[Issue] AZURE_CREDENTIALS not set in new Github workflow, login fails

[pamelafox]

• Make sure you've installed the latest version using instructions in the wiki

Output from azd version

Whatever's in mcr.microsoft.com/azure-dev-cli-apps:latest

Output from az version

N/A

Describe the bug

I updated my Github workflow to use the new login scheme, re-ran azd pipeline config locally on the very latest azd (azd version 0.5.0-beta.3), and pushed the Github secrets.
Unfortunately, the azd provision stage is ending in:

ERROR: loading environment: initializing environment: reading subscription id: no default response for prompt 'Please select an Azure Subscription to use:'

You can see the full output here, I even added --debug flag to help:
https://github.com/pamelafox/msdocs-django-postgresql-sample-app-azd/actions/runs/3925438619/jobs/6710359802

To Reproduce

• git clone https://github.com/pamelafox/msdocs-django-postgresql-sample-app-azd/
• Run azd pipeline config
• Watch results of Github action

Expected behavior

I expected a successful deploy. I ported a very similar repo today as well (https://github.com/pamelafox/msdocs-flask-postgresql-sample-app-azd), and its workflows are fine, which is why I'm really flummoxed by this issue.

[pamelafox]

Update: I looked through the azd code and have a better understanding of the issue. I was getting an error on azd provision in this repo because my repo had an old AZURE_CREDENTIALS secret that didn't match the other env variables. Once I delete that secret, I get an earlier error on the login stage:

Run $info = $Env:AZURE_CREDENTIALS | ConvertFrom-Json -AsHashtable;
  $info = $Env:AZURE_CREDENTIALS | ConvertFrom-Json -AsHashtable;
  Write-Host "::add-mask::$($info.clientSecret)"
  
  azd login `
    --client-id "$($info.clientId)" `
    --client-secret "$($info.clientSecret)" `
    --tenant-id "$($info.tenantId)"
  shell: pwsh -command ". '{0}'"
  env:
    AZURE_CREDENTIALS: 
Warning: Can't add secret mask for empty string in ##[add-mask] command.
Error: flag needs an argument: --tenant-id

That's because there is no AZURE_CREDENTIALS secret, and that's because Github pipeline config defaults to FCIS:

#1086

Is there guidance on how to update workflow for fcis? The latest release notes recommend an incompatible login flow:

- name: Log in with Azure
  run: |
    $info = $Env:AZURE_CREDENTIALS | ConvertFrom-Json -AsHashtable;
    Write-Host "::add-mask::$($info.clientSecret)"

    azd login `
      --client-id "$($info.clientId)" `
      --client-secret "$($info.clientSecret)" `
      --tenant-id "$($info.tenantId)"
  shell: pwsh
  env:
    AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}

[pamelafox]

Ah I see the official samples use a more complex workflow than whats suggested in the release notes, to account for both auth types:
https://github.com/Azure-Samples/todo-python-mongo-aca/blob/main/.github/workflows/azure-dev.yml

      - name: Log in with Azure (Federated Credentials)
        if: ${{ env.AZURE_CLIENT_ID != '' }}
        run: |
          azd login `
            --client-id "$Env:AZURE_CLIENT_ID" `
            --federated-credential-provider "github" `
            --tenant-id "$Env:AZURE_TENANT_ID"
        shell: pwsh

      - name: Log in with Azure (Client Credentials)
        if: ${{ env.AZURE_CREDENTIALS != '' }}
        run: |
          $info = $Env:AZURE_CREDENTIALS | ConvertFrom-Json -AsHashtable;
          Write-Host "::add-mask::$($info.clientSecret)"
          azd login `
            --client-id "$($info.clientId)" `
            --client-secret "$($info.clientSecret)" `
            --tenant-id "$($info.tenantId)"
        shell: pwsh
        env:
          AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}

Can someone update the release notes, please?

This appears to be the full diff needed:

Azure-Samples/todo-python-mongo-aca@5381c01#diff-b0a856ddf67919f52d7a1db1bc5c4edf96e59c4761717ca93aeb11239456c2d7

[rajeshkamal5050]

@wbreza can you take a look and update release notes as needed?

[wbreza]

Updated release notes with instructions on the required updates for your github workflow depending whether you are using Client Credentials or Federated Credentials