fix(ci): eliminate zero-click fork-PR RCE in terraform workflows

[LeonardCareer]

Fixes MSRC #127928 / IcM 31000000665395.

Root cause

terraform-validation.yml was reachable from fork PRs and combined three capabilities that together enabled zero-click RCE and Azure-token minting under AZURE_MI:

1. permissions: id-token: write on a pull_request-triggered job (added in Update CI Validations #327) — fork PRs are not stripped of OIDC minting.
2. terraform test step (added in Add variable to customize AKS os disk type for all node pools #530) — defaults to command = apply and executes attacker-controlled HCL from the PR (null_resource + provisioner "local-exec").
3. AWS creds gate removed in Remove aws creds from CI check #1135 — terraform test now runs on any fork PR without needing any secrets.

Plus an Entra federated identity credential on AZURE_MI (= telescope-github-oidc, sub AKS Airlock, rg telescope) trusting sub=repo:Azure/telescope:pull_request, which GitHub emits identically for same-repo and fork PRs — closing the chain.

Changes

.github/workflows/terraform-validation.yml (pull_request):

• Remove permissions: id-token: write (both jobs).
• Remove terraform test steps (AWS + Azure).
• Remove azure/login step.
• Remove the setup-matrix and terraform-plan jobs (moved).
• Add top-level permissions: contents: read.
• Use terraform init -backend=false to prevent backend-driven egress.
• Keeps only fmt / validate / tflint — safe for any fork PR.

.github/workflows/terraform-integration.yml (new, pull_request_target):

• Every PR (same-repo AND fork) is gated by an authorize job that uses the terraform-privileged environment. Required reviewers = the @Azure/telescope-oncall team. A compromised telescope-write account is part of the threat model, so same-repo PRs are not auto-approved.
• terraform-test, setup-matrix, terraform-plan all needs: authorize and check out github.event.pull_request.head.sha from the PR's head repo only after human approval.
• azure/login@v1 → @v2 (v1 is deprecated).
• Fix pre-existing matrix_combinations double-assignment bug; simplify Create JSON Input to read the file directly via jq -c … "$FILE".

Out-of-band actions

1. Org admin — create team @Azure/telescope-oncall

Members: @wonderyl, @liyu-ma, @LeonardCareer, @xinWeiWei24, @vittoriasalim. Grant the team Write access on Azure/telescope.

2. Repo admin — create terraform-privileged environment

• URL: https://github.com/Azure/telescope/settings/environments
• Name: terraform-privileged
• Required reviewers: @Azure/telescope-oncall

3. Tenant admin — update federated credentials on telescope-github-oidc

Managed Identity: telescope-github-oidc (client-id faa8d4b3-7b17-4588-bef2-95f0fb74abc5), subscription AKS Airlock (137f0351-8235-42a6-ac7a-6b46be2d21c7), resource group telescope.

Two new FICs already created (zero-downtime rollout):

Name	Subject	Status
gh-telescope-env-terraform-privileged	repo:Azure/telescope:environment:terraform-privileged	✅ created
gh-telescope-env-terraform-privileged-numeric	repository_owner_id:6844498:repository_id:718354598:environment:terraform-privileged	✅ created

Old FICs to be deleted after merge + validation:

Name	Subject	Action
gh-telescope-pr	repo:Azure/telescope:pull_request	🗑 delete
gh-telescope-pr-numeric	repository_owner_id:6844498:repository_id:718354598:pull_request	🗑 delete

az identity federated-credential delete -g telescope --identity-name telescope-github-oidc --name gh-telescope-pr --yes
az identity federated-credential delete -g telescope --identity-name telescope-github-oidc --name gh-telescope-pr-numeric --yes

Keep: gh-telescope-main and gh-telescope-main-numeric (needed for post-merge Actions on main).

Rollout order

1. ✅ Add the two new FICs (done).
2. Configure the team (§1) and the environment (§2).
3. Merge this PR.
4. Validate on the next Terraform-touching PR: terraform-validation runs green; terraform-integration / authorize pauses waiting for approval; after approve, azure/login succeeds.
5. Delete the two old gh-telescope-pr* FICs. MSRC vulnerability is not considered closed until this step is done.
6. Notify MSRC to re-test.

[Copilot]

Pull request overview

This PR hardens the Terraform CI against fork-PR zero-click RCE by splitting Terraform checks into an unprivileged pull_request workflow (static validation only) and a privileged pull_request_target workflow that is gated behind a protected environment before any PR code is checked out and executed.

Changes:

• Restricts .github/workflows/terraform-validation.yml to fmt/validate/tflint only, removes OIDC/azure login/terraform test/plan, and uses terraform init -backend=false.
• Adds a new .github/workflows/terraform-integration.yml workflow that gates privileged terraform test/terraform plan behind an authorize job using the terraform-privileged environment.
• Updates Azure login usage in the privileged workflow to azure/login@v2.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/terraform-validation.yml	Removes privileged steps and limits fork-PR execution to static Terraform checks only.
.github/workflows/terraform-integration.yml	Introduces an environment-gated privileged workflow for terraform test/plan and Azure auth.

Comments suppressed due to low confidence (2)

.github/workflows/terraform-integration.yml:75

• Same as above: on pull_request_target, this checkout will fail for fork PRs unless you opt into unsafe PR checkout, and you should fetch from the fork repo explicitly when using the PR’s head SHA.

        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
          persist-credentials: false

.github/workflows/terraform-integration.yml:143

• Same issue in this job: pull_request_target + fork PR checkout will fail without explicitly opting into unsafe PR checkout, and the fork repo should be specified when checking out github.event.pull_request.head.sha.

        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false