Repo Secret Provisioner

Overview

FlowLibs - Repo Secret Provisioner is a daily-scheduled Power Automate Cloud Flow that automatically pre-wires newly created service accounts into a target GitHub repository as Actions secrets. It enumerates an Entra ID security group, filters members created inside a configurable lookback window, generates a random credential for each new account, encrypts it against the repository's public key, and pushes it to GitHub so downstream CI/CD workflows are ready to run the moment they reference the new secret.

The flow is architecturally complete and ships in the Stopped state. Activating it requires only (1) authorizing the three connection references, (2) setting the environment variable defaults for your tenant/repo, and (3) deploying the companion LibSodium encryption Azure Function (since Power Automate has no native sealed-box primitive).

Use Case

When a new service-account identity is provisioned in Entra ID for a GitHub Actions workflow, there is almost always a paired step where a human operator hand-creates a matching repository secret to carry that account's credential. That step is manual, error-prone, and a common bottleneck during onboarding. This flow closes the loop: as soon as the service account appears in the designated security group, it becomes a named GitHub secret (e.g., SA_CREDENTIAL_ALICE_SMITH) with a freshly generated value, a daily summary email is sent to the admin, and the workflow author can reference the secret by name without any backend coordination.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Changing the schedule

Edit the Daily Recurrence 9am Eastern trigger in the designer. The Recurrence action supports any frequency (Minute / Hour / Day / Week / Month) and any time zone.

Changing the lookback window

Update the default value of flowlibs_NewAccountLookbackHours. For example, set 168 to scan the last 7 days, or 1 for the last hour (pair this with a more frequent recurrence).

Targeting a different repo

Update flowlibs_GitHubOwner and flowlibs_GitHubRepository defaults in the solution. No flow JSON edits needed.

Changing the secret naming scheme

Update flowlibs_SecretNamePrefix for a different prefix, or edit the Compose Secret Name For Service Account expression to change the UPN normalization rules (e.g., swap . separators for -, keep the domain, etc.).

Different secret value source

Replace the Compose Generated Secret Value action with any secret source (Key Vault Get secret, HTTP call to an internal credential API, etc.). Downstream actions only require the plaintext secret at that step.

Multiple repositories

Wrap the existing For Each New Service Account body in an outer For each over a list of repo names (stored in an array variable) to provision the same secret across multiple repos.

Companion Azure Function

Because Power Automate has no native LibSodium sealed-box primitive, this flow delegates the actual encryption to an external Azure Function. A minimal Node 18 implementation using the tweetsodium or libsodium-wrappers package is sufficient; it accepts {publicKey, keyId, secretValue} and returns {encrypted_value, key_id}. The Function URL is referenced exclusively via the flowlibs_EncryptionFunctionUrl environment variable, so swapping implementations requires no flow changes.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

addHours(utcNow(), mul(-1, int(variables('varNewAccountLookbackHours'))))

@greaterOrEquals(item()?['createdDateTime'], outputs('Compute_Created_After_Cutoff'))

@{concat(guid(), replace(guid(), '-', ''))}

@{toUpper(concat(variables('varSecretNamePrefix'), replace(replace(first(split(items('For_Each_New_Service_Account')?['userPrincipalName'], '@')), '.', '*'), '-', '*')))}

@{concat(variables('varProvisionedAccountsLog'), '<tr><td>', items('For_Each_New_Service_Account')?['displayName'], '</td><td>', outputs('Compose_Secret_Name_For_Service_Account'), '</td></tr>')}