Use managed identity to log into ACR

Author: AlvaroRausell

.github/workflows/push-again.yml

@@ -40,7 +40,18 @@ jobs:
       with:
         path: 'release'
         ref: ${{ github.event.inputs.release }}
-      
+
+    - name: Log in to Azure using Managed Identity
+      uses: azure/login@v2
+      with:
+        client-id: ${{secrets.ACR_CLIENT_ID}}
+        tenant-id: ${{secrets.ACR_TENANT_ID}}
+        subscription-id: ${{secrets.ACR_SUBSCRIPTION_ID}}
+
+    - name: Log into ACR
+      run: |
+        az acr login --name ${{secrets.ACR_REGISTRY_NAME}}
+        
     - name: Build and push
       id: build_and_push
       env:
@@ -53,11 +64,6 @@ jobs:
         PASSWORD: ${{ secrets.PASSWORD }}
       run: |
         set -e
-
-        # ACR login
-        ACR_REGISTRY_NAME=$(echo "$REGISTRY" | grep -oP '(.+)(?=\.azurecr\.io)')
-        az acr login --name $ACR_REGISTRY_NAME --username $TOKEN_NAME --password $PASSWORD
-
         # Setup build CLI
         cd "$GITHUB_WORKSPACE/ref"
         yarn install

.github/workflows/push-dev.yml

@@ -30,6 +30,17 @@ jobs:
       id: checkout
       uses: actions/checkout@v3
 
+    - name: Log in to Azure using Managed Identity
+      uses: azure/login@v2
+      with:
+        client-id: ${{secrets.ACR_CLIENT_ID}}
+        tenant-id: ${{secrets.ACR_TENANT_ID}}
+        subscription-id: ${{secrets.ACR_SUBSCRIPTION_ID}}
+        
+    - name: Log into ACR
+      run: |
+        az acr login --name ${{secrets.ACR_REGISTRY_NAME}}
+
     - name: Build and push dev tags
       id: build_and_push
       env:
@@ -43,11 +54,6 @@ jobs:
         PASSWORD: ${{ secrets.PASSWORD }}
       run: |
         set -e
-
-        # ACR login
-        ACR_REGISTRY_NAME=$(echo "$REGISTRY" | grep -oP '(.+)(?=\.azurecr\.io)')
-        az acr login --name $ACR_REGISTRY_NAME --username $TOKEN_NAME --password $PASSWORD
-
         # Build and push dev images
         yarn install
         npm install -g @devcontainers/cli

.github/workflows/push-manual-dev.yml

@@ -36,7 +36,18 @@ jobs:
       with:
         path: 'release'
         ref: ${{ github.event.inputs.release }}
-      
+    
+    - name: Log in to Azure using Managed Identity
+      uses: azure/login@v2
+      with:
+        client-id: ${{secrets.ACR_CLIENT_ID}}
+        tenant-id: ${{secrets.ACR_TENANT_ID}}
+        subscription-id: ${{secrets.ACR_SUBSCRIPTION_ID}}
+    
+    - name: Log into ACR
+      run: |
+        az acr login --name ${{secrets.ACR_REGISTRY_NAME}}
+    
     - name: Build and push
       id: build_and_push
       env:
@@ -49,11 +60,6 @@ jobs:
         PASSWORD: ${{ secrets.PASSWORD }}
       run: |
         set -e
-
-        # ACR login
-        ACR_REGISTRY_NAME=$(echo "$REGISTRY" | grep -oP '(.+)(?=\.azurecr\.io)')
-        az acr login --name $ACR_REGISTRY_NAME --username $TOKEN_NAME --password $PASSWORD
-
         # Setup build CLI
         cd "$GITHUB_WORKSPACE/ref"
         yarn install

.github/workflows/push.yml

@@ -33,6 +33,17 @@ jobs:
     - name: Get tag name
       run: echo "TAG=$(echo "${{ github.ref }}" | grep -oP 'refs/tags/\K(.+)')" >> $GITHUB_ENV
 
+    - name: Log in to Azure using Managed Identity
+      uses: azure/login@v2
+      with:
+        client-id: ${{secrets.ACR_CLIENT_ID}}
+        tenant-id: ${{secrets.ACR_TENANT_ID}}
+        subscription-id: ${{secrets.ACR_SUBSCRIPTION_ID}}
+    
+    - name: Log into ACR
+      run: |
+        az acr login --name ${{secrets.ACR_REGISTRY_NAME}}
+
     - name: Build and push
       id: build_and_push
       env:
@@ -46,11 +57,6 @@ jobs:
         PASSWORD: ${{ secrets.PASSWORD }}
       run: |
         set -e
-
-        # ACR login
-        ACR_REGISTRY_NAME=$(echo "$REGISTRY" | grep -oP '(.+)(?=\.azurecr\.io)')
-        az acr login --name $ACR_REGISTRY_NAME --username $TOKEN_NAME --password $PASSWORD
-
         # Build and push images
         yarn install
         npm install -g @devcontainers/cli

.github/workflows/version-history.yml

@@ -47,7 +47,17 @@ jobs:
     - name: Checkout
       id: checkout
       uses: actions/checkout@v3
-
+      
+    - name: Log in to Azure using Managed Identity
+      uses: azure/login@v2
+      with:
+        client-id: ${{secrets.ACR_CLIENT_ID}}
+        tenant-id: ${{secrets.ACR_TENANT_ID}}
+        subscription-id: ${{secrets.ACR_SUBSCRIPTION_ID}}
+        
+    - name: Log into ACR
+      run: |
+        az acr login --name ${{secrets.ACR_REGISTRY_NAME}}
     - name: Get image info
       id: Get_image_info
       env:
@@ -59,11 +69,6 @@ jobs:
         PASSWORD: ${{ secrets.PASSWORD }}
       run: |
         set -e
-
-        # ACR login
-        ACR_REGISTRY_NAME=$(echo "$REGISTRY" | grep -oP '(.+)(?=\.azurecr\.io)')
-        az acr login --name $ACR_REGISTRY_NAME --username $TOKEN_NAME --password $PASSWORD
-
         yarn install
         RELEASE_STRING=$(echo "${{ inputs.release }}" | grep -oP 'refs/(heads|tags)/\K(.+)')
         OVERWRITE_STRING=$(if [ "${{ inputs.overwrite }}" = "false" ]; then echo '--no-overwrite'; else echo '--overwrite'; fi)