|
| 1 | +--- |
| 2 | +title: Register APIs using GitHub Actions - Azure API Center |
| 3 | +description: Learn how to automate the registration of APIs in your API center using a CI/CD workflow based on GitHub Actions. |
| 4 | +ms.service: api-center |
| 5 | +ms.topic: how-to |
| 6 | +ms.date: 07/24/2024 |
| 7 | +ms.author: danlep |
| 8 | +author: dlepow |
| 9 | +ms.custom: devx-track-azurecli |
| 10 | +# Customer intent: As an API developer, I want to automate the registration of APIs in my API center using a CI/CD workflow based on GitHub Actions. |
| 11 | +--- |
| 12 | + |
| 13 | +# Register APIs in your API center using GitHub Actions |
| 14 | + |
| 15 | +This article shows how to set up a basic [GitHub Actions](https://docs.github.com/en/actions/learn-github-actions) workflow to register an API in your organization's [API center](overview.md) when an API specification file is added to a GitHub repository. |
| 16 | + |
| 17 | +Using a GitHub Actions workflow to register APIs in your API center provides a consistent and repeatable CI/CD process for every new or updated API. The workflow can be extended to include steps such as adding metadata to the API registration. |
| 18 | + |
| 19 | +The following diagram shows how API registration in your API center can be automated using a GitHub Actions workflow. |
| 20 | + |
| 21 | +:::image type="content" source="media/register-apis-github-actions/scenario-overview.svg" alt-text="Diagram showing steps to trigger a GitHub actions workflow to register an API in an Azure API center." lightbox="media/register-apis-github-actions/scenario-overview.svg"::: |
| 22 | + |
| 23 | +1. Set up a GitHub Actions workflow in your repository that triggers when a pull request that adds an API definition file is merged. |
| 24 | +1. Create a branch from the main branch in your GitHub repository. |
| 25 | +1. Add an API definition file, commit the changes, and push them to the new branch. |
| 26 | +1. Create a pull request to merge the new branch into the main branch. |
| 27 | +1. Merge the pull request. |
| 28 | +1. The merge triggers a GitHub Actions workflow that registers the API in your API center. |
| 29 | + |
| 30 | +## Prerequisites |
| 31 | + |
| 32 | +* An API center in your Azure subscription. If you haven't created one already, see [Quickstart: Create your API center](set-up-api-center.md). |
| 33 | +* Permissions to create a service principal in the Microsoft Entra ID tenant |
| 34 | +* A GitHub account and a GitHub repo in which you can configure secrets and GitHub Actions workflows |
| 35 | +* For Azure CLI: |
| 36 | + [!INCLUDE [include](~/reusable-content/azure-cli/azure-cli-prepare-your-environment-no-header.md)] |
| 37 | + |
| 38 | + [!INCLUDE [install-apic-extension](includes/install-apic-extension.md)] |
| 39 | + |
| 40 | + > [!NOTE] |
| 41 | + > Azure CLI command examples in this article can run in PowerShell or a bash shell. Where needed because of different variable syntax, separate command examples are provided for the two shells. |
| 42 | +
|
| 43 | +## Set up a GitHub Actions workflow |
| 44 | + |
| 45 | +In this section, you set up the GitHub Actions workflow for this scenario: |
| 46 | + |
| 47 | +* Create a service principal to use for Azure credentials in the workflow. |
| 48 | +* Add the credentials as a secret in your GitHub repository. |
| 49 | +* Configure a GitHub Actions workflow that triggers when a pull request that adds an API definition file is merged. The workflow YAML file includes a step that uses the Azure CLI to register the API in your API center from the definition file. |
| 50 | + |
| 51 | +### Set up a service principal secret |
| 52 | + |
| 53 | +In the following steps, create a Microsoft Entra ID service principal, which will be used to add credentials to the workflow to authenticate with Azure. |
| 54 | + |
| 55 | +> [!NOTE] |
| 56 | +> Configuring a service principal is shown for demonstration purposes. The recommended way to authenticate with Azure for GitHub Actions is with OpenID Connect, an authentication method that uses short-lived tokens. Setting up OpenID Connect with GitHub Actions is more complex but offers hardened security. [Learn more](../app-service/deploy-github-actions.md?tabs=openid%2Caspnetcore#1-generate-deployment-credentials) |
| 57 | +
|
| 58 | +Create a service principal using the [az ad sp create-for-rbac](/cli/azure/ad#az-ad-sp-create-for-rbac) command. The following example first uses the [az apic show](/cli/azure/apic#az-apic-show) command to retrieve the resource ID of the API center. The service principal is then created with the Contributor role for the API center. |
| 59 | + |
| 60 | +#### [Bash](#tab/bash) |
| 61 | + |
| 62 | +```azurecli |
| 63 | +#! /bin/bash |
| 64 | +apiCenter=<api-center-name> |
| 65 | +resourceGroup=<resource-group-name> |
| 66 | +spName=<service-principal-name> |
| 67 | +
|
| 68 | +apicResourceId=$(az apic show --name $apiCenter --resource-group $resourceGroup --query "id" --output tsv) |
| 69 | +
|
| 70 | +az ad sp create-for-rbac --name $spName --role Contributor --scopes $apicResourceId --json-auth |
| 71 | +``` |
| 72 | + |
| 73 | +#### [PowerShell](#tab/powershell) |
| 74 | + |
| 75 | +```azurecli |
| 76 | +# PowerShell syntax |
| 77 | +$apiCenter = "<api-center-name>" |
| 78 | +$resourceGroup = "<resource-group-name>" |
| 79 | +$spName = "<service-principal-name>" |
| 80 | +
|
| 81 | +$apicResourceId = $(az apic show --name $apiCenter --resource-group $resourceGroup --query "id" --output tsv) |
| 82 | +
|
| 83 | +az ad sp create-for-rbac --name $spName --role Contributor --scopes $apicResourceId --json-auth |
| 84 | +``` |
| 85 | +--- |
| 86 | + |
| 87 | +Copy the JSON output, which should look similar to the following: |
| 88 | + |
| 89 | +```json |
| 90 | +{ |
| 91 | + "clientId": "<GUID>", |
| 92 | + "clientSecret": "<GUID>", |
| 93 | + "subscriptionId": "<GUID>", |
| 94 | + "tenantId": "<GUID>", |
| 95 | + "activeDirectoryEndpointUrl": "https://login.microsoftonline.com", |
| 96 | + "resourceManagerEndpointUrl": "https://management.azure.com/", |
| 97 | + [...other endpoints...] |
| 98 | +} |
| 99 | +``` |
| 100 | + |
| 101 | +### Add the service principal as a GitHub secret |
| 102 | + |
| 103 | +1. In [GitHub](https://github.com/), browse your repository. Select **Settings**. |
| 104 | +1. Under **Security**, select **Secrets and variables** > **Actions** |
| 105 | +1. Select **New repository secret**. |
| 106 | +1. Paste the entire JSON output from the Azure CLI command into the secret's value field. Name the secret `AZURE_CREDENTIALS`. Select **Add secret**. |
| 107 | + |
| 108 | + The secret is listed under **Repository secrets**. |
| 109 | + |
| 110 | + :::image type="content" source="media/register-apis-github-actions/repository-secrets-github-small.png" alt-text="Screenshot of secrets for Actions in a GitHub repository." lightbox="media/register-apis-github-actions/repository-secrets-github.png"::: |
| 111 | + |
| 112 | + |
| 113 | +When you configure the GitHub workflow file later, you use the secret for the input `creds` of the [Azure/login](https://github.com/marketplace/actions/azure-login) action. For example: |
| 114 | + |
| 115 | +```yaml |
| 116 | +- uses: azure/login@v1 |
| 117 | + with: |
| 118 | + creds: ${{ secrets.AZURE_CREDENTIALS }} |
| 119 | +``` |
| 120 | +
|
| 121 | +### Add the workflow file to your GitHub repository |
| 122 | +
|
| 123 | +A GitHub Actions workflow is represented by a YAML (.yml) definition file. This definition contains the various steps and parameters that make up the workflow. [Learn more](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions) |
| 124 | +
|
| 125 | +The following is a basic workflow file for this example that you can use or modify. |
| 126 | +
|
| 127 | +In this example: |
| 128 | +* The workflow is triggered when a pull request that adds a JSON definition in the `APIs` path is closed on the main branch. |
| 129 | +* The location of the definition is extracted from the pull request using a GitHub script, which is authenticated with the default GitHub token. |
| 130 | +* The Azure credentials saved in your repo are used to sign into Azure. |
| 131 | +* The [az apic register](/cli/azure/apic/api#az-apic-api-register) command registers the API in the API center specified in the environment variables. |
| 132 | + |
| 133 | +To configure the workflow file: |
| 134 | + |
| 135 | +1. Copy and save the file under a name such as `register-api.yml`. |
| 136 | +1. Update the values for the environment variables to match your API center in Azure. |
| 137 | +1. Confirm or update the name of the repository folder (`APIs`) where you'll add the API definition file. |
| 138 | +1. Add this workflow file in the `/.github/workflows/` path in your GitHub repository. |
| 139 | + |
| 140 | +> [!TIP] |
| 141 | +> Using the [Visual Studio Code extension](use-vscode-extension.md) for Azure API Center, you can generate a starting workflow file by running an extension command. In the Command Palette, select **Azure API Center: Register APIs**. Select **CI/CD** > **GitHub**. You can then modify the file for your scenario. |
| 142 | + |
| 143 | +```yml |
| 144 | +name: Register API Definition to Azure API Center |
| 145 | +on: |
| 146 | + pull_request: |
| 147 | + types: [closed] |
| 148 | + branches: |
| 149 | + - main |
| 150 | + paths: |
| 151 | + - "APIs/**/*.json" |
| 152 | +permissions: |
| 153 | + contents: read |
| 154 | + pull-requests: read |
| 155 | +env: |
| 156 | + # set this to your Azure API Center resource group name |
| 157 | + RESOURCE_GROUP: <YOUR_RESOURCE_GROUP> |
| 158 | + # set this to your Azure API Center service name |
| 159 | + SERVICE_NAME: <YOUR_API_CENTER> |
| 160 | +jobs: |
| 161 | + register: |
| 162 | + runs-on: ubuntu-latest |
| 163 | + environment: production |
| 164 | + steps: |
| 165 | + - uses: actions/checkout@v2 |
| 166 | + |
| 167 | + - name: Get specification file path in the PR |
| 168 | + id: get-file-location |
| 169 | + uses: actions/github-script@v5 |
| 170 | + with: |
| 171 | + github-token: ${{ secrets.GITHUB_TOKEN }} |
| 172 | + script: | |
| 173 | + const pull_number = context.payload.pull_request.number; |
| 174 | + const owner = context.repo.owner; |
| 175 | + const repo = context.repo.repo; |
| 176 | + const files = await github.rest.pulls.listFiles({ |
| 177 | + owner, |
| 178 | + repo, |
| 179 | + pull_number |
| 180 | + }); |
| 181 | + if (files.data.length === 1) { |
| 182 | + const filename = files.data[0].filename; |
| 183 | + core.exportVariable('API_FILE_LOCATION', hfilename); |
| 184 | + console.log(`API_FILE_LOCATION: ${{ env.API_FILE_LOCATION }}`); |
| 185 | + } |
| 186 | + else { |
| 187 | + console.log('The PR does not add exactly one specification file.'); |
| 188 | + } |
| 189 | + - name: Azure login |
| 190 | + uses: azure/login@v1 |
| 191 | + with: |
| 192 | + creds: ${{ secrets.AZURE_CREDENTIALS }} |
| 193 | + |
| 194 | + - name: Register to API Center |
| 195 | + uses: azure/CLI@v2 |
| 196 | + with: |
| 197 | + azcliversion: latest |
| 198 | + inlineScript: | |
| 199 | + az apic api register -g ${{ env.RESOURCE_GROUP }} -n ${{ env.SERVICE_NAME }} --api-location ${{ env.API_FILE_LOCATION }} |
| 200 | +``` |
| 201 | +
|
| 202 | +
|
| 203 | +## Add API definition file to the repository |
| 204 | +
|
| 205 | +Test the workflow by adding an API definition file to the repository. Follow these high-level steps, which are typical of a development workflow. For details on working with GitHub branches, see the [GitHub documentation](https://docs.github.com/en/github/collaborating-with-pull-requests/getting-started/about-collaborative-development-models). |
| 206 | +
|
| 207 | +1. Create a new working branch from the main branch in your repository. |
| 208 | +1. Add the API definition file to the repository in the `APIs` path. For example, `APIs/catfacts-api/07-15-2024.json`. |
| 209 | +1. Commit the changes and push them to the working branch. |
| 210 | +1. Create a pull request to merge the working branch into the main branch. |
| 211 | +1. After review, merge the pull request. The merge triggers the GitHub Actions workflow that registers the API in your API center. |
| 212 | + |
| 213 | + :::image type="content" source="media/register-apis-github-actions/workflow-action.png" alt-text="Screenshot showing successful workflow run in GitHub."::: |
| 214 | + |
| 215 | +## Verify the API registration |
| 216 | + |
| 217 | +Verify that the API is registered in your API center. |
| 218 | + |
| 219 | +1. In the [Azure portal](https://portal.azure.com), navigate to your API center. |
| 220 | +1. In the left menu, under **Assets**, select **APIs**. |
| 221 | +1. Verify that the newly registered API appears in the list of APIs. |
| 222 | + |
| 223 | +:::image type="content" source="media/register-apis-github-actions/api-registered-api-center.png" alt-text="Screenshot of API registered in API Center after workflow."::: |
| 224 | + |
| 225 | +## Add a new API version |
| 226 | + |
| 227 | +To add a new version to an existing API in your API center, follow the preceding steps, with a slight modification: |
| 228 | + |
| 229 | +1. Change to the same working branch in your repo, or create a new working branch. |
| 230 | +1. Add a new API definition file to the repository in the `APIs` path, in the folder for an existing API. For example, if you previously added a Cat Facts API definition, add a new version such as `APIs/catfacts-api/07-22-2024.json`. |
| 231 | +1. Commit the changes and push them to the working branch. |
| 232 | +1. Create a pull request to merge the working branch into the main branch. |
| 233 | +1. After review, merge the pull request. The merge triggers the GitHub Actions workflow that registers the new API version in your API center. |
| 234 | +1. In the Azure portal, navigate to your API center and confirm that the new version is registered. |
| 235 | + |
| 236 | +## Extend the scenario |
| 237 | + |
| 238 | +You can extend the GitHub Actions workflow to include other steps, such as adding metadata for the API registration. For example: |
| 239 | + |
| 240 | +1. Using the [metadata schema](metadata.md) in your API center, create a metadata JSON file to apply metadata values to your API registration. |
| 241 | + |
| 242 | + For example, if the metadata schema includes properties such as `approver`, `team`, and `cost center`, a metadata JSON file might look like this: |
| 243 | + |
| 244 | + ```json |
| 245 | + { |
| 246 | + |
| 247 | + "team": "Store API dev team", |
| 248 | + "costCenter": "12345" |
| 249 | + } |
| 250 | + ``` |
| 251 | +1. Upload a metadata JSON file in the folder for each API in the repository. |
| 252 | +1. Add a workflow step to apply the metadata to the API registration using the [az apic api update](/cli/azure/apic/api#az-apic-api-update) command. In the following example, the API ID and metadata file are passed in environment variables, which would be set elsewhere in the workflow file. |
| 253 | + |
| 254 | + ```yml |
| 255 | + [...] |
| 256 | + - name: Apply metadata to API in API Center |
| 257 | + uses: azure/CLI@v2 |
| 258 | + with: |
| 259 | + azcliversion: latest |
| 260 | + inlineScript: | |
| 261 | + az apic api update -g ${{ env.RESOURCE_GROUP }} -n ${{ env.SERVICE_NAME }} --api-id {{ env.API_ID }} --custom-properties {{ env.METADATA_FILE }} |
| 262 | + ``` |
| 263 | + |
| 264 | +## Related content |
| 265 | + |
| 266 | +* [Using secrets in GitHub Actions](https://docs.github.com/en/actions/reference/encrypted-secrets) |
| 267 | +* [Creating configuration variables for a repository](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions) |
0 commit comments