sec(ci): replace secrets:inherit and static Azure creds with OIDC#538
sec(ci): replace secrets:inherit and static Azure creds with OIDC#538cristim wants to merge 2 commits into
Conversation
Replace `secrets: inherit` in deploy-all.yml with explicit per-secret
passes limited to what each downstream workflow actually consumes.
Replace `creds: ${{ secrets.AZURE_CREDENTIALS }}` (static service-principal
JSON) in rollback.yml and database-migration.yml with the OIDC-federation
form (`client-id`, `tenant-id`, `subscription-id`); both workflows already
declare `id-token: write` permissions so OIDC works without further changes.
Closes #433
cristim
added
triaged
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughGitHub Actions workflows updated to harden CI security: Azure authentication migrated from static credentials to OIDC federation across database-migration.yml and rollback.yml; deploy-all.yml replaces blanket ChangesWorkflow Security Hardening
Sequence Diagram(s)sequenceDiagram
participant Workflow as GitHub_Actions_Workflow
participant AzureLogin as azure/login@v3
participant AzureAPI as Azure_API
Workflow->>AzureLogin: pass client-id, tenant-id, subscription-id
AzureLogin->>AzureAPI: request OIDC token exchange
AzureAPI-->>AzureLogin: return short-lived access token
AzureLogin-->>Workflow: provide authenticated session for Azure steps
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy-all.yml:
- Around line 125-129: Add the missing secret declarations under each reusable
workflow's on.workflow_call.secrets: in deploy-aws-lambda.yml declare
ADMIN_EMAIL, DASHBOARD_URL, FROM_EMAIL, TF_BACKEND_AWS; in
deploy-aws-fargate.yml declare ADMIN_EMAIL, TF_BACKEND_AWS; in deploy-gcp.yml
declare ADMIN_EMAIL, TF_BACKEND_GCP; and in deploy-azure.yml declare
ADMIN_EMAIL, AZURE_CLIENT_ID, AZURE_SUBSCRIPTION_ID, AZURE_TENANT_ID,
TF_BACKEND_AZURE so that the called workflows accept the secrets passed from
deploy-all.yml.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6867b8bf-c99d-4293-94be-da168d5383f2
📒 Files selected for processing (3)
.github/workflows/database-migration.yml.github/workflows/deploy-all.yml.github/workflows/rollback.yml
Each deploy-*.yml reusable workflow lacked an on.workflow_call.secrets block, so GitHub Actions rejected secret pass-through from deploy-all.yml (which uses explicit secrets: rather than secrets: inherit). Add the required secrets declarations to deploy-aws-lambda.yml, deploy-aws-fargate.yml, deploy-gcp.yml, and deploy-azure.yml so that actionlint and GitHub Actions validate the caller/callee contract cleanly.
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai resolve |
✅ Actions performedComments resolved. Approval is disabled; enable |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
CR finding addressed: missing workflow_call.secrets declarationsThe CodeRabbit finding (critical) was already fixed in commit b810919 (pushed 2026-05-20), which was not included in the reviewed commit set (ddda64f). Verified:
@coderabbitai review |
|
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
1 participant
Summary
secrets: inheritblocks with explicit secret maps containing only the secrets each downstream workflow actually uses (audited from each callee's${{ secrets.* }}references). No downstream workflow can now receive secrets it does not need.creds: ${{ secrets.AZURE_CREDENTIALS }}(long-lived static service-principal JSON blob) with the OIDC-federation form usingclient-id,tenant-id, andsubscription-id. Both workflows already declareid-token: writeat the top-levelpermissionsblock, so no permission change is required.Closes #433
Test plan
azure/loginOIDC form works by checking thatAZURE_CLIENT_ID,AZURE_TENANT_ID,AZURE_SUBSCRIPTION_IDsecrets are configured in the repo (they are already used byazure_sanity.yml)secrets: inheritin workflow files to confirm none remain:grep -r "secrets: inherit" .github/workflows/AZURE_CREDENTIALSreferences:grep -r "AZURE_CREDENTIALS" .github/workflows/Summary by CodeRabbit