Github工作流将Python应用程序部署到Azure Azure

Question

我有一个requirements.txt，它的内部依赖关系在私有的Github存储库中。我已经设置了工作流的构建步骤，以使用webfactory/ SSH -agent@v0.5.4来提供SSH身份验证，该身份验证在构建阶段非常有效。由于SSH问题，部署阶段无法进行身份验证，但当Azure Oryx在部署期间处理依赖关系构建时，我找不到类似的方法来使SSH工作。

错误：

Python Version: /opt/python/3.7.12/bin/python3.7
Creating directory for command manifest file if it doesnot exist
Removing existing manifest file
Python Virtual Environment: antenv
Creating virtual environment...
Activating virtual environment...
Running pip install...
"2022-09-12 15:13:31"|ERROR|ERROR: Command errored out with exit status 128: git clone -q 
'ssh://****@github.com/Murphy-Hoffman/IBMi-MHC.git' /tmp/8da94d13f03a38b/antenv/src/ibmi-mhc- 
db2 Check the logs for full command output. | Exit code: 1 | Please review your 
requirements.txt | More information: https://aka.ms/troubleshoot-python
\n/bin/bash -c "oryx build /tmp/zipdeploy/extracted -o /home/site/wwwroot --platform python -- 
platform-version 3.7 -i /tmp/8da94d13f03a38b --compress-destination-dir -p 
virtualenv_name=antenv --log-file /tmp/build-debug.log  | tee /tmp/oryx-build.log ; exit 
$PIPESTATUS "

Generating summary of Oryx build
Parsing the build logs
Found 1 issue(s)

Build Summary :
===============
Errors (1)
1. ERROR: Command errored out with exit status 128: git clone -q 
'ssh://****@github.com/Murphy-Hoffman/IBMi-MHC.git' /tmp/8da94d13f03a38b/antenv/src/ibmi-mhc- 
db2 Check the logs for full command output.  
-  Next Steps: Please review your requirements.txt
-  For more details you can browse to https://aka.ms/troubleshoot-python

我的requirements.txt文件

autopep8==1.7.0
ibm-db==2.0.9
-e git+ssh://git@github.com/Murphy-Hoffman/IBMi- 
MHC.git@57085a5e1f5637bfdd815397b45ba1b2dfd9b52c#egg=IBMi_MHC_db2&subdirectory=utility/db2
-e git+ssh://git@github.com/Murphy-Hoffman/IBMi- 
MHC.git@57085a5e1f5637bfdd815397b45ba1b2dfd9b52c#egg=IBMi_MHC_UNIT&subdirectory=IBMi/_UNIT
itoolkit==1.7.0
pycodestyle==2.9.1
pyodbc==4.0.32
toml==0.10.2

最后，在构建阶段成功但在部署中失败的Github yml

# Docs for the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy
# More GitHub Actions for Azure: https://github.com/Azure/actions
# More info on Python, GitHub Actions, and Azure App Service: https://aka.ms/python-webapps-        
actions

name: Build and deploy Python app to Azure Web App - mhc-customers

on:
push:
branches:
  - main
workflow_dispatch:

jobs:
build:
runs-on: ubuntu-latest

steps:
  - uses: actions/checkout@v2

  - name: Set up Python version
    uses: actions/setup-python@v1
    with:
      python-version: '3.7'

  - name: Create and start virtual environment
    run: |
      python -m venv venv
      source venv/bin/activate
  
  - name: Setup SSH for Private Repos
    uses: webfactory/ssh-agent@v0.5.4
    with:
      ssh-private-key: |
        ${{ secrets.IBMI_MHC_SECRET }}
    

  - name: Install Dependencies
    run: |
      pip install -r requirements.txt

  # Optional: Add step to run tests here (PyTest, Django test suites, etc.)
  
  - name: Upload artifact for deployment jobs
    uses: actions/upload-artifact@v2
    with:
      name: python-app
      path: |
        . 
        !venv/

deploy:
  runs-on: ubuntu-latest
  needs: build
  environment:
    name: 'Production'
    url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}

steps:
  - name: Setup SSH for Private Repos
    uses: webfactory/ssh-agent@v0.5.4
    with:
      ssh-private-key: |
        ${{ secrets.IBMI_MHC_SECRET }}

  - name: Download artifact from build job
    uses: actions/download-artifact@v2
    with:
      name: python-app
      path: .
      
  - name: 'Deploy to Azure Web App'
    uses: azure/webapps-deploy@v2
    id: deploy-to-webapp
    with:
      app-name: 'mhc-customers'
      slot-name: 'Production'
      publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_89B81B4839F24A7589B3A4D5D845DA59 }}

Answer 1

我已经开始工作了-有点。在阅读了Oryx自动构建平台https://github.com/microsoft/Oryx之后，我在运行此配置的应用程序根目录中添加了一个appsvc.yaml：

version: 1

pre-build: | 
git config --global url."https://{secret}@github".insteadOf https://github

问题是我们必须在配置yaml (代替“机密”)中放置实际的Github秘密。这并不理想，但可以让Oryx使用正确的凭据。