20631882992
78%

Ran 01 Jan 2026 03:30AM UTC

Jobs 0

Files 0

Run time –

Badge

Embed ▾

pending completion

cancel

Build # 20631882992

Build Type

push

github

Committed by

web-flow

Commit Message

security: Scope GitHub OIDC to validation resource group only (#667)

* Initial plan

* security: Scope GitHub OIDC permissions to validation RG only

- Scope Contributor role to copilot-bicep-validation-rg (not subscription)
- Scope User Access Administrator to validation RG
- Auto-create validation RG if it doesn't exist
- Remove subscription-level permissions to prevent malicious PRs
- Update documentation to reflect security improvements
- Add clear security boundary warnings in output

Fixes subscription-level access issue where PRs had full Contributor permissions

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Fix code review comments: error handling, duplicate docs, configurable location

- Add proper error checking for resource group creation with exit on failure
- Remove duplicate "Subscription not found" section in GITHUB_OIDC_SETUP.md
- Make validation RG location configurable via VALIDATION_LOCATION env var (default: eastus)

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

Run Details

Source Files on build 20631882992

Detailed source file information is not available for this build.

Alan-Jowett / CoPilot-For-Consensus / 20631882992
78%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on build 20631882992

Alan-Jowett / CoPilot-For-Consensus / 20631882992 78%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on build 20631882992

Alan-Jowett / CoPilot-For-Consensus / 20631882992
78%

README BADGES
x