Skip to content

Commit 964ea7c

Browse files
Vamshi-MicrosoftVamshi-Microsoft
committed
ci: Migrated GitHub Actions authentication from client secrets to OIDC
1 parent 1e52477 commit 964ea7c

16 files changed

Lines changed: 81 additions & 91 deletions

‎.github/workflows/azure-dev.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ jobs:
2424
id: validation
2525
env:
2626
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
27-
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
2827
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
2928
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
3029
AZURE_ENV_NAME: ${{ secrets.AZURE_ENV_NAME }}

‎.github/workflows/build-docker-images.yml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ name: Build Docker and Optional Push
22
permissions:
33
contents: read
44
actions: read
5+
id-token: write
56
on:
67
push:
78
branches:
@@ -50,15 +51,11 @@ jobs:
5051
include:
5152
- app_name: cmsabackend
5253
dockerfile: docker/Backend.Dockerfile
53-
password_secret: DOCKER_PASSWORD
5454
- app_name: cmsafrontend
5555
dockerfile: docker/Frontend.Dockerfile
56-
password_secret: DOCKER_PASSWORD
5756
uses: ./.github/workflows/build-docker.yml
5857
with:
5958
registry: cmsacontainerreg.azurecr.io
60-
username: cmsacontainerreg
61-
password_secret: ${{ matrix.password_secret }}
6259
app_name: ${{ matrix.app_name }}
6360
dockerfile: ${{ matrix.dockerfile }}
6461
push: ${{ github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo' || github.ref_name == 'hotfix' }}

‎.github/workflows/build-docker.yml‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,6 @@ on:
66
registry:
77
required: true
88
type: string
9-
username:
10-
required: true
11-
type: string
12-
password_secret:
13-
required: true
14-
type: string
159
app_name:
1610
required: true
1711
type: string
@@ -21,25 +15,27 @@ on:
2115
push:
2216
required: true
2317
type: boolean
24-
secrets:
25-
DOCKER_PASSWORD:
26-
required: false
2718

2819
jobs:
2920
docker-build:
3021
runs-on: ubuntu-latest
22+
environment: production
3123
steps:
3224

3325
- name: Checkout
3426
uses: actions/checkout@v6
3527

36-
- name: Docker Login
28+
- name: Login to Azure
3729
if: ${{ inputs.push }}
38-
uses: docker/login-action@v3
30+
uses: azure/login@v2
3931
with:
40-
registry: ${{ inputs.registry }}
41-
username: ${{ inputs.username }}
42-
password: ${{ secrets[inputs.password_secret] }}
32+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
33+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
34+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
35+
36+
- name: Login to ACR
37+
if: ${{ inputs.push }}
38+
run: az acr login --name ${{ inputs.registry }}
4339

4440
- name: Set up Docker Buildx
4541
uses: docker/setup-buildx-action@v3

‎.github/workflows/deploy-linux.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ name: Deploy-Test-Cleanup (v2) Linux
22
permissions:
33
contents: read
44
actions: read
5+
id-token: write
56
on:
67
workflow_run:
78
workflows: ["Build Docker and Optional Push"]

‎.github/workflows/deploy-orchestrator.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
11
name: Deployment orchestrator
22

3-
permissions:
4-
contents: read
5-
actions: read
6-
73
on:
84
workflow_call:
95
inputs:

‎.github/workflows/deploy-windows.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ name: Deploy-Test-Cleanup (v2) Windows
22
permissions:
33
contents: read
44
actions: read
5+
id-token: write
56
on:
67
workflow_dispatch:
78
inputs:

‎.github/workflows/deploy.yml‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ name: Deploy-Test-Cleanup Pipeline
33
permissions:
44
contents: read
55
actions: read
6+
id-token: write
67
on:
78
workflow_run:
89
workflows: ["Build Docker and Optional Push"]
@@ -23,6 +24,7 @@ env:
2324
jobs:
2425
deploy:
2526
runs-on: ubuntu-latest
27+
environment: production
2628
outputs:
2729
RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
2830
WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
@@ -31,15 +33,15 @@ jobs:
3133
uses: actions/checkout@v6
3234

3335
- name: Login to Azure
34-
run: |
35-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
36+
uses: azure/login@v2
37+
with:
38+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
39+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
40+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
3641

3742
- name: Run Quota Check
3843
id: quota-check
3944
env:
40-
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
41-
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
42-
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
4345
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
4446
AZURE_REGIONS: ${{ vars.AZURE_REGIONS }}
4547
GPT_MIN_CAPACITY: ${{ env.GPT_MIN_CAPACITY }}
@@ -182,14 +184,17 @@ jobs:
182184
if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
183185
needs: [deploy, e2e-test]
184186
runs-on: ubuntu-latest
187+
environment: production
185188
env:
186189
RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
187190
steps:
188191

189192
- name: Login to Azure
190-
run: |
191-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
192-
az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
193+
uses: azure/login@v2
194+
with:
195+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
196+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
197+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
193198

194199
- name: Assign Contributor role to Service Principal
195200
if: always()

‎.github/workflows/job-cleanup-deployment.yml‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
name: Cleanup Deployment Job
22

3-
permissions:
4-
contents: read
5-
actions: read
63
on:
74
workflow_call:
85
inputs:
@@ -48,6 +45,7 @@ on:
4845
jobs:
4946
cleanup-deployment:
5047
runs-on: ${{ inputs.runner_os }}
48+
environment: production
5149
continue-on-error: true
5250
env:
5351
RESOURCE_GROUP_NAME: ${{ inputs.RESOURCE_GROUP_NAME }}
@@ -58,10 +56,11 @@ jobs:
5856
steps:
5957

6058
- name: Login to Azure
61-
shell: bash
62-
run: |
63-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
64-
az account set --subscription ${{ secrets.AZURE_SUBSCRIPTION_ID }}
59+
uses: azure/login@v2
60+
with:
61+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
62+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
63+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
6564

6665
- name: Delete Resource Group (Optimized Cleanup)
6766
id: delete_rg

‎.github/workflows/job-deploy-linux.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
name: Deploy Steps - Linux
22

3-
permissions:
4-
contents: read
5-
actions: read
63
on:
74
workflow_call:
85
inputs:
@@ -45,6 +42,7 @@ on:
4542
jobs:
4643
deploy-linux:
4744
runs-on: ubuntu-latest
45+
environment: production
4846
env:
4947
AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }}
5048
outputs:
@@ -201,13 +199,18 @@ jobs:
201199
- name: Install azd
202200
uses: Azure/setup-azd@v2
203201

202+
- name: Login to Azure
203+
uses: azure/login@v2
204+
with:
205+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
206+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
207+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
208+
204209
- name: Login to AZD
205210
id: login-azure
206211
shell: bash
207212
run: |
208-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
209-
az account set --subscription ${{ secrets.AZURE_SUBSCRIPTION_ID }}
210-
azd auth login --client-id ${{ secrets.AZURE_CLIENT_ID }} --client-secret ${{ secrets.AZURE_CLIENT_SECRET }} --tenant-id ${{ secrets.AZURE_TENANT_ID }}
213+
azd auth login --client-id ${{ secrets.AZURE_CLIENT_ID }} --federated-credential-provider "github" --tenant-id ${{ secrets.AZURE_TENANT_ID }}
211214
212215
- name: Deploy using azd up and extract values (Linux)
213216
id: get_output_linux

‎.github/workflows/job-deploy-windows.yml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
11
name: Deploy Steps - Windows
22

3-
permissions:
4-
contents: read
5-
actions: read
6-
73
on:
84
workflow_call:
95
inputs:
@@ -46,6 +42,7 @@ on:
4642
jobs:
4743
deploy-windows:
4844
runs-on: windows-latest
45+
environment: production
4946
env:
5047
AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }}
5148
outputs:
@@ -202,13 +199,18 @@ jobs:
202199
- name: Install azd
203200
uses: Azure/setup-azd@v2
204201

202+
- name: Login to Azure
203+
uses: azure/login@v2
204+
with:
205+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
206+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
207+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
208+
205209
- name: Login to AZD
206210
id: login-azure
207211
shell: bash
208212
run: |
209-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
210-
az account set --subscription ${{ secrets.AZURE_SUBSCRIPTION_ID }}
211-
azd auth login --client-id ${{ secrets.AZURE_CLIENT_ID }} --client-secret ${{ secrets.AZURE_CLIENT_SECRET }} --tenant-id ${{ secrets.AZURE_TENANT_ID }}
213+
azd auth login --client-id ${{ secrets.AZURE_CLIENT_ID }} --federated-credential-provider "github" --tenant-id ${{ secrets.AZURE_TENANT_ID }}
212214
213215
214216
- name: Deploy using azd up and extract values (Windows)

0 commit comments

Comments
 (0)