Use Workload Identity Federation for Windows Trusted Signing

[maennchen]

This PR replaces the former client-id / client-secret authentication flow with Azure AD Workload Identity Federation in the release.yml workflow.

Why

• Eliminates long-lived secrets – a short-lived GitHub OIDC token is exchanged for an Azure access token, so there is nothing to rotate or leak.
• Better security posture – credentials are minted just-in-time and expire automatically.
• Simpler maintenance – we drop AZURE_CLIENT_SECRET entirely.

What changed

• Added the id-token: write permission to the build job so GitHub can issue an OIDC token.
• Introduced an environment: release-scoped sign job. Secrets and variables live in that environment.
• Replaced azure-client-secret with WIF parameters in both the azure/login and azure/trusted-signing-action steps.
• Parameterised certificate and account names through environment variables, making them configurable per environment.

Setup instructions

1. Create the environment

   • Settings › Environments › New environment

   • Name it release

   • Add protection rules for:

     • Branch: main
     • Tags: v*

2. Add environment secrets (values will be shared privately)

   • AZURE_CLIENT_ID
   • AZURE_SUBSCRIPTION_ID
   • AZURE_TENANT_ID

3. Add environment variables

   • AZURE_CERTIFICATE_PROFILE_NAME → Elixir
   • AZURE_TRUSTED_SIGNING_ACCOUNT_NAME → trusted-signing-elixir

After those steps, the workflow will authenticate to Azure through Workload Identity Federation with no further secret management required.

References

• Example CI: https://github.com/maennchen/elixir/actions/runs/15874099134/job/44757582967

[maennchen]

I removed the github.repository == 'elixir-lang/elixir' on purpose so that it's simpler to execute this in a fork for testing purposes. As soon as you set the AZURE_TRUSTED_SIGNING_ACCOUNT_NAME variable, this job will attempt to run.

[maennchen]

One thing to consider: We should either backport this change into all maintained branches or keep the old service account login around for a while.

[josevalim]

💚 💙 💜 💛 ❤️