Repository files navigation

This action allows users to easily deploy their application source to anAzure Container App in their GitHub workflow by eitherproviding a previously built image, a Dockerfile that an image can be built from, or using a builder to create arunnable application image for the user.

If no Dockerfile is found or provided in the provided application source, the following steps are performed by this action:

• Uses the Oryx++ Builder to build the application source usingOryx to produce arunnable application image
• Pushes this runnable application image to the provided Container Registry
• Creates or updates a Container App based on this image

If a Dockerfile is found or discovered in the application source, the builder won't be used and the image will be builtwith a call todocker build and the Container App will be created or updated based on this image.

If a previously built image has already been pushed to a Container Registry and is provided to this action, no application source is required and the image will be used when creating or updating the Container App.

A YAML configuration file can also be provided to modify specific properties on the Container App that is created orupdated; please see the section below on theyamlConfigPath argument.

By default, this GitHub Action collects the following pieces of data for Microsoft:

• The Container App build and deploy scenario targeted by the user
  • i.e., used the Oryx++ Builder, used a provided/found Dockerfile, or provided a previously built image
  • Note: the image name isnot collected
• The processing time of the GitHub Action, in milliseconds
• The result of the GitHub Action
  • i.e., succeeded or failed
• If the Oryx++ Builder is used, events and metrics relating to building the provided application using Oryx

If you want to disable data collection, please set thedisableTelemetry argument totrue.

Prior to running this action, a set of Azure resources and GitHub Actions are either required or optional depending onthe arguments provided to this action.

A Container Registry must exist that the user is able to push container images to. This action will leverage the Container Registry to either push a builtrunnable application image to and/or deploy a Container App from.

AnAzure Container App environment is recommendedto have been previously created by the user to improve the performance of the action. If no environment has beencreated before, or if an environment cannot be found in the resource group that is being used to host the createdContainer App, then an environment will be created by as a part of theaz containerapp up command, which may takeadditional time.

Theazure/login action is used to authenticate calls using theAzure CLI, which is used in this action to call theaz containerapp upcommand. Ifazure/login is not called prior to this action being called in the GitHub workflow, theazureCredentialsargument can be used to provide the credentials needed to successfully callazure/login. These credentials arerecommended to be stored as aGitHub secret,and can be provided to this action without their value being exposed.

The credentials used for theazure/login action must have Contributor access over one of the following sets ofpermissions:

• The existing Container App if both theresourceGroup andcontainerAppName arguments are providedand exist
• The existing resource group if only theresourceGroup argument is providedand exists
• The user's subscription if theresourceGroup argument is not providedor is provided but does not exist

More information about configuring the deployment credentials required for this GitHub Action can be foundhere.

Thedocker/login-action action is used to authenticate callsto the user's Container Registry, which will host the image that is then deployed to the Container App.Currently,docker/login-action is called during every invocation of this action, so the user's Container Registry base URL is required, along with username and password credentials that are able to authenticate calls to this Container Registry. If the Container Registry is ACR, these credentials are able to be retrieved bycreating a service principaland giving it proper permissions to the ACR resource.

Thepack CLI is maintained by the Cloud Native Buildpacks project and is usedby this action to create runnable application images for the user when the application source code is provided and noadditional Dockerfile is provided or found. Abuilder wascreated by Oryx to take in the application source code provided to this action and produce an image that could then bepushed to an image registry and used within a Container App to build and run the application.

A stable version of the pack CLI is installed on the GitHub runner executing the task, and depending on the base OS ofthis runner, different tools will be leverage to assist with the installation:

• On Windows runners:
  • curl will be used to pull down the.zip containing thepack executable
  • 7z will be used to unzip the.zip and place thepack executable in a folder called "pack" created in theworking directory of the action
  • The.zip will be removed from the runner and the path containing the executable will be added to thePATHenvironment variable for future use viapack
• On non-Windows runners:
  • curl will be used to pull down the.tgz containing thepack executable
  • tar will be used to unzip the.tgz and place thepack executable in/usr/local/bin

Below are the arguments that can be provided to the Azure Container Apps Build and Deploy GitHub Action.

Note: Although no argument is officially marked as "required" in the metadata of this actions, some arguments willneed to be provided in order for this action to successfully run using one of the two main scenarios.

TheresourceGroup property in the YAML configuration filewill not be used; the value for this either comes fromtheresourceGroup argument provided to the action, or the default resource group name generated by the action. Allother properties provided in the YAML configuration file will override the values provided as arguments to this action;for example, if thecontainerAppName argument is provided to the action, and thename property is set in the YAMLconfiguration file, thename property in the YAML file will be used when creating or updating the Container App.

Image and application source arguments (e.g.,appSourcePath,imageToDeploy) will still be used to first buildand/or push an image that is used by the Container App; in this case, the provided YAML configuration file will need toreference the image specified byimageToDeploy (orimageToBuild, depending on your scenario).

When creating a new Container App, all properties listed in the YAML configuration file (exceptresourceGroup asmentioned above) will be set when the Container App is created. When updating an existing Container App, only theproperties listed in the file will be updated on the Container App.

Currently, the YAML file does not support setting up managed identity authentication for the Container Registry used;for more information on this issue, please seethis GitHub issue.

In cases where theyamlConfigPath argument is provided, the YAML file will be passed through to the correspondingaz containerapp command, eithercreate orupdatedepending on your scenario. For more information on the intended behavior when the YAML configuration file is provided,please see the documents linked for the corresponding commands.

For more information on the structure of the YAML configuration file, please visitthis site.

Seeaction.yml

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:appSourcePath:${{ github.workspace }}acrName:mytestacr

This will create a new Container App namedgithub-action-container-app-<github-run-id>-<github-run-attempt> in a newresource group named<container-app-name>-rg. The Container App will be based off of an image that was built fromthe providedappSourcePath and pushed to the provided ACR instance. An access token will be generated to authenticate an access token will be generated to authenticatethe push to the provided ACR instance.

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:imageToDeploy:mcr.microsoft.com/azuredocs/containerapps-helloworld:latest

This will create a new Container App namedgithub-action-container-app-<github-run-id>-<github-run-attempt> in a newresource group named<container-app-name>-rg whereno new image is built, but an existing image namedmcr.microsoft.com/azuredocs/containerapps-helloworld:latest will be used for the Container App.

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:yamlConfigPath:simple-image-container-app.yaml

This will create a new Container App namedgithub-action-container-app-<github-run-id>-<github-run-attempt> in a newresource group name<container-app-name>-rg whereno new image is built, but an existing image namedmcr.microsoft.com/azuredocs/containerapps-helloworld:latest will be used for the Container App. Additional propertiesabout the Container App will be pulled from thesimple-image-container-app.yaml file and will override any additionalvalues that would've been provided to the GitHub Action as argumentsexcludingresourceGroup.

Thesimple-image-container-app.yaml file has the following structure:

properties:managedEnvironmentId:/subscriptions/SUBSCRIPTION_ID/resourceGroups/RESOURCE_GROUP/providers/Microsoft.App/managedEnvironments/CONTAINER_APP_ENVIRONMENTconfiguration:ingress:external:trueallowInsecure:falsetargetPort:80template:containers:      -image:mcr.microsoft.com/azuredocs/containerapps-helloworld:latestname:mysampleimagecontainer

The values forSUBSCRIPTION_ID,RESOURCE_GROUP andCONTAINER_APP_ENVIRONMENT must be updated to point to the fullresource ID of theexisting Container App environment that the Container App will use.

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:appSourcePath:${{ github.workspace }}acrName:mytestacracrUsername:${{ secrets.REGISTRY_USERNAME }}acrPassword:${{ secrets.REGISTRY_PASSWORD }}

This will create a new Container App namedgithub-action-container-app-<github-run-id>-<github-run-attempt> in a newresource group named<container-app-name>-rg. The Container App will be based off of an image that was built fromthe providedappSourcePath and pushed to the provided ACR instance. The provided ACR credentials will be used toauthenticate the calls to the ACR instance.

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:appSourcePath:${{ github.workspace }}registryUrl:mytestregistry.dockerhub.ioregistryUsername:${{ secrets.REGISTRY_USERNAME }}registryPassword:${{ secrets.REGISTRY_PASSWORD }}

This will create a new Container App namedgithub-action-container-app-<github-run-id>-<github-run-attempt> in a newresource group named<container-app-name>-rg. The Container App will be based off of an image that was built fromthe providedappSourcePath and pushed to the provided Container Registry instance. The provided Container Registry credentials will be used toauthenticate the calls to the Container Registry instance.

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:appSourcePath:${{ github.workspace }}acrName:mytestacrcontainerAppName:my-test-container-app

This will create a new Container App namedmy-test-container-app in a new resource group namedmy-test-container-app-rg.

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:appSourcePath:${{ github.workspace }}acrName:mytestacrresourceGroup:my-test-rg

This will create a new Container App namedgithub-action-container-app-<github-run-id>-<github-run-attempt> in a newresource group namedmy-test-rg.

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:appSourcePath:${{ github.workspace }}acrName:mytestacrcontainerAppName:my-test-container-appresourceGroup:my-test-rg

If themy-test-rg resource group does not exist, this will create the resource group and create a new Container Appnamedmy-test-container-app within the resource group. If the resource group already exists, this will create a newContainer App namedmy-test-container-app in the resource group, or update the Container App if it already existswithin the resource group.

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:appSourcePath:${{ github.workspace }}acrName:mytestacrcontainerAppEnvironment:my-test-container-app-env

This will create a new Container App namedgithub-action-container-app-<github-run-id>-<github-run-attempt> in a newresource group named<container-app-name>-rg with a new Container App environment namedmy-test-container-app-env.

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:appSourcePath:${{ github.workspace }}acrName:mytestacrruntimeStack:'dotnetcore:7.0'

This will create a new Container App namedgithub-action-container-app-<github-run-id>-<github-run-attempt> in a newresource group named<container-app-name>-rg where the runnable application image is using the .NET 7 runtime stack.

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:appSourcePath:${{ github.workspace }}acrName:mytestacrbuildArguments:|        "BP_JVM_VERSION=21" "BP_MAVEN_BUILD_ARGUMENTS=-Dmaven.test.skip=false --no-transfer-progress package"

This will create a new Container App namedgithub-action-container-app-<github-run-id>-<github-run-attempt> in a newresource group named<container-app-name>-rg. The Container App will be based off of an image that was built fromthe providedappSourcePath. Oryx++ builder is used to create a runnable application image, each build argument will be passed to thepack build command via the--env flag, e.g.,BP_JVM_VERSION=21 BP_MAVEN_VERSION=4 will be passed to thepack build as--env BP_JVM_VERSION=21 --env BP_MAVEN_VERSION=4.'

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:appSourcePath:${{ github.workspace }}acrName:mytestacrdockerfilePath:test.DockerfilebuildArguments:|        "arg-1=value-1" "arg-2=value-2"

This will create a new Container App namedgithub-action-container-app-<github-run-id>-<github-run-attempt> in a newresource group named<container-app-name>-rg where the runnable application image was created from thetest.Dockerfilefile found in the provided application source path directory and build arguments"arg-1=value-1" "arg-2=value-2" will be passed to thedocker build as--build-arg "arg-1=value-1" --build-arg "arg-2=value-2". If there's no build argument in the Dockerfile, no need to providebuildArguments.

Note: for values provided todockerfilePath, no file prefixes should be included (e.g.,./test.Dockerfile should bepassed as justtest.Dockerfile). The providedappSourcePath anddockerfilePath arguments will be concatenated insideof the GitHub Action.

steps:  -name:Log in to Azureuses:azure/login@v1with:creds:${{ secrets.AZURE_CREDENTIALS }}  -name:Build and deploy Container Appuses:azure/container-apps-deploy-action@v1with:appSourcePath:${{ github.workspace }}acrName:mytestacrimageToBuild:mytestacr.azurecr.io/app:latest

This will create a new Container App namedgithub-action-container-app-<github-run-id>-<github-run-attempt> in a newresource group named<container-app-name>-rg where the image built and pushed to ACR is namedmytestacr.azurecr.io/app:latest

This project welcomes contributions and suggestions. Most contributions require you to agree to aContributor License Agreement (CLA) declaring that you have the right to, and actually do, grant usthe rights to use your contribution. For details, visithttps://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to providea CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructionsprovided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted theMicrosoft Open Source Code of Conduct.For more information see theCode of Conduct FAQ orcontactopencode@microsoft.com with any additional questions or comments.

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsofttrademarks or logos is subject to and must followMicrosoft's Trademark & Brand Guidelines.Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.Any use of third-party trademarks or logos are subject to those third-party's policies.