Second test self-hosted runner #2

	name: Azure OIDC login via self-hosted runner

	on:
	push:
	branches: [ main ]

	jobs:
	login-and-check:
	runs-on: [self-hosted, macOS, X64] # matcher labelene runneren din annonserer
	environment: dev # må matche subject i Federated credential
	permissions:
	id-token: write
	contents: read
	concurrency: ci-${{ github.ref }} # hindrer parallelle kjøringer på samme branch

	env:
	# Disse kan gjerne ligge som repo/environment "Variables" når de ikke er hemmelige
	ARM_USE_OIDC: true
	ARM_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
	ARM_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
	ARM_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}

	steps:
	- name: Checkout
	uses: actions/checkout@v4

	# (valgfritt ved første feilsøking) Sjekk hvilke claims som faktisk utstedes
	- name: Inspect OIDC claims
	run: \|
	TOK=$(curl -sSL -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
	"${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=api://AzureADTokenExchange" \| jq -r '.value')
	echo "$TOK" \| awk -F. '{print $2}' \| base64 -d 2>/dev/null \| jq '{iss, aud, sub}'

	- name: Azure login (OIDC)
	uses: azure/login@v2
	with:
	client-id: ${{ env.ARM_CLIENT_ID }}
	tenant-id: ${{ env.ARM_TENANT_ID }}
	subscription-id: ${{ env.ARM_SUBSCRIPTION_ID }}
	enable-AzPSSession: true

	- name: Azure CLI
	uses: azure/cli@v2
	with:
	azcliversion: latest
	inlineScript: \|
	az account show

	- name: Azure PowerShell
	uses: azure/powershell@v2
	with:
	azPSVersion: latest
	inlineScript: \|
	Get-AzContext

Workflow file