Prevent crashes when AZURE_CLIENT_ID/AZURE_TENANT_ID/INFRA_CONFIG variables are unset in linearb-deployment.yml

[Copilot]

Applies the same defensive Azure configuration resolution logic from #155 (commit ee19f3f) to linearb-deployment.yml.

Changes

• Created a separate get_azure_config job that runs first and computes Azure configuration
• This job outputs client_id and tenant_id for downstream jobs to reference
• Checks AZURE_CLIENT_ID first, falls back to INFRA_CONFIG.repo_identity_client_id, errors explicitly if neither exists
• Checks AZURE_TENANT_ID first, falls back to INFRA_CONFIG.tenant_id, errors explicitly if neither exists
• Separated deployment into linearb_deployment and cortex_deployment jobs that both depend on get_azure_config
• Both deployment jobs reference the config outputs using needs.get_azure_config.outputs.client_id and needs.get_azure_config.outputs.tenant_id
• Made Cortex deployment job conditional based on inputs.cortexEntityIdOrTag != ''
• LinearB and Cortex deployments can run in parallel after the config job completes

Pattern Applied

get_azure_config:
  runs-on: [idp]
  permissions:
    id-token: write
  outputs:
    client_id: ${{ steps.get_azure_config.outputs.client_id }}
    tenant_id: ${{ steps.get_azure_config.outputs.tenant_id }}
  steps:
  - id: get_azure_config
    env:
      INFRA_CONFIG: ${{ vars.INFRA_CONFIG }}
      AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
    shell: pwsh
    run: |
      if ($env:AZURE_CLIENT_ID) {
          $ClientId = $env:AZURE_CLIENT_ID
      } elseif ($env:INFRA_CONFIG) {
          $ClientId = (ConvertFrom-Json $env:INFRA_CONFIG).repo_identity_client_id
      } else {
          Write-Error "Neither AZURE_CLIENT_ID nor INFRA_CONFIG is set. Cannot determine client id."
          exit 1
      }
      "client_id=$ClientId" >> $env:GITHUB_OUTPUT

      if ($env:AZURE_TENANT_ID) {
          $TenantId = $env:AZURE_TENANT_ID
      } elseif ($env:INFRA_CONFIG) {
          $TenantId = (ConvertFrom-Json $env:INFRA_CONFIG).tenant_id
      } else {
          Write-Error "Neither AZURE_TENANT_ID nor INFRA_CONFIG is set. Cannot determine tenant id."
          exit 1
      }
      "tenant_id=$TenantId" >> $env:GITHUB_OUTPUT

linearb_deployment:
  needs: get_azure_config
  # ... uses needs.get_azure_config.outputs.client_id and tenant_id

cortex_deployment:
  needs: get_azure_config
  if: ${{ inputs.cortexEntityIdOrTag != '' }}
  # ... uses needs.get_azure_config.outputs.client_id and tenant_id

This prevents runtime crashes from attempting to parse undefined variables, provides clear error messages when configuration is missing, and allows for parallel execution of deployment jobs while maintaining a single source of configuration truth.

Original prompt

Look at this change here ee19f3f and then apply the same logic for linearb-deployment.yml

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Mathieu Gamache (PrincessMadMath)]

Copilot Ok I also want to do the same compute logic for AZURE_TENANT_ID. Do not create a new step just rethink it to better evolve.

[Copilot]

Copilot Ok I also want to do the same compute logic for AZURE_TENANT_ID. Do not create a new step just rethink it to better evolve.

Done! The step has been renamed to get_azure_config and now computes both client_id and tenant_id using the same fallback logic (checks direct variable first, then falls back to INFRA_CONFIG). Both outputs are used by the secret retrieval steps. (da59e44)

[Mathieu Gamache (PrincessMadMath)]

Copilot I want a single job not duplicate steps

[Copilot]

Copilot I want a single job not duplicate steps

Consolidated! The two jobs are now merged into a single deployment job with one get_azure_config step. Cortex-related steps are conditional based on the cortexEntityIdOrTag input. This reduces duplication by 37 lines. (dd19862)

[Mathieu Gamache (PrincessMadMath)]

Copilot Ok no create an new jobs that precede the linearB and that both reference

[Copilot]

Copilot Ok no create an new jobs that precede the linearB and that both reference

Done! Created a separate get_azure_config job that runs first and outputs the configuration. Both linearb_deployment and cortex_deployment jobs now reference these outputs via needs.get_azure_config.outputs. The two deployment jobs can run in parallel after the config job completes. (26aa7d7)