Use GitHub and Azure DevOps Environments when running azd pipeline config

[CMeeg]

I like that the azd pipeline config command automates setting up service principals and service connections, but I think there is room for improvement in how it handles environments and environment variables.

When I used the command to configure GitHub Actions some environment variables were created in my repository, but this made me think about what would happen if I wanted my pipeline to support CI/CD for multiple target environments, e.g. a uat and a prod environment, and those environments required different values for some or all of those environment variables, or other environment variables required by my apps/services. I think this would be a fairly common scenario, and I wanted to support it directly in the azd template I have been developing.

GitHub has a concept of Environments that can be used to support this type of requirement.

Azure DevOps (AZDO) has Environments and Variable groups that can be used similarly.

Another benefit of using Environments in GitHub and AZDO is governance through "Deployment protection rules" and "Approvals & checks" (respectively).

I have made use of the above mentioned features of GitHub Actions and AZDO in my template, but it requires additional setup steps to be documented and followed to get it working. I could (and maybe will) write my own custom scripts to automate some or all of this setup, but it would be fantastic if azd pipeline config leveraged these platform features and I think it would work really well alongside the concept of environments already available in azd.

In summary, this is what I would like azd pipeline config to do (either by default or as an option):

• GitHub Actions
  • Create an Environment in the GitHub repo - this could use the name from the "current" azd environment
  • Create a Service Principal in Azure and link the GitHub Actions deploying Azure resources credentials to the GitHub Environment
  • Assign permissions to the Service principal so it can manage resources
  • Add Environment variables to the Environment in GitHub (e.g. AZURE_ENV_NAME, AZURE_SUBSCRIPTION_ID, AZURE_CLIENT_ID etc)
• AZDO
  • If it does not already exist
    • Create the Pipeline in AZDO
    • Create a Service connection in AZDO for the Pipeline, and assign permissions to the Service Principal so it can manage resources
  • Create an Environment in AZDO - this could use the name from the "current" azd environment
  • Create a Variable group in AZDO - this could use the name from the "current" azd environment
  • Add Variables to the Variable group in AZDO (e.g. AZURE_ENV_NAME, AZURE_SUBSCRIPTION_ID)

The GitHub Actions workflow and AZDO Pipelines yaml files provided in the azd template can then include some conditional logic to select the appropriate Environment (and load the associated variables) during a pipeline run, for example, based on source branch e.g. source branch = main - select the prod Environment and variables, source branch = develop - select the build Environment and variables etc.

If you then wanted to support a new Environment through CI/CD you could:

• Add and switch to the new environment using azd env
• Run azd pipeline config to create the Environment and variables etc in GitHub/AZDO
  • You may need to add additional environment variables needed by your apps/services to the Environment in GitHub/AZDO manually though maybe remote environments could be leveraged to automate some/all of this too
• Modify your pipeline yaml to select the appropriate Environment based on some criteria
• Push your yaml file change and let the pipeline azd up into your new environment

[wbreza]

@CMeeg We have an active issue tracking this very topic. Github & AzDO environments make a perfect fit here
You can follow the conversation on #2373