Deploying Azure Functions via GitHub Actions without Publish Profile
Tags: azure, azurefunctions, githubactions, publishprofile
Published: 2020-11-06 00:00:46

---
title: "Deploying Azure Functions via GitHub Actions without Publish Profile"
published: true
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/5ipxefxcv25pknyfyc2d.png
description: "This post shows how to deploy Azure Functions app via GitHub Actions, without having to know the publish profile."
tags: azure, azurefunctions, githubactions, publishprofile
canonical_url: https://devkimchi.com/2020/11/05/deploying-azure-functions-via-github-actions-without-publish-profile/
series: Azure Functions with Custom APEX Domain, SSL Certificate, Azure DNS and GitHub Actions
---

In my [previous post][post 3], I walked through how to update an A record of DNS server and renew the SSL certificate automatically, when an inbound IP of the [Azure Functions][az func] instance changes, using [GitHub Actions][gh actions] workflow. As the last post of this series, I'm going to discuss how to deploy the Azure Functions app through GitHub Actions workflow, without having to know the publish profile.


## Azure Functions Action ##

There is an official [GitHub Actions for Azure Functions deployment][gh actions azfunc] on GitHub Marketplace. The following YAML pipeline shows how to use it. The `publish-profile` parameter takes the publish profile of your Azure Functions instance for deployment (line #11).

{% gist https://gist.github.com/justinyoo/d806e47efde7749c6154b19f081f86d2 file=01-az-func-deploy.yaml %}

As you can see the sample pipeline above, we should store the publish profile onto the repository's secrets. If the publish profile is reset for some reason, the secret MUST be updated with the new profile, **manually**. It's cumbersome. What if we populate and make use of the publish profile within the GitHub Actions workflow? Yes, we can!


## GitHub Action: PowerShell Scripts ##

In order to populate the publish profile, you need to log-in to [Azure PowerShell][az pwsh] through [Azure Login][gh actions az login]. The `enable-AzPSSession` parameter value of `true` lets you log-in to Azure PowerShell session (line #9).

{% gist https://gist.github.com/justinyoo/d806e47efde7749c6154b19f081f86d2 file=02-az-login.yaml %}

Then, get the publish profile value, using the PowerShell action below (line #10-12). As the publish profile is basically an XML document, you should remove all the line-feed characters to make the XML document into one linear string (line #14). Finally, the XML document is set to an output value (line #16).

{% gist https://gist.github.com/justinyoo/d806e47efde7749c6154b19f081f86d2 file=03-get-publish-profile.yaml %}

Once it's done, let's render the output value on the workflow log.

{% gist https://gist.github.com/justinyoo/d806e47efde7749c6154b19f081f86d2 file=04-show-publish-profile.yaml %}

The result might look like the following. Here's the weird thing. We got the publish profile successfully, but the password part is not properly masked. Therefore, as soon as the publish profile is displayed like this, we MUST assume that this publish profile is no longer safe to use.

![][image-01]

I mean, the publish profile itself is still valid. But after the deployment, it's safe to reset the profile from the security perspective. Therefore, use the following action to reset the publish profile (line #9-13).

{% gist https://gist.github.com/justinyoo/d806e47efde7749c6154b19f081f86d2 file=05-reset-publish-profile.yaml %}

So, the entire workflow for Azure Functions deployment is:

1. Download the publish profile for the Azure Functions app,
2. Deploy the Functions app using the publish profile, and
3. Reset the publish profile for the Azure Functions app.


## GitHub Action: Azure App Service Publish Profile ##

Those PowerShell script needs to be written every time you define a new workflow. But it would be great if there is GitHub Actions for it. Of course, there is. If you use this [Azure App Service Publish Profile][gh actions appsvc profile] action, you can get the publish profile and reset it easily. Let's set up the workflow like below:

1. Download the publish profile for the Azure Functions app (line #12-19),
2. Deploy the Functions app using the publish profile (line #26), and
3. Reset the publish profile for the Azure Functions app (line #28-35).

{% gist https://gist.github.com/justinyoo/d806e47efde7749c6154b19f081f86d2 file=06-workflow.yaml %}

With this action, we don't have to know the publish profile, but the workflow takes care of it. In addition to that, by any chance the publish profile is compromised, the last action always resets the profile. Therefore, the compromised one is no longer valid.

---

So far, we've walked through how we can deploy Azure Functions app through [GitHub Actions][gh actions], with no knowledge of the publish profile and reset the profile. I hope this approach would help build your CI/CD pipeline.


[image-01]: https://sa0blogs.blob.core.windows.net/devkimchi/2020/11/deploying-azure-functions-via-github-actions-without-publish-profile-01.png

[post 1]: /azure/3-ways-to-map-apex-domains-to-azure-functions-4m6i
[post 2]: /azure/binding-let-s-encrypt-ssl-certificate-to-azure-functions-529a
[post 3]: /azure/updating-azure-dns-and-ssl-certificate-via-github-actions-1a73
[post 4]: /azure/tbp

[az func]: https://docs.microsoft.com/azure/azure-functions/functions-overview?WT.mc_id=devops-10696-juyoo

[az pwsh]: https://docs.microsoft.com/powershell/azure/new-azureps-module-az?WT.mc_id=devops-10696-juyoo

[gh actions]: https://docs.github.com/en/free-pro-team@latest/actions
[gh actions az login]: https://github.com/marketplace/actions/azure-login#configure-deployment-credentials
[gh actions azfunc]: https://github.com/marketplace/actions/azure-functions-action
[gh actions appsvc profile]: https://github.com/marketplace/actions/azure-app-service-publish-profile