Automated GitHub Actions setup script — from 17 manual steps to one command

[kayasax]

Hi all,
While working on integrating TCM drifts into Maester tests I had to configure it in a new repo, and I thought the current process to integrate Maester with GitHub Action has a lot of manual steps, might discourage some users.
Create the app registration, grant 17+ Graph permissions one by one, configure the federated identity credential, set GitHub secrets is somehow scary.

So I created a script that does all in one command.

• Creates an Entra ID application ("Maester DevOps Account")
• Grants all 19 Graph application permissions that Maester needs
• Triggers admin consent
• Creates the federated identity credential for GitHub Actions OIDC
• Sets AZURE_TENANT_ID and AZURE_CLIENT_ID as GitHub repository secrets via gh CLI

=>Zero required parameters — it auto-detects the GitHub repo from your local git remote. But everything is overridable:

ex

# Custom app name + specific repo
.\New-MaesterServicePrincipal.ps1 -DisplayName "Contoso Maester" -GitHubRepo "contoso/maester-tests"

# Include Exchange & Teams permissions (for CISA SCuBA tests)
.\New-MaesterServicePrincipal.ps1 -IncludeExchange -IncludeTeams

Prerequisites: Microsoft.Graph.Authentication module + gh CLI authenticated.

The script follows the exact same steps as the official Maester setup guide, just automated.
Wondering if this is something that could be interesting to integrate in the repo? Happy to submit a PR in this case.

The script is available here: https://github.com/kayasax/EasyTCM/blob/master/scripts/New-MaesterServicePrincipal.ps1

[SamErde]

Thanks for sharing, Loïc! Can't wait to try this out. 👍

[SamErde]

I've been all over the place lately and almost forgot about this. It would be great if you would like to submit a PR for this script!!

One question: could/should this improvement fit into @merill's existing powershell\public\core\New-MtMaesterApp.ps1 and powershell\public\core\Add-MtMaesterAppFederatedCredential.ps1 functions?

[kayasax]

Hi @SamErde I was not aware of these existing scripts, so real difference is that it auto detect your github repo and push the secrets using gh cli. I created the PR if you still think this adds some values;
#1777

[SamErde]

Definitely!