Categorize managed-identity E2E tests and exclude them from the PR build (#3923)

* Categorize managed-identity E2E tests and exclude them from the PR build

The `AcquireTokenManagedIdentity` E2E test acquires a token for a user-assigned
managed identity via IMDS, so it requires an MI assigned to the build host. It
passes on the official OneBranch pipeline (VM-based agents that have the MI) but
fails on Microsoft-hosted agents (no MI, IMDS returns "Identity not found").

Following the MSAL approach of categorizing MI tests and running them only where
an MI is available:

- Add a shared `TestCategories.ManagedIdentity` ("MI_E2E") constant and tag the
  `AcquireTokenManagedIdentity` class with `[Trait("Category", "MI_E2E")]`.
- Parameterize `template-run-unit-tests.yaml` with `e2eTestFilterCriteria`
  (default empty, so the release build and any other consumer are unaffected).
- The PR build (azure-pipelines.yml) passes `Category!=MI_E2E` to exclude the MI
  tests, which run on Microsoft-hosted agents.

The official OneBranch pipeline uses its own inline VSTest steps and is not
affected, so it continues to run the MI tests on VM-based agents.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Trigger ADO PR pipeline

Empty commit to kick off the newly added ADO PR pipeline trigger.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: iarekk

azure-pipelines.yml

@@ -26,3 +26,8 @@ jobs:
     - template: build/template-install-dependencies.yaml
     - template: build/template-build.yaml
     - template: build/template-run-unit-tests.yaml
+      parameters:
+        # Exclude managed-identity E2E tests: they require an MI assigned to the
+        # host (IMDS), which Microsoft-hosted agents do not have. They still run in
+        # the official OneBranch pipeline on VM-based agents that have the MI.
+        e2eTestFilterCriteria: 'Category!=MI_E2E'

build/template-run-unit-tests.yaml

@@ -1,6 +1,15 @@
 # template-run-unit-tests.yaml
 # Run all unit tests across the IdWeb project
 
+parameters:
+# VSTest filter applied to the E2E test run. Empty by default so every consumer
+# (e.g. the release build) runs the full E2E suite. The PR build passes a filter
+# to exclude tests that cannot run on Microsoft-hosted agents (e.g. managed
+# identity tests, which require an MI assigned to the host: Category!=MI_E2E).
+- name: e2eTestFilterCriteria
+  type: string
+  default: ''
+
 steps:
 
 - task: VSTest@2
@@ -38,6 +47,7 @@ steps:
         tests\E2E Tests\TokenAcquirerTests\bin\**\TokenAcquirerTests.dll
         tests\E2E Tests\NET 7 tests\IntegrationTests\bin\**\IntegrationTests.dll
     searchFolder: '$(System.DefaultWorkingDirectory)'
+    testFiltercriteria: '${{ parameters.e2eTestFilterCriteria }}'
     rerunFailedTests: true
     rerunMaxAttempts: '3'
     runInParallel: false

tests/E2E Tests/TokenAcquirerTests/TokenAcquirer.cs

@@ -551,6 +551,7 @@ private static async Task CreateGraphClientAndAssertAsync(TokenAcquirerFactory t
     }
 
     [Collection(nameof(TokenAcquirerFactorySingletonProtection))]
+    [Trait("Category", TestCategories.ManagedIdentity)]
     public class AcquireTokenManagedIdentity
     {
         [OnlyOnAzureDevopsFact]

tests/Microsoft.Identity.Web.Test.Common/TestCategories.cs

@@ -0,0 +1,21 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+namespace Microsoft.Identity.Web.Test.Common
+{
+    /// <summary>
+    /// Well-known xUnit trait categories (used with <c>[Trait("Category", ...)]</c>)
+    /// so that specific groups of tests can be included or excluded from a test run
+    /// via the VSTest <c>testFilterCriteria</c> (for example <c>Category!=MI_E2E</c>).
+    /// </summary>
+    public static class TestCategories
+    {
+        /// <summary>
+        /// Tests that require a real Azure managed identity to be assigned to the host
+        /// (they call the IMDS endpoint). These pass on the official pipeline, which runs
+        /// on VM-based agents with a managed identity, but cannot run on Microsoft-hosted
+        /// agents that have no managed identity, so they are filtered out there.
+        /// </summary>
+        public const string ManagedIdentity = "MI_E2E";
+    }
+}