Colin Shanahan ships reliable pipelines.

# GitHub Actions logs into Azure with a federated token —
# no client secrets, nothing to rotate, nothing to leak.
resource "azurerm_federated_identity_credential" "github_main" {
  parent_id = azurerm_user_assigned_identity.github.id
  issuer    = "https://token.actions.githubusercontent.com"
  subject   = "repo:cjshanahan1228/portfolio-project-alpha:ref:refs/heads/main"
  audience  = ["api://AzureADTokenExchange"]
}

# Least privilege: identity can only write blobs in one account.
resource "azurerm_role_assignment" "github_blob_writer" {
  scope                = azurerm_storage_account.resume.id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = azurerm_user_assigned_identity.github.principal_id
}

# Replace with an excerpt from a pipeline you actually built —
# the versioning or promotion logic is usually the interesting part.

stages:
  - stage: Build
    jobs:
      - job: Pack
        steps:
          - script: |
              echo "##vso[build.updatebuildnumber]$(MajorMinor).$(Build.BuildId)"
            displayName: Stamp package version
          - task: DotNetCoreCLI@2
            inputs:
              command: pack
              versioningScheme: byBuildNumber

  - stage: Publish
    dependsOn: Build
    jobs:
      - job: Push
        steps:
          - task: NuGetCommand@2
            inputs:
              command: push
              publishVstsFeed: shared-libraries@prerelease