MSAL and OIDC support

.github/workflows/build-test.yml

@@ -33,6 +33,10 @@ env:
   ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
   PULUMI_API: https://api.pulumi-staging.io
 
+# Required for OIDC auth
+permissions:
+  id-token: write
+
 jobs:
   prerequisites:
     runs-on: ubuntu-latest
@@ -134,17 +138,52 @@ jobs:
           repo: GoTestTools/gotestfmt
 
       - name: Run tests
+        env:
+          TMPDIR: ${{ runner.temp }}
         if: "!inputs.short_test"
         run: |
           set -euo pipefail
           cd examples && go test -v -json -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
 
-      - name: Run tests
+      - name: Run short tests
         if: inputs.short_test
         run: |
           set -euo pipefail
           cd examples && go test -v -json -count=1 -cover -timeout 15m -short -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
 
+      - name: Run OIDC tests
+        if: ${{ matrix.language == 'nodejs' }}
+        env:
+          ARM_USE_OIDC: true
+          ARM_CLIENT_SECRET: ""
+          # tkappler oidc-test - temporary unless our main app is OIDC-enabled
+          ARM_CLIENT_ID: 89380e12-5be6-486a-89ef-eea107af2f47
+          TMPDIR: ${{ runner.temp }}
+        run: |
+          set -euo pipefail
+          cd examples
+          go test -v -json -count=1 -cover -timeout 15m -tags=${{ matrix.language }},oidc -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
+
+      ### tkappler: OIDC via the 'az' cli is generally possible, but the current implementation in
+      ### our dependecies doesn't support it.
+      # - name: Log in via az CLI for OIDC tests
+      #   if: ${{ matrix.language == 'nodejs' }}
+      #   uses: azure/login@v1
+      #   with:
+      #     # tkappler oidc-test - temporary unless our main app is OIDC-enabled
+      #     client-id: 89380e12-5be6-486a-89ef-eea107af2f47
+      #     tenant-id: ${{ env.ARM_TENANT_ID }}
+      #     subscription-id: ${{ env.ARM_SUBSCRIPTION_ID }}
+      # - name: Run OIDC tests via az cli
+      #   if: ${{ matrix.language == 'nodejs' }}
+      #   env:
+      #     ARM_CLIENT_SECRET: ""
+      #     TMPDIR: ${{ runner.temp }}
+      #   run: |
+      #     set -euo pipefail
+      #     cd examples
+      #     go test -v -json -count=1 -cover -timeout 15m -tags=${{ matrix.language }},oidc -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
+
       - name: Tar SDK folder
         if: ${{ matrix.language != 'go' }}
         run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .

examples/examples_nodejs_keyvault_test.go

@@ -0,0 +1,33 @@
+// Copyright 2016-2020, Pulumi Corporation.  All rights reserved.
+//go:build nodejs || (nodejs && oidc) || all
+
+package examples
+
+import (
+	"github.com/pulumi/pulumi/pkg/v3/testing/integration"
+	"path/filepath"
+	"testing"
+)
+
+func TestAccKeyVaultTs(t *testing.T) {
+	skipIfShort(t)
+	test := getJSBaseOptions2(t).
+		With(integration.ProgramTestOptions{
+			Dir: filepath.Join(getCwd(t), "keyvault"),
+		})
+
+	integration.ProgramTest(t, &test)
+}
+
+// A copy of getJSBaseOptions from examples_nodejs_test.go because that one
+// isn't built when testing with tag=oidc
+func getJSBaseOptions2(t *testing.T) integration.ProgramTestOptions {
+	base := getBaseOptions(t)
+	baseJS := base.With(integration.ProgramTestOptions{
+		Dependencies: []string{
+			"@pulumi/azure-native",
+		},
+	})
+
+	return baseJS
+}

examples/examples_nodejs_test.go

@@ -1,6 +1,5 @@
 // Copyright 2016-2020, Pulumi Corporation.  All rights reserved.
-//go:build nodejs || all
-// +build nodejs all
+//go:build (nodejs && !oidc) || all
 
 package examples
 
@@ -43,16 +42,6 @@ func TestAccCosmosDBTs(t *testing.T) {
 	integration.ProgramTest(t, &test)
 }
 
-func TestAccKeyVaultTs(t *testing.T) {
-	skipIfShort(t)
-	test := getJSBaseOptions(t).
-		With(integration.ProgramTestOptions{
-			Dir: filepath.Join(getCwd(t), "keyvault"),
-		})
-
-	integration.ProgramTest(t, &test)
-}
-
 func TestAccSimpleTs(t *testing.T) {
 	skipIfShort(t)
 	test := getJSBaseOptions(t).