@equinor/fusion-framework-cli 15.1.3 → 15.1.4

package/dist/esm/version.js

@@ -1,3 +1,3 @@
 // Generated by genversion.
-export const version = '15.1.3';
+export const version = '15.1.4';
 //# sourceMappingURL=version.js.map

package/dist/types/version.d.ts

@@ -1 +1 @@
-export declare const version = "15.1.3";
+export declare const version = "15.1.4";

package/docs/application.md

@@ -90,18 +90,17 @@ pnpm fusion-framework-cli dev
 ffc app dev
 ```
 
-### Log in to Fusion Framework (if needed)
+### Authentication
 
 > [!NOTE]
-> __All HTTP requests to Fusion services require an authorized user.__
-> For example, before running `fusion-framework-cli app publish`, make sure you are authenticated using `fusion-framework-cli auth login`.
-
-> [!WARNING]
-> The `fusion-framework-cli auth login` command is only available in interactive environments (such as your local terminal). For CI/CD pipelines or automated deployments, you must provide a valid authentication token using the `FUSION_TOKEN` environment variable.
+> **All HTTP requests to Fusion services require an authorized user.**
+> - **Local development:** use `fusion-framework-cli auth login` to authenticate interactively. This launches a browser-based login and caches your credentials locally — run it once before issuing other CLI commands.
+> - **CI/CD:** use `azure/login` to establish ambient credentials. The CLI picks them up automatically via `DefaultAzureCredential`. The `auth login` command requires an interactive browser session and is **not applicable** in CI.
 >
-> See [Authentication](auth.md#setting-the-fusion-token-in-github) for details on setting up tokens for CI/CD.
+> See [Authentication](auth.md) for full setup details.
 
 ```sh
+# Local development — launches interactive browser login
 pnpm fusion-framework-cli auth login
 ```
 
@@ -118,7 +117,7 @@ pnpm fusion-framework-cli publish --env <environment>
 pnpm fusion-framework-cli app config --publish --env <environment>
 ```
 
-> **Tip:** For CI/CD and automation, set the `FUSION_TOKEN` environment variable. See [Authentication](auth.md) for details.
+> **Tip:** For CI/CD and automation, prefer Azure OIDC with `azure/login`; `FUSION_TOKEN` remains an optional explicit override. See [Authentication](auth.md) for details.
 
 ---
 

package/docs/auth.md

@@ -8,7 +8,7 @@ For detailed information about the underlying authentication module, see the [Az
 ## Key features
 - **Multiple authentication modes:**
   - `interactive`: Browser-based Azure AD login with OS-level token caching (CLI tools, development).
-  - `default_credential`: Ambient credential chain — environment variables, managed identity, Azure CLI (CI/CD, infrastructure).
+  - **DefaultAzureCredential (default credential chain)**: Ambient credential chain — environment variables, managed identity, Azure CLI (CI/CD, infrastructure).
   - `token_only`: Use a pre-provided token (e.g., for CI/CD and automation).
 - **Secure token storage:** Tokens and authentication records are encrypted at rest using platform-specific mechanisms (Keychain on macOS, DPAPI on Windows, libsecret on Linux) via `@azure/msal-node-extensions`.
 - **Consistent experience:** The same authentication logic and token handling is used across CLI and app environments.
@@ -99,78 +99,50 @@ ffc auth token
 
 ## CI/CD
 
-### Setting the Fusion Token in GitHub
+### Authentication in GitHub Actions
 
-To publish or deploy your Fusion Framework app, you need to authenticate and set the `FUSION_TOKEN` environment variable. This token is required for secure access to Fusion APIs during CI/CD workflows.
+For CI/CD, authenticate with Azure using `azure/login@v2` and run your desired CLI command (e.g. `app publish`) directly. The `fusion-framework-cli auth login` command requires an interactive browser session and is intended for **local development only** — it is not applicable in CI environments.
 
-You can obtain and set the `FUSION_TOKEN` using the Azure CLI as part of your pipeline steps. For example:
+When running in CI and no `--token`/`FUSION_TOKEN` is provided, the CLI automatically uses Azure Identity's `DefaultAzureCredential`. This works with OIDC federation, managed identities, and other ambient credentials.
 
-This ensures the `FUSION_TOKEN` is available as an environment variable for subsequent steps, such as publishing source code or config.
+```yml
+name: Publish app
+on:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Azure Login
+        uses: azure/login@v2
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}    # The app registration (Service Principal) client ID
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
+
+      - name: Publish to Fusion
+        run: fusion-framework-cli app publish --env ci ./dist/app.zip
+```
+
+### Optional Explicit Token Mode
+
+You can still provide an explicit token with `--token` or `FUSION_TOKEN` if needed.
 
 ```yml
-# This GitHub Action authenticates with Azure and retrieves an access token for use as FUSION_TOKEN.
-#
-# - The Azure Login step uses the azure/login action to authenticate with Azure using the provided client and tenant IDs.
-# - The Get Access Token step runs the Azure CLI to acquire an access token for the specified scope, then sets it as the FUSION_TOKEN environment variable for subsequent steps.
-#
-# This makes the token available for publishing, deploying, or running Fusion CLI commands that require authentication.
-#
-# Example usage in a workflow:
-#
-# steps:
-#   - name: Acquire Fusion Token
-#     uses: ./.github/actions/fusion-token
-#   - name: Fusion CLI command
-#     run: fusion-framework-cli app check
-#
-# ---
-# How to set up a Service Principal in Azure for CI/CD:
-#
-# 1. Sign in to Azure CLI:
-#      az login
-# 2. Create a new service principal (replace <NAME> and <SCOPE> as needed):
-#      az ad sp create-for-rbac --name <NAME> --role contributor --scopes <SCOPE>
-#    - This will output appId (client-id), password (client-secret), and tenant.
-# 3. Grant the service principal API permissions if needed (e.g., to call Fusion APIs):
-#    - In Azure Portal, go to Azure Active Directory > App registrations > [Your App] > API permissions.
-#    - Add the required API permissions and grant admin consent.
-# 4. Store the client-id, client-secret, and tenant-id as GitHub Action secrets.
-# 5. Use these secrets in your workflow as shown below.
-# 6. (Optional) For more on setting up environment variables in GitHub Actions workflows, see:
-#    https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment
-#
-# For more details, see:
-# https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal
-# https://learn.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli
-#
-name: Azure Login and Get Access Token
-description: Authenticates with Azure and retrieves an access token
-inputs:
-  client-id:
-    description: >
-      The Azure AD Application (client) ID to use for authentication. This should correspond to an app registration with permissions to request the required scopes.
-    required: true
-  tenant-id:
-    description: >
-      The Azure AD Tenant ID (directory) to authenticate against. This identifies the Azure AD instance where the app is registered.
-    required: true
-  scope:
-    description: >
-      The scope(s) for the access token, typically the Application ID URI of the API you want to access, followed by /.default (e.g., https://my-api/.default). Multiple scopes can be space-separated.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Azure Login
-      uses: azure/login@v2
-      with:
-        client-id: ${{ inputs.client-id }}
-        tenant-id: ${{ inputs.tenant-id }}
-        allow-no-subscriptions: true
-    - name: Get Access Token
-      shell: bash
-      run: |
-        echo "FUSION_TOKEN=$(az account get-access-token --scope ${{ inputs.scope }} --query accessToken --output tsv)" >> $GITHUB_ENV
+- name: Acquire token (optional)
+  run: |
+    echo "FUSION_TOKEN=$(az account get-access-token --scope ${{ vars.FUSION_SCOPE }} --query accessToken --output tsv)" >> $GITHUB_ENV
+
+- name: Publish with explicit token
+  run: fusion-framework-cli app publish --env ci ./dist/app.zip
+```
 
 ## Additional Resources
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@equinor/fusion-framework-cli",
-  "version": "15.1.3",
+  "version": "15.1.4",
   "keywords": [
     "Fusion",
     "Fusion Framework",
@@ -112,10 +112,10 @@
     "vite-tsconfig-paths": "^6.0.4",
     "zod": "^4.4.3",
     "@equinor/fusion-framework-dev-server": "2.0.12",
-    "@equinor/fusion-imports": "2.0.0",
+    "@equinor/fusion-framework-dev-portal": "7.0.0",
     "@equinor/fusion-framework-module-azure-identity": "0.2.1",
-    "@equinor/fusion-framework-vite-plugin-raw-imports": "2.0.0",
-    "@equinor/fusion-framework-dev-portal": "7.0.0"
+    "@equinor/fusion-imports": "2.0.0",
+    "@equinor/fusion-framework-vite-plugin-raw-imports": "2.0.0"
   },
   "devDependencies": {
     "@rollup/plugin-commonjs": "^29.0.0",
@@ -141,8 +141,8 @@
     "@equinor/fusion-framework-module": "6.1.0",
     "@equinor/fusion-framework-module-app": "8.0.2",
     "@equinor/fusion-framework-module-http": "8.0.3",
-    "@equinor/fusion-framework-module-service-discovery": "10.0.1",
-    "@equinor/fusion-framework-react-router": "2.2.0"
+    "@equinor/fusion-framework-react-router": "2.2.0",
+    "@equinor/fusion-framework-module-service-discovery": "10.0.1"
   },
   "peerDependenciesMeta": {
     "typescript": {