[Roger Doherty (MSFT) (doherty100)]

Purpose

Implements #500. The Sandbox deployment workflow now authenticates the root sandbox providers with GitHub OIDC. It federates to a user-assigned managed identity that is not attached to jumplinux2 and holds standing Reader only. Before approving each run, the operator grants it time-bound Contributor and ABAC-conditioned Role Based Access Control Administrator in the portal.

• rg-devops-iac: deployment_identity gains oidc. This creates the unattached identity, a standing Reader assignment and one federated identity credential per environment. The subjects use immutable ids (repository_owner_id:<id>:repository_id:<id>:environment:<name>) to match the repository's existing OIDC subject claim template, so no repository override is needed. The ids are looked up anonymously from the GitHub API using github_runner_url (new hashicorp/http provider). github_repository_id and github_repository_owner_id are optional overrides for private repositories. New outputs: deployment_identity_github_subjects and deployment_identity_jit_condition.
• Root module: auth_mode accepts oidc, and use_oidc is wired into azurerm, azapi and azuread. The state backend still uses the VM's system-assigned identity.
• Workflow and scripts:
  • Only the sandbox job gets id-token: write, and the workflow is now OIDC-only.
  • Preflight waits for the time-bound roles and stops unless at least SANDBOX_JIT_MIN_REMAINING_MINUTES remain (default 150). Apply and unit-test recheck the roles before they start.
  • Azure CLI and Az PowerShell sign in again with a fresh GitHub token for each stage, and during long test runs (Invoke-UnitTests.ps1 -SessionRefresh).
  • The selection test asserts the id-token scope.
• Docs:
  • rg-devops-iac README: OIDC setup, the portal grant procedure with a CLI fallback, residual exposure, and the variable and output tables.
  • Root README: the authentication section.
  • CONTRIBUTING: the deployment environment and OIDC settings.
  • Copilot instructions.

Teardown stays manual. The workflow never destroys a sandbox.

Does this introduce a breaking change?

[x] Yes
[ ] No

Existing client_secret and managed_identity modes are unchanged. The workflow now requires auth_mode = "oidc". To migrate:

1. Apply rg-devops-iac with deployment_identity = "oidc".
2. Update SANDBOX_TFVARS_HCL in both environments (auth_mode = "oidc", client_id = the deployment_identity_client_id output).
3. Grant the time-bound roles before each run.

Pull Request Type

[ ] Bugfix
[x] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

How to Test

• Apply rg-devops-iac with deployment_identity = "oidc". Verify the identity has only Reader, the federated credential subjects match deployment_identity_github_subjects, and jumplinux2 has a system-assigned identity only.
• After this reaches main: grant the time-bound roles, approve a Sandbox deployment run, and confirm preflight, apply and unit-test pass.
• Negative checks:
  • A run without a grant fails fast in preflight.
  • A short remaining window is refused.
  • The VM's managed identity endpoint can't get tokens for the deployment identity.

What to Check

• ./scripts/Invoke-CIChecks.sh passes. Locally, powershell and secrets report only the known git-ignored .terraform and terraform.tfstate false positives (Invoke-CIChecks.sh: exclude .terraform directories from the PSScriptAnalyzer check #902).
• The rg-devops-iac apply was verified with a fresh deployment. The workflow run can only be verified once this is on main, because environments are restricted to main.

Other Information

• Related: Implement a GitHub action to provision a new sandbox environment #173 (auth modes), Workflow-driven start/stop for the rg-devops-iac runner VM #501 (runner lifecycle identity, which will reuse the federated-credential conventions with its own environment).
• Closing keywords don't fire for vnext, so Secretless, approval-gated GitHub OIDC access to an unattached deployment UAMI #500 will be closed manually after release.