feat(portal-backstage): support custom claims

modules/portal-backstage/README.md

@@ -14,19 +14,23 @@ This module deploys the [Humanitec Reference Architecture Backstage](https://git
 | github | ~> 5.38 |
 | humanitec | ~> 1.0 |
 | random | ~> 3.5 |
+| time | ~> 0.11 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
 | github | ~> 5.38 |
 | humanitec | ~> 1.0 |
+| time | ~> 0.11 |
 
 ### Resources
 
 | Name | Type |
 |------|------|
+| [github_actions_repository_oidc_subject_claim_customization_template.backstage](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_repository_oidc_subject_claim_customization_template) | resource |
 | [github_repository.backstage](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository) | resource |
+| [github_repository_file.re_deploy](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource |
 | [humanitec_value.backstage_cloud_provider](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/value) | resource |
 | [humanitec_value.backstage_github_app_client_id](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/value) | resource |
 | [humanitec_value.backstage_github_app_client_secret](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/value) | resource |
@@ -36,6 +40,7 @@ This module deploys the [Humanitec Reference Architecture Backstage](https://git
 | [humanitec_value.backstage_github_org_id](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/value) | resource |
 | [humanitec_value.backstage_humanitec_org](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/value) | resource |
 | [humanitec_value.backstage_humanitec_token](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/value) | resource |
+| [time_sleep.wait_after_claims_change](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
 
 ### Inputs
 
@@ -51,6 +56,7 @@ This module deploys the [Humanitec Reference Architecture Backstage](https://git
 | humanitec\_app\_id | Humanitec Application ID | `string` | n/a | yes |
 | humanitec\_ci\_service\_user\_token\_ref | Humanitec CI Service User Token (Secret Store reference) | <pre>object({<br>    ref     = optional(string)<br>    store   = optional(string)<br>    value   = optional(string)<br>    version = optional(string)<br>  })</pre> | n/a | yes |
 | humanitec\_org\_id | Humanitec Organization ID | `string` | n/a | yes |
+| backstage\_repo\_custom\_claim\_keys | Custom claim keys for the OIDC subject claim customization template | `list(string)` | `null` | no |
 | backstage\_template\_owner | Backstage template owner | `string` | `"humanitec-architecture"` | no |
 | backstage\_template\_repository | Backstage template repository | `string` | `"backstage"` | no |
 <!-- END_TF_DOCS -->

modules/portal-backstage/backstage-github.tf

@@ -15,3 +15,38 @@ resource "github_repository" "backstage" {
     repository = var.backstage_template_repository
   }
 }
+
+# Required as Azure doesn't support wildcards in scopes https://github.com/Azure/azure-workload-identity/issues/373
+# More details in https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-token-claims
+resource "github_actions_repository_oidc_subject_claim_customization_template" "backstage" {
+  count = var.backstage_repo_custom_claim_keys != null ? 1 : 0
+
+  repository         = github_repository.backstage.name
+  use_default        = false
+  include_claim_keys = var.backstage_repo_custom_claim_keys
+}
+
+# Wait for the initial post-repo create action run to start
+resource "time_sleep" "wait_after_claims_change" {
+  count = var.backstage_repo_custom_claim_keys != null ? 1 : 0
+
+  create_duration = "30s"
+
+  depends_on = [github_actions_repository_oidc_subject_claim_customization_template.backstage]
+}
+
+# Redeploy after the custom claim keys change
+resource "github_repository_file" "re_deploy" {
+  count = var.backstage_repo_custom_claim_keys != null ? 1 : 0
+
+  repository          = github_repository.backstage.name
+  branch              = "main"
+  file                = ".github/redeploy"
+  content             = "redeploy after claim keys change"
+  commit_message      = "Redeploy after claim keys change"
+  commit_author       = "github-actions[bot]"
+  commit_email        = "41898282+github-actions[bot]@users.noreply.github.com"
+  overwrite_on_create = true
+
+  depends_on = [time_sleep.wait_after_claims_change]
+}

modules/portal-backstage/providers.tf

@@ -16,6 +16,10 @@ terraform {
       source  = "hashicorp/random"
       version = "~> 3.5"
     }
+    time = {
+      source  = "hashicorp/time"
+      version = "~> 0.11"
+    }
   }
   required_version = ">= 1.3.0"
 }

modules/portal-backstage/terraform.tfvars.example

@@ -1,4 +1,7 @@
 
+# Custom claim keys for the OIDC subject claim customization template
+backstage_repo_custom_claim_keys = ""
+
 # Backstage template owner
 backstage_template_owner = "humanitec-architecture"
 

modules/portal-backstage/variables.tf

@@ -84,3 +84,11 @@ variable "backstage_template_repository" {
   type        = string
   default     = "backstage"
 }
+
+# Required as Azure doesn't support wildcards in scopes https://github.com/Azure/azure-workload-identity/issues/373
+# More details in https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-token-claims
+variable "backstage_repo_custom_claim_keys" {
+  description = "Custom claim keys for the OIDC subject claim customization template"
+  type        = list(string)
+  default     = null
+}