CI/CD Pipelines

Learning objectives#

• Authenticate to Azure from GitHub with OIDC
• Build, test and deploy in one workflow
• Use environments and approvals
• Deploy safely with slots

Explanation#

OpenID Connect (OIDC) federation lets a workflow exchange a short-lived GitHub token for an Azure token. You configure a federated credential on an app registration or user-assigned managed identity — no client secret is stored.

The azure/login action signs in; azure/webapps-deploy deploys the build output.

GitHub environments add protection rules such as required reviewers before production.

Deploying to a staging slot first, then swapping, gives zero-downtime releases and instant rollback.

Code example: Deploy an API with OIDC#

1name: deploy-api
2on: { push: { branches: [main] } }
3permissions: { id-token: write, contents: read }
4

5jobs:
6  deploy:
7    runs-on: ubuntu-latest
8    environment: production            # requires approval if configured
9    steps:
10      - uses: actions/checkout@v4
11      - uses: actions/setup-dotnet@v4
12        with: { dotnet-version: '9.0.x' }
13      - run: dotnet test -c Release
14      - run: dotnet publish src/Shop.Api -c Release -o ./publish
15      - uses: azure/login@v2
16        with:
17          client-id: ${{ secrets.AZURE_CLIENT_ID }}
18          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
19          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
20      - uses: azure/webapps-deploy@v3
21        with: { app-name: app-shop-api, slot-name: staging, package: ./publish }
22      - run: az webapp deployment slot swap -g rg-shop-prod -n app-shop-api --slot staging

Tests pass → the build deploys to the staging slot → staging is swapped into production with no downtime.

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

1. id-token: write lets the job request an OIDC token.
2. The three IDs are not secrets in the password sense, but storing them as secrets keeps workflows tidy.
3. The app deploys to staging first.
4. Swapping moves the warmed-up staging version into production.

Real-world use case#

Common mistakes#

Best practices#

• Use OIDC federation
• Run tests before deploying
• Protect production with environment approvals
• Deploy to slots and swap

Remember this#

Practice exercise#

1      - run: curl --fail --retry 5 --retry-delay 5 https://app-shop-api-staging.azurewebsites.net/health

Mini quiz#

Want more? Practise all Microsoft Azure MCQs · Microsoft Azure interview questions

Related topics#

My notes#

Saved in this browser.