From 38393b99dfd2097c44fa5a77e294ca835f1ad5a1 Mon Sep 17 00:00:00 2001
From: Amy Galles <9685081+AmyLGalles@users.noreply.github.com>
Date: Thu, 30 Jul 2026 11:50:50 -0700
Subject: [PATCH 1/2] [BRE-1935] Phase 2: Convert cd.yml to trigger-actions
 caller

Replaces the full PyPI publishing logic with a trigger-actions caller
that dispatches to bitwarden/deploy's publish-passwordless-python workflow.

Changes:
- Removed all build, poetry, and PyPI publishing steps
- Added workflow_dispatch trigger with tag input for manual dispatch
- Kept release: [created] trigger for automatic releases
- Uses bitwarden/gh-actions/trigger-actions to dispatch to deploy repo

The actual build and publish logic now lives in:
bitwarden/deploy/.github/workflows/publish-passwordless-python.yml

This workflow can still be triggered manually from this repo via:
  gh workflow run cd.yml --repo bitwarden/passwordless-python -f tag=v1.2.3

Or automatically when a release is created in this repo.

This completes Phase 2 (finalize-source) of the BRE-1935 migration pattern.
---
 .github/workflows/cd.yml | 47 +++++++++++++++++-----------------------
 1 file changed, 20 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 16aeced..2796324 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -1,38 +1,31 @@
+---
 name: Release
 
 on:
   release:
     types: [created]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to publish (e.g., v1.2.3)"
+        required: true
+        type: string
+
+permissions:
+  deployments: write
 
 jobs:
-  publish:
-    name: Publish
-    environment: PyPI
+  trigger-publish:
+    name: Trigger Publish in Deploy Repo
     runs-on: ubuntu-24.04
     permissions:
-      contents: read
-      id-token: write
+      deployments: write
     steps:
-      - name: Checkout Repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Install poetry
-        run: pipx install poetry
-
-      - name: Set up Python
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - name: Trigger publish via bitwarden/deploy
+        uses: bitwarden/gh-actions/trigger-actions@main
         with:
-          python-version: '3.10'
-          cache: 'poetry'
-
-      - name: Setup
-        run: poetry env use 3.10
-
-      - name: Environment information
-        run: poetry env info
-      - name: Build package
-        run: poetry build
-      - name: Publish - PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+          task: publish-passwordless-python
+          data: |
+            {
+              "tag": "${{ inputs.tag || github.event.release.tag_name }}"
+            }

From 268280ba91d389a6e224e8d2f24ac0eef0329f33 Mon Sep 17 00:00:00 2001
From: Amy Galles <9685081+AmyLGalles@users.noreply.github.com>
Date: Mon, 3 Aug 2026 14:25:57 -0700
Subject: [PATCH 2/2] Fix overly broad permissions and add required Azure
 credentials

Security fix:
- Changed workflow-level permissions from 'deployments: write' to '{}'
- Grant minimum permissions per-job only (best practice)

Functionality fix:
- Added required Azure credential inputs to trigger-actions call
- Added id-token: write permission for Azure OIDC federation

The trigger-actions composite action requires Azure credentials to
retrieve GitHub App secrets from KeyVault for cross-repo deployment.
---
 .github/workflows/cd.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 2796324..82e899e 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -11,8 +11,7 @@ on:
         required: true
         type: string
 
-permissions:
-  deployments: write
+permissions: {}
 
 jobs:
   trigger-publish:
@@ -20,10 +19,14 @@ jobs:
     runs-on: ubuntu-24.04
     permissions:
       deployments: write
+      id-token: write
     steps:
       - name: Trigger publish via bitwarden/deploy
         uses: bitwarden/gh-actions/trigger-actions@main
         with:
+          azure_subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          azure_tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          azure_client_id: ${{ secrets.AZURE_CLIENT_ID }}
           task: publish-passwordless-python
           data: |
             {