gh-actions-azure-webapps-deploy

cleared
Configures GitHub Actions deployment to Azure App Service (Web Apps) using the official azure/webapps-deploy action—publish-profile or Azure Login (service principal), package paths, slots, and containers. Use when adding or updating Azure Web App deploy steps, App Service CI/CD, or migrating from Azure DevOps deploy to GitHub Actions.
files.json SKILL.md
---
name: gh-actions-azure-webapps-deploy
description: >-
  Configures GitHub Actions deployment to Azure App Service (Web Apps) using the
  official azure/webapps-deploy action—publish-profile or Azure Login (service
  principal), package paths, slots, and containers. Use when adding or updating
  Azure Web App deploy steps, App Service CI/CD, or migrating from Azure DevOps
  deploy to GitHub Actions.
---

# GitHub Actions: deploy Azure Web App (`azure/webapps-deploy`)

Official action: [Azure/webapps-deploy](https://github.com/Azure/webapps-deploy).

## What it deploys

- A **folder**, **`.zip`**, **`.jar`**, or **`.war`** to a **Windows or Linux** App Service app.
- **Container** images via the **`images`** input (with registry auth as documented upstream)—not the same path as a zip/folder package.

Unsupported / caveats from upstream docs: **multi-container** deployments **with publish profile**; **`startup-command`** on Linux **only when using service principal auth**, not with publish profile alone. Prefer **`azure/login`** + SPN when you need those options.

## Authentication (pick one per job)

| Mode | When | Workflow pattern |
|------|------|-------------------|
| **Publish profile** | Simplest for many apps; app- or slot-level credentials | **`publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }}`** (full `.PublishSettings` XML in the secret) |
| **Azure Login (SPN)** | OIDC / reusable Azure auth, container deploy without publish profile, some advanced settings | **`azure/login@v2`** (or current major) then **`azure/webapps-deploy`** **without** `publish-profile`, using the same job session |

Store credentials as **GitHub Actions secrets**; never commit publish profiles or `AZURE_CREDENTIALS` JSON.

## Required `with:` inputs (typical)

| Input | Notes |
|--------|--------|
| **`app-name`** | App Service **name** (not full URL). Often from **`env`** or **`vars`**. |
| **`package`** | Path to **folder** or **file** (`.zip` / `.jar` / `.war`) from the build—e.g. **`artifacts`**, **`./artifacts/web`**, **`frontend/dist`**. Must exist on the runner. |
| **`publish-profile`** | Required for publish-profile flow; secret containing profile XML. |
| **`slot-name`** | Optional. Deployment **slot** name when not targeting the default production slot; download that **slot’s** publish profile. Omit when deploying to the default slot. |
| **`images`** | Container deploy: image reference(s), per [action README](https://github.com/Azure/webapps-deploy). |

Re-resolve **`uses:`** with **`update-github-actions-versions`**; do not trust stale sample majors.

## Workflow placement

- Run **after** the build produces **`package`** (same job or after **`download-artifact`**).
- Give the deploy step an **`id:`** (e.g. **`deploy-to-webapp`**) for **`outputs`** or **`if:`** conditions—see **`ci-cd-pipeline-foundation`**.
- Use **`environment:`** on the **job** for protection rules / secrets scoped to **production** or **staging**.

## Operational notes

- **Static frontends:** build with **`npm run build`**, set **`package:`** to the bundler output (often **`dist`**). Pass **`VITE_*`** (or similar) via **`env:`** on the build step using **`${{ vars.* }}`** for non-secrets.
- **Linux** apps: older docs required **`WEBSITE_WEBDEPLOY_USE_SCM=true`** before downloading a publish profile; confirm current Azure guidance if deploy fails.
- Enable **Run from Package** where appropriate to avoid long remote builds on the app.
- Sample workflows by runtime: [Azure/actions-workflow-samples — AppService](https://github.com/Azure/actions-workflow-samples/tree/master/AppService).

## YAML examples

See [reference.md](reference.md) for **publish-profile** and **Azure Login** patterns.