fix: reauthenticate before deployment stack retries

[RISHABHJAIN27]

Fixes #4209

Summary

Long-running deployment stack operations can outlive the Azure authentication context established at the start of the deployment workflow. This change refreshes Azure authentication before deployment stack retry attempts using a fresh GitHub OIDC token.

Changes

Workflow Template

Updated:

• alz/github/actions/bicep/templates/workflows/cd-template.yaml

Added:

• AZURE_CLIENT_ID
• AZURE_TENANT_ID

to the deploy job environment so they can be used by the deployment action during retry operations.

Deployment Action

Updated:

• alz/github/actions/bicep/templates/actions/bicep-deploy/action.yaml

Added retry-time reauthentication logic that:

• Validates required OIDC and Azure identity variables are available.
• Requests a fresh GitHub OIDC token.
• Reauthenticates using Connect-AzAccount with federated credentials.
• Continues with the existing Azure context if reauthentication is unavailable or fails.

Validation

• Verified Azure identity variables are propagated from the deploy workflow to the deployment action.
• Verified Azure OIDC re-authentication executes successfully during deployment stack retry attempts.
• Preserved existing retry behavior and retry timing.
  -Existing retry behavior is preserved when re-authentication is not performed.
  `

[Copilot]

Pull request overview

Refreshes Azure authentication before deployment stack retry attempts to avoid failures when long-running deployments outlive the initial Azure OIDC-authenticated session.

Changes:

• Propagates AZURE_CLIENT_ID and AZURE_TENANT_ID into the deploy job environment in the CD workflow template.
• Adds retry-time OIDC token acquisition + Connect-AzAccount reauthentication logic to the bicep deployment composite action.
• Passes AZURE_CLIENT_ID / AZURE_TENANT_ID through the action’s step environment for use during retries.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
alz/github/actions/bicep/templates/workflows/cd-template.yaml	Exposes Azure identity variables to the deploy job environment for downstream action use during retries.
alz/github/actions/bicep/templates/actions/bicep-deploy/action.yaml	Reauthenticates to Azure via fresh GitHub OIDC token on deployment stack retry attempts; forwards Azure identity env vars into the action runtime.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.