oidc vars to devcontainer

[tamirkamara]

What is being addressed

We had issues with terraform fails to use oidc outside the 5 min expiration.

How is this addressed

• Pass Github's OIDC vars directly to the devcontainer, and have terraform use it directly.

[tamirkamara]

/test-extended

[github-actions]

Unit Test Results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit c1ead67.

♻️ This comment has been updated with latest results.

[github-actions]

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21862032173 (with refid 8680660d)

(in response to this comment from @tamirkamara)

[tamirkamara]

/test-force-approve
Important tests passed, failures are around destroy and such which are unrelated to this pr.

[github-actions]

🤖 pr-bot 🤖

✅ Marking tests as complete (for commit 122c0f4)

(in response to this comment from @tamirkamara)

[marrobi]

Lets give this a go, hopefully it improves things.

[Copilot]

Pull request overview

This PR aims to improve CI/devcontainer Terraform authentication reliability by passing GitHub Actions OIDC variables into the devcontainer so Terraform can fetch tokens on demand (rather than relying on a short-lived pre-fetched token).

Changes:

• Removes the “write OIDC token to /tmp and mount it” approach from the devcontainer composite action and instead forwards GitHub’s OIDC request env vars.
• Updates the devcontainer run command to set ARM_USE_OIDC=true and pass ACTIONS_ID_TOKEN_REQUEST_* into the container.
• Simplifies bootstrap_azure_env.sh automation login logic and adds a CHANGELOG entry.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
devops/scripts/bootstrap_azure_env.sh	Removes OIDC-based az login in automation and keeps only client-secret login, which impacts CI bootstrap flows.
CHANGELOG.md	Adds an Unreleased entry describing the change.
.github/actions/devcontainer_run_command/action.yml	Switches from mounting a pre-fetched OIDC token file to passing OIDC request env vars + ARM_USE_OIDC into the devcontainer; also mounts $HOME/.azure.

[tamirkamara]

/test

[github-actions]

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/21866719591 (with refid 8680660d)

(in response to this comment from @tamirkamara)

[JC-wk]

makes sense to me