Skip to content

Conversation

@elayrocks
Copy link
Contributor

@elayrocks elayrocks commented May 6, 2024

Description

The motivation of this PR is to remove the client secret in the GitHub actions workflow file cicd.yml to improve security.
To do this, I reference this page and use the federated credentials in service principal which allows authentication without the need for explicit client secret and made corresponding changes to authentication in the workflow.

This PR introduces basically the same code changes as in this PR.

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

How Has This Been Tested?

I created federated credential for this branch user/elay/remove-client-secret, so it can use the service principal to authenticate to Azure. It will be deleted after testing. In cicd.yml , changed branch trigger to user/elay/remove-client-secret
and comment out the if clause, so that build_and_publish and deploy jobs can all be tested once changes are pushed to this branch instead of main. Check out the result of latest pipeline run and workflow file

Checklist:

Please delete options that are not relevant.

  • I have performed a self-review
  • Changelog has been updated
  • Documentation has been updated
  • Unit tests pass locally (./scripts/test)
  • Code is linted and styled (./scripts/format)

@elayrocks elayrocks changed the title remove client secret in deployment Remove secret from cicd May 7, 2024
@elayrocks elayrocks merged commit ceaad79 into main May 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants