Github Workflow deploying Python app to Azure App Service

Question

I have a requirements.txt with internal dependencies in private Github repositories. I've setup the build step of the workflow to use webfactory/[email protected] to provide the SSH authentication which works perfectly during the build phase. The deployment phase is failing to authenticate because of SSH issues, but I can't find a similar way to get SSH working when Azure Oryx is handling the dependency building during the deploy.

The error:

Python Version: /opt/python/3.7.12/bin/python3.7
Creating directory for command manifest file if it doesnot exist
Removing existing manifest file
Python Virtual Environment: antenv
Creating virtual environment...
Activating virtual environment...
Running pip install...
"2022-09-12 15:13:31"|ERROR|ERROR: Command errored out with exit status 128: git clone -q 
'ssh://****@github.com/Murphy-Hoffman/IBMi-MHC.git' /tmp/8da94d13f03a38b/antenv/src/ibmi-mhc- 
db2 Check the logs for full command output. | Exit code: 1 | Please review your 
requirements.txt | More information: https://aka.ms/troubleshoot-python
\n/bin/bash -c "oryx build /tmp/zipdeploy/extracted -o /home/site/wwwroot --platform python -- 
platform-version 3.7 -i /tmp/8da94d13f03a38b --compress-destination-dir -p 
virtualenv_name=antenv --log-file /tmp/build-debug.log  | tee /tmp/oryx-build.log ; exit 
$PIPESTATUS "

Generating summary of Oryx build
Parsing the build logs
Found 1 issue(s)

Build Summary :
===============
Errors (1)
1. ERROR: Command errored out with exit status 128: git clone -q 
'ssh://****@github.com/Murphy-Hoffman/IBMi-MHC.git' /tmp/8da94d13f03a38b/antenv/src/ibmi-mhc- 
db2 Check the logs for full command output.  
-  Next Steps: Please review your requirements.txt
-  For more details you can browse to https://aka.ms/troubleshoot-python

My requirements.txt file

autopep8==1.7.0
ibm-db==2.0.9
-e git+ssh://[email protected]/Murphy-Hoffman/IBMi- 
MHC.git@57085a5e1f5637bfdd815397b45ba1b2dfd9b52c#egg=IBMi_MHC_db2&subdirectory=utility/db2
-e git+ssh://[email protected]/Murphy-Hoffman/IBMi- 
MHC.git@57085a5e1f5637bfdd815397b45ba1b2dfd9b52c#egg=IBMi_MHC_UNIT&subdirectory=IBMi/_UNIT
itoolkit==1.7.0
pycodestyle==2.9.1
pyodbc==4.0.32
toml==0.10.2

Finally, the Github Action yml that succeeds during the build phase but fails in deployment

# Docs for the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy
# More GitHub Actions for Azure: https://github.com/Azure/actions
# More info on Python, GitHub Actions, and Azure App Service: https://aka.ms/python-webapps-        
actions

name: Build and deploy Python app to Azure Web App - mhc-customers

on:
push:
branches:
  - main
workflow_dispatch:

jobs:
build:
runs-on: ubuntu-latest

steps:
  - uses: actions/checkout@v2

  - name: Set up Python version
    uses: actions/setup-python@v1
    with:
      python-version: '3.7'

  - name: Create and start virtual environment
    run: |
      python -m venv venv
      source venv/bin/activate
  
  - name: Setup SSH for Private Repos
    uses: webfactory/[email protected]
    with:
      ssh-private-key: |
        ${{ secrets.IBMI_MHC_SECRET }}
    

  - name: Install Dependencies
    run: |
      pip install -r requirements.txt

  # Optional: Add step to run tests here (PyTest, Django test suites, etc.)
  
  - name: Upload artifact for deployment jobs
    uses: actions/upload-artifact@v2
    with:
      name: python-app
      path: |
        . 
        !venv/

deploy:
  runs-on: ubuntu-latest
  needs: build
  environment:
    name: 'Production'
    url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}

steps:
  - name: Setup SSH for Private Repos
    uses: webfactory/[email protected]
    with:
      ssh-private-key: |
        ${{ secrets.IBMI_MHC_SECRET }}

  - name: Download artifact from build job
    uses: actions/download-artifact@v2
    with:
      name: python-app
      path: .
      
  - name: 'Deploy to Azure Web App'
    uses: azure/webapps-deploy@v2
    id: deploy-to-webapp
    with:
      app-name: 'mhc-customers'
      slot-name: 'Production'
      publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_89B81B4839F24A7589B3A4D5D845DA59 }}

Would using https for the deployment phase work better? (using /usr/bin/git config --global --add url.https://github.com/.insteadOf [email protected]:) — VonC
– VonC, Commented Sep 13, 2022 at 6:04
I switched to HTTPs which still works during the build phase, but fails during the deploy. After more research I'm seeing that the azure/webapps-deploy@v2 has its own docker and build using Oryx - which is the specific issue here. I have no way of telling Oryx to use that HTTPs command, or to use SSH when reading my requirements.txt — Austin Hill
– Austin Hill, Commented Sep 13, 2022 at 13:42

Austin Hill · Accepted Answer · 2022-09-13 14:49:15Z

1

I've got this working - sort of. After reading up on the Oryx automated build platform https://github.com/microsoft/Oryx I added a appsvc.yaml in the application root that ran this config:

version: 1

pre-build: | 
git config --global url."https://{secret}@github".insteadOf https://github

The problem is that we have to put our actual Github secret in the config yaml (in replace of "secret"). This isn't ideal but works to get Oryx using the correct credentials.

answered Sep 13, 2022 at 14:49

Austin Hill

315 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Github Workflow deploying Python app to Azure App Service

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related