lock, which
blocked live-tests on every other PR indefinitely.

Give each run its own resource group by suffixing the name with
github.run_id, and reference it via the RG_POSITIVE env var everywhere
(previously nine jobs used the literal name). With per-run isolation the
repo-wide lock is no longer needed to prevent collisions, so the
concurrency group is now scoped to the branch (github.ref) and only
prevents pile-ups on rapid pushes to the same ref - never across PRs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/azure-login-live-tests.yml | 31 +++++++++++---------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/azure-login-live-tests.yml b/.github/workflows/azure-login-live-tests.yml
index ec872ff77..2c9c798d4 100644
--- a/.github/workflows/azure-login-live-tests.yml
+++ b/.github/workflows/azure-login-live-tests.yml
@@ -9,16 +9,19 @@ permissions:
   id-token: write
   contents: read
 
-# One resource group is shared by every job in this run, so serialize runs to
-# avoid one run tearing down another's group.
+# Each run provisions its own uniquely-named resource group (suffixed with the
+# run id), so concurrent runs on different branches/PRs never collide or tear
+# down each other's group. The concurrency group is branch-scoped only to avoid
+# piling up runs on rapid pushes to the same ref - it does NOT serialize across
+# the whole repo, so an unapproved run on one PR can never block another.
 concurrency:
-  group: azure-login-live-tests
+  group: azure-login-live-tests-${{ github.ref }}
   cancel-in-progress: false
 
 env:
   # Created once in setup; the positive and embedded "can access" assertions
-  # target this group.
-  RG_POSITIVE: GitHubAction_CI_Group
+  # target this group. Suffixed with the run id so every run is isolated.
+  RG_POSITIVE: GitHubAction_CI_Group_${{ github.run_id }}
   LOCATION: eastus
   # Intentionally NEVER created: the negative permission/not-found assertions
   # target this name so they fail as expected.
@@ -77,7 +80,7 @@ jobs:
     - name: Run Azure Cli
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
 
     - name: Run Azure PowerShell
       uses: azure/powershell@v3
@@ -121,7 +124,7 @@ jobs:
     - name: Run Azure Cli
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
 
     - name: Run Azure PowerShell
       uses: azure/powershell@v3
@@ -165,7 +168,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
 
     - name: Login with creds, wrong boolean value
       uses: ./
@@ -176,7 +179,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
 
     - name: Login with creds, allow no subscription
       uses: ./
@@ -188,7 +191,7 @@ jobs:
     - name: Run Azure Cli
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
  
     - name: Run Azure PowerShell
       uses: azure/powershell@v3
@@ -521,7 +524,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
 
     - name: Run Azure PowerShell
       id: ps_8
@@ -531,7 +534,7 @@ jobs:
         azPSVersion: "latest"
         inlineScript: |
           (Get-AzContext).Environment.Name -eq 'AzureCloud'
-          (Get-AzResourceGroup -Name GitHubAction_CI_Group).ResourceGroupName -eq 'GitHubAction_CI_Group'
+          (Get-AzResourceGroup -Name $env:RG_POSITIVE).ResourceGroupName -eq $env:RG_POSITIVE
 
     - name: Check Last step failed
       if: steps.ps_8.outcome == 'success'
@@ -549,7 +552,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
 
     - name: Run Azure PowerShell
       id: ps_9
@@ -559,7 +562,7 @@ jobs:
         azPSVersion: "latest"
         inlineScript: |
           (Get-AzContext).Environment.Name -eq 'AzureCloud'
-          (Get-AzResourceGroup -Name GitHubAction_CI_Group).ResourceGroupName -eq 'GitHubAction_CI_Group'
+          (Get-AzResourceGroup -Name $env:RG_POSITIVE).ResourceGroupName -eq $env:RG_POSITIVE
 
     - name: Check Last step failed
       if: steps.ps_9.outcome == 'success'

From 48890d1697305093fd213e121cba8ebabf294f44 Mon Sep 17 00:00:00 2001
From: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Date: Mon, 17 Aug 2026 08:03:32 +0100
Subject: [PATCH 3/3] Fix resource group name expansion on Windows runners

The per-run resource group name was referenced as the bash-style
"$RG_POSITIVE" in az group show/create/delete run steps. Those steps use
the runner default shell, which is PowerShell on windows-latest, so the
name expanded to an empty string there and az failed with "argument
--name/-n/--resource-group/-g: expected one argument".

Reference the value through the GitHub Actions env expression instead, so
it is substituted before the shell runs, making it shell-agnostic across
ubuntu, windows, and macos. The azure/powershell inline scripts keep
using the PowerShell env form, which is correct there.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/azure-login-live-tests.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/azure-login-live-tests.yml b/.github/workflows/azure-login-live-tests.yml
index 2c9c798d4..1d3657a95 100644
--- a/.github/workflows/azure-login-live-tests.yml
+++ b/.github/workflows/azure-login-live-tests.yml
@@ -41,7 +41,7 @@ jobs:
       with:
         creds: ${{ secrets.PROVISION_CREDS }}
     - name: Create resource group
-      run: az group create --name "$RG_POSITIVE" --location "$LOCATION" --output none
+      run: az group create --name "${{ env.RG_POSITIVE }}" --location "${{ env.LOCATION }}" --output none
 
   # ================================================================ POSITIVE
   Positive_BasicTest:
@@ -80,7 +80,7 @@ jobs:
     - name: Run Azure Cli
       run: |
         az account show --output none
-        az group show --name "$RG_POSITIVE" --output none
+        az group show --name "${{ env.RG_POSITIVE }}" --output none
 
     - name: Run Azure PowerShell
       uses: azure/powershell@v3
@@ -124,7 +124,7 @@ jobs:
     - name: Run Azure Cli
       run: |
         az account show --output none
-        az group show --name "$RG_POSITIVE" --output none
+        az group show --name "${{ env.RG_POSITIVE }}" --output none
 
     - name: Run Azure PowerShell
       uses: azure/powershell@v3
@@ -168,7 +168,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name "$RG_POSITIVE" --output none
+        az group show --name "${{ env.RG_POSITIVE }}" --output none
 
     - name: Login with creds, wrong boolean value
       uses: ./
@@ -179,7 +179,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name "$RG_POSITIVE" --output none
+        az group show --name "${{ env.RG_POSITIVE }}" --output none
 
     - name: Login with creds, allow no subscription
       uses: ./
@@ -191,7 +191,7 @@ jobs:
     - name: Run Azure Cli
       run: |
         az account show --output none
-        az group show --name "$RG_POSITIVE" --output none
+        az group show --name "${{ env.RG_POSITIVE }}" --output none
  
     - name: Run Azure PowerShell
       uses: azure/powershell@v3
@@ -524,7 +524,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name "$RG_POSITIVE" --output none
+        az group show --name "${{ env.RG_POSITIVE }}" --output none
 
     - name: Run Azure PowerShell
       id: ps_8
@@ -552,7 +552,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name "$RG_POSITIVE" --output none
+        az group show --name "${{ env.RG_POSITIVE }}" --output none
 
     - name: Run Azure PowerShell
       id: ps_9
@@ -690,4 +690,4 @@ jobs:
       with:
         creds: ${{ secrets.PROVISION_CREDS }}
     - name: Delete resource group
-      run: az group delete --name "$RG_POSITIVE" --yes --output none || true
+      run: az group delete --name "${{ env.RG_POSITIVE }}" --yes --output none || true