Skip to main content

Git-Ape for DevOps & SRE

TL;DR — Git-Ape provides four GitHub Actions workflows for the full deployment lifecycle: plan-on-PR, deploy-on-merge, destroy-on-request. OIDC auth, no stored secrets, drift detection included.

CI/CD Pipeline Architecture​

OIDC Setup (Zero Stored Secrets)​

Git-Ape uses OIDC federated identity — the GitHub Actions runner exchanges a short-lived token for an Azure access token at deploy time. No AZURE_CREDENTIALS JSON blob.

Required GitHub secrets (identifiers only, not credentials):

SecretPurpose
AZURE_CLIENT_IDApp Registration's client ID
AZURE_TENANT_IDAzure AD tenant ID
AZURE_SUBSCRIPTION_IDTarget subscription ID

Federated credential config:

Issuer:   https://token.actions.githubusercontent.com
Subject:  repo:{org}/{repo}:ref:refs/heads/main
Audience: api://AzureADTokenExchange

:::tip Automated Setup Use @git-ape-onboarding to configure OIDC, RBAC, GitHub environments, and secrets in one guided session. :::

Workflow Deep Dive​

git-ape-plan.yml (PR validation)​

Triggers: PR opened/updated with changes to .azure/deployments/**/template.json

  1. Detect which deployment directories changed
  2. Login to Azure via OIDC
  3. Validate ARM template (az deployment sub validate)
  4. Run what-if analysis (az deployment sub what-if)
  5. Post detailed plan as PR comment (architecture diagram + what-if + validation)

git-ape-deploy.yml (Execution)​

Triggers: Push to main with deployment changes OR /deploy comment on approved PR

  1. OIDC login
  2. Validate template
  3. az deployment sub create
  4. Run integration tests (list resources, test HTTP endpoints)
  5. Commit state.json with deployment result
  6. Post result as PR comment

git-ape-destroy.yml (Teardown)​

Triggers: Push to main where metadata.json status changed to destroy-requested

  1. Read state.json for resource group name
  2. Inventory all resources
  3. az group delete (synchronous, waits for completion)
  4. Update state.json and metadata.json → destroyed

Drift Detection​

GitHub Environment Setup​

Create two protected environments:

EnvironmentPurposeProtection Rules
azure-deployDeployment targetRequired reviewers (optional for prod), branches: main only
azure-destroyTeardown targetRequired reviewers (recommended), branches: main only

Next Steps​