From 28206edb08b41c30412fc0b0ce654ebef80bed1e Mon Sep 17 00:00:00 2001 From: YanaXu Date: Sat, 14 Sep 2024 14:37:28 +0800 Subject: [PATCH 1/5] update README.md to add cleanup examples --- README.md | 112 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 112 insertions(+) diff --git a/README.md b/README.md index 2400cffb8..3159be0b5 100644 --- a/README.md +++ b/README.md @@ -19,6 +19,7 @@ - [Login to Azure US Government cloud](#login-to-azure-us-government-cloud) - [Login to Azure Stack Hub](#login-to-azure-stack-hub) - [Login without subscription](#login-without-subscription) + - [Skip the cleanup steps](#skip-the-cleanup-steps) - [Security hardening](#security-hardening) - [Azure CLI dependency](#azure-cli-dependency) - [Reference](#reference) @@ -555,6 +556,117 @@ jobs: Get-AzContext ``` +### Skip the cleanup steps + +In Azure Login Action, "cleanup" means means cleaning up the login context. For security reasons, we recommend users run cleanup every time before and after login. + +Referring to [`runs` for JavaScript actions](https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions), there are 3 steps in an action: `pre:`, `main:`, `post:`. + +Azure Login Action only implement 2 steps: `main:`, `post:`. + +There are 2 "cleanup" steps in Azure Login Action: + +- cleanup in `main:` + - It's **disabled** by default. + - Users can enable it by setting an env variable `AZURE_LOGIN_PRE_CLEANUP` to `true`. +- cleanup in `post:` + - It's **enabled** by default. + - Users can disable it by setting an env variable `AZURE_LOGIN_POST_CLEANUP` to `false`. + +In GitHub Actions, there are three valid scopes for env variables. +- [env](https://docs.github.com/actions/writing-workflows/workflow-syntax-for-github-actions#env) + - valid for all the jobs in this workflow. +- [jobs..env](https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idenv) + - valid for all the steps in the job. +- [jobs..steps[*].env](https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsenv) + - only valid for the step in a job. + +We set `jobs..steps[*].env` for example. Users can set `env` or `jobs..env` for a wider scope. + +```yaml +# File: .github/workflows/workflow.yml + +on: [push] + +name: Cleanup examples for Multiple Azure Login + +jobs: + + deploy: + runs-on: ubuntu-latest + steps: + + # enable cleanup for the 1st Azure Login + - name: Azure Login + uses: azure/login@v2 + env: + AZURE_LOGIN_PRE_CLEANUP: true + AZURE_LOGIN_POST_CLEANUP: true + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + enable-AzPSSession: true + + # run some actions + + # disable cleanup for all other Azure Login + - name: Azure Login 2 + uses: azure/login@v2 + env: + AZURE_LOGIN_PRE_CLEANUP: false + AZURE_LOGIN_POST_CLEANUP: false + with: + client-id: ${{ secrets.AZURE_CLIENT_ID_2 }} + tenant-id: ${{ secrets.AZURE_TENANT_ID_2 }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_2 }} + enable-AzPSSession: true + + # run other actions + + # disable cleanup for the next Azure Login + - name: Azure Login 3 + uses: azure/login@v2 + env: + AZURE_LOGIN_PRE_CLEANUP: false + AZURE_LOGIN_POST_CLEANUP: false + with: + client-id: ${{ secrets.AZURE_CLIENT_ID_3 }} + tenant-id: ${{ secrets.AZURE_TENANT_ID_3 }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_3 }} + enable-AzPSSession: true + + # run other actions +``` + +```yaml +# File: .github/workflows/workflow.yml + +on: [push] + +name: Disable cleanup for GitHub Hosted Runners + +jobs: + + deploy: + runs-on: [ubuntu-latest, self-hosted] + steps: + + - name: Azure Login + uses: azure/login@v2 + env: + AZURE_LOGIN_PRE_CLEANUP: ${{ startsWith(runner.name, 'GitHub Actions') }} + AZURE_LOGIN_POST_CLEANUP: ${{ startsWith(runner.name, 'GitHub Actions') }} + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + enable-AzPSSession: true + + # run some actions + +``` + ## Security hardening > [!WARNING] From 1853a1c8f7114c862a567c6fe39227db483bd258 Mon Sep 17 00:00:00 2001 From: YanaXu Date: Sat, 14 Sep 2024 14:45:09 +0800 Subject: [PATCH 2/5] update README.md --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 3159be0b5..1affc076c 100644 --- a/README.md +++ b/README.md @@ -558,11 +558,11 @@ jobs: ### Skip the cleanup steps -In Azure Login Action, "cleanup" means means cleaning up the login context. For security reasons, we recommend users run cleanup every time before and after login. +In Azure Login Action, "cleanup" means cleaning up the login context. For security reasons, we recommend users run cleanup every time before and after login. -Referring to [`runs` for JavaScript actions](https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions), there are 3 steps in an action: `pre:`, `main:`, `post:`. +Referring to [`runs` for JavaScript actions](https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions), there are 3 steps in an action: `pre:`, `main:` and `post:`. -Azure Login Action only implement 2 steps: `main:`, `post:`. +Azure Login Action only implement 2 steps: `main:` and `post:`. There are 2 "cleanup" steps in Azure Login Action: @@ -573,9 +573,9 @@ There are 2 "cleanup" steps in Azure Login Action: - It's **enabled** by default. - Users can disable it by setting an env variable `AZURE_LOGIN_POST_CLEANUP` to `false`. -In GitHub Actions, there are three valid scopes for env variables. +Azure Login Action use env variables to enable or disable cleanup steps. In GitHub Actions, there are three valid scopes for env variables. - [env](https://docs.github.com/actions/writing-workflows/workflow-syntax-for-github-actions#env) - - valid for all the jobs in this workflow. + - valid for all jobs in this workflow. - [jobs..env](https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idenv) - valid for all the steps in the job. - [jobs..steps[*].env](https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsenv) @@ -624,7 +624,7 @@ jobs: # run other actions - # disable cleanup for the next Azure Login + # disable cleanup for all other Azure Login - name: Azure Login 3 uses: azure/login@v2 env: From 236fea23fa85478d583e7058f4ba73ffcf26aaec Mon Sep 17 00:00:00 2001 From: YanaXu Date: Sat, 14 Sep 2024 14:51:46 +0800 Subject: [PATCH 3/5] update README.md --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 1affc076c..4ce2abea2 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,7 @@ - [Login to Azure US Government cloud](#login-to-azure-us-government-cloud) - [Login to Azure Stack Hub](#login-to-azure-stack-hub) - [Login without subscription](#login-without-subscription) - - [Skip the cleanup steps](#skip-the-cleanup-steps) + - [Enable/Disable the cleanup steps](#enabledisable-the-cleanup-steps) - [Security hardening](#security-hardening) - [Azure CLI dependency](#azure-cli-dependency) - [Reference](#reference) @@ -556,15 +556,15 @@ jobs: Get-AzContext ``` -### Skip the cleanup steps +### Enable/Disable the cleanup steps -In Azure Login Action, "cleanup" means cleaning up the login context. For security reasons, we recommend users run cleanup every time before and after login. +In Azure Login Action, "cleanup" means cleaning up the login context. For security reasons, we recommend users run cleanup every time. -Referring to [`runs` for JavaScript actions](https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions), there are 3 steps in an action: `pre:`, `main:` and `post:`. +But in some scenarios, users need flexible control over cleanup. -Azure Login Action only implement 2 steps: `main:` and `post:`. +Referring to [`runs` for JavaScript actions](https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions), there are 3 steps in an action: `pre:`, `main:` and `post:`. -There are 2 "cleanup" steps in Azure Login Action: +Azure Login Action only implement 2 steps: `main:` and `post:`. There are 2 "cleanup" steps in Azure Login Action: - cleanup in `main:` - It's **disabled** by default. From 8d2afd415ff5c3ac454883ba9c9297464e756551 Mon Sep 17 00:00:00 2001 From: YanaXu Date: Sat, 14 Sep 2024 14:53:56 +0800 Subject: [PATCH 4/5] update README.md --- README.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 4ce2abea2..fb7e4eade 100644 --- a/README.md +++ b/README.md @@ -558,13 +558,11 @@ jobs: ### Enable/Disable the cleanup steps -In Azure Login Action, "cleanup" means cleaning up the login context. For security reasons, we recommend users run cleanup every time. +In Azure Login Action, "cleanup" means cleaning up the login context. For security reasons, we recommend users run cleanup every time. But in some scenarios, users need flexible control over cleanup. -But in some scenarios, users need flexible control over cleanup. +Referring to [`runs` for JavaScript actions](https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions), there are 3 steps in an action: `pre:`, `main:` and `post:`. Azure Login Action only implement 2 steps: `main:` and `post:`. -Referring to [`runs` for JavaScript actions](https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions), there are 3 steps in an action: `pre:`, `main:` and `post:`. - -Azure Login Action only implement 2 steps: `main:` and `post:`. There are 2 "cleanup" steps in Azure Login Action: +There are 2 "cleanup" steps in Azure Login Action: - cleanup in `main:` - It's **disabled** by default. From 9c426dcbc0da699aa893e270a6f29b93fd9b1d21 Mon Sep 17 00:00:00 2001 From: YanaXu Date: Sat, 14 Sep 2024 16:15:32 +0800 Subject: [PATCH 5/5] fix markdown lint errors --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index fb7e4eade..76ded9178 100644 --- a/README.md +++ b/README.md @@ -560,7 +560,7 @@ jobs: In Azure Login Action, "cleanup" means cleaning up the login context. For security reasons, we recommend users run cleanup every time. But in some scenarios, users need flexible control over cleanup. -Referring to [`runs` for JavaScript actions](https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions), there are 3 steps in an action: `pre:`, `main:` and `post:`. Azure Login Action only implement 2 steps: `main:` and `post:`. +Referring to [`runs` for JavaScript actions](https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions), there are 3 steps in an action: `pre:`, `main:` and `post:`. Azure Login Action only implement 2 steps: `main:` and `post:`. There are 2 "cleanup" steps in Azure Login Action: @@ -572,6 +572,7 @@ There are 2 "cleanup" steps in Azure Login Action: - Users can disable it by setting an env variable `AZURE_LOGIN_POST_CLEANUP` to `false`. Azure Login Action use env variables to enable or disable cleanup steps. In GitHub Actions, there are three valid scopes for env variables. + - [env](https://docs.github.com/actions/writing-workflows/workflow-syntax-for-github-actions#env) - valid for all jobs in this workflow. - [jobs..env](https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idenv)