Skip to content

Commit d34fff2

Browse files
MaddyMicrosoftMaddyMicrosoft
authored
Merge branch 'master' into security/sha-pin-actions
2 parents 335af21 + 3b64cbd commit d34fff2

2 files changed

Lines changed: 22 additions & 18 deletions

File tree

‎.github/workflows/azure-login-live-tests.yml‎

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -9,16 +9,19 @@ permissions:
99
id-token: write
1010
contents: read
1111

12-
# One resource group is shared by every job in this run, so serialize runs to
13-
# avoid one run tearing down another's group.
12+
# Each run provisions its own uniquely-named resource group (suffixed with the
13+
# run id), so concurrent runs on different branches/PRs never collide or tear
14+
# down each other's group. The concurrency group is branch-scoped only to avoid
15+
# piling up runs on rapid pushes to the same ref - it does NOT serialize across
16+
# the whole repo, so an unapproved run on one PR can never block another.
1417
concurrency:
15-
group: azure-login-live-tests
18+
group: azure-login-live-tests-${{ github.ref }}
1619
cancel-in-progress: false
1720

1821
env:
1922
# Created once in setup; the positive and embedded "can access" assertions
20-
# target this group.
21-
RG_POSITIVE: GitHubAction_CI_Group
23+
# target this group. Suffixed with the run id so every run is isolated.
24+
RG_POSITIVE: GitHubAction_CI_Group_${{ github.run_id }}
2225
LOCATION: eastus
2326
# Intentionally NEVER created: the negative permission/not-found assertions
2427
# target this name so they fail as expected.
@@ -38,7 +41,7 @@ jobs:
3841
with:
3942
creds: ${{ secrets.PROVISION_CREDS }}
4043
- name: Create resource group
41-
run: az group create --name "$RG_POSITIVE" --location "$LOCATION" --output none
44+
run: az group create --name "${{ env.RG_POSITIVE }}" --location "${{ env.LOCATION }}" --output none
4245

4346
# ================================================================ POSITIVE
4447
Positive_BasicTest:
@@ -77,7 +80,7 @@ jobs:
7780
- name: Run Azure Cli
7881
run: |
7982
az account show --output none
80-
az group show --name GitHubAction_CI_Group --output none
83+
az group show --name "${{ env.RG_POSITIVE }}" --output none
8184
8285
- name: Run Azure PowerShell
8386
uses: azure/powershell@v3
@@ -121,7 +124,7 @@ jobs:
121124
- name: Run Azure Cli
122125
run: |
123126
az account show --output none
124-
az group show --name GitHubAction_CI_Group --output none
127+
az group show --name "${{ env.RG_POSITIVE }}" --output none
125128
126129
- name: Run Azure PowerShell
127130
uses: azure/powershell@v3
@@ -165,7 +168,7 @@ jobs:
165168
- name: Run Azure Cli
166169
run: |
167170
az account show --output none
168-
az group show --name GitHubAction_CI_Group --output none
171+
az group show --name "${{ env.RG_POSITIVE }}" --output none
169172
170173
- name: Login with creds, wrong boolean value
171174
uses: ./
@@ -176,7 +179,7 @@ jobs:
176179
- name: Run Azure Cli
177180
run: |
178181
az account show --output none
179-
az group show --name GitHubAction_CI_Group --output none
182+
az group show --name "${{ env.RG_POSITIVE }}" --output none
180183
181184
- name: Login with creds, allow no subscription
182185
uses: ./
@@ -188,7 +191,7 @@ jobs:
188191
- name: Run Azure Cli
189192
run: |
190193
az account show --output none
191-
az group show --name GitHubAction_CI_Group --output none
194+
az group show --name "${{ env.RG_POSITIVE }}" --output none
192195
193196
- name: Run Azure PowerShell
194197
uses: azure/powershell@v3
@@ -521,7 +524,7 @@ jobs:
521524
- name: Run Azure Cli
522525
run: |
523526
az account show --output none
524-
az group show --name GitHubAction_CI_Group --output none
527+
az group show --name "${{ env.RG_POSITIVE }}" --output none
525528
526529
- name: Run Azure PowerShell
527530
id: ps_8
@@ -531,7 +534,7 @@ jobs:
531534
azPSVersion: "latest"
532535
inlineScript: |
533536
(Get-AzContext).Environment.Name -eq 'AzureCloud'
534-
(Get-AzResourceGroup -Name GitHubAction_CI_Group).ResourceGroupName -eq 'GitHubAction_CI_Group'
537+
(Get-AzResourceGroup -Name $env:RG_POSITIVE).ResourceGroupName -eq $env:RG_POSITIVE
535538
536539
- name: Check Last step failed
537540
if: steps.ps_8.outcome == 'success'
@@ -549,7 +552,7 @@ jobs:
549552
- name: Run Azure Cli
550553
run: |
551554
az account show --output none
552-
az group show --name GitHubAction_CI_Group --output none
555+
az group show --name "${{ env.RG_POSITIVE }}" --output none
553556
554557
- name: Run Azure PowerShell
555558
id: ps_9
@@ -559,7 +562,7 @@ jobs:
559562
azPSVersion: "latest"
560563
inlineScript: |
561564
(Get-AzContext).Environment.Name -eq 'AzureCloud'
562-
(Get-AzResourceGroup -Name GitHubAction_CI_Group).ResourceGroupName -eq 'GitHubAction_CI_Group'
565+
(Get-AzResourceGroup -Name $env:RG_POSITIVE).ResourceGroupName -eq $env:RG_POSITIVE
563566
564567
- name: Check Last step failed
565568
if: steps.ps_9.outcome == 'success'
@@ -687,4 +690,4 @@ jobs:
687690
with:
688691
creds: ${{ secrets.PROVISION_CREDS }}
689692
- name: Delete resource group
690-
run: az group delete --name "$RG_POSITIVE" --yes --output none || true
693+
run: az group delete --name "${{ env.RG_POSITIVE }}" --yes --output none || true

‎src/common/Utils.ts‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,9 @@ import { AzPSConstants, AzPSUtils } from '../PowerShell/AzPSUtils';
77
export function setUserAgent(): void {
88
let usrAgentRepo = crypto.createHash('sha256').update(`${process.env.GITHUB_REPOSITORY}`).digest('hex');
99
let actionName = 'AzureLogin';
10-
process.env.AZURE_HTTP_USER_AGENT = (!!process.env.AZURE_HTTP_USER_AGENT ? `${process.env.AZURE_HTTP_USER_AGENT} ` : '') + `GITHUBACTIONS/${actionName}@v3_${usrAgentRepo}_${process.env.RUNNER_ENVIRONMENT}_${process.env.GITHUB_RUN_ID}`;
11-
process.env.AZUREPS_HOST_ENVIRONMENT = (!!process.env.AZUREPS_HOST_ENVIRONMENT ? `${process.env.AZUREPS_HOST_ENVIRONMENT} ` : '') + `GITHUBACTIONS/${actionName}@v3_${usrAgentRepo}_${process.env.RUNNER_ENVIRONMENT}_${process.env.GITHUB_RUN_ID}`;
10+
let actionRef = process.env.GITHUB_ACTION_REF || 'unknown';
11+
process.env.AZURE_HTTP_USER_AGENT = (!!process.env.AZURE_HTTP_USER_AGENT ? `${process.env.AZURE_HTTP_USER_AGENT} ` : '') + `GITHUBACTIONS/${actionName}@${actionRef}_${usrAgentRepo}_${process.env.RUNNER_ENVIRONMENT}_${process.env.GITHUB_RUN_ID}`;
12+
process.env.AZUREPS_HOST_ENVIRONMENT = (!!process.env.AZUREPS_HOST_ENVIRONMENT ? `${process.env.AZUREPS_HOST_ENVIRONMENT} ` : '') + `GITHUBACTIONS/${actionName}@${actionRef}_${usrAgentRepo}_${process.env.RUNNER_ENVIRONMENT}_${process.env.GITHUB_RUN_ID}`;
1213
}
1314

1415
export async function cleanupAzCLIAccounts(): Promise<void> {

0 commit comments

Comments
 (0)