Skip to content

Commit c6b8803

Browse files
LJSpillerLJSpiller
authored
Merge pull request #216015 from juliakm/users/jukullam/mysql-gh-actions-include
Update MySQL article to use include file for GitHub Actions
2 parents df66fb0 + 17c796d commit c6b8803

File tree

3 files changed

+6
-114
lines changed

3 files changed

+6
-114
lines changed

‎.openpublishing.publish.config.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -867,7 +867,7 @@
867867
"branch_mapping": {}
868868
},
869869
{
870-
"path_to_root": "reusable-content",
870+
"path_to_root": "articles/reusable-content",
871871
"url": "https://github.com/MicrosoftDocs/reusable-content",
872872
"branch": "main",
873873
"branch_mapping": {}

‎articles/machine-learning/how-to-devops-machine-learning.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,9 @@ https://github.com/azure/azureml-examples
4444

4545
## Step 2: Sign in to Azure Pipelines
4646

47-
[!INCLUDE [include](~/reusable-content/devops-pipelines/sign-in-azure-pipelines.md)]
47+
[!INCLUDE [include](~/articles/reusable-content/devops-pipelines/sign-in-azure-pipelines.md)]
4848

49-
[!INCLUDE [include](~/reusable-content/devops-pipelines/create-project.md)]
49+
[!INCLUDE [include](~/articles/reusable-content/devops-pipelines/create-project.md)]
5050

5151
## Step 3: Create an Azure Resource Manager connection
5252

‎articles/mysql/single-server/quickstart-mysql-github-actions.md

Lines changed: 3 additions & 111 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.subservice: single-server
77
ms.topic: quickstart
88
ms.author: jukullam
99
ms.custom: github-actions-azure, mode-other
10-
ms.date: 06/20/2022
10+
ms.date: 10/26/2022
1111
---
1212

1313
# Quickstart: Use GitHub Actions to connect to Azure MySQL
@@ -44,79 +44,8 @@ The file has two sections:
4444
|**Deploy** | 1. Deploy the database. |
4545

4646
## Generate deployment credentials
47-
# [Service principal](#tab/userlevel)
4847

49-
You can create a [service principal](../../active-directory/develop/app-objects-and-service-principals.md) with the [az ad sp create-for-rbac](/cli/azure/ad/sp#az-ad-sp-create-for-rbac&preserve-view=true) command in the [Azure CLI](/cli/azure/). Run this command with [Azure Cloud Shell](https://shell.azure.com/) in the Azure portal or by selecting the **Try it** button.
50-
51-
Replace the placeholders `server-name` with the name of your MySQL server hosted on Azure. Replace the `subscription-id` and `resource-group` with the subscription ID and resource group connected to your MySQL server.
52-
53-
```azurecli-interactive
54-
az ad sp create-for-rbac --name {server-name} --role contributor \
55-
--scopes /subscriptions/{subscription-id}/resourceGroups/{resource-group} \
56-
--sdk-auth
57-
```
58-
59-
The output is a JSON object with the role assignment credentials that provide access to your database similar to below. Copy this output JSON object for later.
60-
61-
```output
62-
{
63-
"clientId": "<GUID>",
64-
"clientSecret": "<GUID>",
65-
"subscriptionId": "<GUID>",
66-
"tenantId": "<GUID>",
67-
(...)
68-
}
69-
```
70-
71-
> [!IMPORTANT]
72-
> It's always a good practice to grant minimum access. The scope in the previous example is limited to the specific server and not the entire resource group.
73-
74-
# [OpenID Connect](#tab/openid)
75-
76-
OpenID Connect is an authentication method that uses short-lived tokens. Setting up [OpenID Connect with GitHub Actions](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) is more complex process that offers hardened security.
77-
78-
1. If you do not have an existing application, register a [new Active Directory application and service principal that can access resources](../../active-directory/develop/howto-create-service-principal-portal.md). Create the Active Directory application.
79-
80-
```azurecli-interactive
81-
az ad app create --display-name myApp
82-
```
83-
84-
This command will output JSON with an `appId` that is your `client-id`. Save the value to use as the `AZURE_CLIENT_ID` GitHub secret later.
85-
86-
You'll use the `objectId` value when creating federated credentials with Graph API and reference it as the `APPLICATION-OBJECT-ID`.
87-
88-
1. Create a service principal. Replace the `$appID` with the appId from your JSON output.
89-
90-
This command generates JSON output with a different `objectId` and will be used in the next step. The new `objectId` is the `assignee-object-id`.
91-
92-
Copy the `appOwnerTenantId` to use as a GitHub secret for `AZURE_TENANT_ID` later.
93-
94-
```azurecli-interactive
95-
az ad sp create --id $appId
96-
```
97-
98-
1. Create a new role assignment by subscription and object. By default, the role assignment will be tied to your default subscription. Replace `$subscriptionId` with your subscription ID, `$resourceGroupName` with your resource group name, and `$assigneeObjectId` with the generated `assignee-object-id`. Learn [how to manage Azure subscriptions with the Azure CLI](/cli/azure/manage-azure-subscriptions-azure-cli).
99-
100-
```azurecli-interactive
101-
az role assignment create --role contributor --subscription $subscriptionId --assignee-object-id $assigneeObjectId --assignee-principal-type ServicePrincipal --scopes /subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.Web/sites/
102-
```
103-
104-
1. Run the following command to [create a new federated identity credential](/graph/api/application-post-federatedidentitycredentials?view=graph-rest-beta&preserve-view=true) for your active directory application.
105-
106-
* Replace `APPLICATION-OBJECT-ID` with the **objectId (generated while creating app)** for your Active Directory application.
107-
* Set a value for `CREDENTIAL-NAME` to reference later.
108-
* Set the `subject`. The value of this is defined by GitHub depending on your workflow:
109-
* Jobs in your GitHub Actions environment: `repo:< Organization/Repository >:environment:< Name >`
110-
* For Jobs not tied to an environment, include the ref path for branch/tag based on the ref path used for triggering the workflow: `repo:< Organization/Repository >:ref:< ref path>`. For example, `repo:n-username/ node_express:ref:refs/heads/my-branch` or `repo:n-username/ node_express:ref:refs/tags/my-tag`.
111-
* For workflows triggered by a pull request event: `repo:< Organization/Repository >:pull_request`.
112-
113-
```azurecli
114-
az rest --method POST --uri 'https://graph.microsoft.com/beta/applications/<APPLICATION-OBJECT-ID>/federatedIdentityCredentials' --body '{"name":"<CREDENTIAL-NAME>","issuer":"https://token.actions.githubusercontent.com","subject":"repo:organization/repository:ref:refs/heads/main","description":"Testing","audiences":["api://AzureADTokenExchange"]}'
115-
```
116-
117-
To learn how to create a Create an active directory application, service principal, and federated credentials in Azure portal, see [Connect GitHub and Azure](/azure/developer/github/connect-from-azure#use-the-azure-login-action-with-openid-connect).
118-
119-
---
48+
[!INCLUDE [include](~/articles/reusable-content/github-actions/generate-deployment-credentials.md)]
12049

12150
## Copy the MySQL connection string
12251

@@ -134,45 +63,8 @@ In the Azure portal, go to your Azure Database for MySQL server and open **Setti
13463
You'll use the connection string as a GitHub secret.
13564

13665
## Configure GitHub secrets
137-
# [Service principal](#tab/userlevel)
138-
139-
1. In [GitHub](https://github.com/), browse your repository.
140-
141-
2. Select **Settings > Secrets > New secret**.
14266

143-
3. Paste the entire JSON output from the Azure CLI command into the secret's value field. Give the secret the name `AZURE_CREDENTIALS`.
144-
145-
When you configure the workflow file later, you use the secret for the input `creds` of the Azure Login action. For example:
146-
147-
```yaml
148-
- uses: azure/login@v1
149-
with:
150-
creds: ${{ secrets.AZURE_CREDENTIALS }}
151-
```
152-
153-
4. Select **New secret** again.
154-
155-
5. Paste the connection string value into the secret's value field. Give the secret the name `AZURE_MYSQL_CONNECTION_STRING`.
156-
157-
# [OpenID Connect](#tab/openid)
158-
159-
You need to provide your application's **Client ID**, **Tenant ID**, and **Subscription ID** to the login action. These values can either be provided directly in the workflow or can be stored in GitHub secrets and referenced in your workflow. Saving the values as GitHub secrets is the more secure option.
160-
161-
1. Open your GitHub repository and go to **Settings**.
162-
163-
1. Select **Settings > Secrets > New secret**.
164-
165-
1. Create secrets for `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_SUBSCRIPTION_ID`. Use these values from your Active Directory application for your GitHub secrets:
166-
167-
|GitHub Secret | Active Directory Application |
168-
|---------|---------|
169-
|AZURE_CLIENT_ID | Application (client) ID |
170-
|AZURE_TENANT_ID | Directory (tenant) ID |
171-
|AZURE_SUBSCRIPTION_ID | Subscription ID |
172-
173-
1. Save each secret by selecting **Add secret**.
174-
175-
---
67+
[!INCLUDE [include](~/articles/reusable-content/github-actions/create-secrets-with-openid.md)]
17668

17769
## Add your workflow
17870

0 commit comments

Comments
 (0)