Use OIDC federated credentials for migration workflows

Author: Christdej

.github/workflows/deploy_to_staging.yml

@@ -16,14 +16,17 @@ on:
 jobs:
   run_migrations:
     name: Update database in Staging
+    permissions:
+      contents: read
+      pull-requests: read
+      id-token: write
     uses: equinor/armada/.github/workflows/run_dotnet_migrations.yml@main
     with:
       environment: Staging
       checkout_ref: ${{ github.event.release.tag_name }}
       working_directory: api
-    secrets:
-      client_id: ${{ secrets.CLIENTID }}
-      client_secret: ${{ secrets.CLIENTSECRET }}
+      azure_client_id: ${{ secrets.CLIENTID }}
+      azure_subscription_id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
 
   build-and-push-latest-release-images-to-ghcr:
     name: Build and push latest release images to github container registry

.github/workflows/promote_to_production.yaml

@@ -39,14 +39,17 @@ jobs:
   run_migrations:
     name: Update database in Production
     needs: get_staging_version
+    permissions:
+      contents: read
+      pull-requests: read
+      id-token: write
     uses: equinor/armada/.github/workflows/run_dotnet_migrations.yml@main
     with:
       environment: Production
       checkout_ref: ${{ needs.get_staging_version.outputs.versionTag }}
       working_directory: api
-    secrets:
-      client_id: ${{ secrets.CLIENTID }}
-      client_secret: ${{ secrets.CLIENTSECRET }}
+      azure_client_id: ${{ secrets.CLIENTID }}
+      azure_subscription_id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
 
   deploy:
     name: Update deployment in Production

.github/workflows/run_development_migrations.yml

@@ -14,9 +14,9 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
+      id-token: write
     with:
       environment: Development
       working_directory: api
-    secrets:
-      client_id: ${{ secrets.CLIENTID }}
-      client_secret: ${{ secrets.CLIENTSECRET }}
+      azure_client_id: ${{ secrets.CLIENTID }}
+      azure_subscription_id: ${{ vars.AZURE_SUBSCRIPTION_ID }}