Update CI to use federated auth for big query

DFE-Digital · Dec 19, 2024 · 3a62db0 · 3a62db0
1 parent d2409b3
commit 3a62db0
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 2 deletions.
diff --git a/.github/actions/deploy/action.yml b/.github/actions/deploy/action.yml
@@ -43,6 +43,11 @@ runs:
       with:
         azure-credentials: ${{ inputs.azure-credentials }}
 
+    - uses: google-github-actions/auth@v2
+      with:
+        project_id: teacher-vacancy-service
+        workload_identity_provider: projects/689616473831/locations/global/workloadIdentityPools/teaching-vacancies/providers/teaching-vacancies
+
     - name: Pin Terraform version
       uses: hashicorp/setup-terraform@v2
       with:

diff --git a/.github/workflows/build_and_deploy.yml b/.github/workflows/build_and_deploy.yml
@@ -22,7 +22,8 @@ on:
       - reopened
 
 concurrency: workflow-Build-and-deploy-${{ github.event.pull_request.number }}
-
+permissions:
+  id-token: write
 env:
  DOCKER_REPOSITORY: ghcr.io/dfe-digital/teaching-vacancies
 

diff --git a/.github/workflows/delete_review_app.yml b/.github/workflows/delete_review_app.yml
@@ -15,7 +15,8 @@ on:
         required: true
 
 concurrency: workflow-Build-and-deploy-${{ github.event.pull_request.number }}
-
+permissions:
+  id-token: write
 env:
   DOCKER_REPOSITORY: ghcr.io/dfe-digital/teaching-vacancies
 
@@ -55,6 +56,11 @@ jobs:
     - uses: actions/checkout@v4
       name: Checkout Code
 
+    - uses: google-github-actions/auth@v2
+      with:
+        project_id: teacher-vacancy-service
+        workload_identity_provider: projects/689616473831/locations/global/workloadIdentityPools/teaching-vacancies/providers/teaching-vacancies
+
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1