17.2 Zero Trust for CI/CD Pipelines¶

name: Deploy
on:
  push:
    branches: [main]

permissions:
  id-token: write   # Required for OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789:role/GitHubActionsRole
          aws-region: us-east-1
          # No access key ID or secret access key stored!

      - run: aws s3 ls  # Works with temporary credentials

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: 'projects/123456/locations/global/workloadIdentityPools/github/providers/github'
          service_account: 'github-actions@project.iam.gserviceaccount.com'

      - uses: google-github-actions/setup-gcloud@v2

      - run: gcloud storage ls

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: azure/login@v1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          # Note: client-id and tenant-id are not secrets (public identifiers)
          # No client secret stored!

deploy:
  image: amazon/aws-cli
  id_tokens:
    AWS_TOKEN:
      aud: https://gitlab.com
  script:
    - >
      export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s"
      $(aws sts assume-role-with-web-identity
      --role-arn arn:aws:iam::123456789:role/GitLabRole
      --role-session-name "GitLabSession"
      --web-identity-token $AWS_TOKEN
      --duration-seconds 3600
      --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]'
      --output text))
    - aws s3 ls

# GitHub Actions: Request short-lived credentials
- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789:role/DeployRole
    aws-region: us-east-1
    role-duration-seconds: 900  # 15 minutes
    role-session-name: deploy-${{ github.run_id }}

apiVersion: v1
kind: Pod
spec:
  serviceAccountName: build-agent
  containers:
    - name: build
      volumeMounts:
        - name: token
          mountPath: /var/run/secrets/tokens
  volumes:
    - name: token
      projected:
        sources:
          - serviceAccountToken:
              path: token
              expirationSeconds: 600  # 10 minutes
              audience: build-system

# OPA policy for build job verification
package cicd.build

default allow = false

# Allow build if conditions met
allow {
    input.repository == "myorg/myrepo"
    input.ref == "refs/heads/main"
    input.workflow_ref == ".github/workflows/deploy.yml"
    input.runner_environment == "github-hosted"
    input.actor_is_org_member == true
}

# Deny if suspicious patterns
deny[msg] {
    input.ref != "refs/heads/main"
    input.environment == "production"
    msg := "Production deployment only allowed from main branch"
}

deny[msg] {
    input.runner_environment == "self-hosted"
    input.environment == "production"
    msg := "Production deployment requires GitHub-hosted runners"
}

# GitHub Actions: Sign and verify artifacts
jobs:
  build:
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/attest-build-provenance@v1
        with:
          subject-path: 'dist/artifact.tar.gz'

  deploy:
    needs: build
    steps:
      - uses: actions/download-artifact@v4

      # Verify before deployment
      - run: |
          gh attestation verify dist/artifact.tar.gz \
            --owner myorg \
            --repo myrepo

# GitHub Actions: Policy check before deployment
jobs:
  policy-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check policies
        uses: open-policy-agent/opa-action@v2
        with:
          policy: policy/cicd.rego
          input: |
            {
              "event": "${{ github.event_name }}",
              "ref": "${{ github.ref }}",
              "repository": "${{ github.repository }}",
              "actor": "${{ github.actor }}",
              "workflow_ref": "${{ github.workflow_ref }}",
              "environment": "production"
            }
          fail-on-deny: true

  deploy:
    needs: policy-check
    # Only runs if policy check passes

# Run both methods during transition
jobs:
  deploy-new:
    if: ${{ vars.USE_OIDC == 'true' }}
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}

  deploy-legacy:
    if: ${{ vars.USE_OIDC != 'true' }}
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

# Verify OIDC works before removing secrets
steps:
  - name: Test OIDC authentication
    id: test-oidc
    uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: ${{ vars.AWS_ROLE_ARN }}
    continue-on-error: true

  - name: Verify success
    if: steps.test-oidc.outcome == 'success'
    run: echo "OIDC working - safe to remove secrets"

  - name: Alert on failure
    if: steps.test-oidc.outcome == 'failure'
    run: |
      echo "::error::OIDC authentication failed"
      exit 1