Compare commits
3 commits
master
...
sy/improve
| Author | SHA1 | Date | |
|---|---|---|---|
|
5c5b557200 | ||
|
|
2e05c531c4 | ||
|
|
2d52a1a40d |
23 changed files with 10023 additions and 433 deletions
2
.github/CODEOWNERS
vendored
2
.github/CODEOWNERS
vendored
|
|
@ -1 +1 @@
|
|||
@YanaXu
|
||||
@kaverma @kanika1894 @BALAGA-GAYATRI @pulkitaggarwl
|
||||
|
|
|
|||
3
.github/workflows/azure-login-canary.yml
vendored
3
.github/workflows/azure-login-canary.yml
vendored
|
|
@ -30,7 +30,7 @@ jobs:
|
|||
az --version
|
||||
|
||||
- name: Check out repository
|
||||
uses: actions/checkout@v6
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: 'Az CLI login with subscription'
|
||||
uses: azure/login@v1
|
||||
|
|
@ -89,3 +89,4 @@ jobs:
|
|||
- name: Post to slack
|
||||
shell: bash
|
||||
run: curl -X POST -H 'Content-type:application/json' --data '{"blocks":[{"type":"section","text":{"type":"mrkdwn","text":"${{steps.slack_report.outputs.report}}"}}]}' https://hooks.slack.com/services/${{SECRETS.SLACK_CHANNEL_SECRET}}
|
||||
|
||||
|
|
|
|||
|
|
@ -37,7 +37,7 @@ jobs:
|
|||
creds: ${{ secrets.AZURE_CREDENTIALS }}
|
||||
enable-AzPSSession: true
|
||||
|
||||
- uses: azure/powershell@v3
|
||||
- uses: azure/powershell@v1
|
||||
with:
|
||||
inlineScript: "(Get-AzContext).Environment.Name"
|
||||
azPSVersion: "latest"
|
||||
|
|
@ -49,7 +49,7 @@ jobs:
|
|||
enable-AzPSSession: true
|
||||
allow-no-subscriptions: true
|
||||
|
||||
- uses: azure/powershell@v3
|
||||
- uses: azure/powershell@v1
|
||||
with:
|
||||
inlineScript: "(Get-AzContext).Environment.Name"
|
||||
azPSVersion: "latest"
|
||||
|
|
@ -87,7 +87,7 @@ jobs:
|
|||
subscription-id: ${{ secrets.AZURE_SUBSCRIPTIONID }}
|
||||
enable-AzPSSession: true
|
||||
|
||||
- uses: azure/powershell@v3
|
||||
- uses: azure/powershell@v1
|
||||
with:
|
||||
inlineScript: "(Get-AzContext).Environment.Name"
|
||||
azPSVersion: "latest"
|
||||
|
|
@ -100,7 +100,7 @@ jobs:
|
|||
enable-AzPSSession: true
|
||||
allow-no-subscriptions: true
|
||||
|
||||
- uses: azure/powershell@v3
|
||||
- uses: azure/powershell@v1
|
||||
with:
|
||||
inlineScript: "(Get-AzContext).Environment.Name"
|
||||
azPSVersion: "latest"
|
||||
|
|
@ -126,4 +126,4 @@ jobs:
|
|||
|
||||
- name: Post to slack
|
||||
shell: bash
|
||||
run: curl -X POST -H 'Content-type:application/json' --data '{"blocks":[{"type":"section","text":{"type":"mrkdwn","text":"${{steps.slack_report.outputs.report}}"}}]}' https://hooks.slack.com/services/${{SECRETS.SLACK_CHANNEL_SECRET}}
|
||||
run: curl -X POST -H 'Content-type:application/json' --data '{"blocks":[{"type":"section","text":{"type":"mrkdwn","text":"${{steps.slack_report.outputs.report}}"}}]}' https://hooks.slack.com/services/${{SECRETS.SLACK_CHANNEL_SECRET}}
|
||||
|
|
|
|||
57
.github/workflows/azure-login-negative.yml
vendored
57
.github/workflows/azure-login-negative.yml
vendored
|
|
@ -19,12 +19,12 @@ jobs:
|
|||
steps:
|
||||
|
||||
- name: 'Checking out repo code'
|
||||
uses: actions/checkout@v6
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set Node.js 24.x for GitHub Action
|
||||
uses: actions/setup-node@v6
|
||||
- name: Set Node.js 20.x for GitHub Action
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24.x
|
||||
node-version: 20.x
|
||||
|
||||
- name: 'Validate build'
|
||||
run: |
|
||||
|
|
@ -58,7 +58,7 @@ jobs:
|
|||
- name: Run Azure PowerShell
|
||||
id: ps_3
|
||||
continue-on-error: true
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
|
|
@ -82,12 +82,12 @@ jobs:
|
|||
|
||||
steps:
|
||||
- name: 'Checking out repo code'
|
||||
uses: actions/checkout@v6
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set Node.js 24.x for GitHub Action
|
||||
uses: actions/setup-node@v6
|
||||
- name: Set Node.js 20.x for GitHub Action
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24.x
|
||||
node-version: 20.x
|
||||
|
||||
- name: 'Validate build'
|
||||
run: |
|
||||
|
|
@ -186,7 +186,7 @@ jobs:
|
|||
- name: Run Azure PowerShell
|
||||
id: ps_8
|
||||
continue-on-error: true
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
|
|
@ -216,7 +216,7 @@ jobs:
|
|||
- name: Run Azure PowerShell
|
||||
id: ps_9
|
||||
continue-on-error: true
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
|
|
@ -332,4 +332,37 @@ jobs:
|
|||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
core.setFailed('Last action should fail but not. Please check it.')
|
||||
core.setFailed('Last action should fail but not. Please check it.')
|
||||
|
||||
VMTest:
|
||||
strategy:
|
||||
matrix:
|
||||
os: [self_linux, self_windows]
|
||||
runs-on: ${{ matrix.os }}
|
||||
environment: Automation test
|
||||
|
||||
steps:
|
||||
- name: 'Checking out repo code'
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set Node.js 20.x for GitHub Action
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 20.x
|
||||
|
||||
- name: 'Validate build'
|
||||
run: |
|
||||
npm install
|
||||
npm run build
|
||||
|
||||
- name: Login with system-assigned managed identity without auth-type
|
||||
id: login_14
|
||||
continue-on-error: true
|
||||
uses: ./
|
||||
|
||||
- name: Check Last step failed
|
||||
if: steps.login_14.outcome == 'success'
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
core.setFailed('Last action should fail but not. Please check it.')
|
||||
|
|
|
|||
192
.github/workflows/azure-login-positive.yml
vendored
192
.github/workflows/azure-login-positive.yml
vendored
|
|
@ -12,18 +12,18 @@ jobs:
|
|||
BasicTest:
|
||||
strategy:
|
||||
matrix:
|
||||
os: [ubuntu-latest, windows-latest, macos-latest]
|
||||
os: [ubuntu-latest, windows-latest, macos-latest, self_linux, self_windows]
|
||||
runs-on: ${{ matrix.os }}
|
||||
environment: Automation test
|
||||
|
||||
steps:
|
||||
- name: 'Checking out repo code'
|
||||
uses: actions/checkout@v6
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set Node.js 24.x for GitHub Action
|
||||
uses: actions/setup-node@v6
|
||||
- name: Set Node.js 20.x for GitHub Action
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24.x
|
||||
node-version: 20.x
|
||||
|
||||
- name: 'Validate build'
|
||||
run: |
|
||||
|
|
@ -47,11 +47,13 @@ jobs:
|
|||
az vm list --output none
|
||||
|
||||
- name: Run Azure PowerShell
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
$checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
|
||||
$checkResult = $checkResult -and ((Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG')
|
||||
$checkResult = $checkResult -and ((Get-AzVM).Count -gt 0)
|
||||
if(-not $checkResult){
|
||||
throw "Not all checks passed!"
|
||||
}
|
||||
|
|
@ -69,7 +71,7 @@ jobs:
|
|||
az account show --output none
|
||||
|
||||
- name: Run Azure PowerShell again
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
|
|
@ -92,11 +94,13 @@ jobs:
|
|||
az vm list --output none
|
||||
|
||||
- name: Run Azure PowerShell
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
$checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
|
||||
$checkResult = $checkResult -and ((Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG')
|
||||
$checkResult = $checkResult -and ((Get-AzVM).Count -gt 0)
|
||||
if(-not $checkResult){
|
||||
throw "Not all checks passed!"
|
||||
}
|
||||
|
|
@ -110,12 +114,12 @@ jobs:
|
|||
|
||||
steps:
|
||||
- name: 'Checking out repo code'
|
||||
uses: actions/checkout@v6
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set Node.js 24.x for GitHub Action
|
||||
uses: actions/setup-node@v6
|
||||
- name: Set Node.js 20.x for GitHub Action
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24.x
|
||||
node-version: 20.x
|
||||
|
||||
- name: 'Validate build'
|
||||
run: |
|
||||
|
|
@ -160,11 +164,13 @@ jobs:
|
|||
az vm list --output none
|
||||
|
||||
- name: Run Azure PowerShell
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
$checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
|
||||
$checkResult = $checkResult -and ((Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG')
|
||||
$checkResult = $checkResult -and ((Get-AzVM).Count -gt 0)
|
||||
if(-not $checkResult){
|
||||
throw "Not all checks passed!"
|
||||
}
|
||||
|
|
@ -183,7 +189,7 @@ jobs:
|
|||
az account show --output none
|
||||
|
||||
- name: Run Azure PowerShell again
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
|
|
@ -209,7 +215,7 @@ jobs:
|
|||
}
|
||||
|
||||
- name: Run Azure PowerShell
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
|
|
@ -230,7 +236,7 @@ jobs:
|
|||
az account show --output none
|
||||
|
||||
- name: Run Azure PowerShell
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
|
|
@ -239,78 +245,118 @@ jobs:
|
|||
throw "Not all checks passed!"
|
||||
}
|
||||
|
||||
InDockerTest:
|
||||
runs-on: ubuntu-latest
|
||||
container: ubuntu:24.04
|
||||
VMTest:
|
||||
strategy:
|
||||
matrix:
|
||||
os: [self_linux, self_windows]
|
||||
runs-on: ${{ matrix.os }}
|
||||
environment: Automation test
|
||||
|
||||
steps:
|
||||
- name: 'Checking out repo code'
|
||||
uses: actions/checkout@v6
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set Node.js 24.x for GitHub Action
|
||||
uses: actions/setup-node@v6
|
||||
- name: Set Node.js 20.x for GitHub Action
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24.x
|
||||
|
||||
- name: Install Azure CLI
|
||||
run: |
|
||||
apt-get update
|
||||
apt-get install -y curl
|
||||
curl -sL https://aka.ms/InstallAzureCLIDeb | bash
|
||||
|
||||
- name: Check Azure CLI Version
|
||||
run: |
|
||||
az --version
|
||||
|
||||
- name: Install Powershell
|
||||
run: |
|
||||
apt-get update
|
||||
apt-get install -y wget apt-transport-https software-properties-common
|
||||
wget -q "https://packages.microsoft.com/config/ubuntu/24.04/packages-microsoft-prod.deb"
|
||||
dpkg -i packages-microsoft-prod.deb
|
||||
rm packages-microsoft-prod.deb
|
||||
apt-get update
|
||||
apt-get install -y powershell
|
||||
|
||||
- name: Check Powershell Version
|
||||
shell: pwsh
|
||||
run: |
|
||||
$PSVersionTable
|
||||
|
||||
- name: Install Azure Powershell
|
||||
shell: pwsh
|
||||
run: |
|
||||
Install-Module -Name Az -Repository PSGallery -Force
|
||||
|
||||
- name: Check Azure Powershell Version
|
||||
shell: pwsh
|
||||
run: |
|
||||
Get-Module -ListAvailable Az
|
||||
node-version: 20.x
|
||||
|
||||
- name: 'Validate build'
|
||||
run: |
|
||||
npm install
|
||||
npm run build
|
||||
|
||||
- name: 'Run L0 tests'
|
||||
run: |
|
||||
npm run test
|
||||
|
||||
- name: Login with individual parameters
|
||||
- name: Login with system-assigned managed identity, no subscription-id
|
||||
uses: ./
|
||||
with:
|
||||
client-id: ${{ secrets.SP1_CLIENT_ID }}
|
||||
tenant-id: ${{ secrets.SP1_TENANT_ID }}
|
||||
subscription-id: ${{ secrets.SP1_SUBSCRIPTION_ID }}
|
||||
auth-type: IDENTITY
|
||||
allow-no-subscriptions: true
|
||||
enable-AzPSSession: true
|
||||
|
||||
- name: Run Azure Cli again
|
||||
|
||||
- name: Run Azure Cli
|
||||
run: |
|
||||
az group list --output none
|
||||
|
||||
- name: Run Azure PowerShell again
|
||||
uses: azure/powershell@v3
|
||||
az account show --output none
|
||||
|
||||
- name: Run Azure PowerShell
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
$checkResult = Get-AzResourceGroup
|
||||
$checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
|
||||
if(-not $checkResult){
|
||||
throw "Not all checks passed!"
|
||||
}
|
||||
|
||||
- name: Login with system-assigned managed identity, with subscription id
|
||||
uses: ./
|
||||
with:
|
||||
auth-type: IDENTITY
|
||||
subscription-id: ${{ secrets.AZURE_SUBSCRIPTIONID }}
|
||||
enable-AzPSSession: true
|
||||
|
||||
- name: Run Azure Cli
|
||||
run: |
|
||||
az account show --output none
|
||||
az group show --name GitHubAction_CI_RG --output none
|
||||
az vm list --output none
|
||||
|
||||
- name: Run Azure PowerShell
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
$checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
|
||||
$checkResult = $checkResult -and ((Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG')
|
||||
$checkResult = $checkResult -and ((Get-AzVM).Count -gt 0)
|
||||
if(-not $checkResult){
|
||||
throw "Not all checks passed!"
|
||||
}
|
||||
|
||||
- name: Login with tenant-level user-assigned managed identity with allow-no-subscriptions
|
||||
uses: ./
|
||||
with:
|
||||
client-id: ${{ secrets.UMI2_CLIENT_ID }}
|
||||
allow-no-subscriptions: true
|
||||
auth-type: IDENTITY
|
||||
enable-AzPSSession: true
|
||||
|
||||
- name: Run Azure Cli
|
||||
run: |
|
||||
az account show --output none
|
||||
|
||||
- name: Run Azure PowerShell
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
$checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
|
||||
if(-not $checkResult){
|
||||
throw "Not all checks passed!"
|
||||
}
|
||||
|
||||
- name: Login with user-assigned managed identity, subscription-id
|
||||
uses: ./
|
||||
with:
|
||||
client-id: ${{ secrets.UMI1_CLIENT_ID }}
|
||||
subscription-id: ${{ secrets.UMI1_SUBSCRIPTION_ID }}
|
||||
auth-type: IDENTITY
|
||||
enable-AzPSSession: true
|
||||
|
||||
- name: Run Azure Cli
|
||||
run: |
|
||||
az account show --output none
|
||||
az group show --name GitHubAction_CI_RG --output none
|
||||
az vm list --output none
|
||||
|
||||
- name: Run Azure PowerShell
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
$checkResult = (Get-AzContext).Environment.Name -eq 'AzureCloud'
|
||||
$checkResult = $checkResult -and ((Get-AzResourceGroup -Name GitHubAction_CI_RG).ResourceGroupName -eq 'GitHubAction_CI_RG')
|
||||
$checkResult = $checkResult -and ((Get-AzVM).Count -gt 0)
|
||||
if(-not $checkResult){
|
||||
throw "Not all checks passed!"
|
||||
}
|
||||
|
||||
|
|
|
|||
56
.github/workflows/azure-login-pr-check.yml
vendored
56
.github/workflows/azure-login-pr-check.yml
vendored
|
|
@ -1,25 +1,26 @@
|
|||
name: pr-check
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
pull_request_target:
|
||||
branches:
|
||||
- master
|
||||
- 'releases/*'
|
||||
jobs:
|
||||
az-login-test:
|
||||
environment: Automation test
|
||||
runs-on: windows-latest
|
||||
steps:
|
||||
- name: Checkout from PR branch
|
||||
uses: actions/checkout@v6
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: ${{ github.event.pull_request.head.repo.full_name }}
|
||||
ref: ${{ github.event.pull_request.head.ref }}
|
||||
|
||||
# Using 24.x version as an example
|
||||
- name: Set Node.js 24.x for GitHub Action
|
||||
uses: actions/setup-node@v6
|
||||
# Using 20.x version as an example
|
||||
- name: Set Node.js 20.x for GitHub Action
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24.x
|
||||
node-version: 20.x
|
||||
|
||||
- name: installing node_modules
|
||||
run: npm install
|
||||
|
|
@ -27,5 +28,44 @@ jobs:
|
|||
- name: Build GitHub Action
|
||||
run: npm run build
|
||||
|
||||
- name: Run mock test
|
||||
run: npm run test
|
||||
- name: 'Az CLI login with subscription'
|
||||
uses: ./
|
||||
with:
|
||||
creds: ${{ secrets.AZURE_CREDENTIALS }}
|
||||
|
||||
- run: |
|
||||
az account show --output none
|
||||
az vm list --output none
|
||||
|
||||
- name: 'Az CLI login without subscription'
|
||||
uses: ./
|
||||
with:
|
||||
creds: ${{ secrets.AZURE_CREDENTIALS_NO_SUB }}
|
||||
allow-no-subscriptions: true
|
||||
|
||||
- run: |
|
||||
az account show --output none
|
||||
# az vm list --output none
|
||||
|
||||
- name: 'Azure PowerShell login with subscription'
|
||||
uses: ./
|
||||
with:
|
||||
creds: ${{ secrets.AZURE_CREDENTIALS }}
|
||||
enable-AzPSSession: true
|
||||
|
||||
- uses: azure/powershell@v1
|
||||
with:
|
||||
inlineScript: "(Get-AzContext).Environment.Name"
|
||||
azPSVersion: "latest"
|
||||
|
||||
# - name: 'Azure PowerShell login without subscription'
|
||||
# uses: ./
|
||||
# with:
|
||||
# creds: ${{secrets.AZURE_CREDENTIALS_NO_SUB}}
|
||||
# enable-AzPSSession: true
|
||||
# allow-no-subscriptions: true
|
||||
|
||||
# - uses: azure/powershell@v1
|
||||
# with:
|
||||
# inlineScript: "Get-AzContext"
|
||||
# azPSVersion: "latest"
|
||||
|
|
|
|||
8
.github/workflows/ci.yml
vendored
8
.github/workflows/ci.yml
vendored
|
|
@ -18,12 +18,12 @@ jobs:
|
|||
steps:
|
||||
|
||||
- name: 'Checking out repo code'
|
||||
uses: actions/checkout@v6
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set Node.js 24.x for GitHub Action
|
||||
uses: actions/setup-node@v6
|
||||
- name: Set Node.js 20.x for GitHub Action
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24.x
|
||||
node-version: 20.x
|
||||
|
||||
- name: 'Validate build'
|
||||
run: |
|
||||
|
|
|
|||
2
.github/workflows/codeql.yml
vendored
2
.github/workflows/codeql.yml
vendored
|
|
@ -19,7 +19,7 @@ jobs:
|
|||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v6
|
||||
uses: actions/checkout@v4
|
||||
|
||||
# Initializes the CodeQL tools for scanning.
|
||||
- name: Initialize CodeQL
|
||||
|
|
|
|||
6
.github/workflows/markdownlint.yml
vendored
6
.github/workflows/markdownlint.yml
vendored
|
|
@ -7,11 +7,11 @@ jobs:
|
|||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v4
|
||||
- name: Use Node.js
|
||||
uses: actions/setup-node@v6
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24.x
|
||||
node-version: 20.x
|
||||
- name: Run Markdownlint
|
||||
run: |
|
||||
npm i -g markdownlint-cli2
|
||||
|
|
|
|||
|
|
@ -7,4 +7,3 @@ Resources:
|
|||
- [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/)
|
||||
- [Microsoft Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/)
|
||||
- Contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with questions or concerns
|
||||
- Employees can reach out at [aka.ms/opensource/moderation-support](https://aka.ms/opensource/moderation-support)
|
||||
|
|
|
|||
212
README.md
212
README.md
|
|
@ -19,7 +19,6 @@
|
|||
- [Login to Azure US Government cloud](#login-to-azure-us-government-cloud)
|
||||
- [Login to Azure Stack Hub](#login-to-azure-stack-hub)
|
||||
- [Login without subscription](#login-without-subscription)
|
||||
- [Enable/Disable the cleanup steps](#enabledisable-the-cleanup-steps)
|
||||
- [Security hardening](#security-hardening)
|
||||
- [Azure CLI dependency](#azure-cli-dependency)
|
||||
- [Reference](#reference)
|
||||
|
|
@ -57,7 +56,7 @@ Azure Login Action supports different ways of authentication with Azure.
|
|||
|tenant-id|false|UUID||the login tenant id|
|
||||
|creds|false|string||a json string for login with an Azure service principal|
|
||||
|enable-AzPSSession|false|boolean|false|if Azure PowerShell login is enabled|
|
||||
|environment|false|string|azurecloud|the Azure Cloud environment. For cloud environments other than the public cloud, the `audience` will also need to be updated.|
|
||||
|environment|false|string|azurecloud|the Azure Cloud environment|
|
||||
|allow-no-subscriptions|false|boolean|false|if login without subscription is allowed|
|
||||
|audience|false|string|api://AzureADTokenExchange|the audience to get the JWT ID token from GitHub OIDC provider|
|
||||
|auth-type|false|string|SERVICE_PRINCIPAL|the auth type|
|
||||
|
|
@ -127,8 +126,6 @@ By default, Azure Login Action connects to the Azure Public Cloud (`AzureCloud`)
|
|||
|
||||
To login to one of the Azure Government clouds or Azure Stack, set `environment` to one of the supported values `AzureUSGovernment` or `AzureChinaCloud` or `AzureGermanCloud` or `AzureStack`.
|
||||
|
||||
The default [`audience`](#audience) for each of these clouds is different and will also need to be set if using anything other than the public environment.
|
||||
|
||||
Refer to [Login to Azure US Government cloud](#login-to-azure-us-government-cloud) for its usage.
|
||||
|
||||
### `allow-no-subscriptions`
|
||||
|
|
@ -156,7 +153,7 @@ Refer to [Login With System-assigned Managed Identity](#login-with-system-assign
|
|||
> - Ensure the CLI version is 2.30 or above to support login with OIDC.
|
||||
> - By default, Azure access tokens issued during OIDC based login could have limited validity. Azure access token issued by Service Principal is expected to have an expiration of 1 hour by default. And with Managed Identities, it would be 24 hours. This expiration time is further configurable in Azure. Refer to [access-token lifetime](https://learn.microsoft.com/azure/active-directory/develop/access-tokens#access-token-lifetime) for more details.
|
||||
|
||||
Before you use Azure Login Action with OIDC, you need to configure a federated identity credential on a service principal or a managed identity.
|
||||
Before you use Azure Login Action with OIDC, you need to configure a federated identity credential on an service principal or a managed identity.
|
||||
|
||||
- Prepare a service principal for Login with OIDC
|
||||
- [Create a service principal and assign a role to it](https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal)
|
||||
|
|
@ -186,21 +183,21 @@ name: Run Azure Login with OIDC
|
|||
on: [push]
|
||||
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
jobs:
|
||||
id-token: write
|
||||
contents: read
|
||||
jobs:
|
||||
build-and-deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Azure login
|
||||
uses: azure/login@v3
|
||||
uses: azure/login@v2
|
||||
with:
|
||||
client-id: ${{ secrets.AZURE_CLIENT_ID }}
|
||||
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
|
||||
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
|
||||
|
||||
|
||||
- name: Azure CLI script
|
||||
uses: azure/cli@v2
|
||||
uses: azure/CLI@v1
|
||||
with:
|
||||
azcliversion: latest
|
||||
inlineScript: |
|
||||
|
|
@ -216,29 +213,29 @@ name: Run Azure Login with OIDC
|
|||
on: [push]
|
||||
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
jobs:
|
||||
id-token: write
|
||||
contents: read
|
||||
jobs:
|
||||
build-and-deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Azure login
|
||||
uses: azure/login@v3
|
||||
uses: azure/login@v2
|
||||
with:
|
||||
client-id: ${{ secrets.AZURE_CLIENT_ID }}
|
||||
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
|
||||
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
|
||||
enable-AzPSSession: true
|
||||
|
||||
|
||||
- name: Azure CLI script
|
||||
uses: azure/cli@v2
|
||||
uses: azure/CLI@v1
|
||||
with:
|
||||
azcliversion: latest
|
||||
inlineScript: |
|
||||
az account show
|
||||
|
||||
- name: Azure PowerShell script
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
|
|
@ -284,17 +281,18 @@ jobs:
|
|||
build-and-deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
|
||||
- uses: azure/login@v3
|
||||
|
||||
- uses: azure/login@v2
|
||||
with:
|
||||
creds: ${{ secrets.AZURE_CREDENTIALS }}
|
||||
|
||||
|
||||
- name: Azure CLI script
|
||||
uses: azure/cli@v2
|
||||
uses: azure/CLI@v1
|
||||
with:
|
||||
azcliversion: latest
|
||||
inlineScript: |
|
||||
az account show
|
||||
|
||||
```
|
||||
|
||||
- **The workflow sample to run both Azure CLI and Azure PowerShell**
|
||||
|
|
@ -311,21 +309,21 @@ jobs:
|
|||
build-and-deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
|
||||
- uses: azure/login@v3
|
||||
|
||||
- uses: azure/login@v2
|
||||
with:
|
||||
creds: ${{ secrets.AZURE_CREDENTIALS }}
|
||||
enable-AzPSSession: true
|
||||
|
||||
|
||||
- name: Azure CLI script
|
||||
uses: azure/cli@v2
|
||||
uses: azure/CLI@v1
|
||||
with:
|
||||
azcliversion: latest
|
||||
inlineScript: |
|
||||
az account show
|
||||
|
||||
- name: Azure PowerShell script
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
|
|
@ -335,7 +333,7 @@ jobs:
|
|||
If you want to pass subscription ID, tenant ID, client ID, and client secret as individual parameters instead of bundling them in a single JSON object to address the [security concerns](https://docs.github.com/actions/security-guides/encrypted-secrets), below snippet can help with the same.
|
||||
|
||||
```yaml
|
||||
- uses: azure/login@v3
|
||||
- uses: azure/login@v2
|
||||
with:
|
||||
creds: '{"clientId":"${{ secrets.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ secrets.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ secrets.AZURE_TENANT_ID }}"}'
|
||||
```
|
||||
|
|
@ -374,29 +372,29 @@ Now you can try the workflow to login with system-assigned managed identity.
|
|||
name: Run Azure Login with System-assigned Managed Identity
|
||||
on: [push]
|
||||
|
||||
jobs:
|
||||
jobs:
|
||||
build-and-deploy:
|
||||
runs-on: self-hosted
|
||||
steps:
|
||||
- name: Azure login
|
||||
uses: azure/login@v3
|
||||
uses: azure/login@v2
|
||||
with:
|
||||
auth-type: IDENTITY
|
||||
auth-type: IDENTITY
|
||||
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
|
||||
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
|
||||
enable-AzPSSession: true
|
||||
|
||||
# Azure CLI Action only supports linux self-hosted runners for now.
|
||||
# If you want to execute the Azure CLI script on a windows self-hosted runner, you can execute it directly in `run`.
|
||||
# Azure CLI Action only supports linux self-hosted runners for now.
|
||||
# If you want to execute the Azure CLI script on a windows self-hosted runner, you can execute it directly in `run`.
|
||||
- name: Azure CLI script
|
||||
uses: azure/cli@v2
|
||||
uses: azure/CLI@v1
|
||||
with:
|
||||
azcliversion: latest
|
||||
inlineScript: |
|
||||
az account show
|
||||
|
||||
- name: Azure PowerShell script
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
|
|
@ -440,30 +438,30 @@ Now you can try the workflow to login with user-assigned managed identity.
|
|||
name: Run Azure Login with User-assigned Managed Identity
|
||||
on: [push]
|
||||
|
||||
jobs:
|
||||
jobs:
|
||||
build-and-deploy:
|
||||
runs-on: self-hosted
|
||||
steps:
|
||||
- name: Azure login
|
||||
uses: azure/login@v3
|
||||
uses: azure/login@v2
|
||||
with:
|
||||
auth-type: IDENTITY
|
||||
client-id: ${{ secrets.AZURE_CLIENT_ID }}
|
||||
client-id: ${{ secrets.AZURE_CLIENT_ID }}
|
||||
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
|
||||
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
|
||||
enable-AzPSSession: true
|
||||
|
||||
# Azure CLI Action only supports linux self-hosted runners for now.
|
||||
# If you want to execute the Azure CLI script on a windows self-hosted runner, you can execute it directly in `run`.
|
||||
# Azure CLI Action only supports linux self-hosted runners for now.
|
||||
# If you want to execute the Azure CLI script on a windows self-hosted runner, you can execute it directly in `run`.
|
||||
- name: Azure CLI script
|
||||
uses: azure/cli@v2
|
||||
uses: azure/CLI@v1
|
||||
with:
|
||||
azcliversion: latest
|
||||
inlineScript: |
|
||||
az account show
|
||||
|
||||
- name: Azure PowerShell script
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
|
|
@ -484,12 +482,13 @@ jobs:
|
|||
build-and-deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
|
||||
- uses: azure/login@v3
|
||||
|
||||
- uses: azure/login@v2
|
||||
with:
|
||||
creds: ${{ secrets.AZURE_CREDENTIALS }}
|
||||
environment: 'AzureUSGovernment'
|
||||
enable-AzPSSession: true
|
||||
|
||||
```
|
||||
|
||||
### Login to Azure Stack Hub
|
||||
|
|
@ -506,12 +505,13 @@ jobs:
|
|||
build-and-deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
|
||||
- uses: azure/login@v3
|
||||
|
||||
- uses: azure/login@v2
|
||||
with:
|
||||
creds: ${{ secrets.AZURE_CREDENTIALS }}
|
||||
environment: 'AzureStack'
|
||||
enable-AzPSSession: true
|
||||
|
||||
```
|
||||
|
||||
Refer to the [Azure Stack Hub Login Action Tutorial](https://learn.microsoft.com/azure-stack/user/ci-cd-github-action-login-cli) for more detailed instructions.
|
||||
|
|
@ -534,7 +534,7 @@ jobs:
|
|||
steps:
|
||||
|
||||
- name: Azure Login
|
||||
uses: azure/login@v3
|
||||
uses: azure/login@v2
|
||||
with:
|
||||
client-id: ${{ secrets.AZURE_CLIENT_ID }}
|
||||
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
|
||||
|
|
@ -542,130 +542,20 @@ jobs:
|
|||
enable-AzPSSession: true
|
||||
|
||||
- name: Azure CLI script
|
||||
uses: azure/cli@v2
|
||||
uses: azure/CLI@v1
|
||||
with:
|
||||
azcliversion: latest
|
||||
inlineScript: |
|
||||
az account show
|
||||
|
||||
- name: Run Azure PowerShell
|
||||
uses: azure/powershell@v3
|
||||
uses: azure/powershell@v1
|
||||
with:
|
||||
azPSVersion: "latest"
|
||||
inlineScript: |
|
||||
Get-AzContext
|
||||
```
|
||||
|
||||
### Enable/Disable the cleanup steps
|
||||
|
||||
In Azure Login Action, "cleanup" means cleaning up the login context. For security reasons, we recommend users run cleanup every time. But in some scenarios, users need flexible control over cleanup.
|
||||
|
||||
Referring to [`runs` for JavaScript actions](https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions), there are 3 steps in an action: `pre:`, `main:` and `post:`. Azure Login Action only implement 2 steps: `main:` and `post:`.
|
||||
|
||||
There are 2 "cleanup" steps in Azure Login Action:
|
||||
|
||||
- cleanup in `main:`
|
||||
- It's **disabled** by default.
|
||||
- Users can enable it by setting an env variable `AZURE_LOGIN_PRE_CLEANUP` to `true`.
|
||||
- cleanup in `post:`
|
||||
- It's **enabled** by default.
|
||||
- Users can disable it by setting an env variable `AZURE_LOGIN_POST_CLEANUP` to `false`.
|
||||
|
||||
Azure Login Action use env variables to enable or disable cleanup steps. In GitHub Actions, there are three valid scopes for env variables.
|
||||
|
||||
- [env](https://docs.github.com/actions/writing-workflows/workflow-syntax-for-github-actions#env)
|
||||
- valid for all jobs in this workflow.
|
||||
- [jobs.<job_id>.env](https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idenv)
|
||||
- valid for all the steps in the job.
|
||||
- [jobs.<job_id>.steps[*].env](https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsenv)
|
||||
- only valid for the step in a job.
|
||||
|
||||
We set `jobs.<job_id>.steps[*].env` for example. Users can set `env` or `jobs.<job_id>.env` for a wider scope.
|
||||
|
||||
```yaml
|
||||
# File: .github/workflows/workflow.yml
|
||||
|
||||
on: [push]
|
||||
|
||||
name: Cleanup examples for Multiple Azure Login
|
||||
|
||||
jobs:
|
||||
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
|
||||
# enable cleanup for the 1st Azure Login
|
||||
- name: Azure Login
|
||||
uses: azure/login@v3
|
||||
env:
|
||||
AZURE_LOGIN_PRE_CLEANUP: true
|
||||
AZURE_LOGIN_POST_CLEANUP: true
|
||||
with:
|
||||
client-id: ${{ secrets.AZURE_CLIENT_ID }}
|
||||
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
|
||||
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
|
||||
enable-AzPSSession: true
|
||||
|
||||
# run some actions
|
||||
|
||||
# disable cleanup for all other Azure Login
|
||||
- name: Azure Login 2
|
||||
uses: azure/login@v3
|
||||
env:
|
||||
AZURE_LOGIN_PRE_CLEANUP: false
|
||||
AZURE_LOGIN_POST_CLEANUP: false
|
||||
with:
|
||||
client-id: ${{ secrets.AZURE_CLIENT_ID_2 }}
|
||||
tenant-id: ${{ secrets.AZURE_TENANT_ID_2 }}
|
||||
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_2 }}
|
||||
enable-AzPSSession: true
|
||||
|
||||
# run other actions
|
||||
|
||||
# disable cleanup for all other Azure Login
|
||||
- name: Azure Login 3
|
||||
uses: azure/login@v3
|
||||
env:
|
||||
AZURE_LOGIN_PRE_CLEANUP: false
|
||||
AZURE_LOGIN_POST_CLEANUP: false
|
||||
with:
|
||||
client-id: ${{ secrets.AZURE_CLIENT_ID_3 }}
|
||||
tenant-id: ${{ secrets.AZURE_TENANT_ID_3 }}
|
||||
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_3 }}
|
||||
enable-AzPSSession: true
|
||||
|
||||
# run other actions
|
||||
```
|
||||
|
||||
```yaml
|
||||
# File: .github/workflows/workflow.yml
|
||||
|
||||
on: [push]
|
||||
|
||||
name: Disable cleanup for GitHub Hosted Runners
|
||||
|
||||
jobs:
|
||||
|
||||
deploy:
|
||||
runs-on: [ubuntu-latest, self-hosted]
|
||||
steps:
|
||||
|
||||
- name: Azure Login
|
||||
uses: azure/login@v3
|
||||
env:
|
||||
AZURE_LOGIN_PRE_CLEANUP: ${{ startsWith(runner.name, 'GitHub Actions') }}
|
||||
AZURE_LOGIN_POST_CLEANUP: ${{ startsWith(runner.name, 'GitHub Actions') }}
|
||||
with:
|
||||
client-id: ${{ secrets.AZURE_CLIENT_ID }}
|
||||
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
|
||||
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
|
||||
enable-AzPSSession: true
|
||||
|
||||
# run some actions
|
||||
|
||||
```
|
||||
|
||||
## Security hardening
|
||||
|
||||
> [!WARNING]
|
||||
|
|
@ -679,7 +569,7 @@ Internally in this action, we use azure CLI and execute `az login` with the cred
|
|||
|
||||
### GitHub Action
|
||||
|
||||
[GitHub Actions](https://docs.github.com/actions) gives you the flexibility to build an automated software development lifecycle workflow.
|
||||
[GitHub Actions](https://help.github.com/articles/about-github-actions) gives you the flexibility to build an automated software development lifecycle workflow.
|
||||
|
||||
### GitHub Actions for deploying to Azure
|
||||
|
||||
|
|
@ -705,4 +595,4 @@ provided by the bot. You will only need to do this once across all repos using o
|
|||
|
||||
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
|
||||
For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
|
||||
contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
|
||||
contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
|
||||
|
|
|
|||
|
|
@ -245,7 +245,7 @@ describe("LoginConfig Test", () => {
|
|||
|
||||
let loginConfig = new LoginConfig();
|
||||
await loginConfig.initialize();
|
||||
testValidateWithErrorMessage(loginConfig, "Ensure 'subscription-id' is supplied or 'allow-no-subscriptions' is 'true'.");
|
||||
testValidateWithErrorMessage(loginConfig, "Ensure subscriptionId is supplied.");
|
||||
});
|
||||
|
||||
test('validate without subscriptionId and allowNoSubscriptionsLogin=true', async () => {
|
||||
|
|
|
|||
|
|
@ -40,7 +40,7 @@ describe("Getting AzLogin PS script", () => {
|
|||
let loginConfig = new LoginConfig();
|
||||
loginConfig.initialize();
|
||||
return AzPSSCriptBuilder.getAzPSLoginScript(loginConfig).then(([loginMethod, loginScript]) => {
|
||||
expect(loginScript.includes("$psLoginSecrets = ConvertTo-SecureString 'client-secret' -AsPlainText -Force; $psLoginCredential = New-Object System.Management.Automation.PSCredential('client-id', $psLoginSecrets); Connect-AzAccount -ServicePrincipal -Environment 'azurecloud' -Tenant 'tenant-id' -Subscription 'subscription-id' -Credential $psLoginCredential -InformationAction Ignore | out-null;")).toBeTruthy();
|
||||
expect(loginScript.includes("$psLoginSecrets = ConvertTo-SecureString 'client-secret' -AsPlainText -Force; $psLoginCredential = New-Object System.Management.Automation.PSCredential('client-id', $psLoginSecrets); Connect-AzAccount -ServicePrincipal -Environment 'azurecloud' -Tenant 'tenant-id' -Subscription 'subscription-id' -Credential $psLoginCredential | out-null;")).toBeTruthy();
|
||||
expect(loginMethod).toBe('service principal with secret');
|
||||
});
|
||||
});
|
||||
|
|
@ -61,7 +61,7 @@ describe("Getting AzLogin PS script", () => {
|
|||
let loginConfig = new LoginConfig();
|
||||
loginConfig.initialize();
|
||||
return AzPSSCriptBuilder.getAzPSLoginScript(loginConfig).then(([loginMethod, loginScript]) => {
|
||||
expect(loginScript.includes("$psLoginSecrets = ConvertTo-SecureString 'client-se''cret' -AsPlainText -Force; $psLoginCredential = New-Object System.Management.Automation.PSCredential('client-id', $psLoginSecrets); Connect-AzAccount -ServicePrincipal -Environment 'azurecloud' -Tenant 'tenant-id' -Subscription 'subscription-id' -Credential $psLoginCredential -InformationAction Ignore | out-null;")).toBeTruthy();
|
||||
expect(loginScript.includes("$psLoginSecrets = ConvertTo-SecureString 'client-se''cret' -AsPlainText -Force; $psLoginCredential = New-Object System.Management.Automation.PSCredential('client-id', $psLoginSecrets); Connect-AzAccount -ServicePrincipal -Environment 'azurecloud' -Tenant 'tenant-id' -Subscription 'subscription-id' -Credential $psLoginCredential | out-null;")).toBeTruthy();
|
||||
expect(loginMethod).toBe('service principal with secret');
|
||||
});
|
||||
});
|
||||
|
|
@ -82,7 +82,7 @@ describe("Getting AzLogin PS script", () => {
|
|||
let loginConfig = new LoginConfig();
|
||||
loginConfig.initialize();
|
||||
return AzPSSCriptBuilder.getAzPSLoginScript(loginConfig).then(([loginMethod, loginScript]) => {
|
||||
expect(loginScript.includes("$psLoginSecrets = ConvertTo-SecureString 'client-secret' -AsPlainText -Force; $psLoginCredential = New-Object System.Management.Automation.PSCredential('client-id', $psLoginSecrets); Connect-AzAccount -ServicePrincipal -Environment 'azurecloud' -Tenant 'tenant-id' -Subscription 'subscription-id' -Credential $psLoginCredential -InformationAction Ignore | out-null;")).toBeTruthy();
|
||||
expect(loginScript.includes("$psLoginSecrets = ConvertTo-SecureString 'client-secret' -AsPlainText -Force; $psLoginCredential = New-Object System.Management.Automation.PSCredential('client-id', $psLoginSecrets); Connect-AzAccount -ServicePrincipal -Environment 'azurecloud' -Tenant 'tenant-id' -Subscription 'subscription-id' -Credential $psLoginCredential | out-null;")).toBeTruthy();
|
||||
expect(loginMethod).toBe('service principal with secret');
|
||||
});
|
||||
});
|
||||
|
|
@ -100,7 +100,7 @@ describe("Getting AzLogin PS script", () => {
|
|||
loginConfig.initialize();
|
||||
jest.spyOn(loginConfig, 'getFederatedToken').mockImplementation(async () => {loginConfig.federatedToken = "fake-token";});
|
||||
return AzPSSCriptBuilder.getAzPSLoginScript(loginConfig).then(([loginMethod, loginScript]) => {
|
||||
expect(loginScript.includes("Connect-AzAccount -ServicePrincipal -Environment 'azurecloud' -Tenant 'tenant-id' -Subscription 'subscription-id' -ApplicationId 'client-id' -FederatedToken 'fake-token' -InformationAction Ignore | out-null;")).toBeTruthy();
|
||||
expect(loginScript.includes("Connect-AzAccount -ServicePrincipal -Environment 'azurecloud' -Tenant 'tenant-id' -Subscription 'subscription-id' -ApplicationId 'client-id' -FederatedToken 'fake-token' | out-null;")).toBeTruthy();
|
||||
expect(loginMethod).toBe('OIDC');
|
||||
});
|
||||
});
|
||||
|
|
@ -115,7 +115,7 @@ describe("Getting AzLogin PS script", () => {
|
|||
let loginConfig = new LoginConfig();
|
||||
loginConfig.initialize();
|
||||
return AzPSSCriptBuilder.getAzPSLoginScript(loginConfig).then(([loginMethod, loginScript]) => {
|
||||
expect(loginScript.includes("Connect-AzAccount -Identity -Environment 'azurecloud' -Subscription 'subscription-id' -InformationAction Ignore | out-null;")).toBeTruthy();
|
||||
expect(loginScript.includes("Connect-AzAccount -Identity -Environment 'azurecloud' -Subscription 'subscription-id' | out-null;")).toBeTruthy();
|
||||
expect(loginMethod).toBe('system-assigned managed identity');
|
||||
});
|
||||
});
|
||||
|
|
@ -130,7 +130,7 @@ describe("Getting AzLogin PS script", () => {
|
|||
let loginConfig = new LoginConfig();
|
||||
loginConfig.initialize();
|
||||
return AzPSSCriptBuilder.getAzPSLoginScript(loginConfig).then(([loginMethod, loginScript]) => {
|
||||
expect(loginScript.includes("Connect-AzAccount -Identity -Environment 'azurecloud' -InformationAction Ignore | out-null;")).toBeTruthy();
|
||||
expect(loginScript.includes("Connect-AzAccount -Identity -Environment 'azurecloud' | out-null;")).toBeTruthy();
|
||||
expect(loginMethod).toBe('system-assigned managed identity');
|
||||
});
|
||||
});
|
||||
|
|
@ -145,7 +145,7 @@ describe("Getting AzLogin PS script", () => {
|
|||
let loginConfig = new LoginConfig();
|
||||
loginConfig.initialize();
|
||||
return AzPSSCriptBuilder.getAzPSLoginScript(loginConfig).then(([loginMethod, loginScript]) => {
|
||||
expect(loginScript.includes("Connect-AzAccount -Identity -Environment 'azurecloud' -AccountId 'client-id' -InformationAction Ignore | out-null;")).toBeTruthy();
|
||||
expect(loginScript.includes("Connect-AzAccount -Identity -Environment 'azurecloud' -AccountId 'client-id' | out-null;")).toBeTruthy();
|
||||
expect(loginMethod).toBe('user-assigned managed identity');
|
||||
});
|
||||
});
|
||||
|
|
|
|||
|
|
@ -38,7 +38,9 @@ branding:
|
|||
icon: 'login.svg'
|
||||
color: 'blue'
|
||||
runs:
|
||||
using: 'node24'
|
||||
using: 'node20'
|
||||
pre: 'lib/cleanup/index.js'
|
||||
pre-if: (! startsWith(runner.name, 'GitHub Actions'))
|
||||
main: 'lib/main/index.js'
|
||||
post-if: (!env.AZURE_LOGIN_POST_CLEANUP || env.AZURE_LOGIN_POST_CLEANUP != 'false')
|
||||
post: 'lib/cleanup/index.js'
|
||||
post-if: (! startsWith(runner.name, 'GitHub Actions'))
|
||||
|
|
|
|||
4632
lib/cleanup/index.js
Normal file
4632
lib/cleanup/index.js
Normal file
File diff suppressed because it is too large
Load diff
4911
lib/main/index.js
Normal file
4911
lib/main/index.js
Normal file
File diff suppressed because it is too large
Load diff
268
package-lock.json
generated
268
package-lock.json
generated
|
|
@ -1,12 +1,12 @@
|
|||
{
|
||||
"name": "login",
|
||||
"version": "3.0.0",
|
||||
"version": "2.0.0",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "login",
|
||||
"version": "3.0.0",
|
||||
"version": "2.0.0",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@actions/core": "1.9.1",
|
||||
|
|
@ -16,7 +16,7 @@
|
|||
},
|
||||
"devDependencies": {
|
||||
"@types/jest": "^29.2.4",
|
||||
"@types/node": "^24.0.0",
|
||||
"@types/node": "^20.11.1",
|
||||
"@vercel/ncc": "^0.38.1",
|
||||
"jest": "^29.3.1",
|
||||
"jest-circus": "^29.3.1",
|
||||
|
|
@ -77,20 +77,73 @@
|
|||
}
|
||||
},
|
||||
"node_modules/@babel/code-frame": {
|
||||
"version": "7.29.0",
|
||||
"resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
|
||||
"integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
|
||||
"version": "7.23.5",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@babel/helper-validator-identifier": "^7.28.5",
|
||||
"js-tokens": "^4.0.0",
|
||||
"picocolors": "^1.1.1"
|
||||
"@babel/highlight": "^7.23.4",
|
||||
"chalk": "^2.4.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=6.9.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/code-frame/node_modules/ansi-styles": {
|
||||
"version": "3.2.1",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"color-convert": "^1.9.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=4"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/code-frame/node_modules/chalk": {
|
||||
"version": "2.4.2",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"ansi-styles": "^3.2.1",
|
||||
"escape-string-regexp": "^1.0.5",
|
||||
"supports-color": "^5.3.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=4"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/code-frame/node_modules/color-convert": {
|
||||
"version": "1.9.3",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"color-name": "1.1.3"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/code-frame/node_modules/color-name": {
|
||||
"version": "1.1.3",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/@babel/code-frame/node_modules/escape-string-regexp": {
|
||||
"version": "1.0.5",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=0.8.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/code-frame/node_modules/supports-color": {
|
||||
"version": "5.5.0",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"has-flag": "^3.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=4"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/compat-data": {
|
||||
"version": "7.20.5",
|
||||
"dev": true,
|
||||
|
|
@ -268,9 +321,7 @@
|
|||
}
|
||||
},
|
||||
"node_modules/@babel/helper-string-parser": {
|
||||
"version": "7.27.1",
|
||||
"resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
|
||||
"integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
|
||||
"version": "7.23.4",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
|
|
@ -278,9 +329,7 @@
|
|||
}
|
||||
},
|
||||
"node_modules/@babel/helper-validator-identifier": {
|
||||
"version": "7.28.5",
|
||||
"resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
|
||||
"integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
|
||||
"version": "7.22.20",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
|
|
@ -296,28 +345,91 @@
|
|||
}
|
||||
},
|
||||
"node_modules/@babel/helpers": {
|
||||
"version": "7.29.2",
|
||||
"resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.2.tgz",
|
||||
"integrity": "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw==",
|
||||
"version": "7.20.6",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@babel/template": "^7.28.6",
|
||||
"@babel/types": "^7.29.0"
|
||||
"@babel/template": "^7.18.10",
|
||||
"@babel/traverse": "^7.20.5",
|
||||
"@babel/types": "^7.20.5"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=6.9.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/parser": {
|
||||
"version": "7.29.2",
|
||||
"resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.2.tgz",
|
||||
"integrity": "sha512-4GgRzy/+fsBa72/RZVJmGKPmZu9Byn8o4MoLpmNe1m8ZfYnz5emHLQz3U4gLud6Zwl0RZIcgiLD7Uq7ySFuDLA==",
|
||||
"node_modules/@babel/highlight": {
|
||||
"version": "7.23.4",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@babel/types": "^7.29.0"
|
||||
"@babel/helper-validator-identifier": "^7.22.20",
|
||||
"chalk": "^2.4.2",
|
||||
"js-tokens": "^4.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=6.9.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/highlight/node_modules/ansi-styles": {
|
||||
"version": "3.2.1",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"color-convert": "^1.9.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=4"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/highlight/node_modules/chalk": {
|
||||
"version": "2.4.2",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"ansi-styles": "^3.2.1",
|
||||
"escape-string-regexp": "^1.0.5",
|
||||
"supports-color": "^5.3.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=4"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/highlight/node_modules/color-convert": {
|
||||
"version": "1.9.3",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"color-name": "1.1.3"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/highlight/node_modules/color-name": {
|
||||
"version": "1.1.3",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/@babel/highlight/node_modules/escape-string-regexp": {
|
||||
"version": "1.0.5",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=0.8.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/highlight/node_modules/supports-color": {
|
||||
"version": "5.5.0",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"has-flag": "^3.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=4"
|
||||
}
|
||||
},
|
||||
"node_modules/@babel/parser": {
|
||||
"version": "7.23.9",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"bin": {
|
||||
"parser": "bin/babel-parser.js"
|
||||
},
|
||||
|
|
@ -489,15 +601,13 @@
|
|||
}
|
||||
},
|
||||
"node_modules/@babel/template": {
|
||||
"version": "7.28.6",
|
||||
"resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
|
||||
"integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
|
||||
"version": "7.23.9",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@babel/code-frame": "^7.28.6",
|
||||
"@babel/parser": "^7.28.6",
|
||||
"@babel/types": "^7.28.6"
|
||||
"@babel/code-frame": "^7.23.5",
|
||||
"@babel/parser": "^7.23.9",
|
||||
"@babel/types": "^7.23.9"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=6.9.0"
|
||||
|
|
@ -524,14 +634,13 @@
|
|||
}
|
||||
},
|
||||
"node_modules/@babel/types": {
|
||||
"version": "7.29.0",
|
||||
"resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
|
||||
"integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
|
||||
"version": "7.23.9",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@babel/helper-string-parser": "^7.27.1",
|
||||
"@babel/helper-validator-identifier": "^7.28.5"
|
||||
"@babel/helper-string-parser": "^7.23.4",
|
||||
"@babel/helper-validator-identifier": "^7.22.20",
|
||||
"to-fast-properties": "^2.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=6.9.0"
|
||||
|
|
@ -968,13 +1077,11 @@
|
|||
}
|
||||
},
|
||||
"node_modules/@types/node": {
|
||||
"version": "24.12.0",
|
||||
"resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.0.tgz",
|
||||
"integrity": "sha512-GYDxsZi3ChgmckRT9HPU0WEhKLP08ev/Yfcq2AstjrDASOYCSXeyjDsHg4v5t4jOj7cyDX3vmprafKlWIG9MXQ==",
|
||||
"version": "20.11.19",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"undici-types": "~7.16.0"
|
||||
"undici-types": "~5.26.4"
|
||||
}
|
||||
},
|
||||
"node_modules/@types/prettier": {
|
||||
|
|
@ -1163,9 +1270,7 @@
|
|||
"license": "MIT"
|
||||
},
|
||||
"node_modules/brace-expansion": {
|
||||
"version": "1.1.12",
|
||||
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
|
||||
"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
|
||||
"version": "1.1.11",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"balanced-match": "^1.0.0",
|
||||
|
|
@ -1173,13 +1278,11 @@
|
|||
}
|
||||
},
|
||||
"node_modules/braces": {
|
||||
"version": "3.0.3",
|
||||
"resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
|
||||
"integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
|
||||
"version": "3.0.2",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"fill-range": "^7.1.1"
|
||||
"fill-range": "^7.0.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=8"
|
||||
|
|
@ -1363,9 +1466,7 @@
|
|||
"license": "MIT"
|
||||
},
|
||||
"node_modules/cross-spawn": {
|
||||
"version": "7.0.6",
|
||||
"resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
|
||||
"integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
|
||||
"version": "7.0.3",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
|
|
@ -1537,9 +1638,7 @@
|
|||
}
|
||||
},
|
||||
"node_modules/fill-range": {
|
||||
"version": "7.1.1",
|
||||
"resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
|
||||
"integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
|
||||
"version": "7.0.1",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
|
|
@ -1565,21 +1664,6 @@
|
|||
"version": "1.0.0",
|
||||
"license": "ISC"
|
||||
},
|
||||
"node_modules/fsevents": {
|
||||
"version": "2.3.3",
|
||||
"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
|
||||
"integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
|
||||
"dev": true,
|
||||
"hasInstallScript": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
"darwin"
|
||||
],
|
||||
"engines": {
|
||||
"node": "^8.16.0 || ^10.6.0 || >=11.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/function-bind": {
|
||||
"version": "1.1.1",
|
||||
"dev": true,
|
||||
|
|
@ -1662,6 +1746,14 @@
|
|||
"node": ">= 0.4.0"
|
||||
}
|
||||
},
|
||||
"node_modules/has-flag": {
|
||||
"version": "3.0.0",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=4"
|
||||
}
|
||||
},
|
||||
"node_modules/html-escaper": {
|
||||
"version": "2.0.2",
|
||||
"dev": true,
|
||||
|
|
@ -1747,8 +1839,6 @@
|
|||
},
|
||||
"node_modules/is-number": {
|
||||
"version": "7.0.0",
|
||||
"resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
|
||||
"integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
|
|
@ -2386,15 +2476,11 @@
|
|||
},
|
||||
"node_modules/js-tokens": {
|
||||
"version": "4.0.0",
|
||||
"resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
|
||||
"integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/js-yaml": {
|
||||
"version": "3.14.2",
|
||||
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
|
||||
"integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
|
||||
"version": "3.14.1",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
|
|
@ -2465,9 +2551,7 @@
|
|||
}
|
||||
},
|
||||
"node_modules/lodash": {
|
||||
"version": "4.17.23",
|
||||
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
|
||||
"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
|
||||
"version": "4.17.21",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/lodash.memoize": {
|
||||
|
|
@ -2519,13 +2603,11 @@
|
|||
"license": "MIT"
|
||||
},
|
||||
"node_modules/micromatch": {
|
||||
"version": "4.0.8",
|
||||
"resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
|
||||
"integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
|
||||
"version": "4.0.5",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"braces": "^3.0.3",
|
||||
"braces": "^3.0.2",
|
||||
"picomatch": "^2.3.1"
|
||||
},
|
||||
"engines": {
|
||||
|
|
@ -2541,9 +2623,7 @@
|
|||
}
|
||||
},
|
||||
"node_modules/minimatch": {
|
||||
"version": "3.1.5",
|
||||
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
|
||||
"integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
|
||||
"version": "3.1.2",
|
||||
"license": "ISC",
|
||||
"dependencies": {
|
||||
"brace-expansion": "^1.1.7"
|
||||
|
|
@ -2719,9 +2799,7 @@
|
|||
"license": "MIT"
|
||||
},
|
||||
"node_modules/picocolors": {
|
||||
"version": "1.1.1",
|
||||
"resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
|
||||
"integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
|
||||
"version": "1.0.0",
|
||||
"dev": true,
|
||||
"license": "ISC"
|
||||
},
|
||||
|
|
@ -3037,10 +3115,16 @@
|
|||
"dev": true,
|
||||
"license": "BSD-3-Clause"
|
||||
},
|
||||
"node_modules/to-fast-properties": {
|
||||
"version": "2.0.0",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=4"
|
||||
}
|
||||
},
|
||||
"node_modules/to-regex-range": {
|
||||
"version": "5.0.1",
|
||||
"resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
|
||||
"integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
|
|
@ -3145,9 +3229,7 @@
|
|||
}
|
||||
},
|
||||
"node_modules/undici-types": {
|
||||
"version": "7.16.0",
|
||||
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
|
||||
"integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
|
||||
"version": "5.26.5",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "login",
|
||||
"version": "3.0.0",
|
||||
"version": "2.0.0",
|
||||
"description": "Login Azure wraps the az login, allowing for Azure actions to log into Azure",
|
||||
"main": "lib/main/index.js",
|
||||
"scripts": {
|
||||
|
|
@ -13,7 +13,7 @@
|
|||
"license": "MIT",
|
||||
"devDependencies": {
|
||||
"@types/jest": "^29.2.4",
|
||||
"@types/node": "^24.0.0",
|
||||
"@types/node": "^20.11.1",
|
||||
"@vercel/ncc": "^0.38.1",
|
||||
"jest": "^29.3.1",
|
||||
"jest-circus": "^29.3.1",
|
||||
|
|
|
|||
|
|
@ -8,7 +8,6 @@ export class AzureCliLogin {
|
|||
loginConfig: LoginConfig;
|
||||
azPath: string;
|
||||
loginOptions: ExecOptions;
|
||||
azVersion: string;
|
||||
|
||||
constructor(loginConfig: LoginConfig) {
|
||||
this.loginConfig = loginConfig;
|
||||
|
|
@ -29,15 +28,10 @@ export class AzureCliLogin {
|
|||
}
|
||||
};
|
||||
|
||||
await this.executeAzCliCommand(["version"], true, execOptions);
|
||||
await this.executeAzCliCommand(["--version"], true, execOptions);
|
||||
core.debug(`Azure CLI version used:\n${output}`);
|
||||
try {
|
||||
this.azVersion = JSON.parse(output)["azure-cli"];
|
||||
}
|
||||
catch (error) {
|
||||
core.warning("Failed to parse Azure CLI version.");
|
||||
}
|
||||
await this.registerAzurestackEnvIfNecessary();
|
||||
|
||||
this.setAzurestackEnvIfNecessary();
|
||||
|
||||
await this.executeAzCliCommand(["cloud", "set", "-n", this.loginConfig.environment], false);
|
||||
core.info(`Done setting cloud: "${this.loginConfig.environment}"`);
|
||||
|
|
@ -65,7 +59,7 @@ export class AzureCliLogin {
|
|||
}
|
||||
}
|
||||
|
||||
async registerAzurestackEnvIfNecessary() {
|
||||
async setAzurestackEnvIfNecessary() {
|
||||
if (this.loginConfig.environment != "azurestack") {
|
||||
return;
|
||||
}
|
||||
|
|
@ -91,7 +85,7 @@ export class AzureCliLogin {
|
|||
let suffixKeyvault = ".vault" + baseUri.substring(baseUri.indexOf('.')); // keyvault suffix starts with .
|
||||
let suffixStorage = baseUri.substring(baseUri.indexOf('.') + 1); // storage suffix starts without .
|
||||
let profileVersion = "2019-03-01-hybrid";
|
||||
await this.executeAzCliCommand(["cloud", "register", "-n", this.loginConfig.environment, "--endpoint-resource-manager", this.loginConfig.resourceManagerEndpointUrl, "--suffix-keyvault-dns", suffixKeyvault, "--suffix-storage-endpoint", suffixStorage, "--profile", profileVersion], false);
|
||||
await this.executeAzCliCommand(["cloud", "register", "-n", this.loginConfig.environment, "--endpoint-resource-manager", `"${this.loginConfig.resourceManagerEndpointUrl}"`, "--suffix-keyvault-dns", `"${suffixKeyvault}"`, "--suffix-storage-endpoint", `"${suffixStorage}"`, "--profile", `"${profileVersion}"`], false);
|
||||
}
|
||||
catch (error) {
|
||||
core.error(`Error while trying to register cloud "${this.loginConfig.environment}"`);
|
||||
|
|
@ -114,20 +108,7 @@ export class AzureCliLogin {
|
|||
}
|
||||
|
||||
async loginWithUserAssignedIdentity(args: string[]) {
|
||||
let azcliMinorVersion = 0;
|
||||
try {
|
||||
azcliMinorVersion = parseInt(this.azVersion.split('.')[1], 10);
|
||||
}
|
||||
catch (error) {
|
||||
core.warning("Failed to parse the minor version of Azure CLI. Assuming the version is less than 2.69.0");
|
||||
}
|
||||
//From Azure-cli v2.69.0, `--username` is replaced with `--client-id`, `--object-id` or `--resource-id`: https://github.com/Azure/azure-cli/pull/30525
|
||||
if (azcliMinorVersion < 69) {
|
||||
args.push("--username", this.loginConfig.servicePrincipalId);
|
||||
}
|
||||
else {
|
||||
args.push("--client-id", this.loginConfig.servicePrincipalId);
|
||||
}
|
||||
args.push("--username", this.loginConfig.servicePrincipalId);
|
||||
await this.callCliLogin(args, 'user-assigned managed identity');
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -104,7 +104,7 @@ export default class AzPSScriptBuilder {
|
|||
if(subscriptionId){
|
||||
loginCmdlet += `-Subscription '${subscriptionId}' `;
|
||||
}
|
||||
loginCmdlet += `${cmdletSuffix} -InformationAction Ignore | out-null;`;
|
||||
loginCmdlet += `${cmdletSuffix} | out-null;`;
|
||||
return loginCmdlet;
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -79,16 +79,11 @@ export class LoginConfig {
|
|||
this.mask(this.federatedToken);
|
||||
}
|
||||
catch (error) {
|
||||
core.error("Failed to fetch federated token from GitHub. Please make sure to give write permissions to id-token in the workflow.");
|
||||
core.error(`Please make sure to give write permissions to id-token in the workflow.`);
|
||||
throw error;
|
||||
}
|
||||
try {
|
||||
let [issuer, subjectClaim, audience, jobWorkflowRef] = await jwtParser(this.federatedToken);
|
||||
core.info("Federated token details:\n issuer - " + issuer + "\n subject claim - " + subjectClaim + "\n audience - " + audience + "\n job_workflow_ref - " + jobWorkflowRef);
|
||||
}
|
||||
catch (error) {
|
||||
core.warning(`Failed to parse the federated token. Error: ${error}`);
|
||||
}
|
||||
let [issuer, subjectClaim] = await jwtParser(this.federatedToken);
|
||||
core.info("Federated token details:\n issuer - " + issuer + "\n subject claim - " + subjectClaim);
|
||||
}
|
||||
|
||||
validate() {
|
||||
|
|
@ -104,7 +99,7 @@ export class LoginConfig {
|
|||
}
|
||||
}
|
||||
if (!this.subscriptionId && !this.allowNoSubscriptionsLogin) {
|
||||
throw new Error("Ensure 'subscription-id' is supplied or 'allow-no-subscriptions' is 'true'.");
|
||||
throw new Error("Ensure subscriptionId is supplied.");
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -119,20 +114,5 @@ async function jwtParser(federatedToken: string) {
|
|||
let tokenPayload = federatedToken.split('.')[1];
|
||||
let bufferObj = Buffer.from(tokenPayload, "base64");
|
||||
let decodedPayload = JSON.parse(bufferObj.toString("utf8"));
|
||||
const JWT_CLAIM_ISSUER = 'iss';
|
||||
const JWT_CLAIM_SUBJECT = 'sub';
|
||||
const JWT_CLAIM_AUDIENCE = 'aud';
|
||||
const JWT_CLAIM_JOB_WORKFLOW_REF = 'job_workflow_ref';
|
||||
const requiredClaims = [
|
||||
JWT_CLAIM_ISSUER,
|
||||
JWT_CLAIM_SUBJECT,
|
||||
JWT_CLAIM_AUDIENCE,
|
||||
JWT_CLAIM_JOB_WORKFLOW_REF
|
||||
];
|
||||
for (const claim of requiredClaims) {
|
||||
if (!decodedPayload[claim]) {
|
||||
throw new Error(`The claim '${claim}' is missing from the token payload`);
|
||||
}
|
||||
}
|
||||
return [decodedPayload[JWT_CLAIM_ISSUER], decodedPayload[JWT_CLAIM_SUBJECT], decodedPayload[JWT_CLAIM_AUDIENCE], decodedPayload[JWT_CLAIM_JOB_WORKFLOW_REF]];
|
||||
}
|
||||
return [decodedPayload['iss'], decodedPayload['sub']];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,8 +7,8 @@ import { AzPSConstants, AzPSUtils } from '../PowerShell/AzPSUtils';
|
|||
export function setUserAgent(): void {
|
||||
let usrAgentRepo = crypto.createHash('sha256').update(`${process.env.GITHUB_REPOSITORY}`).digest('hex');
|
||||
let actionName = 'AzureLogin';
|
||||
process.env.AZURE_HTTP_USER_AGENT = (!!process.env.AZURE_HTTP_USER_AGENT ? `${process.env.AZURE_HTTP_USER_AGENT} ` : '') + `GITHUBACTIONS/${actionName}@v2_${usrAgentRepo}_${process.env.RUNNER_ENVIRONMENT}_${process.env.GITHUB_RUN_ID}`;
|
||||
process.env.AZUREPS_HOST_ENVIRONMENT = (!!process.env.AZUREPS_HOST_ENVIRONMENT ? `${process.env.AZUREPS_HOST_ENVIRONMENT} ` : '') + `GITHUBACTIONS/${actionName}@v2_${usrAgentRepo}_${process.env.RUNNER_ENVIRONMENT}_${process.env.GITHUB_RUN_ID}`;
|
||||
process.env.AZURE_HTTP_USER_AGENT = (!!process.env.AZURE_HTTP_USER_AGENT ? `${process.env.AZURE_HTTP_USER_AGENT} ` : '') + `GITHUBACTIONS/${actionName}@v1_${usrAgentRepo}`;
|
||||
process.env.AZUREPS_HOST_ENVIRONMENT = (!!process.env.AZUREPS_HOST_ENVIRONMENT ? `${process.env.AZUREPS_HOST_ENVIRONMENT} ` : '') + `GITHUBACTIONS/${actionName}@v1_${usrAgentRepo}`;
|
||||
}
|
||||
|
||||
export async function cleanupAzCLIAccounts(): Promise<void> {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
import * as core from '@actions/core';
|
||||
import { cleanupAzCLIAccounts, cleanupAzPSAccounts, setUserAgent } from './common/Utils';
|
||||
import { setUserAgent } from './common/Utils';
|
||||
import { AzPSLogin } from './PowerShell/AzPSLogin';
|
||||
import { LoginConfig } from './common/LoginConfig';
|
||||
import { AzureCliLogin } from './Cli/AzureCliLogin';
|
||||
|
|
@ -7,13 +7,6 @@ import { AzureCliLogin } from './Cli/AzureCliLogin';
|
|||
async function main() {
|
||||
try {
|
||||
setUserAgent();
|
||||
const preCleanup: string = process.env.AZURE_LOGIN_PRE_CLEANUP;
|
||||
if ('true' == preCleanup) {
|
||||
await cleanupAzCLIAccounts();
|
||||
if (core.getInput('enable-AzPSSession').toLowerCase() === "true") {
|
||||
await cleanupAzPSAccounts();
|
||||
}
|
||||
}
|
||||
|
||||
// prepare the login configuration
|
||||
var loginConfig = new LoginConfig();
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue