Github Workflow deploying Python app to Azure App Service

Viewed 46

I have a requirements.txt with internal dependencies in private Github repositories. I've setup the build step of the workflow to use webfactory/ssh-agent@v0.5.4 to provide the SSH authentication which works perfectly during the build phase. The deployment phase is failing to authenticate because of SSH issues, but I can't find a similar way to get SSH working when Azure Oryx is handling the dependency building during the deploy.

The error:

Python Version: /opt/python/3.7.12/bin/python3.7
Creating directory for command manifest file if it doesnot exist
Removing existing manifest file
Python Virtual Environment: antenv
Creating virtual environment...
Activating virtual environment...
Running pip install...
"2022-09-12 15:13:31"|ERROR|ERROR: Command errored out with exit status 128: git clone -q 
'ssh://****@github.com/Murphy-Hoffman/IBMi-MHC.git' /tmp/8da94d13f03a38b/antenv/src/ibmi-mhc- 
db2 Check the logs for full command output. | Exit code: 1 | Please review your 
requirements.txt | More information: https://aka.ms/troubleshoot-python
\n/bin/bash -c "oryx build /tmp/zipdeploy/extracted -o /home/site/wwwroot --platform python -- 
platform-version 3.7 -i /tmp/8da94d13f03a38b --compress-destination-dir -p 
virtualenv_name=antenv --log-file /tmp/build-debug.log  | tee /tmp/oryx-build.log ; exit 
$PIPESTATUS "

Generating summary of Oryx build
Parsing the build logs
Found 1 issue(s)

Build Summary :
===============
Errors (1)
1. ERROR: Command errored out with exit status 128: git clone -q 
'ssh://****@github.com/Murphy-Hoffman/IBMi-MHC.git' /tmp/8da94d13f03a38b/antenv/src/ibmi-mhc- 
db2 Check the logs for full command output.  
-  Next Steps: Please review your requirements.txt
-  For more details you can browse to https://aka.ms/troubleshoot-python

My requirements.txt file

autopep8==1.7.0
ibm-db==2.0.9
-e git+ssh://git@github.com/Murphy-Hoffman/IBMi- 
MHC.git@57085a5e1f5637bfdd815397b45ba1b2dfd9b52c#egg=IBMi_MHC_db2&subdirectory=utility/db2
-e git+ssh://git@github.com/Murphy-Hoffman/IBMi- 
MHC.git@57085a5e1f5637bfdd815397b45ba1b2dfd9b52c#egg=IBMi_MHC_UNIT&subdirectory=IBMi/_UNIT
itoolkit==1.7.0
pycodestyle==2.9.1
pyodbc==4.0.32
toml==0.10.2

Finally, the Github Action yml that succeeds during the build phase but fails in deployment

# Docs for the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy
# More GitHub Actions for Azure: https://github.com/Azure/actions
# More info on Python, GitHub Actions, and Azure App Service: https://aka.ms/python-webapps-        
actions

name: Build and deploy Python app to Azure Web App - mhc-customers

on:
push:
branches:
  - main
workflow_dispatch:

jobs:
build:
runs-on: ubuntu-latest

steps:
  - uses: actions/checkout@v2

  - name: Set up Python version
    uses: actions/setup-python@v1
    with:
      python-version: '3.7'

  - name: Create and start virtual environment
    run: |
      python -m venv venv
      source venv/bin/activate
  
  - name: Setup SSH for Private Repos
    uses: webfactory/ssh-agent@v0.5.4
    with:
      ssh-private-key: |
        ${{ secrets.IBMI_MHC_SECRET }}
    

  - name: Install Dependencies
    run: |
      pip install -r requirements.txt

  # Optional: Add step to run tests here (PyTest, Django test suites, etc.)
  
  - name: Upload artifact for deployment jobs
    uses: actions/upload-artifact@v2
    with:
      name: python-app
      path: |
        . 
        !venv/

deploy:
  runs-on: ubuntu-latest
  needs: build
  environment:
    name: 'Production'
    url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}

steps:
  - name: Setup SSH for Private Repos
    uses: webfactory/ssh-agent@v0.5.4
    with:
      ssh-private-key: |
        ${{ secrets.IBMI_MHC_SECRET }}

  - name: Download artifact from build job
    uses: actions/download-artifact@v2
    with:
      name: python-app
      path: .
      
  - name: 'Deploy to Azure Web App'
    uses: azure/webapps-deploy@v2
    id: deploy-to-webapp
    with:
      app-name: 'mhc-customers'
      slot-name: 'Production'
      publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_89B81B4839F24A7589B3A4D5D845DA59 }}
1 Answers

I've got this working - sort of. After reading up on the Oryx automated build platform https://github.com/microsoft/Oryx I added a appsvc.yaml in the application root that ran this config:

version: 1

pre-build: | 
git config --global url."https://{secret}@github".insteadOf https://github

The problem is that we have to put our actual Github secret in the config yaml (in replace of "secret"). This isn't ideal but works to get Oryx using the correct credentials.

Related