Update ci to enable federated auth for bq

DFE-Digital · Jan 8, 2025 · 12c33ba · 12c33ba
1 parent f81a3ac
commit 12c33ba
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 0 deletions.
diff --git a/.github/actions/deploy-environment-to-aks/action.yml b/.github/actions/deploy-environment-to-aks/action.yml
@@ -43,6 +43,11 @@ runs:
       with:
         azure-credentials: ${{ inputs.azure-credentials }}
 
+    - uses: google-github-actions/auth@v2
+      with:
+        project_id: ecf-bq
+        workload_identity_provider: projects/808138694727/locations/global/workloadIdentityPools/early-careers-framework/providers/early-careers-framework
+
     - name: Apply Terraform
       id: apply-terraform
       shell: bash
@@ -59,6 +64,11 @@ runs:
       with:
         creds: ${{ inputs.azure-credentials }}
 
+    - uses: google-github-actions/auth@v2
+      with:
+        project_id: ecf-bq
+        workload_identity_provider: projects/808138694727/locations/global/workloadIdentityPools/early-careers-framework/providers/early-careers-framework
+
     - name: Seed database
       if: ${{ inputs.pull-request-number != '' }}
       shell: bash

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -20,6 +20,11 @@ on:
   pull_request:
   merge_group:
 
+permissions:
+  id-token: write
+  pull-requests: write
+  packages: write
+
 jobs:
   lint:
     name: Lint

diff --git a/.github/workflows/destroy_review.yml b/.github/workflows/destroy_review.yml
@@ -5,6 +5,9 @@ on:
     types: [closed]
     branches: [main]
 
+permissions:
+  id-token: write
+
 jobs:
   delete-review-app:
     name: Delete Review App ${{ github.event.pull_request.number }}
@@ -19,6 +22,11 @@ jobs:
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
 
+      - uses: google-github-actions/auth@v2
+        with:
+          project_id: ecf-bq
+          workload_identity_provider: projects/808138694727/locations/global/workloadIdentityPools/early-careers-framework/providers/early-careers-framework
+
       - uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.5.4