Merge branch 'main' into dependabot/go_modules/github.com/stackitcloud/stackit-sdk-go/services/serviceaccount-0.21.1

Author: cgoetz-inovex

.github/workflows/ci.yaml

@@ -50,7 +50,7 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Check GoReleaser
-        uses: goreleaser/goreleaser-action@v7.2.3
+        uses: goreleaser/goreleaser-action@v7.3.0
         with:
           args: check
 

.github/workflows/release.yaml

@@ -74,7 +74,7 @@ jobs:
         uses: samuelmeuli/action-snapcraft@v3
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v7.2.3
+        uses: goreleaser/goreleaser-action@v7.3.0
         with:
           args: release --clean
         env:

AUTHENTICATION.md

@@ -131,3 +131,5 @@ Using this flow is less secure since the token is long-lived. You can provide th
    # Optional: provide a file path containing the OIDC token
    STACKIT_FEDERATED_TOKEN_FILE=/path/to/oidc-token.jwt
    ```
+
+   When running in Azure DevOps with the [STACKIT Service Connection](https://marketplace.visualstudio.com/items?itemName=SchwarzDigits.stackit-service-connection), the CLI reads `STACKIT_SERVICE_CONNECTION_ID` and requests the OIDC token for that service connection.

go.mod

@@ -1,6 +1,6 @@
 module github.com/stackitcloud/stackit-cli
 
-go 1.26.0
+go 1.26.10
 
 require (
 	github.com/fatih/color v1.19.0
@@ -22,24 +22,24 @@ require (
 	github.com/stackitcloud/stackit-sdk-go/services/automation v0.2.1
 	github.com/stackitcloud/stackit-sdk-go/services/cdn v1.21.0
 	github.com/stackitcloud/stackit-sdk-go/services/dns v0.25.0
-	github.com/stackitcloud/stackit-sdk-go/services/edge v0.13.2
+	github.com/stackitcloud/stackit-sdk-go/services/edge v0.14.0
 	github.com/stackitcloud/stackit-sdk-go/services/git v0.14.1
 	github.com/stackitcloud/stackit-sdk-go/services/iaas v1.15.1
 	github.com/stackitcloud/stackit-sdk-go/services/intake v0.12.0
 	github.com/stackitcloud/stackit-sdk-go/services/logs v0.10.2
 	github.com/stackitcloud/stackit-sdk-go/services/mongodbflex v1.13.0
 	github.com/stackitcloud/stackit-sdk-go/services/opensearch v1.5.0
 	github.com/stackitcloud/stackit-sdk-go/services/postgresflex v1.15.0
-	github.com/stackitcloud/stackit-sdk-go/services/resourcemanager v0.26.1
+	github.com/stackitcloud/stackit-sdk-go/services/resourcemanager v0.27.0
 	github.com/stackitcloud/stackit-sdk-go/services/runcommand v1.11.0
-	github.com/stackitcloud/stackit-sdk-go/services/secretsmanager v0.19.1
+	github.com/stackitcloud/stackit-sdk-go/services/secretsmanager v0.20.0
 	github.com/stackitcloud/stackit-sdk-go/services/serverbackup v1.7.3
 	github.com/stackitcloud/stackit-sdk-go/services/serverupdate v1.6.0
 	github.com/stackitcloud/stackit-sdk-go/services/serviceaccount v0.21.1
-	github.com/stackitcloud/stackit-sdk-go/services/serviceenablement v1.7.2
+	github.com/stackitcloud/stackit-sdk-go/services/serviceenablement v1.8.0
 	github.com/stackitcloud/stackit-sdk-go/services/ske v1.21.2
 	github.com/stackitcloud/stackit-sdk-go/services/sqlserverflex v1.18.1
-	github.com/stackitcloud/stackit-sdk-go/services/valkey v0.3.1
+	github.com/stackitcloud/stackit-sdk-go/services/valkey v0.4.0
 	github.com/stackitcloud/stackit-sdk-go/services/vpn v0.15.2
 	github.com/zalando/go-keyring v0.2.8
 	golang.org/x/mod v0.41.0
@@ -269,12 +269,12 @@ require (
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/stackitcloud/stackit-sdk-go/services/kms v1.14.0
 	github.com/stackitcloud/stackit-sdk-go/services/loadbalancer v1.16.0
-	github.com/stackitcloud/stackit-sdk-go/services/logme v1.4.0
-	github.com/stackitcloud/stackit-sdk-go/services/mariadb v1.3.1
+	github.com/stackitcloud/stackit-sdk-go/services/logme v1.5.0
+	github.com/stackitcloud/stackit-sdk-go/services/mariadb v1.4.0
 	github.com/stackitcloud/stackit-sdk-go/services/objectstorage v1.12.0
 	github.com/stackitcloud/stackit-sdk-go/services/observability v0.25.2
 	github.com/stackitcloud/stackit-sdk-go/services/rabbitmq v1.5.0
-	github.com/stackitcloud/stackit-sdk-go/services/redis v1.5.0
+	github.com/stackitcloud/stackit-sdk-go/services/redis v1.6.0
 	github.com/stackitcloud/stackit-sdk-go/services/sfs v0.11.3
 	github.com/subosito/gotenv v1.6.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect

go.sum

@@ -622,8 +622,8 @@ github.com/stackitcloud/stackit-sdk-go/services/cdn v1.21.0 h1:lCs1eq/OOTdwGrrkx
 github.com/stackitcloud/stackit-sdk-go/services/cdn v1.21.0/go.mod h1:NBgvZH5ekJ2hFCNI480C9MdJsa4989YGC1YgX5ELA48=
 github.com/stackitcloud/stackit-sdk-go/services/dns v0.25.0 h1:Yn4etadrdEEPU8YcbvF7a/UExSqri+jUC62w62ic4N8=
 github.com/stackitcloud/stackit-sdk-go/services/dns v0.25.0/go.mod h1:D0iv6XBYkaEwTjbBeom0VTZnwQMfwb48FC8R2jRg80c=
-github.com/stackitcloud/stackit-sdk-go/services/edge v0.13.2 h1:UDkXmgOAlP3y/u7FKp6/MaVxvSi38hNqnj1HytM6bU4=
-github.com/stackitcloud/stackit-sdk-go/services/edge v0.13.2/go.mod h1:hlUcPvOgH/CzZqH7u4SwV81qiismCVAtvw5pTAf6si4=
+github.com/stackitcloud/stackit-sdk-go/services/edge v0.14.0 h1:TTwlI34FUb0AisiApxKs5brGNP3Ma9cTvdmbxzNxs40=
+github.com/stackitcloud/stackit-sdk-go/services/edge v0.14.0/go.mod h1:FBBnDsQns6SjJYQrox3YSY7ydOa4T8FR3sXNwFRTsPc=
 github.com/stackitcloud/stackit-sdk-go/services/git v0.14.1 h1:7R5peSRer3Y83mfB6wcdCP0vhEjsq4myUdVhl24q6to=
 github.com/stackitcloud/stackit-sdk-go/services/git v0.14.1/go.mod h1:kz2pl17t9MNQx0+fNXg10ZAVfjmvOtsHB7VlAzu/Io8=
 github.com/stackitcloud/stackit-sdk-go/services/iaas v1.15.1 h1:5D0ABveu3SZyB7DBkVJcCSS4fr1TiMmfdJA98TgDn/o=
@@ -634,12 +634,12 @@ github.com/stackitcloud/stackit-sdk-go/services/kms v1.14.0 h1:6vZhGEIEqXUcs6pzp
 github.com/stackitcloud/stackit-sdk-go/services/kms v1.14.0/go.mod h1:ZBXRYWP4Yz3Gn75VSFz2mfcLSOrDEbiCoGTIXonvXkA=
 github.com/stackitcloud/stackit-sdk-go/services/loadbalancer v1.16.0 h1:zcPGXu16E5NRp5ocF/0JTnm6AyAQmk61iqIlUpAbfgo=
 github.com/stackitcloud/stackit-sdk-go/services/loadbalancer v1.16.0/go.mod h1:tVD3LmpowgML5U3imG9DdGAjhLmccibO92Ta7DPNfc0=
-github.com/stackitcloud/stackit-sdk-go/services/logme v1.4.0 h1:sm6Xw4tnJvHguNoHBqndpMX3wwzNmQx2ZwvPsU03ass=
-github.com/stackitcloud/stackit-sdk-go/services/logme v1.4.0/go.mod h1:88EgGOZDYkw31BPtuQsqhh2yqzF9ZfoggsP/cYz7+O0=
+github.com/stackitcloud/stackit-sdk-go/services/logme v1.5.0 h1:WFok0NMwTUTIZtClkYZW8M2mAkoQwyaIJD8hLltM+z8=
+github.com/stackitcloud/stackit-sdk-go/services/logme v1.5.0/go.mod h1:88EgGOZDYkw31BPtuQsqhh2yqzF9ZfoggsP/cYz7+O0=
 github.com/stackitcloud/stackit-sdk-go/services/logs v0.10.2 h1:ZVOAS95S445ZUvXLjs4a+xL6kkxDm1bUHjDzYXwGbU4=
 github.com/stackitcloud/stackit-sdk-go/services/logs v0.10.2/go.mod h1:euyZx4EqA2N7lVrC/wWxdCKalZmnY5zjfrjouNkGycA=
-github.com/stackitcloud/stackit-sdk-go/services/mariadb v1.3.1 h1:FZJLUhHVrlrfFnI5VqAx0dOEcTZpMi/vnk/MxkzTkJI=
-github.com/stackitcloud/stackit-sdk-go/services/mariadb v1.3.1/go.mod h1:P1HFWSmuy2i1WA0PhcDfGsa0CRcbGTE+wDb1iEAL8/E=
+github.com/stackitcloud/stackit-sdk-go/services/mariadb v1.4.0 h1:LFpdvASJnTv5Y/PEfwgK0pn7ixXLgcUmLt2cRTg979g=
+github.com/stackitcloud/stackit-sdk-go/services/mariadb v1.4.0/go.mod h1:GpFHOEVEq+Pog9dWPMvGeF4mEvB+MVLIRh3/jB1isUI=
 github.com/stackitcloud/stackit-sdk-go/services/mongodbflex v1.13.0 h1:+7cw7kFNw2dZ3opWDusuW+GC+3lwf8mjpHtIvi2+wqs=
 github.com/stackitcloud/stackit-sdk-go/services/mongodbflex v1.13.0/go.mod h1:yNxGU6mwDzXX82/QfgxRzg2M3+ktVNKS1qPzT01QIi0=
 github.com/stackitcloud/stackit-sdk-go/services/objectstorage v1.12.0 h1:IIvEF3DBLuPF38vvBfKWKaOTWKH9NjTpybd1pfAymb0=
@@ -652,30 +652,30 @@ github.com/stackitcloud/stackit-sdk-go/services/postgresflex v1.15.0 h1:TSxUvRRM
 github.com/stackitcloud/stackit-sdk-go/services/postgresflex v1.15.0/go.mod h1:7Ka8vrinx+DjCXv6lqCVZbIkDIbrzA4qrkNjXr6MUDM=
 github.com/stackitcloud/stackit-sdk-go/services/rabbitmq v1.5.0 h1:SAro5TWVJDDyiqMwew9Ta1tMcItBmWrCRYErIQ9+UBI=
 github.com/stackitcloud/stackit-sdk-go/services/rabbitmq v1.5.0/go.mod h1:mjYkyr/A/+9rZnX5IOLEoAMFqHsRCIToZWpsYzYBwWo=
-github.com/stackitcloud/stackit-sdk-go/services/redis v1.5.0 h1:+6TwnEoyqED1AgbWsBUkP1iOAg3fXfUqXCsjHqfKeQ4=
-github.com/stackitcloud/stackit-sdk-go/services/redis v1.5.0/go.mod h1:/wE98YN+s1s1OcaEPt8Z2xO0Y46Gur3nXlg1AiiMNeY=
-github.com/stackitcloud/stackit-sdk-go/services/resourcemanager v0.26.1 h1:6NHoXh6c/GQ7+CO03bszc09rnKCeP0dzMmyrnz6mkvs=
-github.com/stackitcloud/stackit-sdk-go/services/resourcemanager v0.26.1/go.mod h1:IsId3wbkp5oaO0JEaHZpZnbVW6KFHlAptwB+1iG3v3w=
+github.com/stackitcloud/stackit-sdk-go/services/redis v1.6.0 h1:5UEPilI+RCuXEM8jm4ibREoZAsSAGI1+KnJ0oapye7Q=
+github.com/stackitcloud/stackit-sdk-go/services/redis v1.6.0/go.mod h1:/wE98YN+s1s1OcaEPt8Z2xO0Y46Gur3nXlg1AiiMNeY=
+github.com/stackitcloud/stackit-sdk-go/services/resourcemanager v0.27.0 h1:lZl9X/wl0tF+HufZiurUkYJmk4u6/Vz8/FkdgT3wA10=
+github.com/stackitcloud/stackit-sdk-go/services/resourcemanager v0.27.0/go.mod h1:IsId3wbkp5oaO0JEaHZpZnbVW6KFHlAptwB+1iG3v3w=
 github.com/stackitcloud/stackit-sdk-go/services/runcommand v1.11.0 h1:EVeeGzvyiCN4VbInHIWXZtL8hPsVzZIdnfXjgyZzUf0=
 github.com/stackitcloud/stackit-sdk-go/services/runcommand v1.11.0/go.mod h1:KQLunYwad9IhSbnXuhkKAldVG9LNxCzIYHR8vMJlKQI=
-github.com/stackitcloud/stackit-sdk-go/services/secretsmanager v0.19.1 h1:Mym5vqa3YaF42LbqlVXDFYf/evsNU76l0wpUPGEu+0U=
-github.com/stackitcloud/stackit-sdk-go/services/secretsmanager v0.19.1/go.mod h1:oFbKTkCFtp/RVjTeuv5caSuuEnf3/JG8zRDB4nbLYes=
+github.com/stackitcloud/stackit-sdk-go/services/secretsmanager v0.20.0 h1:D4/yjPk0GMbp5X96luY3wGEkFJ8RjfLJsIQhHh2ZdwI=
+github.com/stackitcloud/stackit-sdk-go/services/secretsmanager v0.20.0/go.mod h1:yV1dcbGaZfdzwcJqjsRNpZ4VVDsQETAAYj2/MCPr4RE=
 github.com/stackitcloud/stackit-sdk-go/services/serverbackup v1.7.3 h1:wqAj7RP4GrfWct1de6ny7UyJpB2vcMaNXR/8xPkPwKg=
 github.com/stackitcloud/stackit-sdk-go/services/serverbackup v1.7.3/go.mod h1:VkF3N0fTP8zOztdeKEG0uoMuMp3larEqNB22fnvlA5M=
 github.com/stackitcloud/stackit-sdk-go/services/serverupdate v1.6.0 h1:X/LEJX8AfiOoKDf/pDLaZSzAxlDHzy+QIy4vD+TVeLc=
 github.com/stackitcloud/stackit-sdk-go/services/serverupdate v1.6.0/go.mod h1:z17c+hqIi6S5Op9Uk0FmxaeZIoN6and2AAV7P1viAqQ=
 github.com/stackitcloud/stackit-sdk-go/services/serviceaccount v0.21.1 h1:GJn6tlJscVpdovN2lekb9R5dOZ1ynM9+gIVhEVsRCE0=
 github.com/stackitcloud/stackit-sdk-go/services/serviceaccount v0.21.1/go.mod h1:f5RySI1PHkYlv2JWIfbTOBARwf/JR+iAs/qeoGiXAvU=
-github.com/stackitcloud/stackit-sdk-go/services/serviceenablement v1.7.2 h1:ne+TBZTWUzIg47X5vRbeyPfJCA1tafIN3R20ADBIu2Q=
-github.com/stackitcloud/stackit-sdk-go/services/serviceenablement v1.7.2/go.mod h1:gmOQuuRATNTmHTuwCsJ6ko1AwHThYpvEkmD2uOYEJCQ=
+github.com/stackitcloud/stackit-sdk-go/services/serviceenablement v1.8.0 h1:PsLXr7R/R/ceWIJOkist2B5chWm/Q34IgQd/dmhvWbQ=
+github.com/stackitcloud/stackit-sdk-go/services/serviceenablement v1.8.0/go.mod h1:izKsr/tJKDNPsgZ/LFQ2civLOICA75BKU06NNWgADIw=
 github.com/stackitcloud/stackit-sdk-go/services/sfs v0.11.3 h1:u3IgZPwcD6yncKPK+PYqPKKaRW4EqfH8x4ARa53DlXI=
 github.com/stackitcloud/stackit-sdk-go/services/sfs v0.11.3/go.mod h1:QDhu6jIIgqgO7l/wAGlfUDHC4Q20vfyUifh3a0qT3W4=
 github.com/stackitcloud/stackit-sdk-go/services/ske v1.21.2 h1:4ApmRQGkcf/G/h1s19QsqH/vqE3oqfrdG1J/3/40iEM=
 github.com/stackitcloud/stackit-sdk-go/services/ske v1.21.2/go.mod h1:YYwFQNYrYUpa4FeT/6pxky8vp7E7pPy2F6+Ptf469hg=
 github.com/stackitcloud/stackit-sdk-go/services/sqlserverflex v1.18.1 h1:EU8vhBTmlqvQGPEeakXrzjpCsYHVaD3XU3sJO9Glj38=
 github.com/stackitcloud/stackit-sdk-go/services/sqlserverflex v1.18.1/go.mod h1:T1xYY3XabHJW6HppYk486ECBRswNwB3tRFM/ZOfQft0=
-github.com/stackitcloud/stackit-sdk-go/services/valkey v0.3.1 h1:zAdxoRrUB5sIz73xAyXXQlZZ46Yc1p3rW1PerOLHNOk=
-github.com/stackitcloud/stackit-sdk-go/services/valkey v0.3.1/go.mod h1:8znHnd2b6rdEHSmW/36LQa4dMMaLuN8dwo3tD6arEic=
+github.com/stackitcloud/stackit-sdk-go/services/valkey v0.4.0 h1:75iJs+mZPnrGSlSoTZtKYYCyNqtqgx6JVChwJokcKVg=
+github.com/stackitcloud/stackit-sdk-go/services/valkey v0.4.0/go.mod h1:0crDO5v97ulHjVZVoFR2gJ4FCpEQeXGdM+V+AlZ6M6E=
 github.com/stackitcloud/stackit-sdk-go/services/vpn v0.15.2 h1:82VZJaJPwcBKSj8WV8v0ujBvbkbMxFXIvvv0wU+0Be0=
 github.com/stackitcloud/stackit-sdk-go/services/vpn v0.15.2/go.mod h1:3OHHiMoNDwI63Vtvf5B/2Hc2hLlaCyTvPwg8N6T957s=
 github.com/stbenjam/no-sprintf-host-port v0.3.1 h1:AyX7+dxI4IdLBPtDbsGAyqiTSLpCP9hWRrXQDU4Cm/g=

internal/pkg/auth/oidc.go

@@ -17,6 +17,7 @@ const (
 	EnvGitHubRequestToken           = "ACTIONS_ID_TOKEN_REQUEST_TOKEN" //nolint:gosec // linter false positive
 	EnvAzureOIDCRequestURI          = "SYSTEM_OIDCREQUESTURI"
 	EnvAzureAccessToken             = "SYSTEM_ACCESSTOKEN" //nolint:gosec // linter false positive
+	EnvAzureServiceConnectionID     = "STACKIT_SERVICE_CONNECTION_ID"
 )
 
 func IsOIDCEnabled() bool {
@@ -40,7 +41,8 @@ func OIDCServiceAccountEmail() string {
 // TokenFunc returns the OIDCTokenFunc to use for Workload Identity Federation.
 // It checks the following token sources in order: STACKIT_SERVICE_ACCOUNT_FEDERATED_TOKEN,
 // STACKIT_FEDERATED_TOKEN_FILE, GitHub Actions (ACTIONS_ID_TOKEN_REQUEST_URL +
-// ACTIONS_ID_TOKEN_REQUEST_TOKEN), and Azure DevOps (SYSTEM_OIDCREQUESTURI + SYSTEM_ACCESSTOKEN).
+// ACTIONS_ID_TOKEN_REQUEST_TOKEN), and Azure DevOps (SYSTEM_OIDCREQUESTURI + SYSTEM_ACCESSTOKEN,
+// optionally scoped to the service connection set in STACKIT_SERVICE_CONNECTION_ID).
 // Returns an error if no source is detected.
 func OIDCTokenFunc() (oidcadapters.OIDCTokenFunc, error) {
 	// static token provided directly via env var
@@ -65,7 +67,7 @@ func OIDCTokenFunc() (oidcadapters.OIDCTokenFunc, error) {
 	// Azure DevOps
 	if adoURL := os.Getenv(EnvAzureOIDCRequestURI); adoURL != "" {
 		if adoToken := os.Getenv(EnvAzureAccessToken); adoToken != "" {
-			return oidcadapters.RequestAzureDevOpsOIDCToken(adoURL, adoToken, ""), nil
+			return oidcadapters.RequestAzureDevOpsOIDCToken(adoURL, adoToken, os.Getenv(EnvAzureServiceConnectionID)), nil
 		}
 	}
 

internal/pkg/auth/oidc_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"testing"
 
 	"github.com/stackitcloud/stackit-cli/internal/pkg/auth"
@@ -169,6 +170,62 @@ func TestTokenFunc_AzureDevOps(t *testing.T) {
 	}
 }
 
+func TestTokenFunc_AzureDevOps_ServiceConnectionID(t *testing.T) {
+	tests := []struct {
+		description         string
+		serviceConnectionID string
+	}{
+		{
+			description:         "service connection id set",
+			serviceConnectionID: "my-service-connection-id",
+		},
+		{
+			description:         "service connection id unset",
+			serviceConnectionID: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.description, func(t *testing.T) {
+			var gotQuery url.Values
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				gotQuery = r.URL.Query()
+				w.Header().Set("Content-Type", "application/json")
+				tok := "ado-oidc-token"
+				_ = json.NewEncoder(w).Encode(map[string]*string{"oidcToken": &tok})
+			}))
+			defer srv.Close()
+
+			t.Setenv(auth.EnvServiceAccountFederatedToken, "")
+			t.Setenv(auth.EnvFederatedTokenFile, "")
+			t.Setenv(auth.EnvGitHubRequestURL, "")
+			t.Setenv(auth.EnvGitHubRequestToken, "")
+			t.Setenv(auth.EnvAzureOIDCRequestURI, srv.URL)
+			t.Setenv(auth.EnvAzureAccessToken, "ado-access-token")
+			t.Setenv(auth.EnvAzureServiceConnectionID, tt.serviceConnectionID)
+
+			fn, err := auth.OIDCTokenFunc()
+			if err != nil {
+				t.Fatalf("OIDCTokenFunc() unexpected error: %v", err)
+			}
+			if _, err := fn(context.Background()); err != nil {
+				t.Fatalf("fn() unexpected error: %v", err)
+			}
+
+			got, ok := gotQuery["serviceConnectionId"]
+			if tt.serviceConnectionID == "" {
+				if ok {
+					t.Errorf("serviceConnectionId query param = %q, want it absent", got)
+				}
+				return
+			}
+			if !ok || len(got) != 1 || got[0] != tt.serviceConnectionID {
+				t.Errorf("serviceConnectionId query param = %q, want %q", got, tt.serviceConnectionID)
+			}
+		})
+	}
+}
+
 func TestTokenFunc_NoSource(t *testing.T) {
 	// All env vars absent → must return an actionable error, no panic.
 	t.Setenv(auth.EnvServiceAccountFederatedToken, "")