Azure App Service plan only. No web app or application source is deployed from this repo. Individual apps will be created on this plan later.
| Resource | Name | Notes |
|---|---|---|
| Resource group | strykerg |
Created by the GitHub Actions workflow in West US 3 if missing |
| Location | West US 3 (westus3) |
All resources |
| App Service Plan | strykeapps-plan |
Linux, SKU B1 (Basic) |
Bicep: infra/main.bicep
Parameters: infra/main.bicepparam
.github/workflows/deploy-infra.yml runs on every push to main or master and workflow_dispatch.
It:
- Logs in to Azure with OIDC (
azure/login) - Creates resource group
strykerginwestus3if needed - Runs
az deployment group createagainststrykerg
| Secret | Value |
|---|---|
AZURE_CLIENT_ID |
App registration (client) ID |
AZURE_TENANT_ID |
Microsoft Entra tenant ID |
AZURE_SUBSCRIPTION_ID |
Azure subscription ID |
- In Azure, create an App registration (or use an existing one) and assign it a role on the subscription or on resource group
strykerg(for example Contributor). - On the app registration, open Certificates & secrets → Federated credentials → Add credential.
- Choose GitHub Actions deploying Azure resources.
- Set:
- Organization:
rfeltis - Repository:
strykeapps - Entity: Branch
main(add another credential for Branchmasterif that branch is used) - If login fails with
AADSTS700213, set the credential subject to the value GitHub presented (this org currently usesrepo:rfeltis@2825162/strykeapps@1366365648:ref:refs/heads/main, plus the same form formaster). You can keep classicrepo:rfeltis/strykeapps:ref:refs/heads/main(andmaster) subjects as well.
- Organization:
- Copy the app (client) ID, tenant ID, and subscription ID into the GitHub secrets listed above.
The workflow uses permissions: id-token: write so GitHub can mint the OIDC token for azure/login.