# GitHub Actions

## Private Cloud Access

:::{admonition} Guidance

GitHub Actions workflows **MUST** use temporary credentials to deploy
resources or services in the target private cloud account.  The root account's
or service account's credentials **MUST NOT** be stored in GitHub Actions
secrets or variables.

:::

The stack gives GitHub Actions workflow jobs permission to log into
private cloud using the GitHub OIDC identity provider but limits which
repositories, branches, or environments can assume which roles.
For more information, refer to
[Configure AWS Credentials for GitHub Actions](https://github.com/aws-actions/configure-aws-credentials#configure-aws-credentials-for-github-actions),
[Configuring a role for GitHub OIDC identity provider](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html#idp_oidc_Create_GitHub),
[About security hardening with OpenID Connect](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#understanding-the-oidc-token),
and
[Using environments for deployment](https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules).

## Private Repository Access

:::{admonition} Guidance

GitHub Actions workflows **MUST** use temporary credentials with read
access to the private GitHub repositories sourced by the stack.

:::

This limits the scope of a possible supply-chain attack.  For more
information, refer to the [configuration guide](configuration).

(manual-workflow-approvals)=
## Manual Workflow Approvals

:::{admonition} Guidance

The NIAID International Program's Change Advisory Board **MUST**
review any infrastructure changes prior to deployment following the
principle of [dual authorization](wiki:Two-person_rule).

:::

As part of the
[Continuous Delivery](https://github.com/ibrsp/ndcp-dev-meta/actions/workflows/cd.yaml)
workflow, this project implements a simple, multi-person consent
protocol using GitHub Issues and GitHub organization teams using the
[Manual Workflow Approval](https://github.com/trstringer/manual-approval)
action.  To implement this protocol using role-based access controls,
the NIAID International Program's Change Advisory Board is represented
by the
[`change-advisory-board`](https://github.com/orgs/ibrsp/teams/change-advisory-board)
team in the [IBRSP](https://github.com/ibrsp) organization on GitHub.
This requires a separate GitHub App, TODO
because
[`GITHUB_TOKEN`](https://docs.github.com/en/actions/tutorials/authenticate-with-github_token),
the API token used by GitHub Actions
[workflows](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions)
and
[jobs](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idpermissions),
cannot be granted permission to read organization group memberships.