Federated Credential to be used by Multiple Repositories - Github Actions

Question

I'm using Github Actions to build my Android applications. I have fifteen repositories in my organisation. In order to build each of these application, I need to access secrets which are kept in Azure Key Vault. I am trying to authenticate using OIDC based on this Github Action

The subject identifier field needs to be populated based on the GH account, repo name and branch name.

I need to make this credential usable for all the 15 applications. Else I will end up creating federated credential for each project repository and adding the same to github repo level. This is not an efficient way. I would like to create just one credential and set this at github organisation level, so all 15 apps GH actions pipeline can consume. Does anyone know if this is possible, if yes, how?

Answer 1

Unfortunately, The secrets needs to be created at the repository level to use them in Action. And you need to configure the federated credentials for each repository and branch separate in the subject like below:-

Script:-

az ad app federated-credential create --id <APPLICATION-OBJECT-ID> --parameters credential.json
("credential.json" contains the following content)
{
    "name": "<CREDENTIAL-NAME>",
    "issuer": "https://token.actions.githubusercontent.com",
    "subject": "repo:octo-org/octo-repo:environment:Production",
    "description": "Testing",
    "audiences": [
        "api://AzureADTokenExchange"
    ]
}

Command Reference:-

Connect GitHub and Azure | Microsoft Learn

You can create one federated credentials and then just change the value of repository and branch before running the workflow in your repository.

And then run the github action workflow to build and deploy your web app.