Use Cake 7 OIDC workload identity for DPI report instead of azure/login

.github/workflows/build.yml

@@ -22,9 +22,6 @@ jobs:
         os: [windows-latest, ubuntu-latest, macos-latest]
     env:
       TRUSTED_INGEST: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop') }}
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
     steps:
       - name: Get the sources
         uses: actions/checkout@v7
@@ -42,19 +39,13 @@ jobs:
         with:
           global-json-file: global.json
 
-      - name: Azure login
-        if: ${{ env.TRUSTED_INGEST == 'true' && env.AZURE_CLIENT_ID != '' && env.AZURE_TENANT_ID != '' && env.AZURE_SUBSCRIPTION_ID != '' }}
-        uses: azure/login@v3
-        with:
-          client-id: ${{ env.AZURE_CLIENT_ID }}
-          tenant-id: ${{ env.AZURE_TENANT_ID }}
-          subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}
-
       - name: Run Cake script
         uses: cake-build/cake-action@v3
         env:
           NuGetReportSettings_Endpoint: ${{ env.TRUSTED_INGEST == 'true' && secrets.NUGETREPORTSETTINGS_ENDPOINT || '' }}
           NuGetReportSettings_RuleId: ${{ env.TRUSTED_INGEST == 'true' && secrets.NUGETREPORTSETTINGS_RULEID || '' }}
+          AZURE_TENANT_ID: ${{ env.TRUSTED_INGEST == 'true' && secrets.AZURE_TENANT_ID || '' }}
+          AZURE_CLIENT_ID: ${{ env.TRUSTED_INGEST == 'true' && secrets.AZURE_CLIENT_ID || '' }}
           GH_PACKAGES_NUGET_SOURCE: ${{ secrets.GH_PACKAGES_NUGET_SOURCE }}
           GH_PACKAGES_NUGET_APIKEY: ${{ secrets.GH_PACKAGES_NUGET_APIKEY }}
           NUGET_SOURCE: ${{ secrets.NUGET_SOURCE }}

build/records.cs

@@ -52,6 +52,14 @@ public bool ShouldReportDPI() =>
         !string.IsNullOrWhiteSpace(System.Environment.GetEnvironmentVariable("NuGetReportSettings_Endpoint"))
         && !string.IsNullOrWhiteSpace(System.Environment.GetEnvironmentVariable("NuGetReportSettings_RuleId"));
 
+    public string? AzureTenantId { get; } = System.Environment.GetEnvironmentVariable("AZURE_TENANT_ID");
+    public string? AzureClientId { get; } = System.Environment.GetEnvironmentVariable("AZURE_CLIENT_ID");
+
+    public bool ShouldPrepareAzureWorkloadIdentity() =>
+        IsRunningOnGitHubActions
+        && !string.IsNullOrWhiteSpace(AzureTenantId)
+        && !string.IsNullOrWhiteSpace(AzureClientId);
+
     public ICollection<DirectoryPath> DirectoryPathsToClean = new []{
         ArtifactsPath,
         OutputPath,

cake.cs

@@ -163,7 +163,12 @@
     )
 .Then("Integration-Tests-Tool-ReportOrAnalyze")
     .Does<BuildData>(
-        static (context, data) => context.DotNetTool(
+        static async (context, data) => {
+            var workload = data.ShouldReportDPI() && data.ShouldPrepareAzureWorkloadIdentity()
+                            ? await GitHubActions.Commands.AzurePrepareWorkloadIdentity(data.AzureTenantId!, data.AzureClientId!)
+                            : null;
+
+            context.DotNetTool(
                 "tool",
                 new DotNetToolSettings {
                     ArgumentCustomization = args => args
@@ -178,9 +183,17 @@
                                                                 : "analyze"
                                                             )
                                                         .AppendSwitchQuoted("--buildversion", data.Version),
-                    WorkingDirectory = data.IntegrationTestPath
+                    WorkingDirectory = data.IntegrationTestPath,
+                    EnvironmentVariables = workload is null
+                        ? new Dictionary<string, string>()
+                        : new Dictionary<string, string> {
+                            ["AZURE_TENANT_ID"] = workload.TenantId,
+                            ["AZURE_CLIENT_ID"] = workload.ClientId,
+                            ["AZURE_FEDERATED_TOKEN_FILE"] = workload.FederatedTokenFile.FullPath
+                        }
                 }
-            )
+            );
+        }
     )
 .Then("Integration-Tests-Tool-Validate-Manifest")
     .Does<BuildData>(