Add managed Gateway lifecycle for routes

[willdavsmith]

Summary

Add an idempotent, provider-neutral Gateway API lifecycle for repo-driven Radius.Compute/routes deployments. Azure and AWS workflows now detect when the Radius default routes recipe needs shared infrastructure, validate BYO Gateways without adopting them, and otherwise reconcile pinned Contour and Gateway API resources with private ClusterIP exposure by default.

Cleanup runs after successful application deletion, fails closed on discovery uncertainty, and preserves the managed stack while Radius routes or non-Radius Gateway API, Ingress, or Contour consumers remain. Deploy and delete workflows serialize per repository and Radius environment to avoid ensure/deploy/delete races.

Reason for change

Repo Radius deploy workflows must support Radius.Compute/routes without creating a public IP by default while safely sharing target-cluster Gateway infrastructure.

Fixes radius-project/ai-extensions#421.

Companion documentation: radius-project/ai-extensions#570.

How to test

make test-routes-gateway
bash .github/extension/actions/action-shell-syntax_test.sh
bash -n .github/extension/actions/manage-routes-gateway/routes-gateway.sh \
  .github/extension/actions/manage-routes-gateway/routes-gateway_test.sh
shellcheck --rcfile .github/linters/.shellcheckrc \
  .github/extension/actions/manage-routes-gateway/routes-gateway.sh \
  .github/extension/actions/manage-routes-gateway/routes-gateway_test.sh
git diff --check main...HEAD

File change summary

File	Summary of change
.github/extension/actions/manage-routes-gateway/action.yml	Add the provider-neutral ensure/cleanup composite action interface.
.github/extension/actions/manage-routes-gateway/routes-gateway.sh	Implement route and recipe detection, BYO validation, managed private/public reconciliation, readiness checks, ownership, and shared-use-safe cleanup.
.github/extension/actions/manage-routes-gateway/routes-gateway_test.sh	Add hermetic coverage for detection, validation, exposure, lifecycle ownership, failures, cleanup retention, and workflow contracts.
.github/extension/run-rad-commands-azure.yml	Ensure routes Gateway infrastructure after recipe setup and before Azure application deployment, with environment-level concurrency.
.github/extension/run-rad-commands-aws.yml	Use the Radius default routes recipe, ensure Gateway infrastructure before AWS application deployment, and add environment-level concurrency.
.github/extension/delete-azure.yml	Clean up unused routes Gateway infrastructure after successful Azure application deletion and serialize environment operations.
.github/extension/delete-aws.yml	Clean up unused routes Gateway infrastructure after successful AWS application deletion and serialize environment operations.
.github/extension/README.md	Document managed/BYO behavior, private/public exposure, version pins, concurrency, and cleanup semantics.
build/test.mk	Add the routes Gateway hermetic suite to the repository test gate.

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	3aa81af
Unique ID	func3a833e7982
Image tag	pr-func3a833e7982

• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-func3a833e7982
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-func3a833e7982
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-func3a833e7982
• controller test image location: ghcr.io/radius-project/dev/controller:pr-func3a833e7982
• ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-func3a833e7982
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting ucp-cloud functional tests...
⌛ Starting corerp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded

[willdavsmith]

Superseded by radius-project/ai-extensions#672 after the Repo Radius extension workflows and actions moved to ai-extensions.