kubectl 1.34 (azure/setup-kubectl@v3) defaults to server-side validation, which tries to reach a kube-apiserver at localhost:8080. CI runners don't have one, so every kubectl apply --dry-run=client invocation in this job exits 1 with "dial tcp [::1]:8080: connect: connection refused".
This failure was masked on main because Prepare all required actions failed first on the broken ludovico85/kube-score-action@v1 pin; once that pin was fixed in the prior commit on this branch, kubectl became reachable and surfaced the next layer of failure. --validate=false disables the API-server roundtrip but keeps client-side YAML parsing, which is the only validation the runner can actually perform without a cluster.
Co-Authored-By: Nakamoto, S <[email protected]>
Devin AIandNakamoto, S <[email protected]>
9b36afb8d9