From 8405145ab617ef4e9b3a7dd76fb8d6a42f5d0861 Mon Sep 17 00:00:00 2001
From: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Date: Thu, 13 Aug 2026 07:17:42 +0100
Subject: [PATCH 1/6] Update azure/login pin from v1 to v3 in canary and
 integration tests

The canary and integration-test workflows still pinned azure/login@v1 while
the action is on v3, so they were validating a two-major-old release instead
of the current one.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/azure-login-canary.yml         |  8 ++++----
 .../workflows/azure-login-integration-tests.yml  | 16 ++++++++--------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/azure-login-canary.yml b/.github/workflows/azure-login-canary.yml
index eb4ef84de..4758fc412 100644
--- a/.github/workflows/azure-login-canary.yml
+++ b/.github/workflows/azure-login-canary.yml
@@ -33,7 +33,7 @@ jobs:
         uses: actions/checkout@v6
         
       - name: 'Az CLI login with subscription'
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           
@@ -41,7 +41,7 @@ jobs:
           az account show --output none
           
       - name: 'Az CLI login without subscription'
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           allow-no-subscriptions: true
@@ -50,7 +50,7 @@ jobs:
           az account show --output none
           
       - name: 'Az CLI login with subscription OIDC'
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           client-id: ${{ secrets.AZURE_CLIENTID }}
           tenant-id: ${{ secrets.AZURE_TENANTID }}
@@ -60,7 +60,7 @@ jobs:
           az account show --output none
           
       - name: 'Az CLI login without subscription OIDC'
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           client-id: ${{ secrets.AZURE_CLIENTID }}
           tenant-id: ${{ secrets.AZURE_TENANTID }}
diff --git a/.github/workflows/azure-login-integration-tests.yml b/.github/workflows/azure-login-integration-tests.yml
index a746e74f0..7101c5c0a 100644
--- a/.github/workflows/azure-login-integration-tests.yml
+++ b/.github/workflows/azure-login-integration-tests.yml
@@ -14,7 +14,7 @@ jobs:
 #     continue-on-error: true
     steps:
       - name: 'Az CLI login with subscription'
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           
@@ -23,7 +23,7 @@ jobs:
           az vm list --output none
           
       - name: 'Az CLI login without subscription'
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           allow-no-subscriptions: true
@@ -32,7 +32,7 @@ jobs:
           az account show --output none
           
       - name: 'Azure PowerShell login with subscription'
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           enable-AzPSSession: true
@@ -43,7 +43,7 @@ jobs:
           azPSVersion: "latest"
           
       - name: 'Azure PowerShell login without subscription'
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           creds: ${{secrets.AZURE_CREDENTIALS}}
           enable-AzPSSession: true
@@ -59,7 +59,7 @@ jobs:
 #     continue-on-error: true
     steps:
       - name: 'Az CLI login with subscription'
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           client-id: ${{ secrets.AZURE_CLIENTID }}
           tenant-id: ${{ secrets.AZURE_TENANTID }}
@@ -70,7 +70,7 @@ jobs:
           az vm list --output none
           
       - name: 'Az CLI login without subscription'
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           client-id: ${{ secrets.AZURE_CLIENTID }}
           tenant-id: ${{ secrets.AZURE_TENANTID }}
@@ -80,7 +80,7 @@ jobs:
           az account show --output none
           
       - name: 'Azure PowerShell login with subscription'
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           client-id: ${{ secrets.AZURE_CLIENTID }}
           tenant-id: ${{ secrets.AZURE_TENANTID }}
@@ -93,7 +93,7 @@ jobs:
           azPSVersion: "latest"
           
       - name: 'Azure PowerShell login without subscription'
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           client-id: ${{ secrets.AZURE_CLIENTID }}
           tenant-id: ${{ secrets.AZURE_TENANTID }}

From 6d646d17ef574a0cf97aa19be38dc68006df8355 Mon Sep 17 00:00:00 2001
From: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Date: Thu, 13 Aug 2026 07:18:06 +0100
Subject: [PATCH 2/6] Remove unused Slack notification jobs from canary and
 integration tests

The slack-post-result jobs posted to a Slack webhook that is no longer used,
and referenced a secret with broken interpolation. Removing them; the test
jobs themselves are unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/azure-login-canary.yml      | 21 -----------------
 .../azure-login-integration-tests.yml         | 23 -------------------
 2 files changed, 44 deletions(-)

diff --git a/.github/workflows/azure-login-canary.yml b/.github/workflows/azure-login-canary.yml
index 4758fc412..665e04432 100644
--- a/.github/workflows/azure-login-canary.yml
+++ b/.github/workflows/azure-login-canary.yml
@@ -68,24 +68,3 @@ jobs:
           
       - run: |
           az account show --output none
-          
-  slack-post-result:
-        runs-on: ubuntu-latest
-#         continue-on-error: true
-        if: ${{ always() }}
-        needs: [az-login-test]
-        steps:
-          - name: Create slack post
-            id: slack_report
-            run: |
-              TITLE="Login action canary tests update - "
-              DATEVAR=`date "+%d/%m/%YT%H:%M:%S"`
-              TITLE="${TITLE}${DATEVAR}"
-              REPORT="${TITLE}\r\nLink to run - https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\r\n" 
-              RUN_URL="https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
-              REPORT="${REPORT}\r\n"
-              if [ ${{needs.az-login-test.result}} == 'success' ]; then REPORT="${REPORT}\r\n|✅|<${RUN_URL}|az-login-test>"; else REPORT="${REPORT}\r\n|❌|<${RUN_URL}|az-login-test>"; fi
-              echo "report=$REPORT" >> $GITHUB_OUTPUT
-          - name: Post to slack
-            shell: bash
-            run: curl -X POST -H 'Content-type:application/json' --data '{"blocks":[{"type":"section","text":{"type":"mrkdwn","text":"${{steps.slack_report.outputs.report}}"}}]}' https://hooks.slack.com/services/${{SECRETS.SLACK_CHANNEL_SECRET}}
diff --git a/.github/workflows/azure-login-integration-tests.yml b/.github/workflows/azure-login-integration-tests.yml
index 7101c5c0a..31b91186e 100644
--- a/.github/workflows/azure-login-integration-tests.yml
+++ b/.github/workflows/azure-login-integration-tests.yml
@@ -104,26 +104,3 @@ jobs:
         with:
           inlineScript: "(Get-AzContext).Environment.Name"
           azPSVersion: "latest"
-          
-  slack-post-result:
-        runs-on: ubuntu-latest
-#         continue-on-error: true
-        if: ${{ always() }}
-        needs: [az-login-test-non-oidc, az-login-test-oidc]
-        steps:
-          - name: Create slack post
-            id: slack_report
-            run: |
-              TITLE="Login action OIDC flow tests update - "
-              DATEVAR=`date "+%d/%m/%YT%H:%M:%S"`
-              TITLE="${TITLE}${DATEVAR}"
-              REPORT="${TITLE}\r\nLink to run - https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\r\n" 
-              RUN_URL="https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
-              REPORT="${REPORT}\r\n"
-              if [ ${{needs.az-login-test-non-oidc.result}} == 'success' ]; then REPORT="${REPORT}\r\n|✅|<${RUN_URL}|az-login-test-non-oidc>"; else REPORT="${REPORT}\r\n|❌|<${RUN_URL}|az-login-test-non-oidc>"; fi
-              if [ ${{needs.az-login-test-oidc.result}} == 'success' ]; then REPORT="${REPORT}\r\n|✅|<${RUN_URL}|az-login-test-oidc>"; else REPORT="${REPORT}\r\n|❌|<${RUN_URL}|az-login-test-oidc>"; fi
-              echo "report=$REPORT" >> $GITHUB_OUTPUT
-
-          - name: Post to slack
-            shell: bash
-            run: curl -X POST -H 'Content-type:application/json' --data '{"blocks":[{"type":"section","text":{"type":"mrkdwn","text":"${{steps.slack_report.outputs.report}}"}}]}' https://hooks.slack.com/services/${{SECRETS.SLACK_CHANNEL_SECRET}}

From 9f30a5155eb31f3a13e182e79a0693874bc2c7b5 Mon Sep 17 00:00:00 2001
From: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Date: Thu, 13 Aug 2026 07:21:07 +0100
Subject: [PATCH 3/6] Remove redundant pr-check workflow

pr-check.yml duplicated ci.yml's build+test (ci.yml already runs on master
PRs across windows and ubuntu). Removing the redundant workflow.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/azure-login-pr-check.yml | 31 ----------------------
 1 file changed, 31 deletions(-)
 delete mode 100644 .github/workflows/azure-login-pr-check.yml

diff --git a/.github/workflows/azure-login-pr-check.yml b/.github/workflows/azure-login-pr-check.yml
deleted file mode 100644
index b0cf457b9..000000000
--- a/.github/workflows/azure-login-pr-check.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-name: pr-check
-
-on:
-  pull_request:
-    branches:
-      - master
-      - 'releases/*'
-jobs:
-   az-login-test:
-     runs-on: windows-latest
-     steps:
-       - name: Checkout from PR branch  
-         uses: actions/checkout@v6
-         with: 
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          ref: ${{ github.event.pull_request.head.ref }}
-
-         # Using 24.x version as an example
-       - name: Set Node.js 24.x for GitHub Action
-         uses: actions/setup-node@v6
-         with:
-           node-version: 24.x
-
-       - name: installing node_modules
-         run: npm install 
-
-       - name: Build GitHub Action
-         run: npm run build
-         
-       - name: Run mock test
-         run: npm run test

From f52c7ba4f6839e66f3b0b8769b51b82ef9a62820 Mon Sep 17 00:00:00 2001
From: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Date: Thu, 13 Aug 2026 07:30:00 +0100
Subject: [PATCH 4/6] Run positive/negative live tests on pull requests instead
 of every push

These suites perform real Azure logins. Triggering on every push to any
branch ran the full matrix (and consumed live credentials) for incidental
commits. Switch to pull_request targeting master, keeping workflow_dispatch
for manual runs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/azure-login-negative.yml | 4 +++-
 .github/workflows/azure-login-positive.yml | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/azure-login-negative.yml b/.github/workflows/azure-login-negative.yml
index 37c39faed..94f9ca2c0 100644
--- a/.github/workflows/azure-login-negative.yml
+++ b/.github/workflows/azure-login-negative.yml
@@ -1,7 +1,9 @@
 name: Azure Login Action Negative Test
 on:
   workflow_dispatch:
-  push:
+  pull_request:
+    branches:
+      - master
 
 permissions:
   id-token: write
diff --git a/.github/workflows/azure-login-positive.yml b/.github/workflows/azure-login-positive.yml
index 340d3b828..217d8348a 100644
--- a/.github/workflows/azure-login-positive.yml
+++ b/.github/workflows/azure-login-positive.yml
@@ -1,7 +1,9 @@
 name: Azure Login Action Positive Test
 on:
   workflow_dispatch:
-  push:
+  pull_request:
+    branches:
+      - master
 
 permissions:
   id-token: write

From 197e28978e7f3e8224d1e5f7b109a459dbda5805 Mon Sep 17 00:00:00 2001
From: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Date: Fri, 14 Aug 2026 17:23:33 +1000
Subject: [PATCH 5/6] Self-provision RG for live login tests; drop VM
 assertions

- positive/negative: add setup/teardown jobs that create and delete
  GitHubAction_CI_Group via azure/login@v3 (stable), gated on all jobs
- drop az vm list / Get-AzVM assertions (no VM is provisioned)
- negative permission tests keep targeting the never-created
  GitHubAction_CI_RG so they fail as expected
- shared concurrency group so positive/negative don't collide on the RG
---
 .github/workflows/azure-login-negative.yml | 60 ++++++++++++++++++----
 .github/workflows/azure-login-positive.yml | 58 +++++++++++++++++----
 2 files changed, 96 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/azure-login-negative.yml b/.github/workflows/azure-login-negative.yml
index 94f9ca2c0..ca5e8ddc4 100644
--- a/.github/workflows/azure-login-negative.yml
+++ b/.github/workflows/azure-login-negative.yml
@@ -9,9 +9,37 @@ permissions:
   id-token: write
   contents: read
 
+# Positive and negative live tests share the same resource group name, so
+# serialize them across workflows to avoid one run tearing down another's group.
+concurrency:
+  group: azure-login-live-tests
+  cancel-in-progress: false
+
+env:
+  # Created in setup; the embedded "can access" assertions target this group.
+  RG_POSITIVE: GitHubAction_CI_Group
+  LOCATION: eastus
+  # Intentionally NEVER created: the permission/not-found assertions target this
+  # name so they fail as expected (the test SP would otherwise have access).
+  RG_NEGATIVE: GitHubAction_CI_RG
+
 jobs:
 
+  # Provision the resource group the embedded "can access" assertions target,
+  # using the stable released action. Torn down in teardown.
+  setup:
+    runs-on: ubuntu-latest
+    environment: Automation test
+    steps:
+    - name: Azure login (provisioning)
+      uses: azure/login@v3
+      with:
+        creds: ${{ secrets.SP1 }}
+    - name: Create resource group
+      run: az group create --name "$RG_POSITIVE" --location "$LOCATION" --output none
+
   PermissionTest:
+    needs: setup
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest]
@@ -48,7 +76,6 @@ jobs:
       run: |
         az account show --output none
         az group show --name GitHubAction_CI_RG --output none
-        az vm list --output none
 
     - name: Check Last step failed
       if: steps.cli_3.outcome == 'success'
@@ -66,7 +93,6 @@ jobs:
         inlineScript: |
           (Get-AzContext).Environment.Name -eq 'AzureCloud'
           (Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG'
-          (Get-AzVM).Count -gt 0
 
     - name: Check Last step failed
       if: steps.ps_3.outcome == 'success'
@@ -76,6 +102,7 @@ jobs:
             core.setFailed('Last action should fail but not. Please check it.')
 
   ParameterTest:
+    needs: setup
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest]
@@ -182,8 +209,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_RG --output none
-        az vm list --output none
+        az group show --name GitHubAction_CI_Group --output none
 
     - name: Run Azure PowerShell
       id: ps_8
@@ -193,8 +219,7 @@ jobs:
         azPSVersion: "latest"
         inlineScript: |
           (Get-AzContext).Environment.Name -eq 'AzureCloud'
-          (Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG'
-          (Get-AzVM).Count -gt 0
+          (Get-AzResourceGroup -Name GitHubAction_CI_Group).ResourceGroupName -eq 'GitHubAction_CI_Group'
 
     - name: Check Last step failed
       if: steps.ps_8.outcome == 'success'
@@ -212,8 +237,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_RG --output none
-        az vm list --output none
+        az group show --name GitHubAction_CI_Group --output none
 
     - name: Run Azure PowerShell
       id: ps_9
@@ -223,8 +247,7 @@ jobs:
         azPSVersion: "latest"
         inlineScript: |
           (Get-AzContext).Environment.Name -eq 'AzureCloud'
-          (Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG'
-          (Get-AzVM).Count -gt 0
+          (Get-AzResourceGroup -Name GitHubAction_CI_Group).ResourceGroupName -eq 'GitHubAction_CI_Group'
 
     - name: Check Last step failed
       if: steps.ps_9.outcome == 'success'
@@ -334,4 +357,19 @@ jobs:
       uses: actions/github-script@v7
       with:
           script: |
-            core.setFailed('Last action should fail but not. Please check it.')
+            core.setFailed('Last action should fail but not. Please check it.')
+
+  # Always remove the resource group created in setup, even on failure, so
+  # nothing is left running (cost) between the infrequent live-test runs.
+  teardown:
+    needs: [setup, PermissionTest, ParameterTest]
+    if: always()
+    runs-on: ubuntu-latest
+    environment: Automation test
+    steps:
+    - name: Azure login (provisioning)
+      uses: azure/login@v3
+      with:
+        creds: ${{ secrets.SP1 }}
+    - name: Delete resource group
+      run: az group delete --name "$RG_POSITIVE" --yes --no-wait || true
diff --git a/.github/workflows/azure-login-positive.yml b/.github/workflows/azure-login-positive.yml
index 217d8348a..c76acc682 100644
--- a/.github/workflows/azure-login-positive.yml
+++ b/.github/workflows/azure-login-positive.yml
@@ -9,9 +9,33 @@ permissions:
   id-token: write
   contents: read
 
+# Positive and negative live tests share the same resource group name, so
+# serialize them across workflows to avoid one run tearing down another's group.
+concurrency:
+  group: azure-login-live-tests
+  cancel-in-progress: false
+
+env:
+  RG_POSITIVE: GitHubAction_CI_Group
+  LOCATION: eastus
+
 jobs:
 
+  # Provision the resource group the "can access" assertions target, using the
+  # stable released action (not the code under test). Torn down in teardown.
+  setup:
+    runs-on: ubuntu-latest
+    environment: Automation test
+    steps:
+    - name: Azure login (provisioning)
+      uses: azure/login@v3
+      with:
+        creds: ${{ secrets.SP1 }}
+    - name: Create resource group
+      run: az group create --name "$RG_POSITIVE" --location "$LOCATION" --output none
+
   BasicTest:
+    needs: setup
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
@@ -45,8 +69,7 @@ jobs:
     - name: Run Azure Cli
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_RG --output none
-        az vm list --output none
+        az group show --name GitHubAction_CI_Group --output none
 
     - name: Run Azure PowerShell
       uses: azure/powershell@v3
@@ -90,8 +113,7 @@ jobs:
     - name: Run Azure Cli
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_RG --output none
-        az vm list --output none
+        az group show --name GitHubAction_CI_Group --output none
 
     - name: Run Azure PowerShell
       uses: azure/powershell@v3
@@ -104,6 +126,7 @@ jobs:
             }
 
   ParameterTest:
+    needs: setup
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
@@ -133,8 +156,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_RG --output none
-        az vm list --output none
+        az group show --name GitHubAction_CI_Group --output none
 
     - name: Login with creds, wrong boolean value
       uses: ./
@@ -145,8 +167,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_RG --output none
-        az vm list --output none
+        az group show --name GitHubAction_CI_Group --output none
 
     - name: Login with creds, allow no subscription
       uses: ./
@@ -158,8 +179,7 @@ jobs:
     - name: Run Azure Cli
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_RG --output none
-        az vm list --output none
+        az group show --name GitHubAction_CI_Group --output none
  
     - name: Run Azure PowerShell
       uses: azure/powershell@v3
@@ -242,6 +262,7 @@ jobs:
             }
 
   InDockerTest:
+    needs: setup
     runs-on: ubuntu-latest
     container: ubuntu:24.04
     environment: Automation test
@@ -315,4 +336,19 @@ jobs:
       with:
         azPSVersion: "latest"
         inlineScript: |
-          $checkResult = Get-AzResourceGroup
+          $checkResult = Get-AzResourceGroup
+
+  # Always remove the resource group created in setup, even on failure, so
+  # nothing is left running (cost) between the infrequent live-test runs.
+  teardown:
+    needs: [setup, BasicTest, ParameterTest, InDockerTest]
+    if: always()
+    runs-on: ubuntu-latest
+    environment: Automation test
+    steps:
+    - name: Azure login (provisioning)
+      uses: azure/login@v3
+      with:
+        creds: ${{ secrets.SP1 }}
+    - name: Delete resource group
+      run: az group delete --name "$RG_POSITIVE" --yes --no-wait || true

From 83104e6014f4222df5a71b9c1fb204ebf35dc8c1 Mon Sep 17 00:00:00 2001
From: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Date: Fri, 14 Aug 2026 18:06:31 +1000
Subject: [PATCH 6/6] Merge positive/negative live tests into one
 self-provisioning workflow

Replace azure-login-positive.yml and azure-login-negative.yml with a
single azure-login-live-tests.yml. All 49 positive and 45 negative test
steps are preserved unchanged; only structure and provisioning change.
---
 ...egative.yml => azure-login-live-tests.yml} | 353 ++++++++++++++++-
 .github/workflows/azure-login-positive.yml    | 354 ------------------
 2 files changed, 334 insertions(+), 373 deletions(-)
 rename .github/workflows/{azure-login-negative.yml => azure-login-live-tests.yml} (51%)
 delete mode 100644 .github/workflows/azure-login-positive.yml

diff --git a/.github/workflows/azure-login-negative.yml b/.github/workflows/azure-login-live-tests.yml
similarity index 51%
rename from .github/workflows/azure-login-negative.yml
rename to .github/workflows/azure-login-live-tests.yml
index ca5e8ddc4..ec872ff77 100644
--- a/.github/workflows/azure-login-negative.yml
+++ b/.github/workflows/azure-login-live-tests.yml
@@ -1,4 +1,4 @@
-name: Azure Login Action Negative Test
+name: Azure Login Action Live Tests
 on:
   workflow_dispatch:
   pull_request:
@@ -9,38 +9,349 @@ permissions:
   id-token: write
   contents: read
 
-# Positive and negative live tests share the same resource group name, so
-# serialize them across workflows to avoid one run tearing down another's group.
+# One resource group is shared by every job in this run, so serialize runs to
+# avoid one run tearing down another's group.
 concurrency:
   group: azure-login-live-tests
   cancel-in-progress: false
 
 env:
-  # Created in setup; the embedded "can access" assertions target this group.
+  # Created once in setup; the positive and embedded "can access" assertions
+  # target this group.
   RG_POSITIVE: GitHubAction_CI_Group
   LOCATION: eastus
-  # Intentionally NEVER created: the permission/not-found assertions target this
-  # name so they fail as expected (the test SP would otherwise have access).
+  # Intentionally NEVER created: the negative permission/not-found assertions
+  # target this name so they fail as expected.
   RG_NEGATIVE: GitHubAction_CI_RG
 
 jobs:
-
-  # Provision the resource group the embedded "can access" assertions target,
-  # using the stable released action. Torn down in teardown.
+  # ---------------------------------------------------------------- setup
+  # Provision the resource group the "can access" assertions target. Uses a
+  # repo-level provisioning credential (PROVISION_CREDS) and does NOT declare an
+  # environment, so it is not subject to the Automation test approval gate -
+  # setup/teardown are provisioning, not part of the gated test surface.
   setup:
     runs-on: ubuntu-latest
-    environment: Automation test
     steps:
     - name: Azure login (provisioning)
       uses: azure/login@v3
       with:
-        creds: ${{ secrets.SP1 }}
+        creds: ${{ secrets.PROVISION_CREDS }}
     - name: Create resource group
       run: az group create --name "$RG_POSITIVE" --location "$LOCATION" --output none
 
-  PermissionTest:
+  # ================================================================ POSITIVE
+  Positive_BasicTest:
     needs: setup
     strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    environment: Automation test
+
+    steps:
+    - name: 'Checking out repo code'
+      uses: actions/checkout@v6
+
+    - name: Set Node.js 24.x for GitHub Action
+      uses: actions/setup-node@v6
+      with:
+        node-version: 24.x
+
+    - name: 'Validate build'
+      run: |
+        npm install
+        npm run build
+
+    - name: 'Run L0 tests'
+      run: |
+        npm run test
+
+    - name: Login with creds
+      uses: ./
+      with:
+        creds: ${{secrets.SP1}}
+        enable-AzPSSession: true
+
+    - name: Run Azure Cli
+      run: |
+        az account show --output none
+        az group show --name GitHubAction_CI_Group --output none
+
+    - name: Run Azure PowerShell
+      uses: azure/powershell@v3
+      with:
+        azPSVersion: "latest"
+        inlineScript: |
+            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
+            if(-not $checkResult){
+                throw "Not all checks passed!"
+            }
+
+    - name: Login with individual parameters
+      uses: ./
+      with:
+        client-id: ${{ secrets.SP1_CLIENT_ID }}
+        tenant-id: ${{ secrets.SP1_TENANT_ID }}
+        subscription-id: ${{ secrets.SP1_SUBSCRIPTION_ID }}
+        enable-AzPSSession: true
+
+    - name: Run Azure Cli again
+      run: |
+        az account show --output none
+
+    - name: Run Azure PowerShell again
+      uses: azure/powershell@v3
+      with:
+        azPSVersion: "latest"
+        inlineScript: |
+            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
+            if(-not $checkResult){
+                throw "Not all checks passed!"
+            }
+
+    - name: Login with explicit auth-type
+      uses: ./
+      with:
+        creds: ${{secrets.SP1}}
+        auth-type: SERVICE_PRINCIPAL
+        enable-AzPSSession: true
+
+    - name: Run Azure Cli
+      run: |
+        az account show --output none
+        az group show --name GitHubAction_CI_Group --output none
+
+    - name: Run Azure PowerShell
+      uses: azure/powershell@v3
+      with:
+        azPSVersion: "latest"
+        inlineScript: |
+            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
+            if(-not $checkResult){
+                throw "Not all checks passed!"
+            }
+
+  Positive_ParameterTest:
+    needs: setup
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    environment: Automation test
+
+    steps:
+    - name: 'Checking out repo code'
+      uses: actions/checkout@v6
+
+    - name: Set Node.js 24.x for GitHub Action
+      uses: actions/setup-node@v6
+      with:
+        node-version: 24.x
+
+    - name: 'Validate build'
+      run: |
+        npm install
+        npm run build
+
+    - name: Login with creds, disable ps session
+      uses: ./
+      with:
+        creds: ${{secrets.SP1}}
+        enable-AzPSSession: false
+
+    - name: Run Azure Cli 
+      run: |
+        az account show --output none
+        az group show --name GitHubAction_CI_Group --output none
+
+    - name: Login with creds, wrong boolean value
+      uses: ./
+      with:
+        creds: ${{secrets.SP1}}
+        enable-AzPSSession: notboolean
+
+    - name: Run Azure Cli 
+      run: |
+        az account show --output none
+        az group show --name GitHubAction_CI_Group --output none
+
+    - name: Login with creds, allow no subscription
+      uses: ./
+      with:
+        creds: ${{secrets.SP1}}
+        allow-no-subscriptions: true
+        enable-AzPSSession: true
+
+    - name: Run Azure Cli
+      run: |
+        az account show --output none
+        az group show --name GitHubAction_CI_Group --output none
+ 
+    - name: Run Azure PowerShell
+      uses: azure/powershell@v3
+      with:
+        azPSVersion: "latest"
+        inlineScript: |
+            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
+            if(-not $checkResult){
+                throw "Not all checks passed!"
+            }
+
+    - name: Login with individual parameters, allow no subscription
+      uses: ./
+      with:
+        client-id: ${{ secrets.SP1_CLIENT_ID }}
+        tenant-id: ${{ secrets.SP1_TENANT_ID}}
+        subscription-id: ${{ secrets.SP1_SUBSCRIPTION_ID }}
+        allow-no-subscriptions: true
+        enable-AzPSSession: true
+
+    - name: Run Azure Cli again
+      run: |
+        az account show --output none
+
+    - name: Run Azure PowerShell again
+      uses: azure/powershell@v3
+      with:
+        azPSVersion: "latest"
+        inlineScript: |
+            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
+            if(-not $checkResult){
+                throw "Not all checks passed!"
+            }
+
+    - name: Login with individual parameters, no subscription, allow no subscription
+      uses: ./
+      with:
+        client-id: ${{ secrets.OIDC_SP2_CLIENT_ID }}
+        tenant-id: ${{ secrets.OIDC_SP2_TENANT_ID }}
+        allow-no-subscriptions: true
+        enable-AzPSSession: true
+
+    - name: Run Azure Cli
+      shell: pwsh
+      run: |
+        $checkResult = (az account list --output json | ConvertFrom-Json).Count -eq 2
+        if(-not $checkResult){
+            throw "Not all checks passed!"
+        }
+
+    - name: Run Azure PowerShell
+      uses: azure/powershell@v3
+      with:
+        azPSVersion: "latest"
+        inlineScript: |
+            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
+            if(-not $checkResult){
+              throw "Not all checks passed!"
+            }
+
+    - name: Login with creds, no subscription, allow no subscription
+      uses: ./
+      with:
+        creds: '{"clientId":"${{ secrets.OIDC_SP2_CLIENT_ID }}","clientSecret":"${{ secrets.SP2_CLIENT_SECRET }}","tenantId":"${{ secrets.OIDC_SP2_TENANT_ID }}"}'
+        allow-no-subscriptions: true
+        enable-AzPSSession: true
+
+    - name: Run Azure Cli
+      run: |
+        az account show --output none
+
+    - name: Run Azure PowerShell
+      uses: azure/powershell@v3
+      with:
+        azPSVersion: "latest"
+        inlineScript: |
+            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
+            if(-not $checkResult){
+                throw "Not all checks passed!"
+            }
+
+  Positive_InDockerTest:
+    needs: setup
+    runs-on: ubuntu-latest
+    container: ubuntu:24.04
+    environment: Automation test
+    steps:
+    - name: 'Checking out repo code'
+      uses: actions/checkout@v6
+
+    - name: Set Node.js 24.x for GitHub Action
+      uses: actions/setup-node@v6
+      with:
+        node-version: 24.x
+      
+    - name: Install Azure CLI
+      run: |
+        apt-get update
+        apt-get install -y curl
+        curl -sL https://aka.ms/InstallAzureCLIDeb | bash
+        
+    - name: Check Azure CLI Version
+      run: |
+        az --version
+
+    - name: Install Powershell
+      run: |
+        apt-get update
+        apt-get install -y wget apt-transport-https software-properties-common
+        wget -q "https://packages.microsoft.com/config/ubuntu/24.04/packages-microsoft-prod.deb"
+        dpkg -i packages-microsoft-prod.deb
+        rm packages-microsoft-prod.deb
+        apt-get update
+        apt-get install -y powershell
+
+    - name: Check Powershell Version
+      shell: pwsh
+      run: |
+        $PSVersionTable
+
+    - name: Install Azure Powershell
+      shell: pwsh
+      run: |
+        Install-Module -Name Az -Repository PSGallery -Force
+
+    - name: Check Azure Powershell Version
+      shell: pwsh
+      run: |
+        Get-Module -ListAvailable Az
+
+    - name: 'Validate build'
+      run: |
+        npm install
+        npm run build
+        
+    - name: 'Run L0 tests'
+      run: |
+        npm run test
+
+    - name: Login with individual parameters
+      uses: ./
+      with:
+        client-id: ${{ secrets.SP1_CLIENT_ID }}
+        tenant-id: ${{ secrets.SP1_TENANT_ID }}
+        subscription-id: ${{ secrets.SP1_SUBSCRIPTION_ID }}
+        enable-AzPSSession: true
+
+    - name: Run Azure Cli again
+      run: |
+        az group list --output none
+
+    - name: Run Azure PowerShell again
+      uses: azure/powershell@v3
+      with:
+        azPSVersion: "latest"
+        inlineScript: |
+          $checkResult = Get-AzResourceGroup
+
+  # ================================================================ NEGATIVE
+  Negative_PermissionTest:
+    needs: setup
+    strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
@@ -101,9 +412,10 @@ jobs:
           script: |
             core.setFailed('Last action should fail but not. Please check it.')
 
-  ParameterTest:
+  Negative_ParameterTest:
     needs: setup
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
@@ -359,17 +671,20 @@ jobs:
           script: |
             core.setFailed('Last action should fail but not. Please check it.')
 
-  # Always remove the resource group created in setup, even on failure, so
-  # nothing is left running (cost) between the infrequent live-test runs.
+  # ---------------------------------------------------------------- teardown
+  # Always delete the resource group created in setup, even if gate jobs failed,
+  # so nothing is left running (cost) between the infrequent runs. Runs
+  # synchronously (no --no-wait) so the group is fully gone before the run ends
+  # and the concurrency lock releases, preventing a delete from a finished run
+  # racing the setup of the next one.
   teardown:
-    needs: [setup, PermissionTest, ParameterTest]
+    needs: [setup, Positive_BasicTest, Positive_ParameterTest, Positive_InDockerTest, Negative_PermissionTest, Negative_ParameterTest]
     if: always()
     runs-on: ubuntu-latest
-    environment: Automation test
     steps:
     - name: Azure login (provisioning)
       uses: azure/login@v3
       with:
-        creds: ${{ secrets.SP1 }}
+        creds: ${{ secrets.PROVISION_CREDS }}
     - name: Delete resource group
-      run: az group delete --name "$RG_POSITIVE" --yes --no-wait || true
+      run: az group delete --name "$RG_POSITIVE" --yes --output none || true
diff --git a/.github/workflows/azure-login-positive.yml b/.github/workflows/azure-login-positive.yml
deleted file mode 100644
index c76acc682..000000000
--- a/.github/workflows/azure-login-positive.yml
+++ /dev/null
@@ -1,354 +0,0 @@
-name: Azure Login Action Positive Test
-on:
-  workflow_dispatch:
-  pull_request:
-    branches:
-      - master
-
-permissions:
-  id-token: write
-  contents: read
-
-# Positive and negative live tests share the same resource group name, so
-# serialize them across workflows to avoid one run tearing down another's group.
-concurrency:
-  group: azure-login-live-tests
-  cancel-in-progress: false
-
-env:
-  RG_POSITIVE: GitHubAction_CI_Group
-  LOCATION: eastus
-
-jobs:
-
-  # Provision the resource group the "can access" assertions target, using the
-  # stable released action (not the code under test). Torn down in teardown.
-  setup:
-    runs-on: ubuntu-latest
-    environment: Automation test
-    steps:
-    - name: Azure login (provisioning)
-      uses: azure/login@v3
-      with:
-        creds: ${{ secrets.SP1 }}
-    - name: Create resource group
-      run: az group create --name "$RG_POSITIVE" --location "$LOCATION" --output none
-
-  BasicTest:
-    needs: setup
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
-    environment: Automation test
-
-    steps:
-    - name: 'Checking out repo code'
-      uses: actions/checkout@v6
-
-    - name: Set Node.js 24.x for GitHub Action
-      uses: actions/setup-node@v6
-      with:
-        node-version: 24.x
-
-    - name: 'Validate build'
-      run: |
-        npm install
-        npm run build
-        
-    - name: 'Run L0 tests'
-      run: |
-        npm run test
-
-    - name: Login with creds
-      uses: ./
-      with:
-        creds: ${{secrets.SP1}}
-        enable-AzPSSession: true
-
-    - name: Run Azure Cli
-      run: |
-        az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
-
-    - name: Run Azure PowerShell
-      uses: azure/powershell@v3
-      with:
-        azPSVersion: "latest"
-        inlineScript: |
-            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            if(-not $checkResult){
-                throw "Not all checks passed!"
-            }
-
-    - name: Login with individual parameters
-      uses: ./
-      with:
-        client-id: ${{ secrets.SP1_CLIENT_ID }}
-        tenant-id: ${{ secrets.SP1_TENANT_ID }}
-        subscription-id: ${{ secrets.SP1_SUBSCRIPTION_ID }}
-        enable-AzPSSession: true
-
-    - name: Run Azure Cli again
-      run: |
-        az account show --output none
-
-    - name: Run Azure PowerShell again
-      uses: azure/powershell@v3
-      with:
-        azPSVersion: "latest"
-        inlineScript: |
-            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            if(-not $checkResult){
-                throw "Not all checks passed!"
-            }
-
-    - name: Login with explicit auth-type
-      uses: ./
-      with:
-        creds: ${{secrets.SP1}}
-        auth-type: SERVICE_PRINCIPAL
-        enable-AzPSSession: true
-
-    - name: Run Azure Cli
-      run: |
-        az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
-
-    - name: Run Azure PowerShell
-      uses: azure/powershell@v3
-      with:
-        azPSVersion: "latest"
-        inlineScript: |
-            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            if(-not $checkResult){
-                throw "Not all checks passed!"
-            }
-
-  ParameterTest:
-    needs: setup
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
-    environment: Automation test
-
-    steps:
-    - name: 'Checking out repo code'
-      uses: actions/checkout@v6
-
-    - name: Set Node.js 24.x for GitHub Action
-      uses: actions/setup-node@v6
-      with:
-        node-version: 24.x
-
-    - name: 'Validate build'
-      run: |
-        npm install
-        npm run build
-
-    - name: Login with creds, disable ps session
-      uses: ./
-      with:
-        creds: ${{secrets.SP1}}
-        enable-AzPSSession: false
-
-    - name: Run Azure Cli 
-      run: |
-        az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
-
-    - name: Login with creds, wrong boolean value
-      uses: ./
-      with:
-        creds: ${{secrets.SP1}}
-        enable-AzPSSession: notboolean
-
-    - name: Run Azure Cli 
-      run: |
-        az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
-
-    - name: Login with creds, allow no subscription
-      uses: ./
-      with:
-        creds: ${{secrets.SP1}}
-        allow-no-subscriptions: true
-        enable-AzPSSession: true
-
-    - name: Run Azure Cli
-      run: |
-        az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
- 
-    - name: Run Azure PowerShell
-      uses: azure/powershell@v3
-      with:
-        azPSVersion: "latest"
-        inlineScript: |
-            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            if(-not $checkResult){
-                throw "Not all checks passed!"
-            }
-
-    - name: Login with individual parameters, allow no subscription
-      uses: ./
-      with:
-        client-id: ${{ secrets.SP1_CLIENT_ID }}
-        tenant-id: ${{ secrets.SP1_TENANT_ID}}
-        subscription-id: ${{ secrets.SP1_SUBSCRIPTION_ID }}
-        allow-no-subscriptions: true
-        enable-AzPSSession: true
-
-    - name: Run Azure Cli again
-      run: |
-        az account show --output none
-
-    - name: Run Azure PowerShell again
-      uses: azure/powershell@v3
-      with:
-        azPSVersion: "latest"
-        inlineScript: |
-            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            if(-not $checkResult){
-                throw "Not all checks passed!"
-            }
-
-    - name: Login with individual parameters, no subscription, allow no subscription
-      uses: ./
-      with:
-        client-id: ${{ secrets.OIDC_SP2_CLIENT_ID }}
-        tenant-id: ${{ secrets.OIDC_SP2_TENANT_ID }}
-        allow-no-subscriptions: true
-        enable-AzPSSession: true
-
-    - name: Run Azure Cli
-      shell: pwsh
-      run: |
-        $checkResult = (az account list --output json | ConvertFrom-Json).Count -eq 2
-        if(-not $checkResult){
-            throw "Not all checks passed!"
-        }
-
-    - name: Run Azure PowerShell
-      uses: azure/powershell@v3
-      with:
-        azPSVersion: "latest"
-        inlineScript: |
-            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            if(-not $checkResult){
-              throw "Not all checks passed!"
-            }
-
-    - name: Login with creds, no subscription, allow no subscription
-      uses: ./
-      with:
-        creds: '{"clientId":"${{ secrets.OIDC_SP2_CLIENT_ID }}","clientSecret":"${{ secrets.SP2_CLIENT_SECRET }}","tenantId":"${{ secrets.OIDC_SP2_TENANT_ID }}"}'
-        allow-no-subscriptions: true
-        enable-AzPSSession: true
-
-    - name: Run Azure Cli
-      run: |
-        az account show --output none
-
-    - name: Run Azure PowerShell
-      uses: azure/powershell@v3
-      with:
-        azPSVersion: "latest"
-        inlineScript: |
-            $checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
-            if(-not $checkResult){
-                throw "Not all checks passed!"
-            }
-
-  InDockerTest:
-    needs: setup
-    runs-on: ubuntu-latest
-    container: ubuntu:24.04
-    environment: Automation test
-    steps:
-    - name: 'Checking out repo code'
-      uses: actions/checkout@v6
-
-    - name: Set Node.js 24.x for GitHub Action
-      uses: actions/setup-node@v6
-      with:
-        node-version: 24.x
-      
-    - name: Install Azure CLI
-      run: |
-        apt-get update
-        apt-get install -y curl
-        curl -sL https://aka.ms/InstallAzureCLIDeb | bash
-        
-    - name: Check Azure CLI Version
-      run: |
-        az --version
-
-    - name: Install Powershell
-      run: |
-        apt-get update
-        apt-get install -y wget apt-transport-https software-properties-common
-        wget -q "https://packages.microsoft.com/config/ubuntu/24.04/packages-microsoft-prod.deb"
-        dpkg -i packages-microsoft-prod.deb
-        rm packages-microsoft-prod.deb
-        apt-get update
-        apt-get install -y powershell
-
-    - name: Check Powershell Version
-      shell: pwsh
-      run: |
-        $PSVersionTable
-
-    - name: Install Azure Powershell
-      shell: pwsh
-      run: |
-        Install-Module -Name Az -Repository PSGallery -Force
-
-    - name: Check Azure Powershell Version
-      shell: pwsh
-      run: |
-        Get-Module -ListAvailable Az
-
-    - name: 'Validate build'
-      run: |
-        npm install
-        npm run build
-        
-    - name: 'Run L0 tests'
-      run: |
-        npm run test
-
-    - name: Login with individual parameters
-      uses: ./
-      with:
-        client-id: ${{ secrets.SP1_CLIENT_ID }}
-        tenant-id: ${{ secrets.SP1_TENANT_ID }}
-        subscription-id: ${{ secrets.SP1_SUBSCRIPTION_ID }}
-        enable-AzPSSession: true
-
-    - name: Run Azure Cli again
-      run: |
-        az group list --output none
-
-    - name: Run Azure PowerShell again
-      uses: azure/powershell@v3
-      with:
-        azPSVersion: "latest"
-        inlineScript: |
-          $checkResult = Get-AzResourceGroup
-
-  # Always remove the resource group created in setup, even on failure, so
-  # nothing is left running (cost) between the infrequent live-test runs.
-  teardown:
-    needs: [setup, BasicTest, ParameterTest, InDockerTest]
-    if: always()
-    runs-on: ubuntu-latest
-    environment: Automation test
-    steps:
-    - name: Azure login (provisioning)
-      uses: azure/login@v3
-      with:
-        creds: ${{ secrets.SP1 }}
-    - name: Delete resource group
-      run: az group delete --name "$RG_POSITIVE" --yes --no-wait || true