Deployment on Github Actions for all tags for Azure App Service

Question

Deployment on Github Actions for all tags for Azure App Service

Krzysztof Szortyka 5

I have the Azure App Service with connecting Github and I would like to use tags during deployment. How set GitHub tag name for Entity type: Tag (App registrations -> Owned applications -> Certificates & secrets -> Federated credentials) so that it works for all tags and not just one?

SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2023-09-14T16:31:13.46+00:00

@Krzysztof Szortyka Thanks for reaching here! Could you please elaborate your scenario or share screen shot to help you better here.
Krzysztof Szortyka 5 Reputation points

2023-09-15T20:23:51.91+00:00
@SnehaAgrawal-MSFT I have a code in Github and I use Github Actions to deployment so I use workflows/azure-container-webapp.yml. The beginning of the file is as follows:

name: Deploy on branch master on: workflow_dispatch: permissions: id-token: write contents: read jobs: build-and-deploy: runs-on: ubuntu-latest defaults: run: shell: bash

I have the following setting in App registrations -> Owned applications -> Certificates & secrets -> Federated credentials:

Entity type: Branch GitHub branch name: master

And running any other branch in Github Actions gives an error.
I would like to run with tags, not branch name but I don't want to change the tag name every time in the App registrations settings (each new deployment is with a new tag). It would be best to set it for all tags.

I ran deployment with the tag but I got an error as in the attachment.
SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2023-09-20T10:39:30.9233333+00:00
@Krzysztof Szortyka

To trigger the workflow on tags instead of branches, you can modify the on section of your workflow file to include the tags event. Here's an example:

name: Deploy on tag on: push: tags: - '*' permissions: id-token: write contents: read jobs: build-and-deploy: runs-on: ubuntu-latest defaults: run: shell: bash

This configuration will trigger the workflow whenever a new tag is pushed to the repository. The '*' wildcard character specifies that any tag should trigger the workflow.

Regarding the Entity type and GitHub branch name settings in your App registrations, you can remove those settings since they are specific to branch-based workflows.

With the updated workflow configuration, the Entity type should be set to Tag and the GitHub tag name should be set to * to allow any tag to be used for authentication.

Let me know if you have any further questions.
Davide 5 Reputation points

2023-10-02T15:52:10.99+00:00

Using wildcards on federated credentials is not working. It looks like we need to setup the credentials with the specific tag we are publishing, which makes the federated credentials with tags useless.

We are using environments to use federated credentials on tag.

@SnehaAgrawal-MSFT please advise
Luke Martin 0 Reputation points

2024-05-28T21:07:57.8466667+00:00

Same issue here... Though we dont have the right subscription of GitHub to even use environments so we are stuck reverting to a less secure method of authentication for GitHub.

Your answer

SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2023-09-14T16:31:13.46+00:00

@Krzysztof Szortyka Thanks for reaching here! Could you please elaborate your scenario or share screen shot to help you better here.
Krzysztof Szortyka 5 Reputation points

2023-09-15T20:23:51.91+00:00

@SnehaAgrawal-MSFT I have a code in Github and I use Github Actions to deployment so I use workflows/azure-container-webapp.yml. The beginning of the file is as follows:

name: Deploy on branch master on: workflow_dispatch: permissions: id-token: write contents: read jobs: build-and-deploy: runs-on: ubuntu-latest defaults: run: shell: bash

I have the following setting in App registrations -> Owned applications -> Certificates & secrets -> Federated credentials:

Entity type: Branch GitHub branch name: master

And running any other branch in Github Actions gives an error.
I would like to run with tags, not branch name but I don't want to change the tag name every time in the App registrations settings (each new deployment is with a new tag). It would be best to set it for all tags.

I ran deployment with the tag but I got an error as in the attachment.
SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2023-09-20T10:39:30.9233333+00:00

@Krzysztof Szortyka

To trigger the workflow on tags instead of branches, you can modify the on section of your workflow file to include the tags event. Here's an example:

name: Deploy on tag on: push: tags: - '*' permissions: id-token: write contents: read jobs: build-and-deploy: runs-on: ubuntu-latest defaults: run: shell: bash

This configuration will trigger the workflow whenever a new tag is pushed to the repository. The '*' wildcard character specifies that any tag should trigger the workflow.

Regarding the Entity type and GitHub branch name settings in your App registrations, you can remove those settings since they are specific to branch-based workflows.

With the updated workflow configuration, the Entity type should be set to Tag and the GitHub tag name should be set to * to allow any tag to be used for authentication.

Let me know if you have any further questions.
Davide 5 Reputation points

2023-10-02T15:52:10.99+00:00

Using wildcards on federated credentials is not working. It looks like we need to setup the credentials with the specific tag we are publishing, which makes the federated credentials with tags useless.

We are using environments to use federated credentials on tag.

@SnehaAgrawal-MSFT please advise
Luke Martin 0 Reputation points

2024-05-28T21:07:57.8466667+00:00

Same issue here... Though we dont have the right subscription of GitHub to even use environments so we are stuck reverting to a less secure method of authentication for GitHub.

Share via

Deployment on Github Actions for all tags for Azure App Service

Your answer