Colin Shanahan ships reliable pipelines.

# GitHub Actions logs into Azure with a federated token —
# no client secrets, nothing to rotate, nothing to leak.
resource "azurerm_federated_identity_credential" "github_main" {
  parent_id = azurerm_user_assigned_identity.github.id
  issuer    = "https://token.actions.githubusercontent.com"
  subject   = "repo:cjshanahan1228/colinshanahan.dev-portfolio:ref:refs/heads/main"
  audience  = ["api://AzureADTokenExchange"]
}

# Least privilege: identity can only write blobs in one account.
resource "azurerm_role_assignment" "github_blob_writer" {
  scope                = azurerm_storage_account.resume.id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = azurerm_user_assigned_identity.github.principal_id
}

// DefaultAzureCredential → system-assigned managed identity.
// No instrumentation keys, no API keys, nothing to rotate.
const logsClient = new LogsQueryClient(new DefaultAzureCredential());

const summaryKql = `
  availabilityResults
  | where timestamp > ago(24h)
  | summarize total = count(),
              passed = countif(success == true),
              avgMs = round(avg(duration), 0)`;

// Partial-failure tolerance: a GitHub hiccup can't blank
// the uptime numbers, and vice versa.
const [avail, deploys] = await Promise.allSettled([
  queryAvailability(),
  queryDeploys(),
]);