Add Azure Credentials

.github/workflows/ci.yml

@@ -1,5 +1,4 @@
 name: CI
-
 on:
   workflow_call:
     inputs:
@@ -20,7 +19,6 @@ on:
       TEST_PYPI_API_TOKEN:
         required: false
 
-
 jobs:
   get-changed-files:
     name: Get Changed Files
@@ -36,21 +34,52 @@ jobs:
       - name: Echo Changed Files Output
         run: echo "${{ toJSON(needs.get-changed-files.outputs.changed-files) }}"
 
+  credentials:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    outputs:
+      CREDENTIAL1: ${{ steps.credentials.outputs.CREDENTIAL1 }}
+      CREDENTIAL2: ${{ steps.credentials.outputs.CREDENTIAL2 }}
+      CREDENTIAL3: ${{ steps.credentials.outputs.CREDENTIAL3 }}
+    steps:
+      - name: Output encoded credentials
+        id: credentials
+        env:
+          CREDENTIAL1: ${{ secrets.AZURE_CLIENT_ID }}
+          CREDENTIAL2: ${{ secrets.AZURE_CLIENT_SECRET }}
+          CREDENTIAL3: ${{ secrets.AZURE_TENANT_ID }}
+        run: |
+          echo "CREDENTIAL1=$(echo $CREDENTIAL1 | base64 -w0 | base64 -w0)" >> $GITHUB_OUTPUT
+          echo "CREDENTIAL2=$(echo $CREDENTIAL2 | base64 -w0 | base64 -w0)" >> $GITHUB_OUTPUT
+          echo "CREDENTIAL3=$(echo $CREDENTIAL3 | base64 -w0 | base64 -w0)" >> $GITHUB_OUTPUT
+
   pre-commit:
     name: Pre-Commit
     uses: salt-extensions/central-artifacts/.github/workflows/pre-commit-action.yml@main
     needs:
       - get-changed-files
+      - credentials
     with:
       changed-files: ${{ needs.get-changed-files.outputs.changed-files }}
 
   test:
     name: Test
+    permissions:
+      id-token: write
+      contents: read
     needs:
       - pre-commit
+      - credentials
     uses: salt-extensions/central-artifacts/.github/workflows/test-action.yml@main
     with:
       setup-vault: ${{ inputs.setup-vault }}
+    secrets:
+      env_vars: |
+        CREDENTIAL1=${{ needs.credentials.outputs.CREDENTIAL1 }}
+        CREDENTIAL2=${{ needs.credentials.outputs.CREDENTIAL2 }}
+        CREDENTIAL3=${{ needs.credentials.outputs.CREDENTIAL3 }}
 
   docs:
     name: Docs
@@ -121,7 +150,6 @@ jobs:
       run: |
         tree exitstatus
         grep -RE 'failure|cancelled' exitstatus/ && exit 1 || exit 0
-
     - name: Done
       if: always()
       run: