kewalaka

function New-FederatedCredentials {
    [CmdletBinding(DefaultParameterSetName='GitHub')]
    param(
        [Parameter(Mandatory)]
        [string]$managedIdentityName,

        [Parameter(Mandatory, ParameterSetName='GitHub', Position=0)]
        [string]$githubOrg,
        [Parameter(Mandatory, ParameterSetName='GitHub', Position=1)]
        [string]$githubRepo,

kewalaka

---
name: test-non-destructive
on:
  workflow_dispatch:

jobs:
  test-non-destructive:
    uses: kewalaka/terraform-azurerm-avm-template/.github/workflows/test-non-destructive-template.yml@feat/test-non-destructive
    name: test changes are non-destructive
    secrets: inherit

kewalaka

$umiSP = Get-MgServicePrincipal -Filter "DisplayName eq '$ManagedIdentityName'" 

$listPermissionAssignments = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $umiSP.Id

Write-Output "Searching for roles for Managed Identity: '$($umiSP.DisplayName)'"
foreach ($assignment in $listPermissionAssignments) {
    $resourceSP = Get-MgServicePrincipal -ServicePrincipalId $assignment.ResourceId
    
    # Find the app role definition that matches the AppRoleId from the assignment
    $appRole = $resourceSP.AppRoles | Where-Object { $_.Id -eq $assignment.AppRoleId }

kewalaka

<#
.SYNOPSIS
Assign Microsoft Graph API permissions to a user-assigned managed identity (UMI).

.DESCRIPTION
This script grants specified Microsoft Graph API application permissions to a given
user-assigned managed identity (UMI) by creating app role assignments.

.PARAMETER TenantId
The Entra (Azure AD) tenant ID where the managed identity resides.

kewalaka

# === STAGE 1: Build Cocoon ===
FROM openjdk:8 as builder

# Set environment variables
ENV JAVA_HOME=/usr/local/openjdk-8
ENV PATH="$JAVA_HOME/bin:$PATH"

# Set working directory
WORKDIR /usr/src/cocoon

kewalaka

<#

1) Under the root folder, create a file called **secrets.ps1**.  
This file exists in gitignore, please check it is greyed out and is not included with git changes.

2) Populate that file with the following obtained from Azure.

$env:ARM_TENANT_ID ='<tenantid>'
$env:ARM_SUBSCRIPTION_ID = '<subscriptionId>'

kewalaka

# This will help you create the necessary resources - you need permission to create a resource group & service principal.
# We log in as the service principal to test the minimum amount of privileges.  
# In a production environment, OIDC or managed identities are preferred.

# make sure you can log in.
az login --tenant $env:ARM_TENANT_ID
az account set --subscription $env:ARM_SUBSCRIPTION_ID

# make a resource group, storage account, and service principal for Terraform state
$random_suffix = -join ((97..122) | Get-Random -Count 12 | ForEach {[char]$_})

kewalaka

terraform {
  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "2.1.0"
    }
  }
}

variable "subscription_id" {

kewalaka

# from .github/actions/e2e-testexamples/
author: AVM
name: e2e - testexamples
description: Tests the example supplied in the input. Needs checkout and Azure login prior.
inputs:
  example:
    description: The example directory to test
    required: true

runs:

kewalaka

# Define the Dev Drive path
$DevDrive = "D:\packages"

# Function to display progress message
function Show-Progress($message, $color) {
    Write-Host -ForegroundColor $color "Progress: $message"
}

# Create npm cache directory and set environment variable
$npmCacheDir = Join-Path $DevDrive "npm"