Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: tamirkamara

.github/workflows/deploy_tre_reusable.yml

@@ -185,6 +185,15 @@ jobs:
           if [ "${{ secrets.TRE_ID }}" == '' ]; then
             echo "Missing secret: TRE_ID" && exit 1
           fi
+          if [ "${{ secrets.AZURE_CLIENT_ID }}" == '' ]; then
+            echo "Missing secret: AZURE_CLIENT_ID" && exit 1
+          fi
+          if [ "${{ secrets.AZURE_TENANT_ID }}" == '' ]; then
+            echo "Missing secret: AZURE_TENANT_ID" && exit 1
+          fi
+          if [ "${{ secrets.AZURE_SUBSCRIPTION_ID }}" == '' ]; then
+            echo "Missing secret: AZURE_SUBSCRIPTION_ID" && exit 1
+          fi
 
           if [ "${{ inputs.DEVCONTAINER_TAG }}" == '' ]; then
             echo "Missing input: DEVCONTAINER_TAG" && exit 1

.github/workflows/lets_encrypt.yml

@@ -66,7 +66,7 @@ jobs:
           ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          AZURE_ENVIRONMENT: ${{ vars.AZURE_ENVIRONMENT }}
+          AZURE_ENVIRONMENT: ${{ (vars.AZURE_ENVIRONMENT != '' && vars.AZURE_ENVIRONMENT) || 'AzureCloud' }}
           TRE_ID: ${{ secrets.TRE_ID }}
           TF_VAR_terraform_state_container_name: ${{ secrets.TERRAFORM_STATE_CONTAINER_NAME || 'tfstate' }}
           TF_VAR_mgmt_resource_group_name: ${{ secrets.MGMT_RESOURCE_GROUP_NAME }}

devops/scripts/bootstrap_azure_env.sh

@@ -67,8 +67,10 @@ set_account_context() {
 
   export ARM_STORAGE_USE_AZUREAD=true
   export ARM_USE_AZUREAD=true
-  # We have to use AZCLI auth in Terraform because with Github Actions
-  # federated-id won't work in the devcontainer passed 5 mins.
+  # Force Terraform to use Azure CLI authentication. GitHub Actions OIDC
+  # (federated) tokens are short-lived and are not reliably available inside
+  # the devcontainer after their initial lifetime, which can cause Terraform
+  # authentication to fail. Using ARM_USE_CLI=true avoids this issue.
   export ARM_USE_CLI=true
 
   echo -e "\e[34m»»» 🔨 \e[96mAzure details from logged on user \e[0m"