Github actions + Azure OIDC with "subject" value for any branch

user_1514576 0
Viewed 305

I'm using Github Actions to build some Docker images that I want to push to Azure Container Registry. I am attempting to use OIDC as an auth mechanism, based on this GH Action. I know the action supports other auth strategies, which I have discarded for my use case for reasons.

According to GH docs the "subject" field needs to be populated based on the GH account, repo name and branch name. However, want to build Docker images for multiple branches, which seems to require one federation config per branch - not practical, IMO.

So my question is: does anyone know if it's possible (and how) to set up a single federation config with a "subject" value that would work as a wildcard of sorts, covering all branches from a give repo?

thanks!

azure-active-directory github-actions openid-connect azure
1 Answers

On AWS it is possible to use wildcards, like:

"repo:MY_ORG/MY_REPO:*"

but that doesn't seem to work on Azure, you can enter a wildcard in Azure Federated Credentials, but the GitHub workflow fails. To actually need a branch is crazy, as we'd need to setup new credential config for each new git branch.

I worked around the issue by using GitHub environments. I set an environment (called main but it can be called anything) and then set my workflow like this:

jobs:
  test:
    runs-on: ubuntu-latest
    environment: main

and then in Azure set the federated creds to use: Entity of Environment rather than Entity of Branch

This will then work for any branch - but clearly if you use GitHub environments for other reasons this may not be viable.

user_148438600
Related