Edit

Share via

Deploy to App Service using GitHub Actions

  • Article

Get started with GitHub Actions to automate your workflow and deploy to Azure App Service from GitHub.

Prerequisites

Set up GitHub Actions deployment when creating the app

GitHub Actions deployment is integrated into the default Create Web App process. Set Continuous deployment to Enable in the Deployment tab, and configure the organization, repository, and branch that you want.

Screenshot shows how to enable GitHub Actions deployment in the App Service create Deployment tab.

When you enable continuous deployment, app creation automatically picks the authentication method based on the basic authentication selection and configures your app and your GitHub repository accordingly:

Basic authentication selection Authentication method
Disable User-assigned identity (OpenID Connect) (recommended)
Enable Basic authentication

Note

You might receive an error when you create the app that your Azure account doesn't have certain permissions. Your account might need the required permissions to create and configure the user-assigned identity. For an alternative, see Set up GitHub Actions deployment from the Deployment Center.

Set up GitHub Actions deployment from the Deployment Center

For an existing app, you can get started quickly with GitHub Actions by using the App Service Deployment Center. This turn-key method generates a GitHub Actions workflow file based on your application stack and commits it to your GitHub repository.

The Deployment Center also lets you easily configure the more secure OpenID Connect authentication with a user-assigned identity. For more information, see the user-assigned identity option.

If your Azure account has the needed permissions, you can create a user-assigned identity. Otherwise, you can select an existing user-assigned managed identity in the Identity dropdown menu. You can work with your Azure administrator to create a user-assigned managed identity with the Website Contributor role.

For more information, see Continuous deployment to Azure App Service.

Set up a GitHub Actions workflow manually

You can deploy a workflow without using the Deployment Center. In that case you need to perform three steps:

  1. Generate deployment credentials
  2. Configure the GitHub secret
  3. Add the workflow file to your GitHub repository

Generate deployment credentials

The recommended way to authenticate with Azure App Services for GitHub Actions is with OpenID Connect. This approach is an authentication method that uses short-lived tokens. Setting up OpenID Connect with GitHub Actions is more complex but offers hardened security.

Alternatively, you can authenticate with a User-assigned Managed Identity, a service principal, or a publish profile.

The following procedure describes the steps for creating an active directory application, service principal, and federated credentials using Azure CLI statements. To learn how to create an active directory application, service principal, and federated credentials in Azure portal, see Connect GitHub and Azure.

  1. If you don't have an existing application, register a new Active Directory application and service principal that can access resources. Create the Active Directory application.

    az ad app create --display-name myApp

    This command returns a JSON with an appId that is your client-id. Save the value to use as the AZURE_CLIENT_ID GitHub secret later.

    You use the objectId value when creating federated credentials with Graph API and reference it as the APPLICATION-OBJECT-ID.

  2. Create a service principal. Replace the $appID with the appId from your JSON output.

    This command generates JSON output with a different objectId to use in the next step. The new objectId is the assignee-object-id.

    Copy the appOwnerTenantId to use as a GitHub secret for AZURE_TENANT_ID later.

    az ad sp create --id $appId

  3. Create a new role assignment by subscription and object. By default, the role assignment is tied to your default subscription. Replace $subscriptionId with your subscription ID, $resourceGroupName with your resource group name, $webappName with your web app name, and $assigneeObjectId with the generated id. Learn how to manage Azure subscriptions with the Azure CLI.

    az role assignment create --role contributor --subscription $subscriptionId --assignee-object-id  $assigneeObjectId --scope /subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.Web/sites/$webappName --assignee-principal-type ServicePrincipal

  4. Run the following command to create a new federated identity credential for your active directory application.

    • Replace APPLICATION-OBJECT-ID with the appId (generated while creating app) for your Active Directory application.

    • Set a value for CREDENTIAL-NAME to reference later.

    • Set the subject. GitHub defines its value depending on your workflow:

      • For jobs in your GitHub Actions environment: repo:< Organization/Repository >:environment:< Name >
      • For Jobs not tied to an environment, include the ref path for branch/tag based on the ref path used for triggering the workflow: repo:< Organization/Repository >:ref:< ref path>. For example, repo:n-username/ node_express:ref:refs/heads/my-branch or repo:n-username/ node_express:ref:refs/tags/my-tag.
      • For workflows triggered by a pull request event: repo:< Organization/Repository >:pull_request.
    az ad app federated-credential create --id <APPLICATION-OBJECT-ID> --parameters credential.json
("credential.json" contains the following content)
{
    "name": "<CREDENTIAL-NAME>",
    "issuer": "https://token.actions.githubusercontent.com",
    "subject": "repo:organization/repository:ref:refs/heads/main",
    "description": "Testing",
    "audiences": [
        "api://AzureADTokenExchange"
    ]
}

Configure the GitHub secret

You need to provide your application's Client ID, Tenant ID, and Subscription ID to the Azure/login action. These values can either be provided directly in the workflow or can be stored in GitHub secrets and referenced in your workflow. Saving the values as GitHub secrets is the more secure option.

  1. Open your GitHub repository and go to Settings > Security > Secrets and variables > Actions > New repository secret.

  2. Create secrets for AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_SUBSCRIPTION_ID. Use these values from your Active Directory application for your GitHub secrets:

    GitHub Secret Active Directory Application
    AZURE_CLIENT_ID Application (client) ID
    AZURE_TENANT_ID Directory (tenant) ID
    AZURE_SUBSCRIPTION_ID Subscription ID

  3. Save each secret by selecting Add secret.

Add the workflow file to your GitHub repository

A YAML (.yml) file in the /.github/workflows/ path in your GitHub repository defines a workflow. This definition contains the various steps and parameters that make up the workflow.

At a minimum, the workflow file would have the following distinct steps:

  1. Authenticate with App Service using the GitHub secret you created.
  2. Build the web app.
  3. Deploy the web app.

To deploy your code to an App Service app, use the azure/webapps-deploy@v3 action. The action requires the name of your web app in app-name and, depending on your language stack, the path of a *.zip, *.war, *.jar, or folder to deploy in package. For a complete list of possible inputs for the azure/webapps-deploy@v3 action, see action.yml.

The following examples show the part of the workflow that builds the web app, in different supported languages.

To deploy with OpenID Connect using the managed identity you configured, use the azure/login@v1 action with the client-id, tenant-id, and subscription-id keys. Reference the GitHub secrets that you created earlier.

name: .NET Core

on: [push]

permissions:
      id-token: write
      contents: read

env:
  AZURE_WEBAPP_NAME: my-app    # set this to your application's name
  AZURE_WEBAPP_PACKAGE_PATH: '.'      # set this to the path to your web app project, defaults to the repository root
  DOTNET_VERSION: '6.0.x'           # set this to the dot net version to use

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      # Checkout the repo
      - uses: actions/checkout@main
      - uses: azure/login@v1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      
      # Setup .NET Core SDK
      - name: Setup .NET Core
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }} 
      
      # Run dotnet build and publish
      - name: dotnet build and publish
        run: |
          dotnet restore
          dotnet build --configuration Release
          dotnet publish -c Release --property:PublishDir='${{ env.AZURE_WEBAPP_PACKAGE_PATH }}/myapp' 
          
      # Deploy to Azure Web apps
      - name: 'Run Azure webapp deploy action using publish profile credentials'
        uses: azure/webapps-deploy@v3
        with: 
          app-name: ${{ env.AZURE_WEBAPP_NAME }} # Replace with your app name
          package: '${{ env.AZURE_WEBAPP_PACKAGE_PATH }}/myapp'
      
      - name: logout
        run: |
          az logout

Frequently Asked Questions

How do I deploy a WAR file through Maven plugin?

In case you configured your Java Tomcat project with the Maven plugin, you can also deploy to Azure App Service through this plugin. If you use the Azure CLI GitHub action, it makes use of your Azure credentials.

    - name: Azure CLI script file
      uses: azure/cli@v2
      with:
        inlineScript: |
          mvn package azure-webapp:deploy

For more information on the Maven plugin and how to use and configure it, see Maven plugin wiki for Azure App Service.

How do I deploy a WAR file through Az CLI?

If you use prefer the Azure CLI to deploy to App Service, you can use the GitHub Action for Azure CLI.

- name: Azure CLI script
  uses: azure/cli@v2
  with:
    inlineScript: |
      az webapp deploy --src-path '${{ github.workspace }}/target/yourpackage.war' --name ${{ env.AZURE_WEBAPP_NAME }} --resource-group ${{ env.RESOURCE_GROUP }}  --async true --type war

For more information on the GitHub Action for CLI and how to use and configure it, see Azure CLI GitHub action.

For more information on the az webapp deploy command, how to use it, and the parameter details, see az webapp deploy documentation.

How do I deploy a startup file?

Use the GitHub Action for CLI. For example:

- name: Deploy startup script
  uses: azure/cli@v2
  with:
    inlineScript: |
      az webapp deploy --src-path ${{ github.workspace }}/src/main/azure/createPasswordlessDataSource.sh --name ${{ env.AZURE_WEBAPP_NAME }} --resource-group ${{ env.RESOURCE_GROUP }} --type startup --track-status false

How do I deploy to a Container?

With the Azure Web Deploy action, you can automate your workflow to deploy custom containers to App Service using GitHub Actions. For more in information about the steps to deploy using GitHub Actions, see Deploy to a Container.

How do I update the Tomcat configuration after deployment?

In case you would like to update any of your web apps settings after deployment, you can use the App Service Settings action.

    - uses: azure/appservice-settings@v1
      with:
        app-name: 'my-app'
        slot-name: 'staging'  # Optional and needed only if the settings have to be configured on the specific deployment slot
        app-settings-json: '[{ "name": "CATALINA_OPTS", "value": "-Dfoo=bar" }]' 
        connection-strings-json: '${{ secrets.CONNECTION_STRINGS }}'
        general-settings-json: '{"alwaysOn": "false", "webSocketsEnabled": "true"}' #'General configuration settings as Key Value pairs'
      id: settings

For more information on this action and how to use and configure it, see the App Service Settings repository.

Related content

Check out references on Azure GitHub Actions and workflows: