Fix health check query not executed

CHANGELOG.md

@@ -8,6 +8,9 @@ ENHANCEMENTS:
 * Pin all GitHub Actions workflow steps to full commit SHAs to prevent supply chain attacks plus update to latest releases ([#4886](https://github.com/microsoft/AzureTRE/pull/4886))
 * Add Windows Server 2025 image support to Guacamole. ([#4890](https://github.com/microsoft/AzureTRE/issues/4890))
 
+BUG FIXES:
+* Health check can falsely return OK even if Cosmos is down or inaccessible. ([#4926](https://github.com/microsoft/AzureTRE/issues/4926))
+
 ## (0.28.0) (March 2, 2026)
 **BREAKING CHANGES**
 * Sonatype Nexus shared service now requires explicit EULA acceptance (`accept_nexus_eula: true`) when deploying. This ensures compliance with Sonatype Nexus Community Edition licensing. ([#4842](https://github.com/microsoft/AzureTRE/issues/4842))

api_app/_version.py

@@ -1 +1 @@
-__version__ = "0.25.16"
+__version__ = "0.25.17"

api_app/services/health_checker.py

@@ -19,7 +19,8 @@ async def create_state_store_status() -> Tuple[StatusEnum, str]:
     message = ""
     try:
         container: ContainerProxy = await Database().get_container_proxy(STATE_STORE_RESOURCES_CONTAINER)
-        container.query_items("SELECT TOP 1 * FROM c")
+        async for _ in container.query_items("SELECT TOP 1 * FROM c", max_item_count=1):
+            break
     except exceptions.ServiceRequestError:
         status = StatusEnum.not_ok
         message = strings.STATE_STORE_ENDPOINT_NOT_RESPONDING

api_app/tests_ma/test_services/test_health_checker.py

@@ -2,6 +2,7 @@
 from unittest.mock import AsyncMock, MagicMock
 import pytest
 from azure.core.exceptions import ServiceRequestError
+from azure.cosmos.exceptions import CosmosHttpResponseError
 from azure.servicebus.exceptions import ServiceBusConnectionError
 from mock import patch
 from models.schemas.status import StatusEnum
@@ -39,6 +40,39 @@ async def test_get_state_store_status_other_exception(container_proxy_mock) -> N
     assert message == strings.UNSPECIFIED_ERROR
 
 
+class AsyncIteratorWithError:
+    def __init__(self, exception):
+        self.exception = exception
+
+    def __aiter__(self):
+        return self
+
+    async def __anext__(self):
+        raise self.exception
+
+
+@patch("api.dependencies.database.Database.get_container_proxy")
+async def test_get_state_store_status_cosmos_http_error(get_container_proxy_mock) -> None:
+    container_mock = MagicMock()
+    container_mock.query_items.return_value = AsyncIteratorWithError(CosmosHttpResponseError(message="some message"))
+    get_container_proxy_mock.return_value = container_mock
+    status, message = await health_checker.create_state_store_status()
+
+    assert status == StatusEnum.not_ok
+    assert message == strings.STATE_STORE_ENDPOINT_NOT_ACCESSIBLE
+
+
+@patch("api.dependencies.database.Database.get_container_proxy")
+async def test_get_state_store_status_service_request_error(get_container_proxy_mock) -> None:
+    container_mock = MagicMock()
+    container_mock.query_items.return_value = AsyncIteratorWithError(ServiceRequestError(message="some message"))
+    get_container_proxy_mock.return_value = container_mock
+    status, message = await health_checker.create_state_store_status()
+
+    assert status == StatusEnum.not_ok
+    assert message == strings.STATE_STORE_ENDPOINT_NOT_RESPONDING
+
+
 @patch("core.credentials.get_credential_async_context")
 @patch("services.health_checker.ServiceBusClient")
 async def test_get_service_bus_status_responding(service_bus_client_mock, get_credential_async_context) -> None: