Impossible to have CI/CD with GitHub Actions on Azure Web App which has Private Endpoint

Question

Hi,

I have created a GitHub Action pipeline for CI/CD for my Azure AppService which was working fine until I didn't add the Private Endpoint. Once I integrate the App Service with the VNet and added a Private Endpoint to it, my deploy job on GitHub action failed. I was using the publish profile of the web app to deploy to it but since it became private the publish url was not valid. I followed the documentation and in my private DNS zone I have these two records. mywebapp.privatelink.azurewebsites.net and mywebapp.scm.privatelink.azurewebsites.net, now since I have the the Private Endpoint I understand that the Application is only accessible from inside the VNet.

My question is, is there a way I can use my GitHub CI/CD pipeline while still having Private Endpoint for the App Service.
Is there any way I can only make public the scm?
Is there a way I can do CI/CD?

Thanks

Answer 1

hi there, are you using the publish profile to deploy the container? You can check by looking at the action YAML. If it has the "publish-profile" property, then you are using a publish profile to authenticate and deploy the container.

- name: 'Run Azure webapp deploy action using publish profile credentials'
      uses: azure/webapps-deploy@v2
      with:
        app-name: node-rn
        publish-profile: ${{ secrets.azureWebAppPublishProfile }}

The publish profile won't work with private endpoints because it tries to authenticate to the SCM site on the webapp. When you have Private Endpoints, that URL is no longer accessible to the public internet.

You can instead use a Service Principal to authenticate and deploy your container. When using Service Principal, the request will go through ARM and update the container name and tag on the web app, instead of going through the SCM site. Here is an example of a workflow using a Service Principal to deploy a container to App Service: https://github.com/azure/webapps-deploy#sample-workflow-to-build-and-deploy-a-nodejs-app-to-containerized-webapp-using-azure-service-principal. Here are instructions on how to create the SP: https://github.com/Azure/login#configure-deployment-credentials

Answer 2

As of January 2025, here's the solution https://systemshogun.com/p/github-actions-and-private-endpoints