GitHub Action for deploying to Azure Web App

With the Azure App Service Actions for GitHub, you can automate your workflow to deploy Azure Web Apps or Azure Web Apps for Containers using GitHub Actions.

Get started today with a free Azure account!

This repository contains GitHub Action for Azure WebApp to deploy to an Azure WebApp (Windows or Linux). Supports deploying *.jar, *.war, *.zip or a folder.

You can also use this Github Action to deploy your customized image into an Azure Webapps container.

For deploying container images to Kubernetes, consider using Kubernetes deploy action. This action requires that the cluster context be set earlier in the workflow by using either the Azure/aks-set-context action or the Azure/k8s-set-context action.

The definition of this Github Action is in action.yml.

End-to-End Sample Workflows

Dependencies on other Github Actions

• Checkout Checkout your Git repository content into Github Actions agent.
• Authenticate using Azure Web App Publish Profile or using Azure Login
• To build app code in a specific language based environment, use setup actions
  • Setup DotNet Sets up a dotnet environment by optionally downloading and caching a version of dotnet by SDK version and adding to PATH .
  • Setup Node sets up a node environment by optionally downloading and caching a version of node - npm by version spec and add to PATH
  • Setup Python sets up Python environment by optionally installing a version of python and adding to PATH.
  • Setup Java sets up Java app environment optionally downloading and caching a version of java by version and adding to PATH. Downloads from Azul's Zulu distribution.
• To build and deploy a containerized app, use docker-login to log in to a private container registry such as Azure Container registry. Once login is done, the next set of Actions in the workflow can perform tasks such as building, tagging and pushing containers.

Create Azure Web App and deploy using GitHub Actions

1. Follow the tutorial Azure Web Apps Quickstart
2. Pick a template from the following table depends on your Azure web app runtime and place the template to .github/workflows/ in your project repository.
3. Change app-name to your Web app name.
4. Commit and push your project to GitHub repository, you should see a new GitHub Action initiated in Actions tab.

Sample workflow to build and deploy a Node.js Web app to Azure using publish profile

# File: .github/workflows/workflow.yml

on: push

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
    # checkout the repo
    - name: 'Checkout Github Action' 
      uses: actions/checkout@master
    
    - name: Setup Node 10.x
      uses: actions/setup-node@v1
      with:
        node-version: '10.x'
    - name: 'npm install, build, and test'
      run: |
        npm install
        npm run build --if-present
        npm run test --if-present
       
    - name: 'Run Azure webapp deploy action using publish profile credentials'
      uses: azure/webapps-deploy@v2
      with: 
        app-name: node-rn
        publish-profile: ${{ secrets.azureWebAppPublishProfile }}
        

Configure deployment credentials:

For any credentials like Azure Service Principal, Publish Profile etc add them as secrets in the GitHub repository and then use them in the workflow.

The above example uses app-level credentials i.e., publish profile file for deployment.

Follow the steps to configure the secret:

• Download the publish profile for the WebApp from the portal (Get Publish profile option)
• Define a new secret under your repository settings, Add secret menu
• Paste the contents for the downloaded publish profile file into the secret's value field
• Now in the workflow file in your branch: .github/workflows/workflow.yml replace the secret for the input publish-profile: of the deploy Azure WebApp action (Refer to the example above)

Sample workflow to build and deploy a Node.js app to Containerized WebApp using Azure service principal

• Azure Login Login with your Azure credentials for Web app deployment authentication. Once login is done, the next set of Azure actions in the workflow can re-use the same session within the job.

on: [push]

name: Linux_Container_Node_Workflow

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
    # checkout the repo
    - name: 'Checkout Github Action' 
      uses: actions/checkout@master
    
    - name: 'Login via Azure CLI'
      uses: azure/login@v1
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}
    
    - uses: azure/docker-login@v1
      with:
        login-server: contoso.azurecr.io
        username: ${{ secrets.REGISTRY_USERNAME }}
        password: ${{ secrets.REGISTRY_PASSWORD }}
    
    - run: |
        docker build . -t contoso.azurecr.io/nodejssampleapp:${{ github.sha }}
        docker push contoso.azurecr.io/nodejssampleapp:${{ github.sha }} 
      
    - uses: azure/webapps-deploy@v2
      with:
        app-name: 'node-rnc'
        images: 'contoso.azurecr.io/nodejssampleapp:${{ github.sha }}'
    

Configure deployment credentials:

For any credentials like Azure Service Principal, Publish Profile etc add them as secrets in the GitHub repository and then use them in the workflow.

The above example uses user-level credentials i.e., Azure Service Principal for deployment.

Follow the steps to configure the secret:

• Define a new secret under your repository settings, Add secret menu
• Paste the contents of the below az cli command as the value of secret variable, for example 'AZURE_CREDENTIALS'

   az ad sp create-for-rbac --name "myApp" --role contributor \
                            --scopes /subscriptions/{subscription-id}/resourceGroups/{resource-group} \
                            --sdk-auth
                            
  # Replace {subscription-id}, {resource-group} with the subscription, resource group details of the WebApp
  
  # The command should output a JSON object similar to this:

  {
    "clientId": "<GUID>",
    "clientSecret": "<GUID>",
    "subscriptionId": "<GUID>",
    "tenantId": "<GUID>",
    (...)
  }
  

• You can further scope down the Azure Credentials to the Web App using scope attribute. For example,

 az ad sp create-for-rbac --name "myApp" --role contributor \
                          --scopes /subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.Web/sites/{app-name} \
                          --sdk-auth

# Replace {subscription-id}, {resource-group}, and {app-name} with the names of your subscription, resource group, and Azure Web App.

• Now in the workflow file in your branch: .github/workflows/workflow.yml replace the secret in Azure login action with your secret (Refer to the example above)

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.