# Azure Nodejs Deployment Via Github Actions

> Best practices and exact steps for deploying a Node.js + Vite application to Azure App Service (Linux) using GitHub Actions and Azure AI Foundry.

- **Type:** Skill
- **Install:** `agentstack add skill-ahtesham-latif-tie-breaker-app-azure-deployment`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Ahtesham-Latif](https://agentstack.voostack.com/s/ahtesham-latif)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Ahtesham-Latif](https://github.com/Ahtesham-Latif)
- **Source:** https://github.com/Ahtesham-Latif/Tie-Breaker-App/tree/main/.agents/skills/azure_deployment
- **Website:** https://tie-breaker-v2-avdmcehxfef8caeh.centralus-01.azurewebsites.net/

## Install

```sh
agentstack add skill-ahtesham-latif-tie-breaker-app-azure-deployment
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Azure App Service Deployment (Node.js)

This skill outlines the flawless, best-practice path to deploy a Node.js application to Azure App Service (Linux) while securely connecting to an Azure AI Foundry agent via Managed Identity.

## 1. Cloud Infrastructure Setup
* **App Service Plan:** Always choose a dedicated tier (e.g., **Basic B1**) for production. Free (F1) tiers have strict 60-minute daily CPU quotas that will forcefully shut down the application (Resulting in a `403 Stopped` error).

## 2. Authentication & Managed Identity (Passwordless)
1. **Code:** Use `DefaultAzureCredential` from `@azure/identity` in the Node.js backend.
2. **Enable Identity:** In the Azure App Service portal, go to **Settings > Identity** and enable **System assigned**.
3. **IAM Permissions:** In the target Azure AI Project, go to **Access control (IAM)** and assign the **Azure AI Developer** role to the App Service's Managed Identity. *(Note: `Cognitive Services OpenAI User` is not sufficient for Azure Foundry Orchestration Agents).*

## 3. Environment Variables (The Frontend vs Backend Trap)
When deploying a full-stack app (React/Vite + Node.js) via GitHub Actions, environment variables must be split logically:

### The Frontend (Vite)
* Variables prefixed with `VITE_` (e.g., Supabase keys) are baked into the static HTML/JS at *build time*.
* **Where to set them:** They MUST be stored in **GitHub Secrets** and explicitly mapped in your `.github/workflows` file under the `env:` block for the `npm run build` step.
* *Danger:* If they are only in Azure and not in GitHub Actions, Vite will build the frontend with empty variables.

### The Backend (Node.js)
* The live `server.js` file reads environment variables at *runtime* from the cloud container.
* **Where to set them:** Configure variables (e.g., Azure AI endpoints, Backend Supabase keys) directly in the Azure Portal under **Settings > Environment variables**.
* *Danger:* The Azure App Service backend does NOT inherit your GitHub Actions secrets. You must set them in the Azure Portal manually.
* **Crucial:** Variables are loaded into memory exactly once when the Node.js process starts. If a variable is added or changed, you **must** explicitly click **Restart** on the App Service Overview page.
* To trust the Azure Load Balancer (required for `express-rate-limit`), ensure the Express app has `app.set('trust proxy', 1);`.

## 4. GitHub Actions CI/CD Pipeline
The safest deployment strategy avoids conflicting build engines (GitHub vs. Azure Oryx). Let GitHub do 100% of the building and packaging.

### Workflow Best Practices:
1. GitHub runs `npm install` and the frontend build (`npm run build`).
2. GitHub uploads an artifact containing the compiled output (`dist`), backend files (`server.js`), and **crucially**, the `node_modules` folder.
   * *Why?* If `node_modules` is omitted, Azure's Oryx engine attempts to build the app itself by executing `npm run build`, which will crash because the raw source files (`index.html`) were not uploaded.
3. Use `azure/webapps-deploy@v3` with a Publish Profile stored as a GitHub Secret.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Ahtesham-Latif](https://github.com/Ahtesham-Latif)
- **Source:** [Ahtesham-Latif/Tie-Breaker-App](https://github.com/Ahtesham-Latif/Tie-Breaker-App)
- **License:** MIT
- **Homepage:** https://tie-breaker-v2-avdmcehxfef8caeh.centralus-01.azurewebsites.net/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-ahtesham-latif-tie-breaker-app-azure-deployment
- Seller: https://agentstack.voostack.com/s/ahtesham-latif
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.