[Steven Ma (stevenjma)]

Why

The current quickstart E2E workflow runs PR code with repository-owned Azure credentials and cannot run for forks.

This PR changes the model: contributors deploy the sample in their own subscription, record an ARM correlation ID, and a maintainer verifies the resulting ARM activity with /validate.

How it works

1. The contributor deploys one changed quickstart with a new ARM_CORRELATION_REQUEST_ID.
2. metadata.json records the correlation ID and UTC start time.
3. The automatic pre-check validates Terraform and the metadata.
4. A maintainer comments /validate.
5. Trusted code from master queries the three approved regional ARMProd stores.
6. GitHub publishes terraform-deployment-validation on the exact PR commit.

Security boundary

• /validate never executes quickstart code from the PR.
• The OIDC application is read-only, subscriptionless, and has no client secret.
• Correlation values are passed to Kusto as query parameters.
• Validation fails if a regional query fails or telemetry does not stabilize.
• PRs changing the validation contract cannot run /validate; those changes must merge and be canary-tested separately.
• Changes under test/** retain a separate internal E2E workflow. Forks do not receive repository OIDC credentials.

What the check proves

The contributor-supplied correlation ID has:

• at least one completed or ARM-accepted Terraform write; and
• no observed final HTTP write failures.

It does not prove:

• the correlation ID belongs to this PR or applied source;
• terraform apply exited successfully; or
• a 202 Accepted operation eventually provisioned successfully.

These are explicit limits of the good-faith evidence model. Code review and static checks remain required.

Reviewer guide

Area	Files
/validate authorization and trusted checkout	.github/workflows/e2e.yaml
ARMProd query and result handling	.github/scripts/validate-arm-correlation.py
Metadata freshness and format	.github/scripts/validate-quickstart-metadata.py, .github/schemas/quickstart-metadata.schema.json
Automatic PR checks	.github/workflows/pr-check.yaml
Internal test-harness E2E	.github/workflows/e2e-pr.yaml
Contributor flow and limitations	quickstart/CONTRIBUTE.md

Validation completed

• Python validator suites run in the required pre-check.
• Workflow YAML and metadata schema parse successfully.
• Live ARMProd test queried all three regions and returned 14 completed writes, 0 failures.
• ARMProd access was approved under IcM 865765936.
• Deep adversarial review completed; confirmed findings were fixed.

Rollout

issue_comment workflows load from the default branch, so the final canary happens after merge on a fresh single-quickstart PR with valid metadata.

[Steven Ma (stevenjma)]

@microsoft-github-policy-service agree company="Microsoft"

[Chunyan (Vieran)]

Thanks for opening this!

[Steven Ma (stevenjma)]

#sign-off