feat: migrate azure/login gha to oidc (#442)

# Description Moves the Azure/login GHA authentication to the more secure OIDC mechanism. Signed-off-by: Evan Baker <[email protected]>
microsoft · Jun 5, 2024 · 149b880 · 149b880
1 parent 3715614
commit 149b880
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 14 deletions.
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
@@ -9,17 +9,14 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   e2e:
     if: ${{ github.event_name == 'merge_group' }}
     name: E2E
     runs-on: ubuntu-latest
 
-    permissions:
-      id-token: write
-      contents: read
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -34,7 +31,9 @@ jobs:
         uses: azure/login@v2
         if: ${{ github.event_name == 'merge_group' }}
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION }}
 
       - name: Run E2E
         env:

diff --git a/.github/workflows/images.yaml b/.github/workflows/images.yaml
@@ -9,6 +9,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   retina-images:
@@ -36,7 +37,9 @@ jobs:
         uses: azure/login@v2
         if: ${{ github.event_name == 'merge_group' }}
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION }}
 
       - name: Build Images
         shell: bash
@@ -83,7 +86,9 @@ jobs:
         uses: azure/login@v2
         if: ${{ github.event_name == 'merge_group' }}
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION }}
 
       - name: Build Images
         shell: bash
@@ -130,7 +135,9 @@ jobs:
         uses: azure/login@v2
         if: ${{ github.event_name == 'merge_group' }}
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION }}
 
       - name: Build Images
         shell: bash
@@ -172,7 +179,9 @@ jobs:
       - name: Azure CLI login
         uses: azure/login@v2
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION }}
 
       - name: Generate Manifests
         shell: bash
@@ -188,10 +197,6 @@ jobs:
     runs-on: ubuntu-latest
     needs: [manifests]
 
-    permissions:
-      id-token: write
-      contents: read
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -206,7 +211,9 @@ jobs:
         uses: azure/login@v2
         if: ${{ github.event_name == 'merge_group' }}
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION }}
 
       - name: Run E2E Tests
         env: