GitHub Actions on Azure

GitHub Actions is GitHub's built-in CI/CD and automation platform. Workflows are defined in YAML files stored in the .github/workflows/ directory of your repository and triggered by GitHub events — pushes, pull requests, releases, and more. GitHub Actions is deeply integrated with the GitHub ecosystem (issues, PRs, packages, security scanning) and provides a rich marketplace of community actions for tasks like building, testing, and deploying to Azure.

A GitHub Actions workflow file has three top-level sections. on defines the trigger events. env sets global environment variables. jobs defines one or more jobs, each running on a runner (GitHub-hosted or self-hosted). Each job has steps — either run (shell script) or uses (a pre-built action). Jobs run in parallel by default; use needs to create sequential dependencies.

The recommended way to authenticate GitHub Actions to Azure is OpenID Connect (OIDC) — it issues short-lived tokens without storing long-lived secrets in GitHub. Configure a federated identity credential on an Azure App Registration or Managed Identity, granting it trust for your GitHub repository and branch. Use the azure/login@v2 action to exchange the GitHub OIDC token for an Azure access token — no client secrets in GitHub Secrets required.

The azure/webapps-deploy@v3 action deploys code or a container image to Azure App Service. It handles slot deployment, package-based deploy, and Docker image deploy. Pair it with azure/login@v2 for authentication. You can target a staging slot, run smoke tests, then swap with the azure/CLI@v2 action running the slot swap command — replicating the Azure Pipelines blue-green deployment pattern entirely in GitHub Actions.

Deploy to AKS from GitHub Actions using the azure/k8s-deploy@v5 action. This action uses kubectl apply to deploy manifests, performs image substitution (replacing the image tag with the current build's tag), and monitors rollout health. The azure/aks-set-context@v4 action configures kubectl credentials by fetching the cluster kubeconfig using the authenticated Azure session.

Store sensitive values in GitHub Secrets — encrypted values accessible as ${{ secrets.SECRET_NAME }} in workflows. Non-sensitive configuration goes in GitHub Variables — accessible as ${{ vars.VARIABLE_NAME }}. Both can be scoped to a repository, environment, or organisation. Use environments in GitHub Actions to add protection rules (required reviewers, deployment branches) similar to Azure DevOps Environments.

GitHub Actions Environments (configured in repository Settings → Environments) add deployment gates similar to Azure DevOps environments. You can require required reviewers who must approve before a job targeting the environment runs, restrict deployments to specific branches (only main can deploy to Production), and add wait timers to delay deployments. Jobs targeting a protected environment pause until all protection rules are satisfied.

Avoid duplicating CI/CD logic across repositories using two GitHub Actions features. Reusable workflows let you define a workflow in one repository and call it from workflows in other repositories using uses: myorg/shared-workflows/.github/workflows/deploy.yml@main. Composite actions bundle multiple steps into a single action stored in a repository, reusable with uses: myorg/my-actions/deploy@v1. Both promote DRY principles across your organisation's CI/CD pipelines.

Choose GitHub Actions when: your code is hosted on GitHub, your team prefers the GitHub UI, you want tight integration with GitHub PR checks and code scanning, or you are building open-source projects (generous free minutes). Choose Azure Pipelines when: you need Azure Boards integration, advanced testing with Azure Test Plans, Azure Artifacts feed management, code is in Azure Repos, or you need complex multi-stage release management with gates across many environments. Both support deploying to Azure equally well.

The GitHub Actions Marketplace hosts thousands of community and official actions for common tasks. Microsoft publishes official Azure actions: azure/login, azure/webapps-deploy, azure/aks-set-context, azure/k8s-deploy, azure/CLI, azure/arm-deploy, and many more. Always pin actions to a specific version tag (e.g., @v3) or a commit SHA to prevent supply chain attacks from a compromised action being updated with malicious code.

GitHub-hosted runners have public internet access only — they cannot reach private Azure resources (SQL databases, internal APIs) without exposing those resources publicly. Use self-hosted runners on Azure VMs inside your VNet for deployments to private resources. Register a runner by downloading the GitHub Actions runner agent, configuring it with your repository URL and registration token, and running it as a service. Scale self-hosted runners with Azure Container Apps for elastic runner pools.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: GitHub Actions workflows are YAML files in .github/workflows/ triggered by GitHub events and executed on runners, OIDC federated credentials enable secretless Azure authentication from GitHub Actions, and GitHub Environments with protection rules add approval gates to production deployments. This completes the Azure DevOps course — next up is Azure Monitor and Log Analytics.