Fix Azure scope construction for v20250801preview API

[Copilot]

Description

The v20250801preview API's Azure provider configuration uses separate subscriptionId and resourceGroupName fields. The config loader was passing only the raw subscription ID as the scope, causing recipe context parsing to fail with "not a valid resource id".

Changes

Core Fix (pkg/recipes/configloader/environment.go)

• Construct full Azure resource ID path in getConfigurationV20250801():

  scope := "/subscriptions/" + subscriptionId
  if resourceGroupName != "" {
      scope += "/resourceGroups/" + resourceGroupName
  }

Test Coverage

• Added test for subscription + resource group: /subscriptions/{id}/resourceGroups/{name}
• Added test for subscription only: /subscriptions/{id}
• Added integration tests verifying end-to-end scope parsing in recipe context

Type of change

• This pull request fixes a bug in Radius and has an approved issue (issue link required).

Issue:

Contributor checklist

Please verify that the PR meets the following requirements, where applicable:

• An overview of proposed schema changes is included in a linked GitHub issue.
  • Yes
  • Not applicable
• A design document PR is created in the design-notes repository, if new APIs are being introduced.
  • Yes
  • Not applicable
• The design document has been reviewed and approved by Radius maintainers/approvers.
  • Yes
  • Not applicable
• A PR for the samples repository is created, if existing samples are affected by the changes in this PR.
  • Yes
  • Not applicable
• A PR for the documentation repository is created, if the changes in this PR affect the documentation or any user facing updates are made.
  • Yes
  • Not applicable
• A PR for the recipes repository is created, if existing recipes are affected by the changes in this PR.
  • Yes
  • Not applicable

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Bug in Environment config loader for new v20250801preview API</issue_title>
<issue_description>### Steps to reproduce

1. Create an environment using Radius.Core/environments@2025-08-01-preview:

   {
     "properties": {
       "providers": {
         "azure": {
           "subscriptionId": "85716382-aaaa-aaaa-aaaa-2126e459a123",
           "resourceGroupName": "my-resource-group"
         }
       }
     }
   }

2. Deploy a resource that uses a recipe (e.g., Radius.Compute/containers)

3. Observe the error during recipe execution

Observed behavior

When using Radius.Core/environments@2025-08-01-preview with the new Azure provider configuration (separate subscriptionId and resourceGroupName fields), recipe deployment fails with:

failed to parse Azure scope: "85716382-aaaa-aaaa-aaaa-2126e459a123" while building the recipe context parameter '85716382-aaaa-aaaa-aaaa-2126e459a123' is not a valid resource id

Desired behavior

The scope should be constructed as a full Azure resource ID path:

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}

Workaround

Including some investigation notes:

Root Cause

In pkg/recipes/configloader/environment.go#L148-L175, the getConfigurationV20250801() function incorrectly sets only the SubscriptionId as the Scope:

if envDatamodel.Properties.Providers.Azure != nil {
    config.Providers.Azure = datamodel.ProvidersAzure{
        Scope: envDatamodel.Properties.Providers.Azure.SubscriptionId,  // ❌ Only subscription ID
    }
}

Later, in pkg/recipes/recipecontext/context.go#L62-L87, New() attempts to parse this as a full Azure resource ID:

p, err := resources.ParseScope(providers.Azure.Scope)  // Fails: not a valid resource ID

Suggested Fix

if envDatamodel.Properties.Providers.Azure != nil {
    scope := "/subscriptions/" + envDatamodel.Properties.Providers.Azure.SubscriptionId
    if envDatamodel.Properties.Providers.Azure.ResourceGroupName != "" {
        scope += "/resourceGroups/" + envDatamodel.Properties.Providers.Azure.ResourceGroupName
    }
    config.Providers.Azure = datamodel.ProvidersAzure{
        Scope: scope,
    }
}

rad Version

CLI Version Information:
RELEASE   VERSION   BICEP     COMMIT
0.54.0    v0.54.0   0.39.26   f06410904c8b92bcc3aaa1f1ed6450981e510107

Control Plane Information:
STATUS     VERSION
Installed  0.54.0

• Radius version: (version with Radius.Core v2025-08-01-preview support)
• API version: 2025-08-01-preview

Operating system

No response

Additional context

No response

AB#18064</issue_description>

Comments on the Issue (you are @copilot in this section)

@sylvainsf Auth for Azure and AWS should have a cloud functional test

• Fixes Bug in Environment config loader for new v20250801preview API #11048

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This pull request fixes a bug in the Azure scope construction for the v20250801preview API version. The environment configuration loader was incorrectly passing only the raw subscription ID as the scope instead of constructing a full Azure resource ID path, causing recipe deployment failures.

Changes:

• Fixed Azure scope construction in getConfigurationV20250801() to build proper resource ID paths
• Added comprehensive test coverage for both subscription-only and subscription+resource group scenarios
• Updated existing test to reflect the corrected scope format

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
pkg/recipes/configloader/environment.go	Core fix: constructs full Azure resource ID path (/subscriptions/{id} or /subscriptions/{id}/resourceGroups/{name}) instead of passing raw subscription ID
pkg/recipes/configloader/environment_test.go	Updated test name for clarity and added new test case for subscription+resource group scenario
pkg/recipes/recipecontext/context_test.go	Added integration tests verifying end-to-end scope parsing in recipe context for both scenarios

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	f5dae40
Unique ID	func8868eef8f7
Image tag	pr-func8868eef8f7

• gotestsum 1.13.0
• KinD: v0.29.0
• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-func8868eef8f7
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-func8868eef8f7
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-func8868eef8f7
• controller test image location: ghcr.io/radius-project/dev/controller:pr-func8868eef8f7
• ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-func8868eef8f7
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting corerp-cloud functional tests...
⌛ Starting ucp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded