From e7bed0e7a387f209ad6cbe79d22a98aa29ffb9cd Mon Sep 17 00:00:00 2001 From: sophia chen Date: Thu, 12 Nov 2026 12:11:59 +1100 Subject: [PATCH 1/5] UID2-8294: Add Azure OIDC login support --- .github/workflows/shared-run-e2e-tests.yaml | 25 ++++++++++++++++ actions/start_aks_cluster/action.yaml | 29 +++++++++++++++++-- .../start_aks_private_operator/action.yaml | 29 +++++++++++++++++-- .../start_azure_private_operator/action.yaml | 29 +++++++++++++++++-- actions/stop_aks_private_operator/action.yaml | 29 +++++++++++++++++-- .../stop_azure_private_operator/action.yaml | 29 +++++++++++++++++-- 6 files changed, 155 insertions(+), 15 deletions(-) diff --git a/.github/workflows/shared-run-e2e-tests.yaml b/.github/workflows/shared-run-e2e-tests.yaml index 7512d04a..5c0803a2 100644 --- a/.github/workflows/shared-run-e2e-tests.yaml +++ b/.github/workflows/shared-run-e2e-tests.yaml @@ -73,6 +73,16 @@ on: description: The AWS PCR0 type: string + azure_client_id: + description: The Azure application client ID for OIDC login + type: string + azure_tenant_id: + description: The Azure tenant ID for OIDC login + type: string + azure_subscription_id: + description: The Azure subscription ID for OIDC login + type: string + env: REGISTRY: ghcr.io @@ -220,6 +230,9 @@ jobs: if: ${{ inputs.operator_type == 'aks' }} uses: IABTechLab/uid2-shared-actions/actions/start_aks_cluster@v3 with: + azure_client_id: ${{ inputs.azure_client_id }} + azure_tenant_id: ${{ inputs.azure_tenant_id }} + azure_subscription_id: ${{ inputs.azure_subscription_id }} azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} run_id: ${{ github.run_id }} @@ -283,6 +296,9 @@ jobs: bore_url_optout: ${{ steps.bore.outputs.bore_url_optout }} template_file: ${{ steps.prepare_azure_metadata.outputs.template_file }} parameters_file: ${{ steps.prepare_azure_metadata.outputs.parameters_file }} + azure_client_id: ${{ inputs.azure_client_id }} + azure_tenant_id: ${{ inputs.azure_tenant_id }} + azure_subscription_id: ${{ inputs.azure_subscription_id }} azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} target_environment: ${{ inputs.target_environment }} @@ -306,6 +322,9 @@ jobs: uses: IABTechLab/uid2-shared-actions/actions/start_aks_private_operator@v3 with: template_file: ${{ steps.prepare_aks_metadata.outputs.template_file }} + azure_client_id: ${{ inputs.azure_client_id }} + azure_tenant_id: ${{ inputs.azure_tenant_id }} + azure_subscription_id: ${{ inputs.azure_subscription_id }} azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} run_id: ${{ github.run_id }} @@ -406,6 +425,9 @@ jobs: if: ${{ inputs.operator_type == 'azure' }} uses: IABTechLab/uid2-shared-actions/actions/stop_azure_private_operator@v3 with: + azure_client_id: ${{ inputs.azure_client_id }} + azure_tenant_id: ${{ inputs.azure_tenant_id }} + azure_subscription_id: ${{ inputs.azure_subscription_id }} azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} azure_container_group_name: ${{ needs.e2e-test.outputs.azure_container_group_name }} @@ -426,5 +448,8 @@ jobs: if: ${{ inputs.operator_type == 'aks' }} uses: IABTechLab/uid2-shared-actions/actions/stop_aks_private_operator@v3 with: + azure_client_id: ${{ inputs.azure_client_id }} + azure_tenant_id: ${{ inputs.azure_tenant_id }} + azure_subscription_id: ${{ inputs.azure_subscription_id }} azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} run_id: ${{ github.run_id }} diff --git a/actions/start_aks_cluster/action.yaml b/actions/start_aks_cluster/action.yaml index e084321f..4e5b33a6 100644 --- a/actions/start_aks_cluster/action.yaml +++ b/actions/start_aks_cluster/action.yaml @@ -2,9 +2,22 @@ name: Start AKS Cluster description: Creates the AKS cluster and infrastructure inputs: + azure_client_id: + description: The Azure application client ID for OIDC login + required: false + default: '' + azure_tenant_id: + description: The Azure tenant ID for OIDC login + required: false + default: '' + azure_subscription_id: + description: The Azure subscription ID for OIDC login + required: false + default: '' azure_credentials: - description: The Azure credentials - required: true + description: The legacy Azure credentials + required: false + default: '' run_id: description: Unique run identifier for resource naming required: true @@ -13,7 +26,17 @@ runs: using: "composite" steps: - - name: Log in to Azure + - name: Log in to Azure with OIDC + if: ${{ inputs.azure_client_id != '' }} + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ inputs.azure_client_id }} + tenant-id: ${{ inputs.azure_tenant_id }} + subscription-id: ${{ inputs.azure_subscription_id }} + enable-AzPSSession: true + + - name: Log in to Azure with legacy credentials + if: ${{ inputs.azure_client_id == '' }} uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: creds: ${{ inputs.azure_credentials }} diff --git a/actions/start_aks_private_operator/action.yaml b/actions/start_aks_private_operator/action.yaml index bd35014e..f992de52 100644 --- a/actions/start_aks_private_operator/action.yaml +++ b/actions/start_aks_private_operator/action.yaml @@ -5,9 +5,22 @@ inputs: template_file: description: The template file required: true + azure_client_id: + description: The Azure application client ID for OIDC login + required: false + default: '' + azure_tenant_id: + description: The Azure tenant ID for OIDC login + required: false + default: '' + azure_subscription_id: + description: The Azure subscription ID for OIDC login + required: false + default: '' azure_credentials: - description: The Azure credentials - required: true + description: The legacy Azure credentials + required: false + default: '' run_id: description: Unique run identifier for resource naming required: true @@ -21,7 +34,17 @@ runs: using: "composite" steps: - - name: Log in to Azure + - name: Log in to Azure with OIDC + if: ${{ inputs.azure_client_id != '' }} + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ inputs.azure_client_id }} + tenant-id: ${{ inputs.azure_tenant_id }} + subscription-id: ${{ inputs.azure_subscription_id }} + enable-AzPSSession: true + + - name: Log in to Azure with legacy credentials + if: ${{ inputs.azure_client_id == '' }} uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: creds: ${{ inputs.azure_credentials }} diff --git a/actions/start_azure_private_operator/action.yaml b/actions/start_azure_private_operator/action.yaml index c48caac9..0f408949 100644 --- a/actions/start_azure_private_operator/action.yaml +++ b/actions/start_azure_private_operator/action.yaml @@ -14,9 +14,22 @@ inputs: parameters_file: description: The parameters file required: true + azure_client_id: + description: The Azure application client ID for OIDC login + required: false + default: '' + azure_tenant_id: + description: The Azure tenant ID for OIDC login + required: false + default: '' + azure_subscription_id: + description: The Azure subscription ID for OIDC login + required: false + default: '' azure_credentials: - description: The Azure credentials - required: true + description: The legacy Azure credentials + required: false + default: '' target_environment: description: The target environment [mock, integ, prod] required: true @@ -33,7 +46,17 @@ runs: using: "composite" steps: - - name: Log in to Azure + - name: Log in to Azure with OIDC + if: ${{ inputs.azure_client_id != '' }} + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ inputs.azure_client_id }} + tenant-id: ${{ inputs.azure_tenant_id }} + subscription-id: ${{ inputs.azure_subscription_id }} + enable-AzPSSession: true + + - name: Log in to Azure with legacy credentials + if: ${{ inputs.azure_client_id == '' }} uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: creds: ${{ inputs.azure_credentials }} diff --git a/actions/stop_aks_private_operator/action.yaml b/actions/stop_aks_private_operator/action.yaml index 583a924d..6ece9b98 100644 --- a/actions/stop_aks_private_operator/action.yaml +++ b/actions/stop_aks_private_operator/action.yaml @@ -2,9 +2,22 @@ name: Stop AKS Private Operator description: Spins down an AKS private operator inputs: + azure_client_id: + description: The Azure application client ID for OIDC login + required: false + default: '' + azure_tenant_id: + description: The Azure tenant ID for OIDC login + required: false + default: '' + azure_subscription_id: + description: The Azure subscription ID for OIDC login + required: false + default: '' azure_credentials: - description: The Azure credentials - required: true + description: The legacy Azure credentials + required: false + default: '' run_id: description: Unique run identifier for resource naming required: true @@ -13,7 +26,17 @@ runs: using: "composite" steps: - - name: Log in to Azure + - name: Log in to Azure with OIDC + if: ${{ inputs.azure_client_id != '' }} + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ inputs.azure_client_id }} + tenant-id: ${{ inputs.azure_tenant_id }} + subscription-id: ${{ inputs.azure_subscription_id }} + enable-AzPSSession: true + + - name: Log in to Azure with legacy credentials + if: ${{ inputs.azure_client_id == '' }} uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: creds: ${{ inputs.azure_credentials }} diff --git a/actions/stop_azure_private_operator/action.yaml b/actions/stop_azure_private_operator/action.yaml index 82c97dd4..5b2f3551 100644 --- a/actions/stop_azure_private_operator/action.yaml +++ b/actions/stop_azure_private_operator/action.yaml @@ -2,9 +2,22 @@ name: Stop Azure Private Operator description: Spins down an Azure private operator inputs: + azure_client_id: + description: The Azure application client ID for OIDC login + required: false + default: '' + azure_tenant_id: + description: The Azure tenant ID for OIDC login + required: false + default: '' + azure_subscription_id: + description: The Azure subscription ID for OIDC login + required: false + default: '' azure_credentials: - description: The Azure credentials - required: true + description: The legacy Azure credentials + required: false + default: '' azure_container_group_name: description: The Azure instance name required: true @@ -13,7 +26,17 @@ runs: using: "composite" steps: - - name: Log in to Azure + - name: Log in to Azure with OIDC + if: ${{ inputs.azure_client_id != '' }} + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ inputs.azure_client_id }} + tenant-id: ${{ inputs.azure_tenant_id }} + subscription-id: ${{ inputs.azure_subscription_id }} + enable-AzPSSession: true + + - name: Log in to Azure with legacy credentials + if: ${{ inputs.azure_client_id == '' }} uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: creds: ${{ inputs.azure_credentials }} From 385448a3af2a4affdf4fea99339e556e95cb44fa Mon Sep 17 00:00:00 2001 From: sophia chen Date: Thu, 12 Nov 2026 14:13:07 +1100 Subject: [PATCH 2/5] UID2-8294: Centralize Azure OIDC identifiers --- .github/workflows/shared-run-e2e-tests.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/shared-run-e2e-tests.yaml b/.github/workflows/shared-run-e2e-tests.yaml index 5c0803a2..afe1cfe8 100644 --- a/.github/workflows/shared-run-e2e-tests.yaml +++ b/.github/workflows/shared-run-e2e-tests.yaml @@ -76,12 +76,15 @@ on: azure_client_id: description: The Azure application client ID for OIDC login type: string + default: cb9577ac-2972-46a9-b882-d3c0da07b4ce azure_tenant_id: description: The Azure tenant ID for OIDC login type: string + default: 67714990-53f7-4cc5-b369-edabfd7d01d9 azure_subscription_id: description: The Azure subscription ID for OIDC login type: string + default: 63e97a70-d825-4b08-af6d-c0d8ad98bed3 env: REGISTRY: ghcr.io From ed19e9568284110197bf96a460219e8e27dce371 Mon Sep 17 00:00:00 2001 From: sophia chen Date: Thu, 12 Nov 2026 14:25:14 +1100 Subject: [PATCH 3/5] UID2-8294: Remove legacy Azure credentials --- .github/workflows/shared-run-e2e-tests.yaml | 5 ----- actions/start_aks_cluster/action.yaml | 21 +++---------------- .../start_aks_private_operator/action.yaml | 21 +++---------------- .../start_azure_private_operator/action.yaml | 21 +++---------------- actions/stop_aks_private_operator/action.yaml | 21 +++---------------- .../stop_azure_private_operator/action.yaml | 21 +++---------------- 6 files changed, 15 insertions(+), 95 deletions(-) diff --git a/.github/workflows/shared-run-e2e-tests.yaml b/.github/workflows/shared-run-e2e-tests.yaml index afe1cfe8..3e1af306 100644 --- a/.github/workflows/shared-run-e2e-tests.yaml +++ b/.github/workflows/shared-run-e2e-tests.yaml @@ -236,7 +236,6 @@ jobs: azure_client_id: ${{ inputs.azure_client_id }} azure_tenant_id: ${{ inputs.azure_tenant_id }} azure_subscription_id: ${{ inputs.azure_subscription_id }} - azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} run_id: ${{ github.run_id }} - name: Get AKS operator key @@ -302,7 +301,6 @@ jobs: azure_client_id: ${{ inputs.azure_client_id }} azure_tenant_id: ${{ inputs.azure_tenant_id }} azure_subscription_id: ${{ inputs.azure_subscription_id }} - azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} target_environment: ${{ inputs.target_environment }} - name: Start AWS private operator @@ -328,7 +326,6 @@ jobs: azure_client_id: ${{ inputs.azure_client_id }} azure_tenant_id: ${{ inputs.azure_tenant_id }} azure_subscription_id: ${{ inputs.azure_subscription_id }} - azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} run_id: ${{ github.run_id }} - name: Decide E2E test environment variables @@ -431,7 +428,6 @@ jobs: azure_client_id: ${{ inputs.azure_client_id }} azure_tenant_id: ${{ inputs.azure_tenant_id }} azure_subscription_id: ${{ inputs.azure_subscription_id }} - azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} azure_container_group_name: ${{ needs.e2e-test.outputs.azure_container_group_name }} - name: Stop AWS private operator @@ -454,5 +450,4 @@ jobs: azure_client_id: ${{ inputs.azure_client_id }} azure_tenant_id: ${{ inputs.azure_tenant_id }} azure_subscription_id: ${{ inputs.azure_subscription_id }} - azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} run_id: ${{ github.run_id }} diff --git a/actions/start_aks_cluster/action.yaml b/actions/start_aks_cluster/action.yaml index 4e5b33a6..42cb3f60 100644 --- a/actions/start_aks_cluster/action.yaml +++ b/actions/start_aks_cluster/action.yaml @@ -4,20 +4,13 @@ description: Creates the AKS cluster and infrastructure inputs: azure_client_id: description: The Azure application client ID for OIDC login - required: false - default: '' + required: true azure_tenant_id: description: The Azure tenant ID for OIDC login - required: false - default: '' + required: true azure_subscription_id: description: The Azure subscription ID for OIDC login - required: false - default: '' - azure_credentials: - description: The legacy Azure credentials - required: false - default: '' + required: true run_id: description: Unique run identifier for resource naming required: true @@ -27,7 +20,6 @@ runs: steps: - name: Log in to Azure with OIDC - if: ${{ inputs.azure_client_id != '' }} uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: client-id: ${{ inputs.azure_client_id }} @@ -35,13 +27,6 @@ runs: subscription-id: ${{ inputs.azure_subscription_id }} enable-AzPSSession: true - - name: Log in to Azure with legacy credentials - if: ${{ inputs.azure_client_id == '' }} - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 - with: - creds: ${{ inputs.azure_credentials }} - enable-AzPSSession: true - - name: Start AKS cluster id: start_aks shell: bash diff --git a/actions/start_aks_private_operator/action.yaml b/actions/start_aks_private_operator/action.yaml index f992de52..aee6232c 100644 --- a/actions/start_aks_private_operator/action.yaml +++ b/actions/start_aks_private_operator/action.yaml @@ -7,20 +7,13 @@ inputs: required: true azure_client_id: description: The Azure application client ID for OIDC login - required: false - default: '' + required: true azure_tenant_id: description: The Azure tenant ID for OIDC login - required: false - default: '' + required: true azure_subscription_id: description: The Azure subscription ID for OIDC login - required: false - default: '' - azure_credentials: - description: The legacy Azure credentials - required: false - default: '' + required: true run_id: description: Unique run identifier for resource naming required: true @@ -35,7 +28,6 @@ runs: steps: - name: Log in to Azure with OIDC - if: ${{ inputs.azure_client_id != '' }} uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: client-id: ${{ inputs.azure_client_id }} @@ -43,13 +35,6 @@ runs: subscription-id: ${{ inputs.azure_subscription_id }} enable-AzPSSession: true - - name: Log in to Azure with legacy credentials - if: ${{ inputs.azure_client_id == '' }} - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 - with: - creds: ${{ inputs.azure_credentials }} - enable-AzPSSession: true - - name: Start AKS private operator id: start_aks shell: bash diff --git a/actions/start_azure_private_operator/action.yaml b/actions/start_azure_private_operator/action.yaml index 0f408949..e0afba67 100644 --- a/actions/start_azure_private_operator/action.yaml +++ b/actions/start_azure_private_operator/action.yaml @@ -16,20 +16,13 @@ inputs: required: true azure_client_id: description: The Azure application client ID for OIDC login - required: false - default: '' + required: true azure_tenant_id: description: The Azure tenant ID for OIDC login - required: false - default: '' + required: true azure_subscription_id: description: The Azure subscription ID for OIDC login - required: false - default: '' - azure_credentials: - description: The legacy Azure credentials - required: false - default: '' + required: true target_environment: description: The target environment [mock, integ, prod] required: true @@ -47,7 +40,6 @@ runs: steps: - name: Log in to Azure with OIDC - if: ${{ inputs.azure_client_id != '' }} uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: client-id: ${{ inputs.azure_client_id }} @@ -55,13 +47,6 @@ runs: subscription-id: ${{ inputs.azure_subscription_id }} enable-AzPSSession: true - - name: Log in to Azure with legacy credentials - if: ${{ inputs.azure_client_id == '' }} - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 - with: - creds: ${{ inputs.azure_credentials }} - enable-AzPSSession: true - - name: Start Azure private operator id: start_azure shell: bash diff --git a/actions/stop_aks_private_operator/action.yaml b/actions/stop_aks_private_operator/action.yaml index 6ece9b98..d772868b 100644 --- a/actions/stop_aks_private_operator/action.yaml +++ b/actions/stop_aks_private_operator/action.yaml @@ -4,20 +4,13 @@ description: Spins down an AKS private operator inputs: azure_client_id: description: The Azure application client ID for OIDC login - required: false - default: '' + required: true azure_tenant_id: description: The Azure tenant ID for OIDC login - required: false - default: '' + required: true azure_subscription_id: description: The Azure subscription ID for OIDC login - required: false - default: '' - azure_credentials: - description: The legacy Azure credentials - required: false - default: '' + required: true run_id: description: Unique run identifier for resource naming required: true @@ -27,7 +20,6 @@ runs: steps: - name: Log in to Azure with OIDC - if: ${{ inputs.azure_client_id != '' }} uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: client-id: ${{ inputs.azure_client_id }} @@ -35,13 +27,6 @@ runs: subscription-id: ${{ inputs.azure_subscription_id }} enable-AzPSSession: true - - name: Log in to Azure with legacy credentials - if: ${{ inputs.azure_client_id == '' }} - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 - with: - creds: ${{ inputs.azure_credentials }} - enable-AzPSSession: true - - name: Stop AKS private operator shell: bash env: diff --git a/actions/stop_azure_private_operator/action.yaml b/actions/stop_azure_private_operator/action.yaml index 5b2f3551..29fc3014 100644 --- a/actions/stop_azure_private_operator/action.yaml +++ b/actions/stop_azure_private_operator/action.yaml @@ -4,20 +4,13 @@ description: Spins down an Azure private operator inputs: azure_client_id: description: The Azure application client ID for OIDC login - required: false - default: '' + required: true azure_tenant_id: description: The Azure tenant ID for OIDC login - required: false - default: '' + required: true azure_subscription_id: description: The Azure subscription ID for OIDC login - required: false - default: '' - azure_credentials: - description: The legacy Azure credentials - required: false - default: '' + required: true azure_container_group_name: description: The Azure instance name required: true @@ -27,7 +20,6 @@ runs: steps: - name: Log in to Azure with OIDC - if: ${{ inputs.azure_client_id != '' }} uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: client-id: ${{ inputs.azure_client_id }} @@ -35,13 +27,6 @@ runs: subscription-id: ${{ inputs.azure_subscription_id }} enable-AzPSSession: true - - name: Log in to Azure with legacy credentials - if: ${{ inputs.azure_client_id == '' }} - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 - with: - creds: ${{ inputs.azure_credentials }} - enable-AzPSSession: true - - name: Stop Azure private operator shell: bash env: From 8ebb4840eb6ac46f600bac94da1b68011471291b Mon Sep 17 00:00:00 2001 From: sophia chen Date: Thu, 12 Nov 2026 14:48:50 +1100 Subject: [PATCH 4/5] UID2-8294: Configure Azure OIDC from caller variables --- .github/workflows/shared-run-e2e-tests.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/shared-run-e2e-tests.yaml b/.github/workflows/shared-run-e2e-tests.yaml index 3e1af306..e62bb38c 100644 --- a/.github/workflows/shared-run-e2e-tests.yaml +++ b/.github/workflows/shared-run-e2e-tests.yaml @@ -76,15 +76,12 @@ on: azure_client_id: description: The Azure application client ID for OIDC login type: string - default: cb9577ac-2972-46a9-b882-d3c0da07b4ce azure_tenant_id: description: The Azure tenant ID for OIDC login type: string - default: 67714990-53f7-4cc5-b369-edabfd7d01d9 azure_subscription_id: description: The Azure subscription ID for OIDC login type: string - default: 63e97a70-d825-4b08-af6d-c0d8ad98bed3 env: REGISTRY: ghcr.io From 86c8c7c659619fb87c8407eff928b91f63569c1e Mon Sep 17 00:00:00 2001 From: sophia chen Date: Thu, 12 Nov 2026 16:14:03 +1100 Subject: [PATCH 5/5] UID2-8294: Use environment subject for Azure E2E --- .github/workflows/shared-run-e2e-tests.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/shared-run-e2e-tests.yaml b/.github/workflows/shared-run-e2e-tests.yaml index e62bb38c..8edf041d 100644 --- a/.github/workflows/shared-run-e2e-tests.yaml +++ b/.github/workflows/shared-run-e2e-tests.yaml @@ -82,6 +82,9 @@ on: azure_subscription_id: description: The Azure subscription ID for OIDC login type: string + azure_environment: + description: The GitHub environment used for Azure OIDC login + type: string env: REGISTRY: ghcr.io @@ -116,6 +119,7 @@ jobs: name: E2E Test # The pinned azure-cli is not in Microsoft's apt repo for Ubuntu 26.04 (ubuntu-latest). runs-on: ${{ inputs.operator_type == 'aks' && 'ubuntu-24.04' || 'ubuntu-latest' }} + environment: ${{ inputs.azure_environment }} permissions: contents: write packages: read