From 53cce474f02606ebd83ff9f5a4b7dd617d073c3d Mon Sep 17 00:00:00 2001 From: Akshay Kumar Date: Fri, 20 Feb 2026 12:10:50 +0530 Subject: [PATCH 1/2] Add a file to keep the version --- src/main.ts | 3 ++- src/version.ts | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) create mode 100644 src/version.ts diff --git a/src/main.ts b/src/main.ts index 752c79395..05400460c 100644 --- a/src/main.ts +++ b/src/main.ts @@ -8,6 +8,7 @@ import { DEPLOYMENT_PROVIDER_TYPES } from "./DeploymentProvider/Providers/BaseWe import { DeploymentProviderFactory } from './DeploymentProvider/DeploymentProviderFactory'; import { IAuthorizer } from 'azure-actions-webclient/Authorizer/IAuthorizer'; import { ValidatorFactory } from './ActionInputValidator/ValidatorFactory'; +import { VERSION } from './version'; var prefix = !!process.env.AZURE_HTTP_USER_AGENT ? `${process.env.AZURE_HTTP_USER_AGENT}` : ""; @@ -18,7 +19,7 @@ export async function main() { // Set user agent variable let usrAgentRepo = crypto.createHash('sha256').update(`${process.env.GITHUB_REPOSITORY}`).digest('hex'); let actionName = 'DeployWebAppToAzure'; - let userAgentString = (!!prefix ? `${prefix}+` : '') + `GITHUBACTIONS_${actionName}_${usrAgentRepo}`; + let userAgentString = (!!prefix ? `${prefix}+` : '') + `GITHUBACTIONS_${actionName}_${usrAgentRepo}_${VERSION}`; core.exportVariable('AZURE_HTTP_USER_AGENT', userAgentString); // Initialize action inputs diff --git a/src/version.ts b/src/version.ts new file mode 100644 index 000000000..4a7906d32 --- /dev/null +++ b/src/version.ts @@ -0,0 +1,2 @@ +// Update this file before release. +export const VERSION = 'dev'; From 76722e7dcb8fe04223365300dcc81c57fcc0095d Mon Sep 17 00:00:00 2001 From: Akshay Kumar Date: Fri, 14 Aug 2026 13:30:45 +0530 Subject: [PATCH 2/2] Harden Windows container publish profile workflow --- .../pr_check_windows_container_pubprofile.yml | 84 +--------------- .../windows_container_pubprofile_deploy.yml | 99 +++++++++++++++++++ 2 files changed, 104 insertions(+), 79 deletions(-) create mode 100644 .github/workflows/windows_container_pubprofile_deploy.yml diff --git a/.github/workflows/pr_check_windows_container_pubprofile.yml b/.github/workflows/pr_check_windows_container_pubprofile.yml index 3417fc3b3..d3ebf41a7 100644 --- a/.github/workflows/pr_check_windows_container_pubprofile.yml +++ b/.github/workflows/pr_check_windows_container_pubprofile.yml @@ -1,103 +1,29 @@ name: pr_check_windows_container_publishprofile on: - push: - branches: - - master - - releases/* - paths-ignore: - - '**.md' pull_request: branches: - master - 'releases/*' permissions: - id-token: write - -env: - AZURE_WEBAPP_NAME: wincontainerswebapp # set this to your application's name - CONTAINER_REGISTRY: webdeployprtestscontainerregistry.azurecr.io # set secret with Container Registry URL, example : xyz.azurecr.io + contents: read jobs: - build-and-deploy: - environment: automation test - name: Validate PR + validate-pr: + name: Validate PR build runs-on: windows-latest steps: - # checkout the repo - - name: 'Checkout Github Action' - uses: actions/checkout@master - with: - repository: GH-ACE/python_container_App - ref: main - path: 'python_container_App' - - - name: Azure authentication - uses: azure/login@v2 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - - name: Logout from Azure Container Registry - run: | - docker logout env.CONTAINER_REGISTRY - - - name: Login to Azure Container Registry - uses: azure/docker-login@v1 - with: - login-server: ${{ env.CONTAINER_REGISTRY }} - username: ${{ secrets.WEBDEPLOY_TEST_ACR_USERNAME }} - password: ${{ secrets.WEBDEPLOY_TEST_ACR_PASSWORD }} - - - name: Pull and tag an image and push it to ACR - run: | - pwd - cd python_container_App - docker pull mcr.microsoft.com/azure-app-service/windows/canary:5.0-nanoserver - docker tag mcr.microsoft.com/azure-app-service/windows/canary:5.0-nanoserver ${{ env.CONTAINER_REGISTRY }}/containerwebapp/canaryreplica:latest - docker push ${{ env.CONTAINER_REGISTRY }}/containerwebapp/canaryreplica:latest - - - name: Set Web App ACR authentication - uses: Azure/appservice-settings@v1 - with: - app-name: ${{ env.AZURE_WEBAPP_NAME }} - app-settings-json: | - [ - { - "name": "DOCKER_REGISTRY_SERVER_PASSWORD", - "value": "${{ secrets.WEBDEPLOY_TEST_ACR_PASSWORD }}", - "slotSetting": false - }, - { - "name": "DOCKER_REGISTRY_SERVER_URL", - "value": "https://${{ env.CONTAINER_REGISTRY }}", - "slotSetting": false - }, - { - "name": "DOCKER_REGISTRY_SERVER_USERNAME", - "value": "${{ secrets.WEBDEPLOY_TEST_ACR_USERNAME }}", - "slotSetting": false - } - ] - - name: Checkout from PR branch - uses: actions/checkout@v2 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: repository: ${{ github.event.pull_request.head.repo.full_name }} path: 'webapps-deploy' ref: ${{ github.event.pull_request.head.sha }} + persist-credentials: false - name: Installing dependencies and building latest changes in action run: | cd webapps-deploy npm ci npm run package - - - name: 'Deploy to Azure WebApp' - uses: ./webapps-deploy/ - with: - app-name: ${{ env.AZURE_WEBAPP_NAME }} # Replace with your app name - publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} - images: ${{ env.CONTAINER_REGISTRY }}/containerwebapp/canaryreplica:latest \ No newline at end of file diff --git a/.github/workflows/windows_container_pubprofile_deploy.yml b/.github/workflows/windows_container_pubprofile_deploy.yml new file mode 100644 index 000000000..9a789a53a --- /dev/null +++ b/.github/workflows/windows_container_pubprofile_deploy.yml @@ -0,0 +1,99 @@ +name: windows_container_publishprofile_deploy + +on: + push: + branches: + - master + - releases/* + paths-ignore: + - '**.md' + +permissions: + contents: read + +env: + AZURE_WEBAPP_NAME: wincontainerswebapp # set this to your application's name + CONTAINER_REGISTRY: webdeployprtestscontainerregistry.azurecr.io # set secret with Container Registry URL, example : xyz.azurecr.io + +jobs: + build-and-deploy: + environment: automation test + name: Deploy trusted push + runs-on: windows-latest + permissions: + contents: read + id-token: write + steps: + - name: 'Checkout Github Action' + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + repository: GH-ACE/python_container_App + ref: main + path: 'python_container_App' + persist-credentials: false + + - name: Azure authentication + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + - name: Logout from Azure Container Registry + run: docker logout ${{ env.CONTAINER_REGISTRY }} + + - name: Login to Azure Container Registry + uses: azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1 + with: + login-server: ${{ env.CONTAINER_REGISTRY }} + username: ${{ secrets.WEBDEPLOY_TEST_ACR_USERNAME }} + password: ${{ secrets.WEBDEPLOY_TEST_ACR_PASSWORD }} + + - name: Pull and tag an image and push it to ACR + run: | + cd python_container_App + docker pull mcr.microsoft.com/azure-app-service/windows/canary:5.0-nanoserver + docker tag mcr.microsoft.com/azure-app-service/windows/canary:5.0-nanoserver ${{ env.CONTAINER_REGISTRY }}/containerwebapp/canaryreplica:latest + docker push ${{ env.CONTAINER_REGISTRY }}/containerwebapp/canaryreplica:latest + + - name: Set Web App ACR authentication + uses: Azure/appservice-settings@1808c4fbba4b8723107948a295d396a5c0e33dcd # v1 + with: + app-name: ${{ env.AZURE_WEBAPP_NAME }} + app-settings-json: | + [ + { + "name": "DOCKER_REGISTRY_SERVER_PASSWORD", + "value": "${{ secrets.WEBDEPLOY_TEST_ACR_PASSWORD }}", + "slotSetting": false + }, + { + "name": "DOCKER_REGISTRY_SERVER_URL", + "value": "https://${{ env.CONTAINER_REGISTRY }}", + "slotSetting": false + }, + { + "name": "DOCKER_REGISTRY_SERVER_USERNAME", + "value": "${{ secrets.WEBDEPLOY_TEST_ACR_USERNAME }}", + "slotSetting": false + } + ] + + - name: Checkout trusted action commit + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + path: 'webapps-deploy' + persist-credentials: false + + - name: Installing dependencies and building latest changes in action + run: | + cd webapps-deploy + npm ci + npm run package + + - name: 'Deploy to Azure WebApp' + uses: ./webapps-deploy/ + with: + app-name: ${{ env.AZURE_WEBAPP_NAME }} # Replace with your app name + publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} + images: ${{ env.CONTAINER_REGISTRY }}/containerwebapp/canaryreplica:latest \ No newline at end of file