Azure/login is slow to execute with Hosted Compute Networking
- Dominant language
- TypeScript
- Stars
- 552
- Forks
- 440
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 17
Description
Possibly related to any of these issues (some open, some closed):
https://github.com/Azure/login/issues/456
https://github.com/Azure/login/issues/449
https://github.com/actions/runner-images/issues/10110
--------------------
We're running `Azure/login@v2` on Github-hosted Actions Runners using the Github provided/default Ubuntu 24.04 image.
It seems when using Hosted Compute Networking, the `Azure/login@v2` action takes a long time to complete.
My first theory was "maybe there's an NSG rule doing something weird", but then when I saw just running an `az version` beforehand speeds things up so much, I feel like something else is at play?
Added context:
- for Hosted Compute Networking we're using the default NSG rules listed in here: https://docs.github.com/en/enterprise-cloud@latest/admin/configuring-settings/configuring-private-networking-for-hosted-compute-products/configuring-private-networking-for-github-hosted-runners-in-your-enterprise#prerequisites **The important part: we don't have a "block all Internet" NSG rule**
- we're using `allow-no-subscriptions: true` as this setup is relying on the [Flexible Federated Identity Credentials (Preview)](https://learn.microsoft.com/en-us/entra/workload-id/workload-identities-flexible-federated-identity-credentials?tabs=github) which isn't supported on User-Assigned Managed Identities yet, only App Registrations.
Any additional debugging steps that can be suggested would be appreciated - I can run further tests to try isolate the root cause with maintainer input.
--------------------
Examples:
- just running login, nothing else, 43-49 seconds
- note the `runs-on`


```
on:
push:
branches:
- main
permissions:
id-token: write
jobs:
azure-cli-startup:
runs-on: ubuntu-latest-2core--azure-vnet
steps:
- name: Azure login
uses: Azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
allow-no-subscriptions: true
```
- if we run `az version` before a login, that drops to 7 seconds aggregate, 4 seconds for `az version` and 3 seconds for the login 🤯

```
on:
push:
branches:
- main
permissions:
id-token: write
jobs:
azure-cli-startup:
runs-on: ubuntu-latest-2core--azure-vnet
steps:
- name: Run az version
run: |
az version
- name: Azure login
uses: Azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
allow-no-subscriptions: true
```
- if we run this without Hosted Compute Networking, its a 5 second execution time
- note the `runs-on`

```
on:
push:
branches:
- main
permissions:
id-token: write
jobs:
azure-cli-startup:
runs-on: ubuntu-latest
steps:
- name: Azure login
uses: Azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
allow-no-subscriptions: true
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the Azure/login@v2 workflow examples and compare runs on Hosted Compute Networking versus ubuntu-latest. Reproduce the timing difference with and without a preceding az version command, then use maintainer guidance to collect diagnostics around the login path. Done means isolating the source of the delay and identifying a specific fix or actionable next step.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, github-actions, typescript
- Domain
- authentication, ci-cd, cloud, performance
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100