Skip to content

Commit 688e1c4

Browse files
vhvb1989pamelafox
vhvb1989
and
pamelafox
authored
Add workflow for azd deployment on GitHub Actions and ADO (#1083)
* Configure Azure Developer Pipeline * Configure Azure Developer Pipeline * Configure Azure Developer Pipeline * Configure Azure Developer Pipeline * Configure Azure Developer Pipeline * Configure Azure Developer Pipeline * rev * rev * rev * r * Configure Azure Developer Pipeline * Configure Azure Developer Pipeline * Configure Azure Developer Pipeline * keep using interactive for CI * Configure Azure Developer Pipeline * update for daily azd * update versions * Update infra/main.parameters.json --------- Co-authored-by: Pamela Fox <[email protected]>
1 parent 88056e1 commit 688e1c4

File tree

5 files changed

+256
-11
lines changed

5 files changed

+256
-11
lines changed

‎.azdo/pipelines/azure-dev.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Run when commits are pushed to mainline branch (main or master)
2+
# Set this to the mainline branch you are using
3+
trigger:
4+
- main
5+
- master
6+
7+
# Azure Pipelines workflow to deploy to Azure using azd
8+
# To configure required secrets and service connection for connecting to Azure, simply run `azd pipeline config --provider azdo`
9+
# Task "Install azd" needs to install setup-azd extension for azdo - https://marketplace.visualstudio.com/items?itemName=ms-azuretools.azd
10+
# See below for alternative task to install azd if you can't install above task in your organization
11+
12+
pool:
13+
vmImage: ubuntu-latest
14+
15+
steps:
16+
- task: setup-azd@0
17+
displayName: Install azd
18+
19+
# If you can't install above task in your organization, you can comment it and uncomment below task to install azd
20+
# - task: Bash@3
21+
# displayName: Install azd
22+
# inputs:
23+
# targetType: 'inline'
24+
# script: |
25+
# curl -fsSL https://aka.ms/install-azd.sh | bash
26+
27+
# azd delegate auth to az to use service connection with AzureCLI@2
28+
- pwsh: |
29+
azd config set auth.useAzCliAuth "true"
30+
displayName: Configure AZD to Use AZ CLI Authentication.
31+
32+
- task: AzureCLI@2
33+
displayName: Provision Infrastructure
34+
inputs:
35+
# azconnection is the service connection created by azd. You can change it to any service connection you have in your organization.
36+
azureSubscription: azconnection
37+
scriptType: bash
38+
scriptLocation: inlineScript
39+
inlineScript: |
40+
azd provision --no-prompt
41+
env:
42+
AZURE_SUBSCRIPTION_ID: $(AZURE_SUBSCRIPTION_ID)
43+
AZURE_ENV_NAME: $(AZURE_ENV_NAME)
44+
AZURE_LOCATION: $(AZURE_LOCATION)
45+
AZD_INITIAL_ENVIRONMENT_CONFIG: $(AZD_INITIAL_ENVIRONMENT_CONFIG)
46+
AZURE_OPENAI_SERVICE: $(AZURE_OPENAI_SERVICE)
47+
AZURE_OPENAI_RESOURCE_GROUP: $(AZURE_OPENAI_RESOURCE_GROUP)
48+
AZURE_FORMRECOGNIZER_SERVICE: $(AZURE_FORMRECOGNIZER_SERVICE)
49+
AZURE_FORMRECOGNIZER_RESOURCE_GROUP: $(AZURE_FORMRECOGNIZER_RESOURCE_GROUP)
50+
AZURE_FORMRECOGNIZER_SKU: $(AZURE_FORMRECOGNIZER_SKU)
51+
AZURE_SEARCH_INDEX: $(AZURE_SEARCH_INDEX)
52+
AZURE_SEARCH_SERVICE: $(AZURE_SEARCH_SERVICE)
53+
AZURE_SEARCH_SERVICE_RESOURCE_GROUP: $(AZURE_SEARCH_SERVICE_RESOURCE_GROUP)
54+
AZURE_SEARCH_SERVICE_LOCATION: $(AZURE_SEARCH_SERVICE_LOCATION)
55+
AZURE_SEARCH_SERVICE_SKU: $(AZURE_SEARCH_SERVICE_SKU)
56+
AZURE_SEARCH_QUERY_LANGUAGE: $(AZURE_SEARCH_QUERY_LANGUAGE)
57+
AZURE_SEARCH_QUERY_SPELLER: $(AZURE_SEARCH_QUERY_SPELLER)
58+
AZURE_SEARCH_SEMANTIC_RANKER: $(AZURE_SEARCH_SEMANTIC_RANKER)
59+
AZURE_STORAGE_ACCOUNT: $(AZURE_STORAGE_ACCOUNT)
60+
AZURE_STORAGE_RESOURCE_GROUP: $(AZURE_STORAGE_RESOURCE_GROUP)
61+
AZURE_STORAGE_SKU: $(AZURE_STORAGE_SKU)
62+
AZURE_APP_SERVICE_SKU: $(AZURE_APP_SERVICE_SKU)
63+
AZURE_OPENAI_CHATGPT_DEPLOYMENT: $(AZURE_OPENAI_CHATGPT_DEPLOYMENT)
64+
AZURE_OPENAI_EMB_DEPLOYMENT: $(AZURE_OPENAI_EMB_DEPLOYMENT)
65+
OPENAI_HOST: $(OPENAI_HOST)
66+
OPENAI_API_KEY: $(OPENAI_API_KEY)
67+
OPENAI_ORGANIZATION: $(OPENAI_ORGANIZATION)
68+
AZURE_USE_APPLICATION_INSIGHTS: $(AZURE_USE_APPLICATION_INSIGHTS)
69+
USE_VECTORS: $(USE_VECTORS)
70+
USE_GPT4V: $(USE_GPT4V)
71+
AZURE_USE_AUTHENTICATION: $(AZURE_USE_AUTHENTICATION)
72+
AZURE_ENFORCE_ACCESS_CONTROL: $(AZURE_ENFORCE_ACCESS_CONTROL)
73+
AZURE_TENANT_ID: $(AZURE_TENANT_ID)
74+
AZURE_AUTH_TENANT_ID: $(AZURE_AUTH_TENANT_ID)
75+
AZURE_SERVER_APP_ID: $(AZURE_SERVER_APP_ID)
76+
AZURE_CLIENT_APP_ID: $(AZURE_CLIENT_APP_ID)
77+
ALLOWED_ORIGIN: $(ALLOWED_ORIGIN)
78+
AZURE_SERVER_APP_SECRET: $(AZURE_SERVER_APP_SECRET)
79+
AZURE_CLIENT_APP_SECRET: $(AZURE_CLIENT_APP_SECRET)
80+
81+
- task: AzureCLI@2
82+
displayName: Deploy Application
83+
inputs:
84+
azureSubscription: azconnection
85+
scriptType: bash
86+
scriptLocation: inlineScript
87+
inlineScript: |
88+
azd deploy --no-prompt

‎.github/workflows/azure-dev.yml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: Deploy
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
# Run when commits are pushed to mainline branch (main or master)
7+
# Set this to the mainline branch you are using
8+
branches:
9+
- main
10+
- master
11+
12+
# GitHub Actions workflow to deploy to Azure using azd
13+
# To configure required secrets for connecting to Azure, simply run `azd pipeline config`
14+
15+
# Set up permissions for deploying with secretless Azure federated credentials
16+
# https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-portal%2Clinux#set-up-azure-login-with-openid-connect-authentication
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
build:
23+
runs-on: ubuntu-latest
24+
env:
25+
# azd required
26+
AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
27+
AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
28+
AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
29+
AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}
30+
AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
31+
# project specific
32+
AZURE_OPENAI_SERVICE: ${{ vars.AZURE_OPENAI_SERVICE }}
33+
AZURE_OPENAI_RESOURCE_GROUP: ${{ vars.AZURE_OPENAI_RESOURCE_GROUP }}
34+
AZURE_FORMRECOGNIZER_SERVICE: ${{ vars.AZURE_FORMRECOGNIZER_SERVICE }}
35+
AZURE_FORMRECOGNIZER_RESOURCE_GROUP: ${{ vars.AZURE_FORMRECOGNIZER_RESOURCE_GROUP }}
36+
AZURE_FORMRECOGNIZER_SKU: ${{ vars.AZURE_FORMRECOGNIZER_SKU }}
37+
AZURE_SEARCH_INDEX: ${{ vars.AZURE_SEARCH_INDEX }}
38+
AZURE_SEARCH_SERVICE: ${{ vars.AZURE_SEARCH_SERVICE }}
39+
AZURE_SEARCH_SERVICE_RESOURCE_GROUP: ${{ vars.AZURE_SEARCH_SERVICE_RESOURCE_GROUP }}
40+
AZURE_SEARCH_SERVICE_LOCATION: ${{ vars.AZURE_SEARCH_SERVICE_LOCATION }}
41+
AZURE_SEARCH_SERVICE_SKU: ${{ vars.AZURE_SEARCH_SERVICE_SKU }}
42+
AZURE_SEARCH_QUERY_LANGUAGE: ${{ vars.AZURE_SEARCH_QUERY_LANGUAGE }}
43+
AZURE_SEARCH_QUERY_SPELLER: ${{ vars.AZURE_SEARCH_QUERY_SPELLER }}
44+
AZURE_SEARCH_SEMANTIC_RANKER: ${{ vars.AZURE_SEARCH_SEMANTIC_RANKER }}
45+
AZURE_STORAGE_ACCOUNT: ${{ vars.AZURE_STORAGE_ACCOUNT }}
46+
AZURE_STORAGE_RESOURCE_GROUP: ${{ vars.AZURE_STORAGE_RESOURCE_GROUP }}
47+
AZURE_STORAGE_SKU: ${{ vars.AZURE_STORAGE_SKU }}
48+
AZURE_APP_SERVICE_SKU: ${{ vars.AZURE_APP_SERVICE_SKU }}
49+
AZURE_OPENAI_CHATGPT_DEPLOYMENT: ${{ vars.AZURE_OPENAI_CHATGPT_DEPLOYMENT }}
50+
AZURE_OPENAI_EMB_DEPLOYMENT: ${{ vars.AZURE_OPENAI_EMB_DEPLOYMENT }}
51+
OPENAI_HOST: ${{ vars.OPENAI_HOST }}
52+
OPENAI_API_KEY: ${{ vars.OPENAI_API_KEY }}
53+
OPENAI_ORGANIZATION: ${{ vars.OPENAI_ORGANIZATION }}
54+
AZURE_USE_APPLICATION_INSIGHTS: ${{ vars.AZURE_USE_APPLICATION_INSIGHTS }}
55+
USE_VECTORS: ${{ vars.USE_VECTORS }}
56+
USE_GPT4V: ${{ vars.USE_GPT4V }}
57+
AZURE_USE_AUTHENTICATION: ${{ vars.AZURE_USE_AUTHENTICATION }}
58+
AZURE_ENFORCE_ACCESS_CONTROL: ${{ vars.AZURE_ENFORCE_ACCESS_CONTROL }}
59+
AZURE_AUTH_TENANT_ID: ${{ vars.AZURE_AUTH_TENANT_ID }}
60+
AZURE_SERVER_APP_ID: ${{ vars.AZURE_SERVER_APP_ID }}
61+
AZURE_CLIENT_APP_ID: ${{ vars.AZURE_CLIENT_APP_ID }}
62+
ALLOWED_ORIGIN: ${{ vars.ALLOWED_ORIGIN }}
63+
64+
steps:
65+
- name: Checkout
66+
uses: actions/checkout@v4
67+
68+
- name: Install azd
69+
uses: Azure/[email protected]
70+
71+
- name: Install Nodejs
72+
uses: actions/setup-node@v3
73+
with:
74+
node-version: 20
75+
76+
- name: Log in with Azure (Federated Credentials)
77+
if: ${{ env.AZURE_CLIENT_ID != '' }}
78+
run: |
79+
azd auth login `
80+
--client-id "$Env:AZURE_CLIENT_ID" `
81+
--federated-credential-provider "github" `
82+
--tenant-id "$Env:AZURE_TENANT_ID"
83+
shell: pwsh
84+
85+
- name: Log in with Azure (Client Credentials)
86+
if: ${{ env.AZURE_CREDENTIALS != '' }}
87+
run: |
88+
$info = $Env:AZURE_CREDENTIALS | ConvertFrom-Json -AsHashtable;
89+
Write-Host "::add-mask::$($info.clientSecret)"
90+
91+
azd auth login `
92+
--client-id "$($info.clientId)" `
93+
--client-secret "$($info.clientSecret)" `
94+
--tenant-id "$($info.tenantId)"
95+
shell: pwsh
96+
env:
97+
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
98+
99+
- name: Provision Infrastructure
100+
run: azd provision --no-prompt
101+
env:
102+
AZD_INITIAL_ENVIRONMENT_CONFIG: ${{ secrets.AZD_INITIAL_ENVIRONMENT_CONFIG }}
103+
AZURE_SERVER_APP_SECRET: ${{ secrets.AZURE_SERVER_APP_SECRET }}
104+
AZURE_CLIENT_APP_SECRET: ${{ secrets.AZURE_CLIENT_APP_SECRET }}
105+
106+
- name: Deploy Application
107+
run: azd deploy --no-prompt

‎azure.yaml‎

Lines changed: 38 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,49 @@ services:
1313
windows:
1414
shell: pwsh
1515
run: cd ../frontend;npm install;npm run build
16-
interactive: true
16+
interactive: false
1717
continueOnError: false
1818
posix:
1919
shell: sh
2020
run: cd ../frontend;npm install;npm run build
21-
interactive: true
21+
interactive: false
2222
continueOnError: false
23+
pipeline:
24+
variables:
25+
- AZURE_OPENAI_SERVICE
26+
- AZURE_OPENAI_RESOURCE_GROUP
27+
- AZURE_FORMRECOGNIZER_SERVICE
28+
- AZURE_FORMRECOGNIZER_RESOURCE_GROUP
29+
- AZURE_FORMRECOGNIZER_SKU
30+
- AZURE_SEARCH_INDEX
31+
- AZURE_SEARCH_SERVICE
32+
- AZURE_SEARCH_SERVICE_RESOURCE_GROUP
33+
- AZURE_SEARCH_SERVICE_LOCATION
34+
- AZURE_SEARCH_SERVICE_SKU
35+
- AZURE_SEARCH_QUERY_LANGUAGE
36+
- AZURE_SEARCH_QUERY_SPELLER
37+
- AZURE_SEARCH_SEMANTIC_RANKER
38+
- AZURE_STORAGE_ACCOUNT
39+
- AZURE_STORAGE_RESOURCE_GROUP
40+
- AZURE_STORAGE_SKU
41+
- AZURE_APP_SERVICE_SKU
42+
- AZURE_OPENAI_CHATGPT_DEPLOYMENT
43+
- AZURE_OPENAI_EMB_DEPLOYMENT
44+
- OPENAI_HOST
45+
- OPENAI_API_KEY
46+
- OPENAI_ORGANIZATION
47+
- AZURE_USE_APPLICATION_INSIGHTS
48+
- USE_VECTORS
49+
- USE_GPT4V
50+
- AZURE_USE_AUTHENTICATION
51+
- AZURE_ENFORCE_ACCESS_CONTROL
52+
- AZURE_AUTH_TENANT_ID
53+
- AZURE_SERVER_APP_ID
54+
- AZURE_CLIENT_APP_ID
55+
- ALLOWED_ORIGIN
56+
secrets:
57+
- AZURE_SERVER_APP_SECRET
58+
- AZURE_CLIENT_APP_SECRET
2359
hooks:
2460
preprovision:
2561
windows:

‎infra/main.bicep‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,12 @@ var useKeyVault = useGPT4V || useSearchServiceKey
122122
var tenantIdForAuth = !empty(authTenantId) ? authTenantId : tenantId
123123
var authenticationIssuerUri = '${environment().authentication.loginEndpoint}${tenantIdForAuth}/v2.0'
124124

125+
@description('Whether the deployment is running on GitHub Actions')
126+
param runningOnGh string = ''
127+
128+
@description('Whether the deployment is running on Azure DevOps Pipeline')
129+
param runningOnAdo string = ''
130+
125131
// Organize resources in a resource group
126132
resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
127133
name: !empty(resourceGroupName) ? resourceGroupName : '${abbrs.resourcesResourceGroups}${environmentName}'
@@ -424,13 +430,15 @@ module storage 'core/storage/storage-account.bicep' = {
424430
}
425431

426432
// USER ROLES
433+
var principalType = empty(runningOnGh) && empty(runningOnAdo) ? 'User': 'ServicePrincipal'
434+
427435
module openAiRoleUser 'core/security/role.bicep' = if (openAiHost == 'azure') {
428436
scope: openAiResourceGroup
429437
name: 'openai-role-user'
430438
params: {
431439
principalId: principalId
432440
roleDefinitionId: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'
433-
principalType: 'User'
441+
principalType: principalType
434442
}
435443
}
436444

@@ -440,7 +448,7 @@ module formRecognizerRoleUser 'core/security/role.bicep' = {
440448
params: {
441449
principalId: principalId
442450
roleDefinitionId: 'a97b65f3-24c7-4388-baec-2e87135dc908'
443-
principalType: 'User'
451+
principalType: principalType
444452
}
445453
}
446454

@@ -450,7 +458,7 @@ module storageRoleUser 'core/security/role.bicep' = {
450458
params: {
451459
principalId: principalId
452460
roleDefinitionId: '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1'
453-
principalType: 'User'
461+
principalType: principalType
454462
}
455463
}
456464

@@ -460,7 +468,7 @@ module storageContribRoleUser 'core/security/role.bicep' = {
460468
params: {
461469
principalId: principalId
462470
roleDefinitionId: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
463-
principalType: 'User'
471+
principalType: principalType
464472
}
465473
}
466474

@@ -471,7 +479,7 @@ module searchRoleUser 'core/security/role.bicep' = if (!useSearchServiceKey) {
471479
params: {
472480
principalId: principalId
473481
roleDefinitionId: '1407120a-92aa-4202-b7e9-c0e197c71c8f'
474-
principalType: 'User'
482+
principalType: principalType
475483
}
476484
}
477485

@@ -481,7 +489,7 @@ module searchContribRoleUser 'core/security/role.bicep' = if (!useSearchServiceK
481489
params: {
482490
principalId: principalId
483491
roleDefinitionId: '8ebe5a00-799e-43f5-93ac-243d3dce84a7'
484-
principalType: 'User'
492+
principalType: principalType
485493
}
486494
}
487495

@@ -491,7 +499,7 @@ module searchSvcContribRoleUser 'core/security/role.bicep' = if (!useSearchServi
491499
params: {
492500
principalId: principalId
493501
roleDefinitionId: '7ca78c08-252a-4471-8644-bb5ff32d4ba0'
494-
principalType: 'User'
502+
principalType: principalType
495503
}
496504
}
497505

‎infra/main.parameters.json‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@
7474
"embeddingDeploymentName": {
7575
"value": "${AZURE_OPENAI_EMB_DEPLOYMENT=embedding}"
7676
},
77-
"openAiHost":{
77+
"openAiHost": {
7878
"value": "${OPENAI_HOST=azure}"
7979
},
8080
"openAiApiKey": {
@@ -119,8 +119,14 @@
119119
"allowedOrigin": {
120120
"value": "${ALLOWED_ORIGIN}"
121121
},
122-
"useIntegratedVectorization" :{
122+
"useIntegratedVectorization": {
123123
"value": "${USE_FEATURE_INT_VECTORIZATION}"
124+
},
125+
"runningOnGh": {
126+
"value": "${GITHUB_ACTIONS}"
127+
},
128+
"runningOnAdo": {
129+
"value": "${TF_BUILD}"
124130
}
125131
}
126132
}

0 commit comments

Comments
 (0)