Authorise workflows to GCP

DFE-Digital · Dec 6, 2024 · 35bcafc · 35bcafc
1 parent a4e2cbb
commit 35bcafc
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 2 deletions.
diff --git a/.github/workflows/actions/deploy/action.yml b/.github/workflows/actions/deploy/action.yml
@@ -60,6 +60,11 @@ runs:
           ;;
         esac
 
+    - uses: google-github-actions/auth@v2
+      with:
+        project_id: get-into-teaching
+        workload_identity_provider: projects/574582782335/locations/global/workloadIdentityPools/schools-experience/providers/schools-experience
+
     - name: Use Terraform ${{ env.TERRAFORM_VERSION }}
       uses: hashicorp/setup-terraform@v3
       with:

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -11,6 +11,7 @@ permissions:
   issues: write
   packages: write
   pull-requests: write
+  id-token: write
 
 env:
   code-coverage-artifact-name: code_coverage_${{github.run_number}}_${{github.run_attempt}}
@@ -382,6 +383,7 @@ jobs:
     concurrency: ${{matrix.environment}}_${{github.event.number}}
     needs: [prepare]
     runs-on: ubuntu-latest
+
     steps:
       - name: Check out the repo
         uses: actions/checkout@v4
@@ -544,7 +546,6 @@ jobs:
             echo "::add-mask::$SECRET_VALUE"
             echo "SLACK-WEBHOOK=$SECRET_VALUE" >> $GITHUB_OUTPUT
 
-
       - name: Slack Notification
         if: failure()
         uses: rtCamp/action-slack-notify@master

diff --git a/.github/workflows/destroy.yml b/.github/workflows/destroy.yml
@@ -3,6 +3,10 @@ on:
   pull_request:
     types: [closed]
 
+permissions:
+  id-token: write
+  pull-requests: write
+
 jobs:
   destroy:
     name: Destroy
@@ -16,13 +20,19 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+
       - name: Set Environment variables
         shell: bash
         run: |
           tf_vars_file=terraform/aks/config/review.tfvars.json
           terraform_version=$(awk '/{/{f=/^terraform/;next}f' terraform/aks/terraform.tf | grep -o [0-9\.]*)
           echo "TERRAFORM_VERSION=$terraform_version" >> $GITHUB_ENV
 
+      - uses: google-github-actions/auth@v2
+        with:
+          project_id: get-into-teaching
+          workload_identity_provider: projects/574582782335/locations/global/workloadIdentityPools/schools-experience/providers/schools-experience
+
       - name: Use Terraform ${{ env.TERRAFORM_VERSION }}
         uses: hashicorp/setup-terraform@v3
         with:

diff --git a/.github/workflows/manual.yml b/.github/workflows/manual.yml
@@ -11,6 +11,9 @@ on:
         description: Release Tag
         required: true
 
+permissions:
+  id-token: write
+
 jobs:
   manual:
     name: Deploy to ${{github.event.inputs.environment}}
@@ -31,7 +34,7 @@ jobs:
       - uses: Azure/login@v2
         with:
             creds: ${{ secrets.AZURE_CREDENTIALS }}
-      
+
       - name: Fetch slack token
         uses: azure/CLI@v2
         id: fetch-slack-secret