Use OIDC creds to deploy (#364)

primer · Jun 6, 2023 · 4b81816 · 4b81816
1 parent 3d9c631
commit 4b81816
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 2 deletions.
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -7,6 +7,10 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -46,6 +50,13 @@ jobs:
       url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}
 
     steps:
+      - name: Az CLI login
+        uses: azure/login@v1
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
       - name: Download artifact from build job
         uses: actions/download-artifact@v2
         with:
@@ -57,5 +68,4 @@ jobs:
         with:
           app-name: 'primerstyle'
           slot-name: 'production'
-          publish-profile: ${{ secrets.AZURE_PUBLISH_PROFILE }}
           package: .
diff --git a/.github/workflows/deploy_staging.yml b/.github/workflows/deploy_staging.yml
@@ -7,6 +7,10 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -46,6 +50,13 @@ jobs:
       url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}
 
     steps:
+      - name: Az CLI login
+        uses: azure/login@v1
+        with:
+          client-id: ${{ secrets.AZURE_STAGING_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
       - name: Download artifact from build job
         uses: actions/download-artifact@v2
         with:
@@ -57,5 +68,4 @@ jobs:
         with:
           app-name: 'primerstyle'
           slot-name: 'staging'
-          publish-profile: ${{ secrets.AZURE_PUBLISH_PROFILE_STAGING }}
           package: .