SFI Alerts 04 Nov (#265)

* SFI Alerts 04 Nov

* Split secrets & test cicd

* Add azurite key

* Address review comment

* Remove azurite key

* Add Azurite account key setup to PR workflow

* Fix: Pass AZURITE_ACCOUNT_KEY environment variable to cibuild step

* Fix typo in Azurite account key (remove extra H)

* Update pr.yml workflow configuration

* Add AZURITE_ACCOUNT_KEY environment variable to cibuild step

* Use environment variable substitution for AZURITE_ACCOUNT_KEY in docker-compose.dev.yml

* Update AZURITE_ACCOUNT_KEY to use secrets in pr.yml

---------

Co-authored-by: Karthick <karthick.narendran@microsoft.com>

Author: karthick-rn

.github/workflows/cicd.yml

@@ -26,9 +26,9 @@ jobs:
       - name: Log in with Azure
         uses: azure/login@v1
         with:
-          client-id: ${{ fromJSON(secrets.SECURE_AZURE_CREDENTIALS).clientId }}
-          tenant-id: ${{ fromJSON(secrets.SECURE_AZURE_CREDENTIALS).tenantId }}
-          subscription-id: ${{ fromJSON(secrets.SECURE_AZURE_CREDENTIALS).subscriptionId }}
+          client-id: ${{ secrets.SECURE_AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.SECURE_AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.SECURE_AZURE_SUBSCRIPTION_ID }}
 
       - name: Set Azurite Default Key
         run: |
@@ -72,9 +72,9 @@ jobs:
       - name: Log in with Azure
         uses: azure/login@v1
         with:
-          client-id: ${{ fromJSON(secrets.SECURE_AZURE_CREDENTIALS).clientId }}
-          tenant-id: ${{ fromJSON(secrets.SECURE_AZURE_CREDENTIALS).tenantId }}
-          subscription-id: ${{ fromJSON(secrets.SECURE_AZURE_CREDENTIALS).subscriptionId }}
+          client-id: ${{ secrets.SECURE_AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.SECURE_AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.SECURE_AZURE_SUBSCRIPTION_ID }}
 
       - name: Get image tag
         id: get_image_tag
@@ -94,7 +94,7 @@ jobs:
         env:
           IMAGE_TAG: ${{needs.build_and_publish.outputs.image_tag}}
           ENVIRONMENT: staging
-          ARM_CLIENT_ID: ${{ fromJSON(secrets.SECURE_AZURE_CREDENTIALS).clientId }}
-          ARM_SUBSCRIPTION_ID: ${{ fromJSON(secrets.SECURE_AZURE_CREDENTIALS).subscriptionId }}
-          ARM_TENANT_ID: ${{ fromJSON(secrets.SECURE_AZURE_CREDENTIALS).tenantId }}
+          ARM_CLIENT_ID: ${{ secrets.SECURE_AZURE_CLIENT_ID }}
+          ARM_SUBSCRIPTION_ID: ${{ secrets.SECURE_AZURE_SUBSCRIPTION_ID }}
+          ARM_TENANT_ID: ${{ secrets.SECURE_AZURE_TENANT_ID }}
           ARM_USE_OIDC: true

.github/workflows/pr.yml

@@ -11,15 +11,10 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - name: Set Azurite Default Key
-        run: echo "AZURITE_ACCOUNT_KEY=$(curl https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azurite | grep "Account key:" | cut -b 24-111)" >> $GITHUB_ENV
-
-      - name: Verify Azurite Key was retrieved correctly
-        if: "!startsWith(env.AZURITE_ACCOUNT_KEY, 'Eby8')"
-        run: echo Failed to find key at learn.microsoft.com && exit 1
-
       - name: Run cibuild
         run: ./scripts/cibuild
+        env:
+          AZURITE_ACCOUNT_KEY: ${{ secrets.AZURITE_ACCOUNT_KEY }}
 
   validate:
     runs-on: ubuntu-latest
@@ -30,8 +25,7 @@ jobs:
           python-version: "3.10" # stac-api-validator requires >= 3.10
           cache: "pip"
 
-      - name: Set Azurite Default Key
-        run: echo "AZURITE_ACCOUNT_KEY=$(curl https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azurite | grep "Account key:" | cut -b 24-111)" >> $GITHUB_ENV
-
       - name: API Validator
         run: ./scripts/validate
+        env:
+          AZURITE_ACCOUNT_KEY: ${{ secrets.AZURITE_ACCOUNT_KEY }}