Quickstart: Deploy Bicep files by using GitHub Actions

GitHub Actions is a suite of features in GitHub to automate your software development workflows. In this quickstart, you use the GitHub Actions for Azure Resource Manager deployment to automate deploying a Bicep file to Azure.

It provides a short introduction to GitHub actions and Bicep files. If you want more detailed steps on setting up the GitHub actions and project, see Deploy Azure resources by using Bicep and GitHub Actions.

Prerequisites

• An Azure account with an active subscription. Create an account for free.
• A GitHub account. If you don't have one, sign up for free.
• A GitHub repository to store your Bicep files and your workflow files. To create one, see Creating a new repository.

Create resource group

Create a resource group. Later in this quickstart, you deploy your Bicep file to this resource group.

CLI

az group create -n exampleRG -l westus

PowerShell

New-AzResourceGroup -Name exampleRG -Location westus

Generate deployment credentials

OpenID Connect

To use Azure Login action with OIDC, you need to configure a federated identity credential on a Microsoft Entra application or a user-assigned managed identity.

Option 1: Microsoft Entra application

• Create a Microsoft Entra application with a service principal by Azure portal, Azure CLI, or Azure PowerShell.
• Copy the values for Client ID, Subscription ID, and Directory (tenant) ID to use later in your GitHub Actions workflow.
• Assign an appropriate role to your service principal by Azure portal, Azure CLI, or Azure PowerShell.
• Configure a federated identity credential on a Microsoft Entra application to trust tokens issued by GitHub Actions to your GitHub repository.

Option 2: User-assigned managed identity

• Create a user-assigned managed identity.
• Copy the values for Client ID, Subscription ID, and Directory (tenant) ID to use later in your GitHub Actions workflow.
• Assign an appropriate role to your user-assigned managed identity.
• Configure a federated identity credential on a user-assigned managed identity to trust tokens issued by GitHub Actions to your GitHub repository.

Service principal

• Create a Microsoft Entra application with a service principal by Azure portal, Azure CLI, or Azure PowerShell.
• Create a client secret for your service principal by Azure portal, Azure CLI, or Azure PowerShell.
• Copy the values for Client ID, Client Secret, Subscription ID, and Directory (tenant) ID to use later in your GitHub Actions workflow.
• Assign an appropriate role to your service principal by Azure portal, Azure CLI, or Azure PowerShell.

Configure the GitHub secrets

OpenID Connect

You need to provide your application's Client ID, Directory (tenant) ID, and Subscription ID to the login action. These values can either be provided directly in the workflow or can be stored in GitHub secrets and referenced in your workflow. Saving the values as GitHub secrets is the more secure option.

1. In GitHub, go to your repository.

2. Select Security > Secrets and variables > Actions.

   

3. Select New repository secret.

   Note

   To enhance workflow security in public repositories, use environment secrets instead of repository secrets. If the environment requires approval, a job cannot access environment secrets until one of the required reviewers approves it.

4. Create secrets for AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_SUBSCRIPTION_ID. Copy these values from your Microsoft Entra application or user-assigned managed identity for your GitHub secrets:

   GitHub secret	Microsoft Entra application or user-assigned managed identity
   AZURE_CLIENT_ID	Client ID
   AZURE_SUBSCRIPTION_ID	Subscription ID
   AZURE_TENANT_ID	Directory (tenant) ID

   Note

   For security reasons, we recommend using GitHub Secrets rather than passing values directly to the workflow.

Service principal

1. In GitHub, go to your repository.

2. Go to Settings in the navigation menu.

3. Select Security > Secrets and variables > Actions.

   

4. Select New repository secret.

5. Paste the entire JSON output from the Azure CLI command into the secret's value field. Give the secret the name AZURE_CREDENTIALS.

6. Select Add secret.

Add a Bicep file

Add a Bicep file to your GitHub repository. The following Bicep file creates a storage account:

@minLength(3)
@maxLength(11)
param storagePrefix string

@allowed([
  'Standard_LRS'
  'Standard_GRS'
  'Standard_RAGRS'
  'Standard_ZRS'
  'Premium_LRS'
  'Premium_ZRS'
  'Standard_GZRS'
  'Standard_RAGZRS'
])
param storageSKU string = 'Standard_LRS'

param location string = resourceGroup().location

var uniqueStorageName = '${storagePrefix}${uniqueString(resourceGroup().id)}'

resource stg 'Microsoft.Storage/storageAccounts@2023-04-01' = {
  name: uniqueStorageName
  location: location
  sku: {
    name: storageSKU
  }
  kind: 'StorageV2'
  properties: {
    supportsHttpsTrafficOnly: true
  }
}

output storageEndpoint object = stg.properties.primaryEndpoints

The Bicep file requires one parameter called storagePrefix with 3 to 11 characters.

You can put the file anywhere in the repository. The workflow sample in the next section assumes the Bicep file is named main.bicep, and it's stored at the root of your repository.

Create workflow

A workflow defines the steps to execute when triggered. It's a YAML (.yml) file in the .github/workflows/ path of your repository. The workflow file extension can be either .yml or .yaml.

To create a workflow, take the following steps:

1. From your GitHub repository, select Actions from the top menu.

2. Select New workflow.

3. Select set up a workflow yourself.

4. Rename the workflow file if you prefer a different name other than main.yml. For example: deployBicepFile.yml.

5. Replace the content of the yml file with the following code:

   OpenID Connect

   on: [push]
   name: Azure ARM
   permissions:
     id-token: write
     contents: read
   jobs:
     build-and-deploy:
       runs-on: ubuntu-latest
       steps:
   
         # Checkout code
       - uses: actions/checkout@main
   
         # Log into Azure
       - uses: azure/login@v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
   
         # Deploy Bicep file
       - name: deploy
         uses: azure/arm-deploy@v1
         with:
           subscriptionId: ${{ secrets.AZURE_SUBSCRIPTION }}
           resourceGroupName: ${{ secrets.AZURE_RG }}
           template: ./main.bicep
           parameters: 'storagePrefix=mystore storageSKU=Standard_LRS'
           failOnStdErr: false
   

   Service principal

   name: Deploy Bicep file
   on: [push]
   jobs:
     build-and-deploy:
       runs-on: ubuntu-latest
       steps:
   
       - name: Checkout code
         uses: actions/checkout@main
   
       - name: Log into Azure
         uses: azure/login@v2
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
   
       - name: Deploy Bicep file
         uses: azure/arm-deploy@v1
         with:
           subscriptionId: ${{ secrets.AZURE_SUBSCRIPTION }}
           resourceGroupName: ${{ secrets.AZURE_RG }}
           template: ./main.bicep
           parameters: 'storagePrefix=mystore storageSKU=Standard_LRS'
           failOnStdErr: false
   

   Replace mystore with your own storage account name prefix.

   Note

   You can specify a JSON format parameters file instead in the ARM Deploy action (example: .azuredeploy.parameters.json).

   The first section of the workflow file includes:

   • name: The name of the workflow.
   • on: The name of the GitHub events that triggers the workflow. The workflow is triggered when there's a push event on the main branch.

6. Select Commit changes.

7. Select Commit directly to the main branch.

8. Select Commit new file (or Commit changes).

Updating either the workflow file or Bicep file triggers the workflow. The workflow starts right after you commit the changes.

Check workflow status

1. Select the Actions tab. You see a Create deployBicepFile.yml workflow listed. It takes 1-2 minutes to run the workflow.
2. Select the workflow to open it, and verify the Status is Success.

Clean up resources

When your resource group and repository are no longer needed, clean up the resources you deployed by deleting the resource group and your GitHub repository.

CLI

az group delete --name exampleRG

PowerShell

Remove-AzResourceGroup -Name exampleRG

Next steps

Bicep file structure and syntax