test: seed Terraform provider read permission

[Mani Bindra (maniSbindra)]

Summary

Seed Microsoft.Resources/subscriptions/providers/read as a bootstrap permission across the Terraform E2E suite and include it consistently in expected E2E results.

This makes Terraform permission-count assertions independent of whether AzureRM's resource-provider cache request is temporarily authorized by residual RBAC state.

Background

AzureRM 3.x and 4.x can initialize their resource-provider cache by calling:

GET /subscriptions/{subscriptionId}/providers

This maps to:

Microsoft.Resources/subscriptions/providers/read

The call predates #328 and was observed in failures both before and after service-principal rotation. Post-merge runs also showed the permission affecting both the primary and alternate Terraform identities, so workflow spacing and identity rotation do not make the current exact permission counts deterministic.

Changes

• Add a shared Terraform E2E bootstrap-permission helper containing:
  • Microsoft.Resources/deployments/read
  • Microsoft.Resources/deployments/write
  • Microsoft.Resources/subscriptions/providers/read
• Use the shared bootstrap permissions in all 11 active Terraform E2E paths.
• Return independent initial/result slices to avoid accidental shared mutation.
• Update the seven affected numeric result expectations by one.
• Preserve the zero-iteration assertion in TestTerraformACIWithInitialPermissions with all nine permissions supplied initially.
• Add focused unit coverage for helper contents and slice independence.

Scope

This change is intentionally limited to Terraform E2E setup and assertions. It does not change:

• cmd/terraformCmd.go or production MPF output;
• AzureRM provider versions or sample provider configuration;
• ARM or Bicep tests;
• service-principal rotation or workflow orchestration;
• RBAC propagation delays.

Production Terraform runs continue to discover this permission dynamically when the selected AzureRM version and configuration require it. This avoids unconditionally reporting the permission for AzureRM configurations, such as newer 5.x defaults, that may not perform the provider-cache listing.

Validation

• E2E package compile-only validation completed without executing tests.
• Changed files have no IDE diagnostics or formatting errors.
• Full branch E2E workflow is running: 33163652106.

Related issue

References #231.

[Copilot]

Pull request overview

This PR stabilizes the Terraform E2E permission-count assertions by always seeding Microsoft.Resources/subscriptions/providers/read (used by AzureRM 3.x/4.x during provider-cache initialization) into the Terraform E2E bootstrap permissions, ensuring test results don’t depend on residual RBAC state.

Changes:

• Introduces a shared Terraform E2E bootstrap-permissions helper that includes deployments {read,write} plus subscriptions/providers/read, and returns independent slices to avoid shared-mutation bugs.
• Updates Terraform E2E tests to use the helper and adjusts affected expected permission counts (+1).
• Adds focused unit coverage for helper contents and slice independence, and wires that test into the testunit Taskfile target.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
Taskfile.yml	Updates unit-test task to also run the new Terraform bootstrap-permissions unit test.
e2eTests/e2eTerraformWithImportAndTargeting_test.go	Switches to shared bootstrap permissions and updates expected permission counts.
e2eTests/e2eTerraformPermissions_test.go	Adds bootstrap-permissions helper + unit test validating contents and slice independence.
e2eTests/e2eTerraformInvalid_test.go	Switches Terraform invalid-path E2Es to shared bootstrap permissions.
e2eTests/e2eTerraformAuthPermissionMismatch_test.go	Switches to shared bootstrap permissions and updates expected permission count.
e2eTests/e2eTerraformAuthorizationRequestDenied_test.go	Switches to shared bootstrap permissions for the Authorization_RequestDenied E2E.
e2eTests/e2eTerraform_test.go	Switches Terraform E2Es to shared bootstrap permissions and updates expectations/comments for the seeded permission.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.