Panduan CI/CD GitHub Actions untuk Microsoft Azure
Mencakup OIDC (Federated Credentials), build & push image ke Azure Container Registry (ACR), deploy
ke Azure Web App for Containers, AKS (Kubernetes), dan Azure Functions—plus best practices.
Pendahuluan & Prasyarat
Dokumen ini memandu pembuatan pipeline CI/CD di GitHub Actions yang melakukan: (1) build & test, (2)
build/push container ke Azure Container Registry (ACR), (3) deployment ke layanan Azure (Web App for
Containers, AKS, atau Functions). Kita menggunakan OIDC (Federated Credentials) sehingga runner
GitHub dapat mengakses Azure tanpa menyimpan secret client secret panjang.
Prasyarat singkat: Subscription Azure aktif, Resource Group, ACR, App Service/AKS/Function App;
buat Federated Credential di Entra ID untuk GitHub OIDC.
Diagram Alur Pipeline
Konfigurasi OIDC GitHub → Azure (Federated Credentials)
1) Di Microsoft Entra ID (Azure AD), buat App Registration untuk GitHub Actions (atau gunakan yang
ada).
2) Buat Federated credential bertipe GitHub OIDC; batasi subject (mis.
repo:org/repo:ref:refs/heads/main).
3) Beri peran ke App Registration (Service Principal) minimal: AcrPush pada ACR, Contributor/WebSite
Contributor untuk App Service, atau akses AKS melalui Azure RBAC for Kubernetes / kubeconfig; untuk
Functions berikan Contributor di Resource Group terkait.
4) Catat client-id, tenant-id, dan subscription-id; simpan sebagai unencrypted variables atau secrets di
GitHub.
Contoh 1 — CI Dasar ([Link]) + Build & Test
File: .github/workflows/[Link]
name: CI - Build & Test ([Link])
on:
push:
branches: [ main ]
pull_request:
branches: [ main ]
jobs:
build-test:
runs-on: ubuntu-latest
strategy:
matrix:
node: [18.x, 20.x]
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: ${{ [Link] }}
cache: 'npm'
- name: Install deps
run: npm ci
- name: Lint
run: npm run lint --if-present
- name: Unit test
run: npm test -- --ci
- name: Upload coverage
if: always()
uses: actions/upload-artifact@v4
with:
name: coverage-${{ [Link] }}
path: coverage/**
Contoh 2 — Build & Push ke ACR, Deploy ke Azure Web
App for Containers
File: .github/workflows/[Link]
name: CD - ACR + Azure Web App for Containers
on:
push:
branches: [ main ]
workflow_dispatch:
permissions:
contents: read
id-token: write
env:
AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
ACR_NAME: myacrname
ACR_LOGIN_SERVER: [Link]
WEBAPP_NAME: my-webapp # Web App for Containers
IMAGE_NAME: my-app
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Azure Login (OIDC)
uses: azure/login@v2
with:
client-id: ${{ env.AZURE_CLIENT_ID }}
tenant-id: ${{ env.AZURE_TENANT_ID }}
subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}
- name: ACR Login
run: az acr login --name $ACR_NAME
- name: Build & Push Image
run: |
IMAGE_TAG=${{ [Link] }}
docker build -t $ACR_LOGIN_SERVER/$IMAGE_NAME:$IMAGE_TAG .
docker push $ACR_LOGIN_SERVER/$IMAGE_NAME:$IMAGE_TAG
echo "ACR_IMAGE=$ACR_LOGIN_SERVER/$IMAGE_NAME:$IMAGE_TAG" >> $GITHUB_ENV
- name: Deploy to Web App for Containers
uses: azure/webapps-deploy@v3
with:
app-name: ${{ env.WEBAPP_NAME }}
images: ${{ env.ACR_IMAGE }}
Contoh 3 — Build & Push ke ACR, Deploy ke AKS (kubectl)
File: .github/workflows/[Link]
name: CD - ACR + AKS
on:
push:
tags:
- 'v*.*.*'
workflow_dispatch:
permissions:
contents: read
id-token: write
env:
AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
ACR_LOGIN_SERVER: [Link]
IMAGE_NAME: my-app
AKS_RG: my-aks-rg
AKS_CLUSTER: my-aks-cluster
K8S_NAMESPACE: default
K8S_DEPLOYMENT: app
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Azure Login (OIDC)
uses: azure/login@v2
with:
client-id: ${{ env.AZURE_CLIENT_ID }}
tenant-id: ${{ env.AZURE_TENANT_ID }}
subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}
- name: Build & Push Image to ACR
run: |
IMAGE_TAG=${{ github.ref_name }}
docker build -t $ACR_LOGIN_SERVER/$IMAGE_NAME:$IMAGE_TAG .
az acr login --name $(echo $ACR_LOGIN_SERVER | cut -d'.' -f1)
docker push $ACR_LOGIN_SERVER/$IMAGE_NAME:$IMAGE_TAG
echo "ACR_IMAGE=$ACR_LOGIN_SERVER/$IMAGE_NAME:$IMAGE_TAG" >> $GITHUB_ENV
- name: Set AKS context
uses: azure/aks-set-context@v4
with:
resource-group: ${{ env.AKS_RG }}
cluster-name: ${{ env.AKS_CLUSTER }}
- name: Deploy to AKS
run: |
kubectl -n $K8S_NAMESPACE set image deployment/$K8S_DEPLOYMENT app=$ACR_IMAGE
kubectl -n $K8S_NAMESPACE rollout status deployment/$K8S_DEPLOYMENT --timeout=180s
Contoh 4 — Deploy ke Azure Functions
File: .github/workflows/[Link]
name: CD - Azure Functions
on:
push:
branches: [ main ]
permissions:
contents: read
id-token: write
env:
AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
FUNCTIONAPP_NAME: my-func-app
# untuk Python: python-version, untuk Node: node-version
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Azure Login (OIDC)
uses: azure/login@v2
with:
client-id: ${{ env.AZURE_CLIENT_ID }}
tenant-id: ${{ env.AZURE_TENANT_ID }}
subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}
- name: Setup Functions Core Tools (via npm)
run: |
npm install -g azure-functions-core-tools@4 --unsafe-perm true
- name: Build (opsional, tergantung bahasa)
run: echo "Run build/test sesuai stack."
- name: Deploy
run: |
func azure functionapp publish $FUNCTIONAPP_NAME --nozip
Best Practices Pipeline GitHub Actions di Azure
• Gunakan OIDC + Federated Credentials; hindari menyimpan client secret panjang.
• Pisahkan pipeline CI (lint/test/build) dengan CD (rilis/deploy) dan gunakan environments untuk
approval produksi.
• Terapkan least privilege untuk Service Principal (AcrPush, WebApp Contributor, AKS RBAC sesuai
kebutuhan).
• Manfaatkan cache & artifact; tagging image pakai sha atau semver yang konsisten.
• Tambahkan langkah security scan (Trivy/Snyk), SBOM, dan pengecekan infrastructure drift bila
memakai Bicep/Terraform.
• Monitoring & Observability: Application Insights, Azure Monitor, Log Analytics; aktifkan health probe dan
rollout/rollback terkontrol untuk AKS.
