Github actions WIF

.github/actions/deploy-environment/action.yml

@@ -8,12 +8,21 @@ inputs:
   docker-image:
     description: The Docker image to deploy
     required: true
-  azure-credentials:
-    description: JSON object containing a service principal that can read from Azure Key Vault
-    required: true
   pull-request-number:
     description: The pull request number which triggered this deploy.
     required: false
+  azure-client-id:
+    description: Managed identity client ID
+    required: true
+  azure-subscription-id:
+    description: Azure subscription ID
+    required: true
+  azure-tenant-id:
+    description: Azure tenant ID
+    required: true
+  dev-cluster:
+    description: Development cluster name (Optional)
+    required: false
 
 runs:
   using: composite
@@ -24,9 +33,11 @@ runs:
         terraform_version: 1.6.4
         terraform_wrapper: false
 
-    - uses: DFE-Digital/github-actions/set-kubelogin-environment@master
+    - uses: DFE-Digital/github-actions/set-kubelogin-environment@oidc-ga
       with:
-        azure-credentials: ${{ inputs.azure-credentials }}
+        azure-client-id: ${{ inputs.azure-client-id }}
+        azure-tenant-id: ${{ inputs.azure-tenant-id }}
+        azure-subscription-id: ${{ inputs.azure-subscription-id }}
 
     - name: Terraform Apply
       shell: bash
@@ -35,6 +46,7 @@ runs:
       env:
         DOCKER_IMAGE_TAG: ${{ inputs.docker-image }}
         PR_NUMBER: ${{ inputs.pull-request-number }}
+        CLUSTER: ${{ inputs.dev-cluster }}
 
     - name: Extract Terraform outputs
       shell: bash

.github/workflows/build_and_deploy.yml

@@ -11,6 +11,8 @@ concurrency: deploy-${{ github.ref }}
 permissions:
   packages: write
   pull-requests: write
+  id-token: write
+
 
 jobs:
   build:
@@ -48,8 +50,10 @@ jobs:
         with:
           environment: review
           docker-image: ${{ needs.build.outputs.docker-image-tag }}
-          azure-credentials: ${{ secrets.AZURE_CREDENTIALS }}
           pull-request-number: ${{ github.event.number }}
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
 
       - name: Post comment to Pull Request ${{ github.event.number }}
         if: ${{ github.event_name == 'pull_request' }}
@@ -86,7 +90,9 @@ jobs:
 
       - uses: azure/login@v2
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Fetch secrets from key vault
         uses: azure/CLI@v2
@@ -102,7 +108,9 @@ jobs:
         with:
           environment: ${{ matrix.environment }}
           docker-image: ${{ needs.build.outputs.docker-image-tag }}
-          azure-credentials: ${{ secrets.AZURE_CREDENTIALS }}
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
 
       - name: Slack Notification
         if: failure()
@@ -131,7 +139,9 @@ jobs:
 
       - uses: azure/login@v2
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Fetch secrets from key vault
         uses: azure/CLI@v2
@@ -147,7 +157,9 @@ jobs:
         with:
           environment: production
           docker-image: ${{ needs.build.outputs.docker-image-tag }}
-          azure-credentials: ${{ secrets.AZURE_CREDENTIALS }}
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
 
       - name: Slack Notification
         if: failure()

.github/workflows/database-backup.yml

@@ -46,7 +46,9 @@ jobs:
 
     - uses: azure/login@v2
       with:
-        creds: ${{ secrets.AZURE_CREDENTIALS }}
+        client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
     - name: Set environment variables
       run: |
@@ -77,13 +79,15 @@ jobs:
           echo "SLACK_WEBHOOK=$SLACK_WEBHOOK" >> $GITHUB_OUTPUT
 
     - name: Backup ${{ env.DEPLOY_ENV }} postgres
-      uses: DFE-Digital/github-actions/backup-postgres@master
+      uses: DFE-Digital/github-actions/backup-postgres@oidc-ga
       with:
         storage-account: ${{ env.STORAGE_ACCOUNT_NAME }}
         resource-group: ${{ env.RESOURCE_GROUP_NAME }}
         app-name: ${{ env.SERVICE_NAME }}-${{ env.DEPLOY_ENV }}
         cluster: ${{ env.CLUSTER }}
-        azure-credentials: ${{ secrets.AZURE_CREDENTIALS }}
+        azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+        azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
         backup-file: ${{ env.BACKUP_FILE }}.sql
         db-server-name: ${{ inputs.db-server }}
         slack-webhook: ${{ steps.key-vault-secrets.outputs.SLACK_WEBHOOK }}

.github/workflows/delete_review_app.yml

@@ -21,6 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ contains(github.event.pull_request.labels.*.name, 'deploy') || github.event_name == 'workflow_dispatch' }}
     environment: review
+    permissions:
+      pull-requests: write
+      id-token: write
+
     steps:
     - name: Checkout
       uses: actions/checkout@v4
@@ -40,9 +44,11 @@ jobs:
         terraform_version: 1.6.4
         terraform_wrapper: false
 
-    - uses: DFE-Digital/github-actions/set-kubelogin-environment@master
+    - uses: DFE-Digital/github-actions/set-kubelogin-environment@oidc-ga
       with:
-        azure-credentials: ${{ secrets.AZURE_CREDENTIALS }}
+        azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+        azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
 
     - name: Terraform Destroy
       run: |

.github/workflows/deploy.yml

@@ -13,32 +13,41 @@ on:
           - review
           - staging
           - sandbox
-          - dv
+          - dv_review
+          - pt_review
       sha:
         description: Commit sha to be deployed
         required: true
-      pr_number:
-        description: PR number
+      pr-number:
+        description: PR number for review apps (Optional)
+        required: false
+      dev-cluster:
+        description: Development cluster name (Optional)
         required: false
 
 jobs:
   deploy:
-    name: ${{ github.event.inputs.environment }} deployment
+    name: ${{ inputs.environment }} deployment
     environment:
-      name: ${{ github.event.inputs.environment }}
+      name: ${{ inputs.environment }}
     concurrency: deploy_all
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      id-token: write
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - uses: azure/login@v2
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
 
       - name: Fetch secrets from key vault
-        if: ${{ github.event.inputs.environment != 'review' }}
+        if: ${{ inputs.environment != 'review' && inputs.environment != 'dv_review' }}
         uses: azure/CLI@v2
         id: keyvault-yaml-secret
         with:
@@ -50,13 +59,16 @@ jobs:
       - uses: ./.github/actions/deploy-environment
         id: deploy
         with:
-          environment: ${{ github.event.inputs.environment }}
-          docker-image: ${{ github.event.inputs.sha }}
-          azure-credentials: ${{ secrets.AZURE_CREDENTIALS }}
-          pull-request-number: ${{ github.event.inputs.pr_number }}
+          environment: ${{ inputs.environment }}
+          docker-image: ${{ inputs.sha }}
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          pull-request-number: ${{ inputs.pr-number }}
+          dev-cluster: ${{ inputs.dev-cluster }}
 
-      - name: Post comment to Pull Request ${{ github.event.inputs.pr_number }}
-        if: ${{ github.event.inputs.environment == 'review' }}
+      - name: Post comment to Pull Request ${{ inputs.pr-number }}
+        if: ${{ inputs.environment != 'review' && inputs.environment != 'dv_review' }}
         uses: marocchino/sticky-pull-request-comment@v2
         with:
           header: aks
@@ -65,14 +77,14 @@ jobs:
 
             | App               | URL                                                                                      |
             | ----------------- | ---------------------------------------------------------------------------------------- |
-            | Track & Pay       | <https://track-and-pay-${{ github.event.inputs.pr_number }}.test.teacherservices.cloud>            |
-            | School Placements | <https://manage-school-placements-${{ github.event.inputs.pr_number }}.test.teacherservices.cloud> |
+            | Track & Pay       | <https://track-and-pay-${{ inputs.pr-number }}.test.teacherservices.cloud>            |
+            | School Placements | <https://manage-school-placements-${{ inputs.pr-number }}.test.teacherservices.cloud> |
 
       - name: Slack Notification
-        if: ${{ failure() && github.event.inputs.environment != 'review' }}
+        if: ${{ failure() && inputs.environment != 'review' }}
         uses: rtCamp/action-slack-notify@master
         env:
           SLACK_COLOR: failure
-          SLACK_TITLE: Failure deploying release to${{ github.event.inputs.environment }}
-          SLACK_MESSAGE: Failure deploying release to ${{ github.event.inputs.environment }} - Docker tag ${{ github.event.inputs.sha }}
+          SLACK_TITLE: Failure deploying release to${{ inputs.environment }}
+          SLACK_MESSAGE: Failure deploying release to ${{ inputs.environment }} - Docker tag ${{ inputs.sha }}
           SLACK_WEBHOOK: ${{ steps.keyvault-yaml-secret.outputs.SLACK_WEBHOOK }}

.github/workflows/maintenance.yml

@@ -21,15 +21,20 @@ jobs:
     name: Set maintenance mode
     runs-on: ubuntu-latest
     environment: ${{ inputs.environment }}
+    permissions:
+      id-token: write
+      packages: write
 
     steps:
     - name: Checkout
       uses: actions/checkout@v4
 
     - name: Enable or disable maintenance mode
-      uses: DFE-Digital/github-actions/maintenance@master
+      uses: DFE-Digital/github-actions/maintenance@oidc-ga
       with:
-        azure-credentials: ${{ secrets.AZURE_CREDENTIALS}}
+        azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+        azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
         environment: ${{ inputs.environment }}
         mode: ${{ inputs.mode }}
         docker-repository: ghcr.io/dfe-digital/itt-mentor-services-maintenance

.github/workflows/postgres-ptr.yml

@@ -60,11 +60,13 @@ jobs:
         echo "NEW_DB_SERVER=${NEW_DB_SERVER}" >> $GITHUB_ENV
 
     - name: Restore ${{ inputs.environment }} postgres
-      uses: DFE-Digital/github-actions/ptr-postgres@master
+      uses: DFE-Digital/github-actions/ptr-postgres@oidc-ga
       with:
         resource-group: ${{ env.RESOURCE_GROUP_NAME }}
         source-server: ${{ env.DB_SERVER }}
         new-server: ${{ env.NEW_DB_SERVER }}
         restore-time: ${{ inputs.restore-time }}
         cluster: ${{ env.CLUSTER }}
-        azure-credentials: ${{ secrets.AZURE_CREDENTIALS}}
+        azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+        azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}