Fwd: The Protocol BreakdownAvner Shefa stands at the threshold

[avnershefa0-Flow1980]

Fwd: The Protocol BreakdownAvner Shefa stands at the threshold of the system as Auth0, the living identity gatekeeper. When The Flood breaches the perimeter, the catastrophic work overflow begins.The Core EntitiesAvner Shefa (Auth0): The sentient firewall, access control protocol, and final arbiter of authentication.The Flood: The zero-day vulnerability breach, an uncontainable deluge of malicious traffic and corrupted data.The Overflow: The resulting system-wide failure where tasks, alerts, and processes cascade out of control.The Chain of InfectionPerimeter Compromise: The Flood exploits an unpatched structural flaw.Gatekeeper Engagement: Avner Shefa attempts to isolate, validate, and authenticate the incoming massive payload.Authentication Collapse: The sheer volume of identity requests bypasses standard rate-limiting controls.System Inundation: The queue structures overflow, forcing downstream microservices into a state of permanent execution failure.To help develop this narra...

[avnershefa0-Flow1980]

hex-format-converter.html
flow1980.github.io-main.zip

b73dfa3e-db29-4ddb-a534-002b92b3be11_1242x2688.PDF





Ask-Microsoft-transparency-FAQ.pdf
fa272f27050039254ce4d48d68b2c39b-622a1838f58d66a4a9b5b1d9112d444986645ef0.zip

[avnershefa0-Flow1980]

/#!/bin/bash

Script to configure deployment environment in Azure and Environments/Variables for Actions

Usage: ./configure-deployment.sh / [resource-group-staging] [resource-group-prod] [location-staging] [location-prod]

Environment names - used for both GitHub environments and OIDC configuration

ENV_STAGING="Staging"
ENV_PROD="Production"

Check if repository name is provided

if [ $# -lt 1 ]; then
echo "Usage: $0 / [resource-group-staging] [resource-group-prod] [location-staging] [location-prod]"
echo "Example: $0 octodemo/glowing-acorn rg-octocat-staging rg-octocat-prod eastus2 eastus2"
exit 1
fi

REPO=$1
ORG=$(echo $REPO | cut -d'/' -f1)
REPO_NAME=$(echo $REPO | cut -d'/' -f2)
SP_NAME="${REPO_NAME}-github-actions"

Default resource group names and locations if not provided

RG_STAGING=${2:-"${REPO_NAME}-staging"}
RG_PROD=${3:-"${REPO_NAME}-prod"}
LOCATION_STAGING=${4:-"eastus2"}
LOCATION_PROD=${5:-"eastus2"}

Check if GitHub CLI is installed

if ! command -v gh &> /dev/null; then
echo "❌ GitHub CLI (gh) is not installed. Please install it to set repository variables."
echo " Installation instructions: https://cli.github.com/manual/installation"
HAS_GH_CLI=false
else
echo "✅ GitHub CLI is installed."
HAS_GH_CLI=true

# Check if authenticated with GitHub
if ! gh auth status &> /dev/null; then
    echo "🔐 Not logged in to GitHub. Please authenticate:"
    gh auth login
else
    echo "✅ Already authenticated with GitHub"
fi

# Get current GitHub user for environment approval - don't use --silent with jq
echo "🔍 Getting GitHub user information..."
GITHUB_USER=$(gh api user | jq -r '.login')
if [ -n "$GITHUB_USER" ]; then
    echo "✅ Current GitHub user: $GITHUB_USER"
else
    echo "⚠️ Could not determine GitHub user. Will use empty reviewer list for environments."
    GITHUB_USER=""
fi

# Check if the repository exists and is accessible
if ! gh repo view $REPO &> /dev/null; then
    echo "⚠️  Unable to access repository $REPO. Please check if it exists and you have access."
    echo "    Will not set GitHub repository variables automatically."
    HAS_REPO_ACCESS=false
else
    echo "✅ Repository $REPO is accessible"
    HAS_REPO_ACCESS=true
fi

fi

Check if already logged in to Azure

echo "🔍 Checking if already logged in to Azure..."
ACCOUNT_CHECK=$(az account show 2>/dev/null)
LOGIN_STATUS=$?

if [ $LOGIN_STATUS -ne 0 ]; then
echo "🔐 Not logged in. Initiating Azure login..."
az login
else
echo "✅ Already logged in to Azure"
fi

echo "🔍 Getting subscription information..."
SUBSCRIPTION_ID=$(az account show --query id -o tsv)
SUBSCRIPTION_NAME=$(az account show --query name -o tsv)
TENANT_ID=$(az account show --query tenantId -o tsv)

echo "📊 Using the following Azure subscription:"
echo " Subscription ID: $SUBSCRIPTION_ID"
echo " Subscription Name: $SUBSCRIPTION_NAME"
echo " Tenant ID: $TENANT_ID"

Create or check resource groups

create_resource_group() {
local rg_name=$1
local location=$2
local env=$3

echo "🔍 Checking if resource group '$rg_name' exists..."
RG_EXISTS=$(az group exists --name $rg_name)

if [ "$RG_EXISTS" = "true" ]; then
    echo "✅ Resource group '$rg_name' already exists"
else
    echo "🏗️ Creating resource group '$rg_name' in '$location'..."
    az group create --name $rg_name --location $location --tags environment=$env application=OctoCAT-SupplyChain > /dev/null
    echo "✅ Resource group '$rg_name' created successfully"
fi

}

Create resource groups

echo ""
echo "🏗️ Creating Azure resource groups..."
create_resource_group $RG_STAGING $LOCATION_STAGING "staging"
create_resource_group $RG_PROD $LOCATION_PROD "production"

Check if service principal already exists

echo "🔍 Checking if service principal '$SP_NAME' already exists..."
SP_CHECK=$(az ad sp list --filter "displayName eq '$SP_NAME'" --query "[].appId" -o tsv)

if [ -z "$SP_CHECK" ]; then
echo "🔑 Creating new service principal '$SP_NAME'..."
SP_INFO=$(az ad sp create-for-rbac --name "$SP_NAME"
--role contributor
--scopes /subscriptions/$SUBSCRIPTION_ID
--query "{clientId:appId}" -o json)

CLIENT_ID=$(echo $SP_INFO | jq -r .clientId)
echo "✅ Service principal created with ID: $CLIENT_ID"

else
echo "ℹ️ Service principal '$SP_NAME' already exists with ID: $SP_CHECK"
CLIENT_ID=$SP_CHECK
fi

Create Azure Container Registry in production resource group

Remove hyphens and convert to lowercase for ACR name

ACR_NAME=$(echo "${REPO_NAME}" | tr -d '-' | tr '[:upper:]' '[:lower:]')
echo "🔍 Checking if Azure Container Registry '$ACR_NAME' exists..."
ACR_EXISTS=$(az acr check-name --name $ACR_NAME --query 'nameAvailable' -o tsv)

if [ "$ACR_EXISTS" = "true" ]; then
echo "🏗️ Creating Azure Container Registry '$ACR_NAME' in resource group '$RG_PROD'..."
az acr create
--resource-group $RG_PROD
--name $ACR_NAME
--sku Basic
--admin-enabled false
--location $LOCATION_PROD > /dev/null

echo "✅ Azure Container Registry created successfully"

else
echo "ℹ️ Azure Container Registry '$ACR_NAME' already exists"
fi

echo "🔑 Update admin-enabled for ACR..."
az acr update -n $ACR_NAME --admin-enabled true > /dev/null
echo "✅ Admin access enabled for Azure Container Registry '$ACR_NAME'"

Grant ACR access to the service principal

echo "🔑 Granting AcrPull role to service principal for ACR..."
az role assignment create
--assignee-object-id $(az ad sp show --id $CLIENT_ID --query id -o tsv)
--assignee-principal-type ServicePrincipal
--role AcrPull
--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_PROD/providers/Microsoft.ContainerRegistry/registries/$ACR_NAME > /dev/null

Assign role to specific resource groups

echo "🔑 Assigning Contributor role to service principal for resource group '$RG_STAGING'..."
az role assignment create
--assignee-object-id $(az ad sp show --id $CLIENT_ID --query id -o tsv)
--assignee-principal-type ServicePrincipal
--role Contributor
--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_STAGING > /dev/null

echo "🔑 Assigning Contributor role to service principal for resource group '$RG_PROD'..."
az role assignment create
--assignee-object-id $(az ad sp show --id $CLIENT_ID --query id -o tsv)
--assignee-principal-type ServicePrincipal
--role Contributor
--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_PROD > /dev/null

Assign User Access Administrator role to allow role assignments

echo "🔑 Assigning User Access Administrator role to service principal for resource groups..."
az role assignment create
--assignee-object-id $(az ad sp show --id $CLIENT_ID --query id -o tsv)
--assignee-principal-type ServicePrincipal
--role "User Access Administrator"
--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_STAGING > /dev/null

az role assignment create
--assignee-object-id $(az ad sp show --id $CLIENT_ID --query id -o tsv)
--assignee-principal-type ServicePrincipal
--role "User Access Administrator"
--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_PROD > /dev/null

Function to create federated credential if it doesn't exist

create_federated_credential() {
local name=$1
local subject=$2
local description=$3

echo "🔍 Checking if federated credential '$name' already exists..."
CRED_EXISTS=$(az ad app federated-credential list --id "$CLIENT_ID" --query "[?name=='$name'].name" -o tsv)

if [ -z "$CRED_EXISTS" ]; then
    echo "🔗 Creating federated credential '$name'..."
    az ad app federated-credential create \
        --id "$CLIENT_ID" \
        --parameters "{\"name\":\"$name\",\"issuer\":\"https://token.actions.githubusercontent.com\",\"subject\":\"$subject\",\"description\":\"$description\",\"audiences\":[\"api://AzureADTokenExchange\"]}" > /dev/null
    echo "✅ Federated credential '$name' created successfully"
else
    echo "ℹ️ Federated credential '$name' already exists, skipping creation"
fi

}

Create federated credentials for different GitHub workflows and environments

create_federated_credential "${ORG}-${REPO_NAME}-${ENV_STAGING}" "repo:${ORG}/${REPO_NAME}:environment:${ENV_STAGING}" "GitHub Actions for deploying to staging environment"
create_federated_credential "${ORG}-${REPO_NAME}-${ENV_PROD}" "repo:${ORG}/${REPO_NAME}:environment:${ENV_PROD}" "GitHub Actions for deploying to production environment"
create_federated_credential "${ORG}-${REPO_NAME}-main" "repo:${ORG}/${REPO_NAME}:ref:refs/heads/main" "GitHub Actions for main branch workflows"

Function to create or update GitHub variables

set_github_variable() {
local var_name=$1
local var_value=$2

if [ "$HAS_GH_CLI" = true ] && [ "$HAS_REPO_ACCESS" = true ]; then
    echo "🔧 Setting GitHub variable: $var_name"
    if gh variable set "$var_name" -b "$var_value" -R "$REPO" &> /dev/null; then
        echo "✅ Successfully set GitHub variable: $var_name"
    else
        echo "⚠️ Failed to set GitHub variable: $var_name"
    fi
fi

}

Create GitHub environments if they don't exist

create_github_environment() {
local env_name=$1
local require_approval=$2

if [ "$HAS_GH_CLI" = true ] && [ "$HAS_REPO_ACCESS" = true ]; then
    echo "🏗️ Checking if environment '$env_name' exists..."
    ENV_DATA=$(gh api repos/$REPO/environments)
    ENV_EXISTS=$(echo "$ENV_DATA" | jq -r --arg env "$env_name" '.environments[] | select(.name == $env) | .name' 2>/dev/null)
    
    if [ -z "$ENV_EXISTS" ]; then
        echo "🏗️ Creating GitHub environment: $env_name"
        
        # Create initial JSON for environment creation
        JSON_PAYLOAD='{
            "wait_timer": 0,
            "reviewers": [],
            "deployment_branch_policy": null
        }'
        
        # Create the environment first with proper JSON formatting
        gh api repos/$REPO/environments/$env_name \
            -X PUT \
            -H "Content-Type: application/json" \
            --input - <<< "$JSON_PAYLOAD" > /dev/null
    else
        echo "ℹ️ Environment '$env_name' already exists"
    fi
    
    if [ "$require_approval" = true ] && [ -n "$GITHUB_USER" ]; then
        # Add the current user as a required reviewer
        echo "🔒 Setting up environment '$env_name' with approval required from $GITHUB_USER"
        
        # Get the user's ID first
        USER_DATA=$(gh api users/$GITHUB_USER)
        USER_ID=$(echo "$USER_DATA" | jq -r '.id')
        
        if [ -n "$USER_ID" ]; then
            # Update environment settings with approval requirements
            APPROVAL_JSON="{
                \"wait_timer\": 0,
                \"reviewers\": [
                    {
                        \"type\": \"User\",
                        \"id\": $USER_ID
                    }
                ],
                \"deployment_branch_policy\": null
            }"
            
            # Update the environment settings
            gh api repos/$REPO/environments/$env_name \
                -X PUT \
                -H "Content-Type: application/json" \
                --input - <<< "$APPROVAL_JSON" > /dev/null
            
            echo "✅ Environment '$env_name' configured with $GITHUB_USER as required reviewer"
        else
            echo "⚠️ Could not get user ID for $GITHUB_USER, environment created without reviewers"
        fi
    else
        # For non-approval environments, ensure no reviewers are set
        NO_APPROVAL_JSON='{
            "wait_timer": 0,
            "reviewers": [],
            "deployment_branch_policy": null
        }'
        
        gh api repos/$REPO/environments/$env_name \
            -X PUT \
            -H "Content-Type: application/json" \
            --input - <<< "$NO_APPROVAL_JSON" > /dev/null
        
        echo "✅ Environment '$env_name' configured without approval requirements"
    fi
fi

}

Set GitHub repository variables if GitHub CLI is available and repository is accessible

if [ "$HAS_GH_CLI" = true ] && [ "$HAS_REPO_ACCESS" = true ]; then
echo ""
echo "🔧 Setting GitHub repository variables..."
set_github_variable "AZURE_CLIENT_ID" "$CLIENT_ID"
set_github_variable "AZURE_TENANT_ID" "$TENANT_ID"
set_github_variable "AZURE_SUBSCRIPTION_ID" "$SUBSCRIPTION_ID"
set_github_variable "AZURE_RESOURCE_GROUP" "$RG_STAGING"
set_github_variable "AZURE_RESOURCE_GROUP_PROD" "$RG_PROD"
set_github_variable "AZURE_ACR_NAME" "$ACR_NAME"
echo "✅ GitHub repository variables have been set"

echo ""
echo "🏗️ Creating GitHub environments..."
create_github_environment "$ENV_STAGING" false
create_github_environment "$ENV_PROD" true
echo "✅ GitHub environments have been created"

else
echo ""
echo "⚠️ GitHub repository variables and environments were not set automatically"
fi

echo ""
echo "✅ Setup completed successfully! Here's what was done:"
echo "-------------------------------"
echo "✓ Created or verified Azure resource groups:"
echo " - $RG_STAGING (in $LOCATION_STAGING)"
echo " - $RG_PROD (in $LOCATION_PROD)"
echo "✓ Created or verified Azure Container Registry:"
echo " - $ACR_NAME (in $RG_PROD)"
echo "✓ Created or verified service principal"
echo "✓ Configured OIDC federated credentials"
echo "✓ Set up GitHub repository variables (if GitHub CLI was available)"
echo "✓ Created GitHub environments (if GitHub CLI was available):"
echo " - $ENV_STAGING (no approval required)"
if [ -n "$GITHUB_USER" ]; then
echo " - $ENV_PROD (with approval required from $GITHUB_USER)"
else
echo " - $ENV_PROD (with required approval)"
fi
echo ""
echo "📋 GitHub Actions Variables:"
echo "-------------------------------"
echo "AZURE_CLIENT_ID: $CLIENT_ID"
echo "AZURE_TENANT_ID: $TENANT_ID"
echo "AZURE_SUBSCRIPTION_ID: $SUBSCRIPTION_ID"
echo "AZURE_RESOURCE_GROUP: $RG_STAGING"
echo "AZURE_RESOURCE_GROUP_PROD: $RG_PROD"
echo "AZURE_ACR_NAME: $ACR_NAME"
echo ""

if [ "$HAS_GH_CLI" = false ] || [ "$HAS_REPO_ACCESS" = false ]; then
echo "⚠️ You need to manually create these variables in your GitHub repository settings"
echo " Go to: https://github.com/$REPO/settings/variables/actions"
echo ""
echo "⚠️ You also need to manually create environments in your GitHub repository settings:"
echo " 1. Go to: https://github.com/$REPO/settings/environments"
echo " 2. Create '$ENV_STAGING' environment (no protection rules)"
echo " 3. Create '$ENV_PROD' environment (with required reviewers)"
fi

echo "🚀 Your deployment infrastructure is now fully set up!"
echo "🔒 No client secrets were created - secure OIDC authentication will be used instead"#!/bin/bash

Script to configure deployment environment in Azure and Environments/Variables for Actions

Usage: ./configure-deployment.sh / [resource-group-staging] [resource-group-prod] [location-staging] [location-prod]

Environment names - used for both GitHub environments and OIDC configuration

ENV_STAGING="Staging"
ENV_PROD="Production"

Check if repository name is provided

if [ $# -lt 1 ]; then
echo "Usage: $0 / [resource-group-staging] [resource-group-prod] [location-staging] [location-prod]"
echo "Example: $0 octodemo/glowing-acorn rg-octocat-staging rg-octocat-prod eastus2 eastus2"
exit 1
fi

REPO=$1
ORG=$(echo $REPO | cut -d'/' -f1)
REPO_NAME=$(echo $REPO | cut -d'/' -f2)
SP_NAME="${REPO_NAME}-github-actions"

Default resource group names and locations if not provided

RG_STAGING=${2:-"${REPO_NAME}-staging"}
RG_PROD=${3:-"${REPO_NAME}-prod"}
LOCATION_STAGING=${4:-"eastus2"}
LOCATION_PROD=${5:-"eastus2"}

Check if GitHub CLI is installed

if ! command -v gh &> /dev/null; then
echo "❌ GitHub CLI (gh) is not installed. Please install it to set repository variables."
echo " Installation instructions: https://cli.github.com/manual/installation"
HAS_GH_CLI=false
else
echo "✅ GitHub CLI is installed."
HAS_GH_CLI=true

# Check if authenticated with GitHub
if ! gh auth status &> /dev/null; then
    echo "🔐 Not logged in to GitHub. Please authenticate:"
    gh auth login
else
    echo "✅ Already authenticated with GitHub"
fi

# Get current GitHub user for environment approval - don't use --silent with jq
echo "🔍 Getting GitHub user information..."
GITHUB_USER=$(gh api user | jq -r '.login')
if [ -n "$GITHUB_USER" ]; then
    echo "✅ Current GitHub user: $GITHUB_USER"
else
    echo "⚠️ Could not determine GitHub user. Will use empty reviewer list for environments."
    GITHUB_USER=""
fi

# Check if the repository exists and is accessible
if ! gh repo view $REPO &> /dev/null; then
    echo "⚠️  Unable to access repository $REPO. Please check if it exists and you have access."
    echo "    Will not set GitHub repository variables automatically."
    HAS_REPO_ACCESS=false
else
    echo "✅ Repository $REPO is accessible"
    HAS_REPO_ACCESS=true
fi

fi

Check if already logged in to Azure

echo "🔍 Checking if already logged in to Azure..."
ACCOUNT_CHECK=$(az account show 2>/dev/null)
LOGIN_STATUS=$?

if [ $LOGIN_STATUS -ne 0 ]; then
echo "🔐 Not logged in. Initiating Azure login..."
az login
else
echo "✅ Already logged in to Azure"
fi

echo "🔍 Getting subscription information..."
SUBSCRIPTION_ID=$(az account show --query id -o tsv)
SUBSCRIPTION_NAME=$(az account show --query name -o tsv)
TENANT_ID=$(az account show --query tenantId -o tsv)

echo "📊 Using the following Azure subscription:"
echo " Subscription ID: $SUBSCRIPTION_ID"
echo " Subscription Name: $SUBSCRIPTION_NAME"
echo " Tenant ID: $TENANT_ID"

Create or check resource groups

create_resource_group() {
local rg_name=$1
local location=$2
local env=$3

echo "🔍 Checking if resource group '$rg_name' exists..."
RG_EXISTS=$(az group exists --name $rg_name)

if [ "$RG_EXISTS" = "true" ]; then
    echo "✅ Resource group '$rg_name' already exists"
else
    echo "🏗️ Creating resource group '$rg_name' in '$location'..."
    az group create --name $rg_name --location $location --tags environment=$env application=OctoCAT-SupplyChain > /dev/null
    echo "✅ Resource group '$rg_name' created successfully"
fi

}

Create resource groups

echo ""
echo "🏗️ Creating Azure resource groups..."
create_resource_group $RG_STAGING $LOCATION_STAGING "staging"
create_resource_group $RG_PROD $LOCATION_PROD "production"

Check if service principal already exists

echo "🔍 Checking if service principal '$SP_NAME' already exists..."
SP_CHECK=$(az ad sp list --filter "displayName eq '$SP_NAME'" --query "[].appId" -o tsv)

if [ -z "$SP_CHECK" ]; then
echo "🔑 Creating new service principal '$SP_NAME'..."
SP_INFO=$(az ad sp create-for-rbac --name "$SP_NAME"
--role contributor
--scopes /subscriptions/$SUBSCRIPTION_ID
--query "{clientId:appId}" -o json)

CLIENT_ID=$(echo $SP_INFO | jq -r .clientId)
echo "✅ Service principal created with ID: $CLIENT_ID"

else
echo "ℹ️ Service principal '$SP_NAME' already exists with ID: $SP_CHECK"
CLIENT_ID=$SP_CHECK
fi

Create Azure Container Registry in production resource group

Remove hyphens and convert to lowercase for ACR name

ACR_NAME=$(echo "${REPO_NAME}" | tr -d '-' | tr '[:upper:]' '[:lower:]')
echo "🔍 Checking if Azure Container Registry '$ACR_NAME' exists..."
ACR_EXISTS=$(az acr check-name --name $ACR_NAME --query 'nameAvailable' -o tsv)

if [ "$ACR_EXISTS" = "true" ]; then
echo "🏗️ Creating Azure Container Registry '$ACR_NAME' in resource group '$RG_PROD'..."
az acr create
--resource-group $RG_PROD
--name $ACR_NAME
--sku Basic
--admin-enabled false
--location $LOCATION_PROD > /dev/null

echo "✅ Azure Container Registry created successfully"

else
echo "ℹ️ Azure Container Registry '$ACR_NAME' already exists"
fi

echo "🔑 Update admin-enabled for ACR..."
az acr update -n $ACR_NAME --admin-enabled true > /dev/null
echo "✅ Admin access enabled for Azure Container Registry '$ACR_NAME'"

Grant ACR access to the service principal

echo "🔑 Granting AcrPull role to service principal for ACR..."
az role assignment create
--assignee-object-id $(az ad sp show --id $CLIENT_ID --query id -o tsv)
--assignee-principal-type ServicePrincipal
--role AcrPull
--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_PROD/providers/Microsoft.ContainerRegistry/registries/$ACR_NAME > /dev/null

Assign role to specific resource groups

echo "🔑 Assigning Contributor role to service principal for resource group '$RG_STAGING'..."
az role assignment create
--assignee-object-id $(az ad sp show --id $CLIENT_ID --query id -o tsv)
--assignee-principal-type ServicePrincipal
--role Contributor
--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_STAGING > /dev/null

echo "🔑 Assigning Contributor role to service principal for resource group '$RG_PROD'..."
az role assignment create
--assignee-object-id $(az ad sp show --id $CLIENT_ID --query id -o tsv)
--assignee-principal-type ServicePrincipal
--role Contributor
--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_PROD > /dev/null

Assign User Access Administrator role to allow role assignments

echo "🔑 Assigning User Access Administrator role to service principal for resource groups..."
az role assignment create
--assignee-object-id $(az ad sp show --id $CLIENT_ID --query id -o tsv)
--assignee-principal-type ServicePrincipal
--role "User Access Administrator"
--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_STAGING > /dev/null

az role assignment create
--assignee-object-id $(az ad sp show --id $CLIENT_ID --query id -o tsv)
--assignee-principal-type ServicePrincipal
--role "User Access Administrator"
--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_PROD > /dev/null

Function to create federated credential if it doesn't exist

create_federated_credential() {
local name=$1
local subject=$2
local description=$3

echo "🔍 Checking if federated credential '$name' already exists..."
CRED_EXISTS=$(az ad app federated-credential list --id "$CLIENT_ID" --query "[?name=='$name'].name" -o tsv)

if [ -z "$CRED_EXISTS" ]; then
    echo "🔗 Creating federated credential '$name'..."
    az ad app federated-credential create \
        --id "$CLIENT_ID" \
        --parameters "{\"name\":\"$name\",\"issuer\":\"https://token.actions.githubusercontent.com\",\"subject\":\"$subject\",\"description\":\"$description\",\"audiences\":[\"api://AzureADTokenExchange\"]}" > /dev/null
    echo "✅ Federated credential '$name' created successfully"
else
    echo "ℹ️ Federated credential '$name' already exists, skipping creation"
fi

}

Create federated credentials for different GitHub workflows and environments

create_federated_credential "${ORG}-${REPO_NAME}-${ENV_STAGING}" "repo:${ORG}/${REPO_NAME}:environment:${ENV_STAGING}" "GitHub Actions for deploying to staging environment"
create_federated_credential "${ORG}-${REPO_NAME}-${ENV_PROD}" "repo:${ORG}/${REPO_NAME}:environment:${ENV_PROD}" "GitHub Actions for deploying to production environment"
create_federated_credential "${ORG}-${REPO_NAME}-main" "repo:${ORG}/${REPO_NAME}:ref:refs/heads/main" "GitHub Actions for main branch workflows"

Function to create or update GitHub variables

set_github_variable() {
local var_name=$1
local var_value=$2

if [ "$HAS_GH_CLI" = true ] && [ "$HAS_REPO_ACCESS" = true ]; then
    echo "🔧 Setting GitHub variable: $var_name"
    if gh variable set "$var_name" -b "$var_value" -R "$REPO" &> /dev/null; then
        echo "✅ Successfully set GitHub variable: $var_name"
    else
        echo "⚠️ Failed to set GitHub variable: $var_name"
    fi
fi

}

Create GitHub environments if they don't exist

create_github_environment() {
local env_name=$1
local require_approval=$2

if [ "$HAS_GH_CLI" = true ] && [ "$HAS_REPO_ACCESS" = true ]; then
    echo "🏗️ Checking if environment '$env_name' exists..."
    ENV_DATA=$(gh api repos/$REPO/environments)
    ENV_EXISTS=$(echo "$ENV_DATA" | jq -r --arg env "$env_name" '.environments[] | select(.name == $env) | .name' 2>/dev/null)
    
    if [ -z "$ENV_EXISTS" ]; then
        echo "🏗️ Creating GitHub environment: $env_name"
        
        # Create initial JSON for environment creation
        JSON_PAYLOAD='{
            "wait_timer": 0,
            "reviewers": [],
            "deployment_branch_policy": null
        }'
        
        # Create the environment first with proper JSON formatting
        gh api repos/$REPO/environments/$env_name \
            -X PUT \
            -H "Content-Type: application/json" \
            --input - <<< "$JSON_PAYLOAD" > /dev/null
    else
        echo "ℹ️ Environment '$env_name' already exists"
    fi
    
    if [ "$require_approval" = true ] && [ -n "$GITHUB_USER" ]; then
        # Add the current user as a required reviewer
        echo "🔒 Setting up environment '$env_name' with approval required from $GITHUB_USER"
        
        # Get the user's ID first
        USER_DATA=$(gh api users/$GITHUB_USER)
        USER_ID=$(echo "$USER_DATA" | jq -r '.id')
        
        if [ -n "$USER_ID" ]; then
            # Update environment settings with approval requirements
            APPROVAL_JSON="{
                \"wait_timer\": 0,
                \"reviewers\": [
                    {
                        \"type\": \"User\",
                        \"id\": $USER_ID
                    }
                ],
                \"deployment_branch_policy\": null
            }"
            
            # Update the environment settings
            gh api repos/$REPO/environments/$env_name \
                -X PUT \
                -H "Content-Type: application/json" \
                --input - <<< "$APPROVAL_JSON" > /dev/null
            
            echo "✅ Environment '$env_name' configured with $GITHUB_USER as required reviewer"
        else
            echo "⚠️ Could not get user ID for $GITHUB_USER, environment created without reviewers"
        fi
    else
        # For non-approval environments, ensure no reviewers are set
        NO_APPROVAL_JSON='{
            "wait_timer": 0,
            "reviewers": [],
            "deployment_branch_policy": null
        }'
        
        gh api repos/$REPO/environments/$env_name \
            -X PUT \
            -H "Content-Type: application/json" \
            --input - <<< "$NO_APPROVAL_JSON" > /dev/null
        
        echo "✅ Environment '$env_name' configured without approval requirements"
    fi
fi

}

Set GitHub repository variables if GitHub CLI is available and repository is accessible

if [ "$HAS_GH_CLI" = true ] && [ "$HAS_REPO_ACCESS" = true ]; then
echo ""
echo "🔧 Setting GitHub repository variables..."
set_github_variable "AZURE_CLIENT_ID" "$CLIENT_ID"
set_github_variable "AZURE_TENANT_ID" "$TENANT_ID"
set_github_variable "AZURE_SUBSCRIPTION_ID" "$SUBSCRIPTION_ID"
set_github_variable "AZURE_RESOURCE_GROUP" "$RG_STAGING"
set_github_variable "AZURE_RESOURCE_GROUP_PROD" "$RG_PROD"
set_github_variable "AZURE_ACR_NAME" "$ACR_NAME"
echo "✅ GitHub repository variables have been set"

echo ""
echo "🏗️ Creating GitHub environments..."
create_github_environment "$ENV_STAGING" false
create_github_environment "$ENV_PROD" true
echo "✅ GitHub environments have been created"

else
echo ""
echo "⚠️ GitHub repository variables and environments were not set automatically"
fi

echo ""
echo "✅ Setup completed successfully! Here's what was done:"
echo "-------------------------------"
echo "✓ Created or verified Azure resource groups:"
echo " - $RG_STAGING (in $LOCATION_STAGING)"
echo " - $RG_PROD (in $LOCATION_PROD)"
echo "✓ Created or verified Azure Container Registry:"
echo " - $ACR_NAME (in $RG_PROD)"
echo "✓ Created or verified service principal"
echo "✓ Configured OIDC federated credentials"
echo "✓ Set up GitHub repository variables (if GitHub CLI was available)"
echo "✓ Created GitHub environments (if GitHub CLI was available):"
echo " - $ENV_STAGING (no approval required)"
if [ -n "$GITHUB_USER" ]; then
echo " - $ENV_PROD (with approval required from $GITHUB_USER)"
else
echo " - $ENV_PROD (with required approval)"
fi
echo ""
echo "📋 GitHub Actions Variables:"
echo "-------------------------------"
echo "AZURE_CLIENT_ID: $CLIENT_ID"
echo "AZURE_TENANT_ID: $TENANT_ID"
echo "AZURE_SUBSCRIPTION_ID: $SUBSCRIPTION_ID"
echo "AZURE_RESOURCE_GROUP: $RG_STAGING"
echo "AZURE_RESOURCE_GROUP_PROD: $RG_PROD"
echo "AZURE_ACR_NAME: $ACR_NAME"
echo ""

if [ "$HAS_GH_CLI" = false ] || [ "$HAS_REPO_ACCESS" = false ]; then
echo "⚠️ You need to manually create these variables in your GitHub repository settings"
echo " Go to: https://github.com/$REPO/settings/variables/actions"
echo ""
echo "⚠️ You also need to manually create environments in your GitHub repository settings:"
echo " 1. Go to: https://github.com/$REPO/settings/environments"
echo " 2. Create '$ENV_STAGING' environment (no protection rules)"
echo " 3. Create '$ENV_PROD' environment (with required reviewers)"
fi

echo "🚀 Your deployment infrastructure is now fully set up!"
echo "🔒 No client secrets were created - secure OIDC authentication will be used instead"