How do I force Packer to use Azure client secret in GitHub Actions workflow?

Question

I use the following yml workflow in GitHub:

- name: Packer Build
  run: packer build -force -var 'client_id=${{ secrets.AZURE_CLIENT_ID }}' \
                           -var 'client_secret=${{ secrets.AZURE_CLIENT_SECRET }}' \
                           -var 'subscription_id=${{ secrets.AZURE_SUBSCRIPTION_ID }}' \
                           -var 'tenant_id=${{ secrets.AZURE_TENANT_ID }}' \
                           -on-error=abort ubuntu.json

The Azure service principal credentials are stored as GitHub repository secrets. I can successfully build the image from my local machine using the same credentials as zsh environment variables:

-> % packer build -force foo.json
azure-arm: output will be in this color.

==> azure-arm: Running builder ...
==> azure-arm: Getting tokens using client secret
==> azure-arm: Getting tokens using client secret
    azure-arm: Creating Azure Resource Manager (ARM) client ...

However, in the GitHub workflow, Packer tries to use Managed Identity, instead of the service principal and fails with the following error message:

azure-arm: output will be in this color.
==> azure-arm: Running builder ...
==> azure-arm: Getting tokens using Managed Identity for Azure
Build 'azure-arm' errored after 146 milliseconds 736 microseconds: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"invalid_request","error_description":"Identity not found"} Endpoint http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F

Answer 1

The solution was to declare the variables in the json template used by Packer build command.🙈 Like this:

{
  "variables": {
    "azure_cd":      "{{env `azure_cd`}}",
    "azure_ct":      "{{env `azure_ct`}}",
    "azure_td":      "{{env `azure_td`}}",
    "azure_sd":      "{{env `azure_sd`}}"
  },

  "builders": [{
    "type": "azure-arm",
    <etc..>