You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You can use a [GitHub Actions workflow](https://docs.github.com/actions/learn-github-actions/introduction-to-github-actions#the-components-of-github-actions) to automatically build and deploy your function code to Azure. This article supports these GitHub Actions-based deployment methods:
12
+
You can use a [GitHub Actions workflow](https://docs.github.com/actions/learn-github-actions/introduction-to-github-actions#the-components-of-github-actions) to define a workflow to automatically build and deploy code to your function app in Azure Functions.
13
13
14
-
| Method | Action | Tasks |
15
-
| ---- | ---- | ---- |
16
-
| Code-only |`Azure/functions-action`| 1. Set up the environment.<br/>2. Build the code project.<br/>3. Deploy the package to a function app in Azure. |
17
-
| Container |`Azure/functions-container-action`| 1. Set up the environment.<br/>2. Build the Docker container.<br/>3. Push the image to the container registry.<br/>4. Deploy the container to Azure. |
14
+
A YAML file (.yml) that defines the workflow configuration is maintained in the `/.github/workflows/` path in your repository. This definition contains the actions and parameters that make up the workflow, which is specific to the development language of your functions. A GitHub Actions workflow for Functions performs the following tasks, regardless of language:
18
15
19
-
A YAML file (.yml) that defines the workflow configuration is maintained in the `/.github/workflows/` path in your repository. This definition contains the actions and parameters that make up the workflow, which is specific to the development language of your functions.
16
+
1. Set up the environment.
17
+
1. Build the code project.
18
+
1. Deploy the package to a function app in Azure.
19
+
20
+
The Azure Functions action handles the deployment to an existing function app in Azure.
20
21
21
22
You can create a workflow configuration file for your deployment manually. You can also generate the file from a set of language-specific templates in one of these ways:
22
23
@@ -32,74 +33,24 @@ If you don't want to create your YAML file by hand, select a different method at
32
33
33
34
+ A GitHub account. If you don't have one, sign up for [free](https://github.com/join).
34
35
35
-
+ Project source code in a GitHub repository.
36
-
37
-
+ One of these deployment targets:
38
-
39
-
+ A working function app hosted on Azure. This function app must have [basic authentication enabled on the `scm` endpoint](./functions-continuous-deployment.md#enable-basic-authentication-for-deployments).
40
-
41
-
+ An existing container registry, such as [Azure Container Registry](../container-registry/container-registry-get-started-azure-cli.md), a private container registry hosted in Azure. Examples in this article feature Azure Container Registry.
42
-
::: zone pivot="method-cli,method-manual,method-template"
36
+
+ A working function app hosted on Azure with source code in a GitHub repository.
37
+
:::zone pivot="method-cli"
43
38
+[Azure CLI](/cli/azure/install-azure-cli), when developing locally. You can also use the Azure CLI in Azure Cloud Shell.
Since GitHub Actions requires credentials to be able to access Azure resources, you first need to get the credentials you need from Azure and store them securely in your repository as [GitHub secrets](https://docs.github.com/en/actions/reference/encrypted-secrets).
42
+
## Generate deployment credentials
50
43
51
-
There are several supported authentication credentials you can use when deploying your code to Azure using GitHub Actions. This article supports these credentials:
52
-
53
-
| Credential | Set in... | Deployment type | Usage |
54
-
| ---- | ---- | --- | --- |
55
-
| Publish profile |[`Azure/functions-action`](https://github.com/marketplace/actions/azure-functions-action)| Code-only | Use the basic authentication credentials in the publish profile to connect to the `scm` deployment endpoint. |
56
-
| Service principal secret |[`Azure/login`](https://github.com/Azure/login)| Code-only<br/>Containers | Using the [credentials of an Azure service principal](https://github.com/marketplace/actions/azure-login?version=v1.6.1#login-with-a-service-principal-secret) to perform identity-based authentication during deployment. |
57
-
| Docker credentials |[`docker/login-action`](https://github.com/marketplace/actions/docker-login)| Container | When accessing a private Docker container registry. For an Azure Container Registry, you can also use an Azure service principal secret. |
58
-
59
-
You must securely store the required credentials in GitHub secrets for use by GitHub Actions during deployment.
60
-
61
-
## Get the service access credentals
44
+
Since GitHub Actions uses your publish profile to access your function app during deployment, you first need to get your publish profile and store it securely as a [GitHub secret](https://docs.github.com/en/actions/reference/encrypted-secrets).
62
45
63
46
>[!IMPORTANT]
64
-
>In this section you are working with valuable credentials that allow access to Azure resources. Make sure you always transport and store credentials securely. In GitHub, these credentials **must** only be stored as GitHub secrets.
47
+
>The publish profile is a valuable credential that allows access to Azure resources. Make sure you always transport and store it securely. In GitHub, the publish profile must only be stored in GitHub secrets.
65
48
66
-
### [Publish profile](#tab/publish-profile)
67
-
68
-
Publish profile is an XML-formated object that contains basic authentication credentials used to access the `scm` deployment endpoint. These credentials are used by tools like Visual Studio and Azure Functions Core Tools to deploy code to your function app. Publish profiles require you to [enable basic authentication](./functions-continuous-deployment.md#enable-basic-authentication-for-deployments) on the `scm` management endoint.
### [Service principal secret](#tab/service-principal)
73
-
74
-
You can use the identity of a service principal in Azure when connecting to your app's `scm` deployment endpoint. This is also the recommended way to connect to an Azure Container Registry from your GitHub account. You use Azure role-based access control (Azure RBAC) to limit access only to the Azure resources required for publishing.
75
-
76
-
1. Use this [az ad sp create-for-rbac](/cli/azure/ad/sp#az-ad-sp-create-for-rbac) command to create a service principal and get its credential:
77
-
78
-
```azurecli
79
-
az ad sp create-for-rbac --name "<APP_NAME>_deployment" --role contributor --scopes /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Web/sites/<APP_NAME> --sdk-auth
80
-
```
81
-
82
-
Replace `<SUBSCRIPTION_ID>`, `<RESOURCE_GROUP>`, and `<APP_NAME>` with the names of your subscription, resource group, and function app.
83
-
84
-
The output from this command is a JSON object that is the credential that GitHub Actions uses to connect to your app.You need to securely retain this output until you can add as a GitHub secret.
85
-
86
-
1. (Optional) To deploy a containerized function app from Azure Container Registry, use this [az role assignment create](/cli/azure/role/assignment#az-role-assignment-create) command to add the `acrpull` role to the new service principal:
87
-
88
-
```azurecli
89
-
az role assignment create --assignee <SERVICE_PRINCIPAL_ID> --scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.ContainerRegistry/registries/<REGISTRY_NAME> --role acrpull
90
-
```
91
-
92
-
Replace `<SUBSCRIPTION_ID>`, `<RESOURCE_GROUP>`, and `<REGISTRY_NAME>` with the names of your subscription, resource group, and registry.Replace `<SERVICE_PRINCIPAL_ID>` with the `clientID` from the credentials you obtained in the previous step. The role you added is scoped to your specific Azure Container Registry instance.
93
-
94
-
### [Docker credentials](#tab/docker-credentials)
95
-
96
-
You need to use registry-specific credentials when deploying a container from a private container registry. The way that you obtain this credential depends on the container registry. For more information, see [Docker Login Action](https://github.com/marketplace/actions/docker-login#usage).
97
-
98
-
For Azure Container Registry (ACR), you can instead use the same service principal credentials you use to deploy to Azure.
99
-
100
-
---
101
-
102
-
## Add credentials to GitHub secrets
53
+
### Add the GitHub secret
103
54
104
55
1. In [GitHub](https://github.com/), go to your repository.
105
56
@@ -109,30 +60,11 @@ For Azure Container Registry (ACR), you can instead use the same service princip
109
60
110
61
1. Select **New repository secret**.
111
62
112
-
1. Define the secret, which depends on your chosen credential:
113
-
114
-
### [Publish profile](#tab/publish-profile)
115
-
116
-
+ **Name**: `AZURE_FUNCTIONAPP_PUBLISH_PROFILE`
117
-
+ **Secret**: Paste the entire XML contents of the publish profile.
118
-
119
-
### [Service principal secret](#tab/service-principal)
120
-
121
-
+ **Name**: `AZURE_CREDENTIALS`
122
-
+ **Secret**: Paste the entire JSON output you obtained when you created your service principal.
123
-
124
-
### [Docker credentials](#tab/docker-credentials)
125
-
126
-
+ **Name**: `REGISTRY_USERNAME`
127
-
+ **Secret**: The username of your account in the private Docker registry.
128
-
+ **Name**: `REGISTRY_PASSWORD`
129
-
+ **Secret**: The password for your account in the private Docker registry.
130
-
131
-
---
63
+
1. Add a new secret with the name `AZURE_FUNCTIONAPP_PUBLISH_PROFILE` and the value set to the contents of the publishing profile file.
132
64
133
65
1. Select **Add secret**.
134
66
135
-
GitHub can now authenticate with your Azure resources during deployment.
67
+
GitHub can now authenticate to your function app in Azure.
136
68
::: zone-end
137
69
::: zone pivot="method-manual"
138
70
@@ -142,97 +74,61 @@ The best way to manually create a workflow configuration is to start from the of
142
74
143
75
1. Choose either **Windows** or **Linux** to make sure that you get the template for the correct operating system.
144
76
145
-
### [Windows](#tab/windows)
77
+
# [Windows](#tab/windows)
146
78
147
-
Deployments to Windows use `runs-on: windows-latest`. Containerized deployments require Linux.
79
+
Deployments to Windows use `runs-on: windows-latest`.
148
80
149
-
### [Linux](#tab/linux)
81
+
# [Linux](#tab/linux)
150
82
151
-
Deployments to Linux use `runs-on: ubuntu-latest`. Use Linux for containerized deployments.
83
+
Deployments to Linux use `runs-on: ubuntu-latest`.
152
84
153
85
---
154
86
155
87
1. Copy the language-specific template from the Azure Functions actions repository using the following link:
Remember to do the following before you use this YAML file:
206
-
207
-
+ Update the values of `REGISTRY`, `NAMESPACE`, `IMAGE`, and `TAG` based on your container registry.
208
-
+ Update the container respository credentials in the `docker/login-action` action. To use service principal credentials with Azure Container Registry, add an environment variable for the credentials object to your file:
209
-
210
-
```yml
211
-
- env:
212
-
creds: ${{ secrets.AZURE_CREDENTIALS }}
213
-
```
214
-
215
-
Then replace the existing `azure/docker-Login` action with this `docker/login-action`:
216
-
217
-
```yml
218
-
- name: Login to ACR
219
-
uses: docker/login-action@v3
220
-
with:
221
-
registry: <registry-name>.azurecr.io
222
-
username: ${{ fromJson(creds.clientId) }}
223
-
password: ${{ fromJson(creds.clientSecret) }}
224
-
```
225
129
---
226
130
227
131
1. Update the `env.AZURE_FUNCTIONAPP_NAME` parameter with the name of your function app resource in Azure. You may optionally need to update the parameter that sets the language version used by your app, such as `DOTNET_VERSION` for C#.
228
-
229
-
1. To connect to your app using service principal credentials instead of a publish profile, remove `publish-profile` from the `azure/functions-action` and add this `azure/login` action before `azure/functions-action`:
230
-
231
-
```yml
232
-
- name: 'Login w/ service principal'
233
-
uses: azure/login@v2
234
-
with:
235
-
creds: ${{ secrets.AZURE_CREDENTIALS }}
236
132
237
133
1. Add this new YAML file in the `/.github/workflows/` path in your repository.
238
134
@@ -316,14 +212,6 @@ You can create the GitHub Actions workflow configuration file from the Azure Fun
316
212
317
213
1. In the newly created YAML file, update the `env.AZURE_FUNCTIONAPP_NAME` parameter with the name of your function app resource in Azure. You may optionally need to update the parameter that sets the language version used by your app, such as `DOTNET_VERSION` for C#.
318
214
319
-
1. To use service principal credentials instead of a publish profile, remove `publish-profile` from the `azure/functions-action` and add this `azure/login` action before `azure/functions-action`:
320
-
321
-
```yml
322
-
- name: 'Login w/ service principal'
323
-
uses: azure/login@v2
324
-
with:
325
-
creds: ${{ secrets.AZURE_CREDENTIALS }}
326
-
327
215
1. Verify that the new workflow file is being saved in `/.github/workflows/` and select **Commit changes...**.
328
216
::: zone-end
329
217
@@ -335,69 +223,61 @@ If for some reason, you need to update or change an existing workflow configurat
335
223
336
224
The following template example uses version 1 of the `functions-action` and a `publish profile` for authentication. The template depends on your chosen language and the operating system on which your function app is deployed:
337
225
338
-
### [Windows](#tab/windows)
226
+
# [Windows](#tab/windows)
339
227
340
228
If your function app runs on Linux, select **Linux**.
341
229
342
-
### [Linux](#tab/linux)
230
+
# [Linux](#tab/linux)
343
231
344
232
If your function app runs on Windows, select **Windows**.
The Azure Functions action (`Azure/functions-action`) defines how your code is published to an existing function app in Azure, or to a specific slot in your app.
280
+
The Azure Functions action (`Azure/azure-functions`) defines how your code is published to an existing function app in Azure, or to a specific slot in your app.
401
281
402
282
### Parameters
403
283
@@ -407,7 +287,7 @@ The following parameters are most commonly used with this action:
407
287
|---------|---------|
408
288
|_**app-name**_ | (Mandatory) The name of your function app. |
409
289
|_**slot-name**_ | (Optional) The name of a specific [deployment slot](functions-deployment-slots.md) you want to deploy to. The slot must already exist in your function app. When not specified, the code is deployed to the active slot. |
410
-
|_**publish-profile**_ | (Optional) The name of the GitHub secret that contains your publish profile. Don't include this if you are instead using service principal credentials with `azure/login`.|
290
+
|_**publish-profile**_ | (Optional) The name of the GitHub secret that contains your publish profile. |
411
291
412
292
The following parameters are also supported, but are used only in specific cases:
0 commit comments