Skip to content

Commit f2bf189

Browse files
Vamshi-MicrosoftVamshi-Microsoft
committed
Migrated GitHub Actions authentication from client secrets to OIDC
1 parent 8691b0c commit f2bf189

16 files changed

Lines changed: 99 additions & 80 deletions

‎.github/workflows/azure-dev.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ jobs:
2525
id: validation
2626
env:
2727
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
28-
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
2928
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
3029
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
3130
AZURE_ENV_NAME: ${{ secrets.AZURE_ENV_NAME }}

‎.github/workflows/deploy-linux.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: Deploy-Test-Cleanup (v2) Linux
22

33
permissions:
4+
id-token: write
45
contents: read
56
actions: read
67
on:

‎.github/workflows/deploy-orchestrator.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
11
name: Deployment orchestrator
22

3-
permissions:
4-
contents: read
5-
actions: read
6-
73
on:
84
workflow_call:
95
inputs:

‎.github/workflows/deploy-waf.yml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: Validate WAF Deployment v4
22

33
permissions:
4+
id-token: write
45
contents: read
56
actions: read
67
on:
@@ -13,6 +14,7 @@ on:
1314
jobs:
1415
deploy:
1516
runs-on: ubuntu-latest
17+
environment: production
1618
env:
1719
GPT_MIN_CAPACITY: 1
1820
O4_MINI_MIN_CAPACITY: 1
@@ -21,12 +23,16 @@ jobs:
2123
- name: Checkout Code
2224
uses: actions/checkout@v4
2325

26+
- name: Login to Azure
27+
uses: azure/login@v2
28+
with:
29+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
30+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
31+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
32+
2433
- name: Run Quota Check
2534
id: quota-check
2635
env:
27-
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
28-
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
29-
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
3036
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
3137
GPT_MIN_CAPACITY: ${{ env.GPT_MIN_CAPACITY }}
3238
O4_MINI_MIN_CAPACITY: ${{ env.O4_MINI_MIN_CAPACITY }}
@@ -66,10 +72,6 @@ jobs:
6672
echo "Selected Region: $VALID_REGION"
6773
echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
6874
69-
- name: Login to Azure
70-
run: |
71-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
72-
7375
- name: Install Bicep CLI
7476
run: az bicep install
7577

‎.github/workflows/deploy-windows.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: Deploy-Test-Cleanup (v2) Windows
22

33
permissions:
4+
id-token: write
45
contents: read
56
actions: read
67
on:

‎.github/workflows/deploy.yml‎

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: Validate Deployment v4
22

33
permissions:
4+
id-token: write
45
contents: read
56
actions: read
67
on:
@@ -24,6 +25,7 @@ env:
2425
jobs:
2526
deploy:
2627
runs-on: ubuntu-latest
28+
environment: production
2729
outputs:
2830
RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
2931
WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
@@ -34,12 +36,16 @@ jobs:
3436
- name: Checkout Code
3537
uses: actions/checkout@v4
3638

39+
- name: Login to Azure
40+
uses: azure/login@v2
41+
with:
42+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
43+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
44+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
45+
3746
- name: Run Quota Check
3847
id: quota-check
3948
env:
40-
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
41-
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
42-
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
4349
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
4450
GPT_MIN_CAPACITY: ${{ env.GPT_MIN_CAPACITY }}
4551
O4_MINI_MIN_CAPACITY: ${{ env.O4_MINI_MIN_CAPACITY }}
@@ -79,10 +85,6 @@ jobs:
7985
echo "Selected Region: $VALID_REGION"
8086
echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
8187
82-
- name: Login to Azure
83-
run: |
84-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
85-
8688
- name: Install Bicep CLI
8789
run: az bicep install
8890

@@ -212,13 +214,19 @@ jobs:
212214
if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
213215
needs: [deploy, e2e-test]
214216
runs-on: ubuntu-latest
217+
environment: production
215218
env:
216219
RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
217220
steps:
218221
- name: Login to Azure
219-
run: |
220-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
221-
az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
222+
uses: azure/login@v2
223+
with:
224+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
225+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
226+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
227+
228+
- name: Set Azure Subscription
229+
run: az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
222230

223231
- name: Extract AI Services and Key Vault Names
224232
if: always()

‎.github/workflows/docker-build-and-push.yml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -45,12 +45,14 @@ on:
4545
workflow_dispatch:
4646

4747
permissions:
48+
id-token: write
4849
contents: read
4950
actions: read
5051

5152
jobs:
5253
build-and-push:
5354
runs-on: ubuntu-latest
55+
environment: production
5456

5557
steps:
5658
- name: Checkout repository
@@ -59,13 +61,17 @@ jobs:
5961
- name: Set up Docker Buildx
6062
uses: docker/setup-buildx-action@v3
6163

62-
- name: Log in to Azure Container Registry
64+
- name: Login to Azure
6365
if: ${{ github.ref_name == 'main' || github.ref_name == 'dev-v4'|| github.ref_name == 'demo-v4' || github.ref_name == 'hotfix' }}
64-
uses: azure/docker-login@v2
66+
uses: azure/login@v2
6567
with:
66-
login-server: ${{ secrets.ACR_LOGIN_SERVER || 'acrlogin.azurecr.io' }}
67-
username: ${{ secrets.ACR_USERNAME }}
68-
password: ${{ secrets.ACR_PASSWORD }}
68+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
69+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
70+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
71+
72+
- name: Log in to Azure Container Registry
73+
if: ${{ github.ref_name == 'main' || github.ref_name == 'dev-v4'|| github.ref_name == 'demo-v4' || github.ref_name == 'hotfix' }}
74+
run: az acr login --name ${{ secrets.ACR_LOGIN_SERVER || 'acrlogin.azurecr.io' }}
6975

7076
- name: Get current date
7177
id: date

‎.github/workflows/job-cleanup-deployment.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
name: Cleanup Deployment Job
22

3-
permissions:
4-
contents: read
5-
actions: read
63
on:
74
workflow_call:
85
inputs:
@@ -49,6 +46,7 @@ jobs:
4946
cleanup-deployment:
5047
runs-on: ${{ inputs.runner_os }}
5148
continue-on-error: true
49+
environment: production
5250
env:
5351
RESOURCE_GROUP_NAME: ${{ inputs.RESOURCE_GROUP_NAME }}
5452
AZURE_LOCATION: ${{ inputs.AZURE_LOCATION }}
@@ -58,10 +56,15 @@ jobs:
5856
steps:
5957

6058
- name: Login to Azure
59+
uses: azure/login@v2
60+
with:
61+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
62+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
63+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
64+
65+
- name: Set Azure Subscription
6166
shell: bash
62-
run: |
63-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
64-
az account set --subscription ${{ secrets.AZURE_SUBSCRIPTION_ID }}
67+
run: az account set --subscription ${{ secrets.AZURE_SUBSCRIPTION_ID }}
6568

6669
- name: Delete Resource Group (Optimized Cleanup)
6770
id: delete_rg

‎.github/workflows/job-deploy-linux.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
11
name: Deploy Steps - Linux
22

3-
permissions:
4-
contents: read
5-
actions: read
6-
73
on:
84
workflow_call:
95
inputs:
@@ -49,6 +45,7 @@ on:
4945
jobs:
5046
deploy-linux:
5147
runs-on: ubuntu-latest
48+
environment: production
5249
env:
5350
AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }}
5451
outputs:
@@ -206,13 +203,19 @@ jobs:
206203
- name: Install azd
207204
uses: Azure/setup-azd@v2
208205

206+
- name: Login to Azure
207+
uses: azure/login@v2
208+
with:
209+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
210+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
211+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
212+
209213
- name: Login to AZD
210214
id: login-azure
211215
shell: bash
212216
run: |
213-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
214217
az account set --subscription ${{ secrets.AZURE_SUBSCRIPTION_ID }}
215-
azd auth login --client-id ${{ secrets.AZURE_CLIENT_ID }} --client-secret ${{ secrets.AZURE_CLIENT_SECRET }} --tenant-id ${{ secrets.AZURE_TENANT_ID }}
218+
azd auth login --client-id "${{ secrets.AZURE_CLIENT_ID }}" --federated-credential-provider "github" --tenant-id "${{ secrets.AZURE_TENANT_ID }}"
216219
217220
- name: Deploy using azd up and extract values (Linux)
218221
id: get_output_linux

‎.github/workflows/job-deploy-windows.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
11
name: Deploy Steps - Windows
22

3-
permissions:
4-
contents: read
5-
actions: read
6-
73
on:
84
workflow_call:
95
inputs:
@@ -48,6 +44,7 @@ on:
4844
jobs:
4945
deploy-windows:
5046
runs-on: windows-latest
47+
environment: production
5148
env:
5249
AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }}
5350
outputs:
@@ -205,13 +202,19 @@ jobs:
205202
- name: Install azd
206203
uses: Azure/setup-azd@v2
207204

205+
- name: Login to Azure
206+
uses: azure/login@v2
207+
with:
208+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
209+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
210+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
211+
208212
- name: Login to AZD
209213
id: login-azure
210214
shell: bash
211215
run: |
212-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
213216
az account set --subscription ${{ secrets.AZURE_SUBSCRIPTION_ID }}
214-
azd auth login --client-id ${{ secrets.AZURE_CLIENT_ID }} --client-secret ${{ secrets.AZURE_CLIENT_SECRET }} --tenant-id ${{ secrets.AZURE_TENANT_ID }}
217+
azd auth login --client-id "${{ secrets.AZURE_CLIENT_ID }}" --federated-credential-provider "github" --tenant-id "${{ secrets.AZURE_TENANT_ID }}"
215218
216219
217220
- name: Deploy using azd up and extract values (Windows)

0 commit comments

Comments
 (0)