release: update .NET tool azure connection/variables

Update the .NET tool release workflow to use the workflow's Federated
credential for Azure access. Additionally, update ESRP setup to use secrets
instead of storage account/resource names.

Author: ldennington

.github/set_up_esrp.ps1

@@ -1,5 +1,5 @@
 # Install ESRP client
-az storage blob download --file esrp.zip --auth-mode login --account-name esrpsigningstorage --container signing-resources --name microsoft.esrpclient.1.2.76.nupkg
+az storage blob download --file esrp.zip --auth-mode login --account-name $env:AZURE_STORAGE_ACCOUNT --container $env:AZURE_STORAGE_CONTAINER --name $env:ESRP_TOOL
 Expand-Archive -Path esrp.zip -DestinationPath .\esrp
 
 # Install certificates

.github/workflows/release.yml

@@ -309,6 +309,7 @@ jobs:
   dotnet-tool-build:
     name: Build .NET tool
     runs-on: ubuntu-latest
+    needs: prereqs
     steps:
     - uses: actions/checkout@v4
 
@@ -349,14 +350,20 @@ jobs:
         cd payload
         Get-ChildItem -Exclude payload.zip | Remove-Item -Recurse -Force
 
-    - uses: azure/login@v1
+    - name: Log into Azure
+      uses: azure/login@v1
       with:
-        creds: ${{ secrets.AZURE_CREDENTIALS }}
+        client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
     - name: Set up ESRP client
       shell: pwsh
       env:
         AZURE_VAULT: ${{ secrets.AZURE_VAULT }}
+        AZURE_STORAGE_ACCOUNT: ${{ secrets.AZURE_STORAGE_ACCOUNT }}
+        AZURE_STORAGE_CONTAINER: ${{ secrets.AZURE_STORAGE_CONTAINER }}
+        ESRP_TOOL: ${{ secrets.ESRP_TOOL }}
         AUTH_CERT: ${{ secrets.AZURE_VAULT_AUTH_CERT_NAME }}
         REQUEST_SIGNING_CERT: ${{ secrets.AZURE_VAULT_REQUEST_SIGNING_CERT_NAME }}
       run: |
@@ -390,15 +397,10 @@ jobs:
   dotnet-tool-pack:
     name: Package .NET tool
     runs-on: ubuntu-latest
-    needs: dotnet-tool-payload-sign
+    needs: [ prereqs, dotnet-tool-payload-sign ]
     steps:
     - uses: actions/checkout@v4
 
-    - name: Set version environment variable
-      run: echo "VERSION=$(cat VERSION | sed -E 's/.[0-9]+$//')" >> $GITHUB_ENV
-
-    - uses: actions/checkout@v4
-
     - name: Download signed payload
       uses: actions/download-artifact@v3
       with:
@@ -413,7 +415,8 @@ jobs:
     - name: Package tool
       run: |
         src/shared/DotnetTool/pack.sh --configuration=Release \
-          --version=$VERSION --publish-dir=$(pwd)/signed
+          --version="${{ needs.prereqs.outputs.version }}" \
+          --publish-dir=$(pwd)/signed
 
     - name: Upload unsigned package
       uses: actions/upload-artifact@v3
@@ -444,14 +447,20 @@ jobs:
         cd nupkg
         Get-ChildItem -Exclude gcm-nupkg.zip | Remove-Item -Recurse -Force
 
-    - uses: azure/login@v1
+    - name: Log into Azure
+      uses: azure/login@v1
       with:
-        creds: ${{ secrets.AZURE_CREDENTIALS }}
+        client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
     - name: Set up ESRP client
       shell: pwsh
       env:
         AZURE_VAULT: ${{ secrets.AZURE_VAULT }}
+        AZURE_STORAGE_ACCOUNT: ${{ secrets.AZURE_STORAGE_ACCOUNT }}
+        AZURE_STORAGE_CONTAINER: ${{ secrets.AZURE_STORAGE_CONTAINER }}
+        ESRP_TOOL: ${{ secrets.ESRP_TOOL }}
         AUTH_CERT: ${{ secrets.AZURE_VAULT_AUTH_CERT_NAME }}
         REQUEST_SIGNING_CERT: ${{ secrets.AZURE_VAULT_REQUEST_SIGNING_CERT_NAME }}
       run: |