GitHub Actions

Overview

We implement GitHub Actions workflows for build, test, and deployment to Azure. OpenID Connect to Entra ID is used so the workflow does not store a client secret, and environments protect the production deployment.

We split workflows so a documentation change does not redeploy infrastructure, and we pin actions to a commit or a version you can review. Runners are GitHub-hosted unless a private network forces a larger runner or a self-hosted one.

What we deliver

• Workflows for build, infrastructure, and application release
• OIDC federation to Entra ID with a scoped role
• GitHub environments and required reviewers for production
• Pinned actions and a note on which jobs need a private runner

Business benefits

• Deployments to Azure do not rely on a stored client secret
• Production runs require a reviewer
• Workflows are specific, so a small change does not redeploy the estate