Azure での GitHub Actions

GitHub Actionsとは

GitHub Actionsワークフローの構造

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  NODE_VERSION: '18.x'

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODE_VERSION }}
    - run: npm ci
    - run: npm test

GitHub ActionsからAzureへの認証

# Configure OIDC federated credential in Azure
az ad app federated-credential create \
  --id <AppRegistrationObjectId> \
  --parameters '{
    "name": "github-oidc",
    "issuer": "https://token.actions.githubusercontent.com",
    "subject": "repo:myorg/myrepo:ref:refs/heads/main",
    "audiences": ["api://AzureADTokenExchange"]
  }'

# In the workflow: login via OIDC
# permissions:
#   id-token: write
#   contents: read
# - uses: azure/login@v2
#   with:
#     client-id: ${{ vars.AZURE_CLIENT_ID }}
#     tenant-id: ${{ vars.AZURE_TENANT_ID }}
#     subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

Azure App Serviceへのデプロイ

# .github/workflows/deploy.yml
jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
    - uses: actions/checkout@v4

    - uses: azure/login@v2
      with:
        client-id: ${{ vars.AZURE_CLIENT_ID }}
        tenant-id: ${{ vars.AZURE_TENANT_ID }}
        subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

    - name: Build and zip app
      run: npm ci && npm run build && zip -r app.zip dist/

    - uses: azure/webapps-deploy@v3
      with:
        app-name: myUniqueWebApp
        slot-name: staging
        package: app.zip

Azure Kubernetes Serviceへのデプロイ

jobs:
  deploy-aks:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
    - uses: actions/checkout@v4
    - uses: azure/login@v2
      with:
        client-id: ${{ vars.AZURE_CLIENT_ID }}
        tenant-id: ${{ vars.AZURE_TENANT_ID }}
        subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

    - uses: azure/aks-set-context@v4
      with:
        resource-group: MyRG
        cluster-name: myAKSCluster

    - uses: azure/k8s-deploy@v5
      with:
        namespace: production
        manifests: k8s/
        images: 'mycontainerregistry.azurecr.io/myapp:${{ github.sha }}'

GitHub Secretsと変数

# Reference secrets and variables in a workflow
steps:
- name: Configure app settings
  uses: azure/CLI@v2
  with:
    inlineScript: |
      az webapp config appsettings set \
        --name myUniqueWebApp \
        --resource-group MyRG \
        --settings \
          DATABASE_URL='${{ secrets.DATABASE_URL }}' \
          API_VERSION='${{ vars.API_VERSION }}'

環境の保護ルール

# Workflow job targeting a protected GitHub environment
jobs:
  deploy-production:
    runs-on: ubuntu-latest
    environment:
      name: Production           # Must have 2 approvers in GitHub settings
      url: https://myapp.contoso.com
    needs: deploy-staging
    steps:
    - uses: azure/login@v2
      with:
        client-id: ${{ vars.AZURE_CLIENT_ID }}
        tenant-id: ${{ vars.AZURE_TENANT_ID }}
        subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
    - uses: azure/webapps-deploy@v3
      with:
        app-name: myUniqueWebApp
        package: app.zip

再利用可能なワークフローと複合アクション

# Call a reusable workflow from another workflow
jobs:
  deploy:
    uses: myorg/shared-workflows/.github/workflows/deploy-appservice.yml@main
    with:
      app-name: myUniqueWebApp
      slot-name: staging
      package-path: dist/
    secrets:
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

GitHub ActionsとAzure Pipelines：選択する基準

GitHub Actions Marketplace

# Pin actions to specific version (recommended)
- uses: actions/checkout@v4         # Pinned to v4 tag
- uses: azure/login@v2               # Pinned to v2
- uses: azure/webapps-deploy@v3      # Pinned to v3

# Extra security: pin to commit SHA
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

# Avoid unpinned 'latest' or branch references
# - uses: some-action@main           # UNSAFE - could change at any time

プライベートネットワーク向けのセルフホストランナー

# Register a self-hosted runner on an Azure VM
# 1. Download runner (run on the VM)
curl -O -L https://github.com/actions/runner/releases/download/v2.317.0/actions-runner-linux-x64-2.317.0.tar.gz
mkdir actions-runner && tar xzf ./actions-runner-linux-x64-2.317.0.tar.gz -C actions-runner
cd actions-runner

# 2. Configure (use token from GitHub Settings > Actions > Runners)
./config.sh --url https://github.com/myorg/myrepo --token <REGISTRATION_TOKEN>

# 3. Run as a service
sudo ./svc.sh install && sudo ./svc.sh start

# Use in workflow
# runs-on: self-hosted

クイックチェック

レッスンのまとめ