fix(uat): propagate az_federated_relogin step failures

[mchmarny]

Summary

Follow-up to #1722, addressing @yuanchen8911's review comment: az_federated_relogin could report success after a failed refresh. Every mint/login/warm-up step now propagates failure explicitly, and the success message prints only after all steps pass.

Motivation / Context

The helper is invoked as if az_federated_relogin; then …, and Bash suspends errexit inside a function body called in a conditional context. A failed OIDC curl | jq, az login, az account set, or az account get-access-token therefore fell through to the unconditional success echo, whose 0 exit became the function result — the caller advanced last_relogin as if the refresh succeeded, skipped the warning/retry path, and a later AADSTS700024 would surface without the diagnostic this mechanism exists to provide.

Now each step carries || return 1, and the minted token is additionally rejected when empty or the JSON-null string (jq -r .value on an unexpected response shape). pipefail (set script-wide, unaffected by the conditional context) already propagates a curl failure through the jq pipe.

Fixes: N/A
Related: #1722 (review follow-up)

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• Build/CI/tooling

Component(s) Affected

• Other: UAT pipeline (tests/uat/azure/run)

Implementation Notes

Single-function change; the caller's warn-and-retry contract ("the timer only advances on success") is now actually enforced rather than merely documented.

Testing

bash -n tests/uat/azure/run     # clean
shellcheck -x tests/uat/azure/run  # clean

• No Go changes; coverage gate N/A.
• Behavior exercised end-to-end by the next full uat-run dispatch (the gate logs each refresh).

Risk Assessment

• Low — Strictly tightens an error path in a CI helper; the success path is byte-identical.

Checklist

• Tests pass locally (make test with -race) — no Go changes
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality (N/A — CI shell helper)
• I updated docs if user-facing behavior changed (N/A)
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)

[coderabbitai]

📝 Walkthrough

Walkthrough

The az_federated_relogin function now explicitly returns failure when OIDC token minting, token validation, Azure login, subscription selection, or AKS access-token acquisition fails. Empty and null tokens are also rejected.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: propagating failures in az_federated_relogin.
Description check	✅ Passed	The description accurately explains the same failure-propagation fix and its motivation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/uat-azure-relogin-propagation

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/uat/azure/run`:
- Around line 149-167: Add regression tests covering token minting errors, empty
or null OIDC tokens, and failures from az login, az account set, and az account
get-access-token. For each case, assert the re-login helper returns non-zero and
the readiness caller preserves last_relogin. Use the existing test setup and
helper/readiness function symbols to mock command failures and verify these
outcomes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: e7be7b96-2134-4851-b5b6-0e96129aa7cc

📥 Commits

Reviewing files that changed from the base of the PR and between 2f55a40 and bc44273.

📒 Files selected for processing (1)

• tests/uat/azure/run

[yuanchen8911]

Verified the fix: each mint/login/warm-up step now propagates failure via || return 1, and the success message prints only after all steps pass, so the caller's warn-and-retry branch actually runs and last_relogin no longer advances on a failed refresh. Reproduced the set -euo pipefail + if az_federated_relogin conditional-context semantics locally to confirm. The empty/null token guard is a good addition. Thanks for the quick turnaround.

[github-actions]

Coverage Report ✅

Metric	Value
Coverage	78.9%
Threshold	75%
Status	Pass

Coverage Badge

![Coverage](https://img.shields.io/badge/coverage-78.9%25-green)

No Go source files changed in this PR.