Automating Azure App Service Deployments with GitHub Actions and Secure Secrets

The Deployment Pipeline That Pays for Itself

Manual deployments are a tax. Every manual step is a potential error, a context switch, and a reason deployments slow down as the team grows. CI/CD pipelines convert that tax into a fixed one-time investment.

This is the GitHub Actions pipeline we use for deploying Next.js + FastAPI applications to Azure App Service — with secrets managed via Azure Key Vault, environment configuration via GitHub Environments, and zero-downtime slot swaps.

The Overall Pipeline Structure

The key design decision: separate jobs for test, build, staging deploy, and production deploy — each requiring the previous to succeed, with manual approval gates on production.

Authentication: OIDC Instead of Service Principal Secrets

The old pattern — create a service principal, store the JSON credentials as a GitHub secret — works but requires rotating secrets and gives broad access. The modern pattern usesOpenID Connect (OIDC) to mint short-lived tokens on demand with no stored secrets.

Azure configuration (one-time setup):

Building and Pushing to Azure Container Registry

The

lines enable GitHub Actions layer caching — Docker build times drop from 3–4 minutes to 30–45 seconds on warm cache.

Zero-Downtime Deployment with Slot Swaps

Azure App Service deployment slots let you deploy to a staging slot, warm it up, then swap it into production atomically:

Environment Variables and Secrets Strategy

Never put secrets in YAML files. The hierarchy:

Non-sensitive configuration → App Service Application Settings:

Secrets → Azure Key Vault references:

Key Vault references auto-rotate: when the secret value changes in Key Vault, App Service picks up the new value on the next restart without any pipeline changes.

The Complete Picture

From

to production-ready container: 4–6 minutes. From manual approval to live traffic: 2 minutes. Rollback (swap back): 90 seconds.