Add verification workflow for Repo Radius

[sk593]

Description

Lands the Repo Radius verify credential-verification GitHub Actions workflow in this repository, plus a README.md documenting it.

The workflow contract is owned by Radius and consumed by the multi-cluster v1 work (#12106), so it needs a canonical, reviewed home here that any frontend (the Copilot app, the CLI, etc.) can drive.

This PR adds the verify workflow only. The companion deploy workflow and the RADIUS_TARGET_KUBECONFIG / KUBE_CONFIG_PATH integration contract will follow in a later PR.

What's added:

radius-verify-credentials.yml — a workflow_dispatch workflow that, per provider:
Authenticates to Azure/AWS via GitHub OIDC (no long-lived cloud secrets stored).
Verifies access (az account show / aws sts get-caller-identity, with the AWS account ID masked in logs).
Discovers resources (resource groups, AKS/EKS clusters, VPCs, subnets, locations) and uploads them as the radius-discovery artifact for the caller to read back.
Branches by provider so the same file serves Azure-only and AWS-only environments; steps are skipped when a provider's variables are empty.
README.md — documents the workflow's purpose, trigger, inputs, permissions, required GitHub Environment variables, and the cloud-side OIDC trust prerequisites.

Type of change

• This pull request adds or changes features of Radius and has an approved issue Add Repo Radius verify/deploy workflows to the repo #12118

Fixes: #issue_number

Contributor checklist

Please verify that the PR meets the following requirements, where applicable:

• An overview of proposed schema changes is included in a linked GitHub issue.
  • Yes
  • Not applicable
• A design document is added or updated under eng/design-notes/ in this repository, if new APIs are being introduced.
  • Yes
  • Not applicable
• The design document has been reviewed and approved by Radius maintainers/approvers.
  • Yes
  • Not applicable
• A PR for resource-types-contrib is created, if resource types or recipes are affected by the changes in this PR.
  • Yes
  • Not applicable
• A PR for dashboard is created, if the Radius Dashboard is affected by the changes in this PR.
  • Yes
  • Not applicable
• A PR for the documentation repository is created, if the changes in this PR affect the documentation or any user facing updates are made.
  • Yes
  • Not applicable

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 52.88%. Comparing base (7dba961) to head (60d0b77).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #12170      +/-   ##
==========================================
- Coverage   52.89%   52.88%   -0.01%     
==========================================
  Files         753      753              
  Lines       48550    48550              
==========================================
- Hits        25681    25677       -4     
- Misses      20450    20454       +4     
  Partials     2419     2419              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Unit Tests

    2 files  ±0    451 suites  ±0   7m 22s ⏱️ -13s
5 625 tests ±0  5 623 ✅ ±0  2 💤 ±0  0 ❌ ±0 
6 822 runs  ±0  6 820 ✅ ±0  2 💤 ±0  0 ❌ ±0 

Results for commit 60d0b77. ± Comparison against base commit 7dba961.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

This PR introduces the “Repo Radius” credential verification workflow template (to be copied into and run from target user repositories) plus supporting documentation and an agent skill to drive the environment-setup flow.

Changes:

• Add a workflow_dispatch verification workflow template that authenticates to Azure/AWS via OIDC and uploads discovery data as an artifact.
• Add .github/extension/README.md documenting the workflow’s trigger, permissions, required variables, and cloud-side OIDC prerequisites.
• Add a new radius-environment skill describing the environment setup + verification/discovery flow.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

File	Description
.github/skills/radius-environment/SKILL.md	Adds an environment setup/verification skill (needs a backing contributor doc link per repo conventions).
.github/extension/README.md	Documents how the workflow template is consumed (copied into target repos and dispatched).
.github/extension/radius-verify-credentials.yml	Adds the verification + discovery workflow template (needs action SHA pinning, provider config validation, and less-silent discovery failures).

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	60d0b77
Unique ID	func8b9952be1b
Image tag	pr-func8b9952be1b

• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-func8b9952be1b
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-func8b9952be1b
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-func8b9952be1b
• controller test image location: ghcr.io/radius-project/dev/controller:pr-func8b9952be1b
• ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-func8b9952be1b
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting ucp-cloud functional tests...
⌛ Starting corerp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded