Secretless CI/CD deployments (OIDC federation)

# Despliegue desde CI sin secretos — GCP
#
# Workload Identity Pool + provider OIDC de GitHub con una condición CEL sobre
# IDs inmutables, y una service account de despliegue que solo puede
# impersonar el principalSet de ese repositorio.

locals {
  # Las cuatro APIs que pide la guía de Google para pipelines.
  apis = ["iam.googleapis.com", "cloudresourcemanager.googleapis.com", "iamcredentials.googleapis.com", "sts.googleapis.com"]

  envs_cel = join(", ", [for e in sort(tolist(var.environments)) : "'${e}'"])

  # Sin condición, cualquier repo de GitHub podría obtener tokens: el issuer es compartido.
  attribute_condition = "assertion.repository_owner_id == '${var.github.owner_id}' && assertion.repository_id == '${var.github.repository_id}' && assertion.environment in [${local.envs_cel}]"

  attribute_mapping = {
    "google.subject"                = "assertion.sub"
    "attribute.repository_id"       = "assertion.repository_id"
    "attribute.repository_owner_id" = "assertion.repository_owner_id"
    "attribute.environment"         = "assertion.environment"
  }
}

resource "google_project_service" "required" {
  for_each = toset(local.apis)

  project            = var.project_id
  service            = each.value
  disable_on_destroy = false
}

resource "google_iam_workload_identity_pool" "github" {
  project                   = var.project_id
  workload_identity_pool_id = var.pool_id
  display_name              = "GitHub Actions"
  description               = "Tokens OIDC de GitHub Actions"

  depends_on = [google_project_service.required]
}

resource "google_iam_workload_identity_pool_provider" "github" {
  #checkov:skip=CKV_GCP_125:El check solo reconoce condiciones sobre assertion.sub con nombres; esta condición usa repository_owner_id y repository_id (inmutables), que es lo que recomienda Google.
  project                            = var.project_id
  workload_identity_pool_id          = google_iam_workload_identity_pool.github.workload_identity_pool_id
  workload_identity_pool_provider_id = "github-oidc"
  display_name                       = "GitHub OIDC"

  attribute_mapping   = local.attribute_mapping
  attribute_condition = local.attribute_condition

  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }
}

resource "google_service_account" "deploy" {
  project      = var.project_id
  account_id   = "gha-deploy"
  display_name = "GitHub Actions deploy"
}

# Solo el principalSet de este repositorio puede impersonar la SA.
resource "google_service_account_iam_member" "workload_identity_user" {
  service_account_id = google_service_account.deploy.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github.name}/attribute.repository_id/${var.github.repository_id}"
}

resource "google_project_iam_member" "deploy" {
  for_each = var.deploy_roles

  project = var.project_id
  role    = each.value
  member  = "serviceAccount:${google_service_account.deploy.email}"
}

variable "project_id" {
  description = "Proyecto donde viven el pool y la service account de despliegue."
  type        = string
}

variable "region" {
  description = "Región por defecto del provider."
  type        = string
  default     = "us-central1"
}

variable "pool_id" {
  description = "ID del workload identity pool (4-32, minúsculas). Un pool borrado bloquea su ID ~30 días (gotcha: pool-soft-delete-30-days)."
  type        = string
  default     = "github"

  validation {
    condition     = can(regex("^[a-z0-9-]{4,32}$", var.pool_id)) && !startswith(var.pool_id, "gcp-")
    error_message = "pool_id: 4-32 caracteres [a-z0-9-], sin el prefijo reservado gcp-."
  }
}

variable "github" {
  description = <<-EOT
    Repositorio que puede desplegar. En GCP la condición se arma sobre los IDs numéricos (inmutables), no sobre
    los nombres: un nombre de org o repo reciclado no hereda la confianza.
  EOT
  type = object({
    owner_id      = number
    repository_id = number
  })
}

variable "environments" {
  description = "Environments de GitHub que pueden desplegar."
  type        = set(string)
  default     = ["production"]

  validation {
    condition     = length(var.environments) >= 1 && alltrue([for e in var.environments : can(regex("^[A-Za-z0-9_.-]+$", e))])
    error_message = "environments: al menos uno, solo letras, números, '.', '_' o '-'."
  }
}

variable "deploy_roles" {
  description = "Roles de proyecto que necesita el despliegue (mínimo privilegio)."
  type        = set(string)

  validation {
    condition     = length(setintersection(var.deploy_roles, ["roles/owner", "roles/editor", "roles/iam.serviceAccountUser", "roles/iam.serviceAccountTokenCreator"])) == 0
    error_message = "deploy_roles: nada de owner/editor ni roles que permitan actuar como otras service accounts a nivel proyecto."
  }
}

output "workload_identity_provider" {
  description = "workload_identity_provider para google-github-actions/auth (usa el número de proyecto, no el ID)."
  value       = google_iam_workload_identity_pool_provider.github.name
}

output "service_account" {
  description = "service_account para google-github-actions/auth."
  value       = google_service_account.deploy.email
}

output "attribute_condition" {
  description = "Condición CEL que evalúa cada token."
  value       = local.attribute_condition
}

output "workflow_snippet" {
  description = "Fragmento mínimo del workflow."
  value       = <<-YAML
    permissions:
      id-token: write   # sin esto el job no puede pedir el token OIDC
      contents: read
    jobs:
      deploy:
        environment: ${sort(tolist(var.environments))[0]}
        steps:
          - uses: google-github-actions/auth@v3
            with:
              workload_identity_provider: ${google_iam_workload_identity_pool_provider.github.name}
              service_account: ${google_service_account.deploy.email}
  YAML
}

terraform {
  required_version = ">= 1.7.0"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 8.6"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

# Despliegue desde CI sin secretos — Azure
#
# User-assigned managed identity con un federated identity credential por
# environment de GitHub (match exacto de issuer + subject) y un único role
# assignment sobre el resource group destino.

data "azurerm_client_config" "current" {}

locals {
  github_issuer = "https://token.actions.githubusercontent.com"
  # Único audience aceptado por Entra ID para federated identity credentials.
  audience = "api://AzureADTokenExchange"

  repo_path = var.github.owner_id == null ? "${var.github.owner}/${var.github.repository}" : "${var.github.owner}@${var.github.owner_id}/${var.github.repository}@${var.github.repository_id}"

  # Si el job declara `environment:`, el sub es este (y no el de la rama).
  subjects = { for env in var.environments : env => "repo:${local.repo_path}:environment:${env}" }
}

resource "azurerm_resource_group" "identity" {
  name     = "rg-${var.name}-identity"
  location = var.location
  tags     = var.tags
}

resource "azurerm_user_assigned_identity" "deploy" {
  name                = "id-${var.name}"
  resource_group_name = azurerm_resource_group.identity.name
  location            = azurerm_resource_group.identity.location
  tags                = var.tags
}

# azurerm crea las credenciales de una misma identidad en serie (desde 3.40);
# en ARM/Bicep hay que forzarlo (gotcha: fic-concurrent-writes-409).
resource "azurerm_federated_identity_credential" "github" {
  for_each = local.subjects

  name                      = "github-${each.key}"
  user_assigned_identity_id = azurerm_user_assigned_identity.deploy.id
  issuer                    = local.github_issuer
  audience                  = [local.audience]
  subject                   = each.value
}

resource "azurerm_role_assignment" "deploy" {
  scope                = var.target_scope_id
  role_definition_name = var.role_definition_name
  principal_id         = azurerm_user_assigned_identity.deploy.principal_id
  principal_type       = "ServicePrincipal"
  description          = "GitHub Actions ${local.repo_path} (${join(", ", sort(tolist(var.environments)))})"
}

variable "name" {
  description = "Prefijo para nombrar los recursos (ej. \"deploy-web\")."
  type        = string

  validation {
    condition     = can(regex("^[a-z0-9-]{3,24}$", var.name))
    error_message = "name: 3-24 caracteres, minúsculas, números o guiones."
  }
}

variable "location" {
  description = "Región de Azure de la identidad (no tiene que ser la de los recursos que despliega)."
  type        = string
  default     = "eastus2"
}

variable "github" {
  description = <<-EOT
    Repositorio que puede desplegar. owner_id y repository_id (numéricos) activan el formato inmutable del
    claim sub ("repo:owner@123/repo@456:..."), que GitHub usa por defecto en repos creados, renombrados o
    transferidos desde el 15/07/2026 (gotcha: github-sub-format-changed).
  EOT
  type = object({
    owner         = string
    repository    = string
    owner_id      = optional(number)
    repository_id = optional(number)
  })

  validation {
    condition     = (var.github.owner_id == null) == (var.github.repository_id == null)
    error_message = "github: owner_id y repository_id van juntos (formato inmutable) o ninguno de los dos."
  }
}

variable "environments" {
  description = "Environments de GitHub que pueden desplegar. Uno por federated identity credential (sin comodines)."
  type        = set(string)
  default     = ["production"]

  validation {
    # Máximo 20 credenciales por identidad (gotcha: fic-exact-match-max-20).
    condition     = length(var.environments) >= 1 && length(var.environments) <= 20
    error_message = "environments: entre 1 y 20 (límite de federated identity credentials por identidad)."
  }

  validation {
    condition     = alltrue([for e in var.environments : !strcontains(e, "*")])
    error_message = "environments: los federated identity credentials no admiten comodines."
  }
}

variable "target_scope_id" {
  description = "ID del scope donde despliega el pipeline (idealmente un resource group, no la suscripción)."
  type        = string

  validation {
    condition     = can(regex("^/subscriptions/[^/]+/resourceGroups/[^/]+$", var.target_scope_id))
    error_message = "target_scope_id: tiene que ser un resource group (/subscriptions/<id>/resourceGroups/<nombre>)."
  }
}

variable "role_definition_name" {
  description = "Rol sobre el scope. Contributor no puede crear role assignments (gotcha: contributor-cannot-assign-roles)."
  type        = string
  default     = "Contributor"

  validation {
    condition     = !contains(["Owner", "User Access Administrator"], var.role_definition_name)
    error_message = "role_definition_name: Owner y User Access Administrator no; si el pipeline asigna roles, usá un role assignment con condición aparte."
  }
}

variable "tags" {
  description = "Tags comunes."
  type        = map(string)
  default     = {}
}

output "client_id" {
  description = "AZURE_CLIENT_ID para azure/login (no es un secreto)."
  value       = azurerm_user_assigned_identity.deploy.client_id
}

output "tenant_id" {
  description = "AZURE_TENANT_ID para azure/login."
  value       = data.azurerm_client_config.current.tenant_id
}

output "subjects" {
  description = "Subjects exactos que acepta cada credencial. Compará con el sub real del token si el login falla con AADSTS70021."
  value       = local.subjects
}

output "workflow_snippet" {
  description = "Fragmento mínimo del workflow."
  value       = <<-YAML
    permissions:
      id-token: write   # sin esto el job no puede pedir el token OIDC
      contents: read
    jobs:
      deploy:
        environment: ${sort(tolist(var.environments))[0]}
        steps:
          - uses: azure/login@v2
            with:
              client-id: ${azurerm_user_assigned_identity.deploy.client_id}
              tenant-id: ${data.azurerm_client_config.current.tenant_id}
              subscription-id: <subscription del scope>
  YAML
}

terraform {
  required_version = ">= 1.7.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 5.8"
    }
  }
}

provider "azurerm" {
  features {}

  # subscription_id se toma de ARM_SUBSCRIPTION_ID.
}