ci: Refactor pipeline and sample data uploading workflows and updated client secrets to oidc

[Vamshi-Microsoft]

Purpose

This pull request updates several GitHub Actions workflows to improve security, streamline Azure authentication, and simplify configuration. The main focus is on migrating from client secret–based authentication to OIDC (OpenID Connect) federated identity for Azure logins, enhancing secrets management, and making input handling more robust and flexible.

Key improvements include:

• Migration to OIDC-based Azure authentication across CI/CD workflows, removing the need for client secrets.
• Enhanced permissions and environment variable handling for better security and clarity.
• Simplified and improved workflow input validation and resource group handling.
• Updates to sample data import to automate storage access and data download.

---

Azure Authentication & Security

• Migrated all workflows (ci.yml, build-docker.yml, import-sample-data-postgresql.yml) to use OIDC-based Azure authentication via the azure/login@v2 action, replacing client secret usage with federated tokens and removing related secrets and environment variables. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16]

• Updated workflow permissions to explicitly grant id-token: write for OIDC and limited other permissions to contents: read and packages: write where needed. [1] [2] [3] [4]

Workflow Input Handling & Validation

• Made resource_group_name optional in deploy-v2.yml, with improved validation and messaging for auto-generation if not provided. Updated default runner OS logic and input passing to orchestrator workflow. [1] [2] [3] [4]

• Removed the need to provide or validate the PostgreSQL host name as a workflow input in import-sample-data-postgresql.yml, simplifying the input requirements. [1] [2]

Docker Build & Registry

• Refactored Docker build workflows to remove explicit username/password authentication for the registry, switching to Azure OIDC login and ACR login via CLI, and removed unnecessary input parameters. [1] [2] [3]

Sample Data Import Automation

• Automated enabling public access on the Azure Storage account for sample data, downloading the data using Azure CLI, and setting up environment variables for downstream steps in the import-sample-data-postgresql.yml workflow.

Miscellaneous

• Removed unused output variable RESOURCE_TOKEN from deploy-orchestrator.yml.

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information