Skip to content

Commit 5b17193

Browse files
Vamshi-MicrosoftVamshi-Microsoft
committed
Migrated GitHub Actions authentication from client secrets to OIDC
1 parent de077da commit 5b17193

12 files changed

Lines changed: 95 additions & 66 deletions

‎.github/workflows/bicep_deploy.yml‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,20 +4,28 @@ on:
44
branches:
55
- ckm-v2
66

7-
7+
permissions:
8+
contents: read
9+
id-token: write
10+
811
jobs:
912
deploy:
1013
runs-on: ubuntu-latest
14+
environment: production
1115
steps:
1216
- name: Checkout Code
1317
uses: actions/checkout@v6
1418

19+
- name: Login to Azure
20+
uses: azure/login@v2
21+
with:
22+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
23+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
24+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
25+
1526
- name: Run Quota Check
1627
id: quota-check
1728
env:
18-
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
19-
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
20-
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
2129
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
2230
GPT_MIN_CAPACITY: "30"
2331
AZURE_REGIONS: ${{ vars.AZURE_REGIONS }}
@@ -55,10 +63,6 @@ jobs:
5563
echo "Selected Region: $VALID_REGION"
5664
echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
5765
58-
- name: Login to Azure
59-
run: |
60-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
61-
6266
- name: Install Bicep CLI
6367
run: az bicep install
6468

‎.github/workflows/deploy-KMGeneric.yml‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ on:
1515
permissions:
1616
contents: read
1717
actions: read
18+
id-token: write
1819

1920
env:
2021
GPT_MIN_CAPACITY: 150
@@ -23,6 +24,7 @@ env:
2324
jobs:
2425
deploy:
2526
runs-on: ubuntu-latest
27+
environment: production
2628
outputs:
2729
RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
2830
WEBAPP_URL: ${{ steps.get_output.outputs.WEBAPP_URL }}
@@ -33,14 +35,15 @@ jobs:
3335
uses: actions/checkout@v6
3436

3537
- name: Login to Azure
36-
run: |
37-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
38+
uses: azure/login@v2
39+
with:
40+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
41+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
42+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
43+
3844
- name: Run Quota Check
3945
id: quota-check
4046
env:
41-
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
42-
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
43-
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
4447
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
4548
GPT_MIN_CAPACITY: ${{ env.GPT_MIN_CAPACITY }}
4649
TEXT_EMBEDDING_MIN_CAPACITY: ${{ env.TEXT_EMBEDDING_MIN_CAPACITY }}
@@ -191,13 +194,17 @@ jobs:
191194
if: always() && needs.deploy.outputs.RESOURCE_GROUP_NAME != ''
192195
needs: [deploy, e2e-test]
193196
runs-on: ubuntu-latest
197+
environment: production
194198
env:
195199
RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
196200
steps:
197201
- name: Login to Azure
198-
run: |
199-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
200-
az account set --subscription "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
202+
uses: azure/login@v2
203+
with:
204+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
205+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
206+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
207+
201208
- name: Extract AI Services and Key Vault Names
202209
if: always()
203210
run: |

‎.github/workflows/deploy-linux.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ on:
9898
permissions:
9999
contents: read
100100
actions: read
101+
id-token: write
101102

102103
jobs:
103104
validate-inputs:

‎.github/workflows/deploy-windows.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ on:
8181
permissions:
8282
contents: read
8383
actions: read
84+
id-token: write
8485

8586
jobs:
8687
validate-inputs:

‎.github/workflows/docker-build.yml‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,12 @@ on:
2121
permissions:
2222
contents: read
2323
actions: read
24+
id-token: write
2425

2526
jobs:
2627
build-and-push:
2728
runs-on: ubuntu-latest
29+
environment: production
2830

2931
steps:
3032
- name: Checkout repository
@@ -33,13 +35,19 @@ jobs:
3335
- name: Set up Docker Buildx
3436
uses: docker/setup-buildx-action@v3
3537

36-
- name: Log in to Azure Container Registry
38+
- name: Login to Azure
3739
if: ${{ (github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo')) || (github.event_name == 'workflow_dispatch' && (github.ref_name == 'dependabotchanges'||github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo')) }}
38-
uses: azure/docker-login@v2
40+
uses: azure/login@v2
3941
with:
40-
login-server: ${{ secrets.ACR_LOGIN_SERVER }}
41-
username: ${{ secrets.ACR_USERNAME }}
42-
password: ${{ secrets.ACR_PASSWORD }}
42+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
43+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
44+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
45+
46+
- name: Log in to Azure Container Registry
47+
if: ${{ (github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo')) || (github.event_name == 'workflow_dispatch' && (github.ref_name == 'dependabotchanges'||github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo')) }}
48+
run: |
49+
ACR_NAME=$(echo "${{ secrets.ACR_LOGIN_SERVER }}" | sed 's/\.azurecr\.io$//')
50+
az acr login --name "$ACR_NAME"
4351
4452
- name: Get current date
4553
id: date

‎.github/workflows/job-azure-deploy.yml‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ jobs:
112112
name: Azure Setup
113113
if: inputs.trigger_type != 'workflow_dispatch' || inputs.existing_webapp_url == '' || inputs.existing_webapp_url == null
114114
runs-on: ubuntu-latest
115+
environment: production
115116
outputs:
116117
RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
117118
ENV_NAME: ${{ steps.generate_env_name.outputs.ENV_NAME }}
@@ -325,17 +326,15 @@ jobs:
325326
uses: actions/checkout@v6
326327

327328
- name: Login to Azure
328-
shell: bash
329-
run: |
330-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
331-
az account set --subscription ${{ secrets.AZURE_SUBSCRIPTION_ID }}
329+
uses: azure/login@v2
330+
with:
331+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
332+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
333+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
332334

333335
- name: Run Quota Check
334336
id: quota-check
335337
env:
336-
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
337-
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
338-
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
339338
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
340339
GPT_MIN_CAPACITY: ${{ env.GPT_MIN_CAPACITY }}
341340
TEXT_EMBEDDING_MIN_CAPACITY: ${{ env.TEXT_EMBEDDING_MIN_CAPACITY }}

‎.github/workflows/job-cleanup-resources.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ on:
4545
jobs:
4646
cleanup-deployment:
4747
runs-on: ${{ inputs.runner_os }}
48+
environment: production
4849
continue-on-error: true
4950
env:
5051
RESOURCE_GROUP_NAME: ${{ inputs.resource_group_name }}
@@ -54,10 +55,11 @@ jobs:
5455
IMAGE_TAG: ${{ inputs.image_tag }}
5556
steps:
5657
- name: Login to Azure
57-
shell: bash
58-
run: |
59-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
60-
az account set --subscription ${{ secrets.AZURE_SUBSCRIPTION_ID }}
58+
uses: azure/login@v2
59+
with:
60+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
61+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
62+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
6163

6264
- name: Delete Resource Group (Optimized Cleanup)
6365
id: delete_rg

‎.github/workflows/job-deploy-linux.yml‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ on:
4949
jobs:
5050
deploy-linux:
5151
runs-on: ubuntu-latest
52+
environment: production
5253
env:
5354
AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }}
5455
outputs:
@@ -217,13 +218,16 @@ jobs:
217218
- name: Install azd
218219
uses: Azure/setup-azd@v2
219220

220-
- name: Login to AZD
221-
id: login-azure
221+
- name: Login to Azure
222+
uses: azure/login@v2
223+
with:
224+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
225+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
226+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
227+
228+
- name: Configure AZD to use Azure CLI authentication
222229
shell: bash
223-
run: |
224-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
225-
az account set --subscription ${{ secrets.AZURE_SUBSCRIPTION_ID }}
226-
azd auth login --client-id ${{ secrets.AZURE_CLIENT_ID }} --client-secret ${{ secrets.AZURE_CLIENT_SECRET }} --tenant-id ${{ secrets.AZURE_TENANT_ID }}
230+
run: azd config set auth.useAzCliAuth "true"
227231

228232
- name: Deploy using azd up and extract values (Linux)
229233
id: get_output_linux

‎.github/workflows/job-deploy-windows.yml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ on:
5353
jobs:
5454
deploy-windows:
5555
runs-on: windows-latest
56+
environment: production
5657
env:
5758
AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }}
5859
outputs:
@@ -220,14 +221,16 @@ jobs:
220221
- name: Setup Azure Developer CLI (Windows)
221222
uses: Azure/setup-azd@v2
222223

223-
- name: Login to AZD
224-
id: login-azure
225-
shell: bash
226-
run: |
227-
az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
228-
az account set --subscription ${{ secrets.AZURE_SUBSCRIPTION_ID }}
229-
azd auth login --client-id ${{ secrets.AZURE_CLIENT_ID }} --client-secret ${{ secrets.AZURE_CLIENT_SECRET }} --tenant-id ${{ secrets.AZURE_TENANT_ID }}
224+
- name: Login to Azure
225+
uses: azure/login@v2
226+
with:
227+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
228+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
229+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
230230

231+
- name: Configure AZD to use Azure CLI authentication
232+
shell: bash
233+
run: azd config set auth.useAzCliAuth "true"
231234

232235
- name: Deploy using azd up and extract values (Windows)
233236
id: get_output_windows

‎.github/workflows/job-docker-build.yml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ jobs:
2424
docker-build:
2525
if: inputs.trigger_type == 'workflow_dispatch' && inputs.build_docker_image == true
2626
runs-on: ubuntu-latest
27+
environment: production
2728
outputs:
2829
IMAGE_TAG: ${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}
2930
steps:
@@ -47,12 +48,17 @@ jobs:
4748
- name: Set up Docker Buildx
4849
uses: docker/setup-buildx-action@v3
4950

50-
- name: Log in to Azure Container Registry
51-
uses: azure/docker-login@v2
51+
- name: Login to Azure
52+
uses: azure/login@v2
5253
with:
53-
login-server: ${{ secrets.ACR_TEST_LOGIN_SERVER }}
54-
username: ${{ secrets.ACR_TEST_USERNAME }}
55-
password: ${{ secrets.ACR_TEST_PASSWORD }}
54+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
55+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
56+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
57+
58+
- name: Log in to Azure Container Registry
59+
run: |
60+
ACR_NAME=$(echo "${{ secrets.ACR_TEST_LOGIN_SERVER }}" | sed 's/\.azurecr\.io$//')
61+
az acr login --name "$ACR_NAME"
5662
5763
- name: Build and Push Docker Image for WebApp
5864
uses: docker/build-push-action@v6

0 commit comments

Comments
 (0)