- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Cloud
Deploy an Azure App with GitHub Actions and Federated Identity
In this Azure lab, you deploy a Node.js web application to Azure App Service using a GitHub Actions workflow that authenticates with workload identity federation, so no long-lived secrets are stored anywhere in the pipeline. You fork a starter repository into your own GitHub account, establish federated trust between your fork and a preconfigured Azure managed identity, and complete the deployment workflow by adding the sign-in and deploy steps. You then run the workflow, troubleshoot a controlled failure at the Azure sign-in step by reading the error and adding the missing workflow permission, rerun it cleanly, and confirm the deployed application is reachable in place of the default App Service page. By the end, you can connect a GitHub repository to Azure with federated identity and operate a deployment workflow that never handles a client secret.
Lab Info
Table of Contents
-
Challenge
Prepare the Azure target and the GitHub repository for automated deployment
- Locate the pre-provisioned resource group, the App Service web app, and the managed identity, and confirm nothing is deployed to the web app yet.
- Sign in to GitHub with your personal account and fork the provided starter repository.
-
Challenge
Configure federated trust so GitHub Actions can authenticate without long-lived secrets
- Add a federated credential on the managed identity using the GitHub Actions deploying Azure resources scenario, scoped to your fork and its main branch.
- Record the identity and subscription values the workflow needs to authenticate.
- Store those values as repository secrets in your fork.
-
Challenge
Build a workflow that deploys the application to Azure
- Add the Azure sign-in step that authenticates over OIDC using the stored repository secrets.
- Add the deploy step that packages the application and deploys it to the App Service web app.
- Commit the completed workflow to the fork.
-
Challenge
Run the workflow and monitor deployment progress
- Trigger the workflow and observe the run fail at the Azure sign-in step.
- Read the error, identify the missing token permission, and add the workflow permissions block.
- Rerun the workflow and confirm it completes successfully.
-
Challenge
Validate that the application deployed successfully and is reachable
- Browse the web app URL and confirm the application responds in place of the default App Service page.
- Confirm the version endpoint returns the deployed application version.
- Confirm the deployment record in the App Service deployment center.
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.