| name | azure-deploy |
| description | Deploy a static UI to Azure Static Web Apps and a backend API to Azure App Service using OIDC Workload Identity Federation. Orchestrates three subskills — wif (identity setup), swa (static UI deploy), appservice (API deploy). Use when deploying any service to Azure via GitHub Actions. Keywords: azure static web apps, azure app service, oidc, workload identity, github actions, deploy. |
Azure Deploy
Deploy a static UI to Azure Static Web Apps and a backend API to Azure App Service using passwordless OIDC — no long-lived secrets stored in GitHub.
Configuration
All deployment metadata lives in .claude/skills/azure-deploy/deploy.json. Read and customize it before running any subskill.
{
"ResourceGroup": "rg-myapp",
"Location": "westeurope",
"WIF": "wi-myapp",
"GitHubRepo": "org/repo",
"SWA": {
"Name": "swa-myapp",
"AppLocation": "src/ui",
"OutputLocation": "dist/my-ui/browser"
},
"AppService": {
"Name": "app-myapi",
"Plan": "asp-myapp",
"Sku": "F1",
"Runtime": "DOTNETCORE:10.0",
"Source": "src/api"
}
}
Subskills
Run wif once for initial setup. swa and appservice are used for every deploy.
wif — Workload Identity Federation
Creates managed identity, assigns Contributor role, and establishes federated trust with GitHub Actions — no secrets needed.
Trigger: "set up workload identity", "create WIF", "configure OIDC for GitHub Actions"
See: .claude/skills/azure-deploy/wif/SKILL.md
swa — Azure Static Web Apps
Builds the UI and deploys to Azure Static Web Apps. Retrieves the SWA deployment token via Azure CLI after OIDC login — the deploy action cannot use the OIDC session directly.
Trigger: "deploy UI", "deploy to static web apps", "deploy SWA", "deploy Angular"
See: .claude/skills/azure-deploy/swa/SKILL.md
appservice — Azure App Service
Publishes the API with dotnet publish and deploys to Azure App Service (F1 free tier) via azure/webapps-deploy@v2.
Trigger: "deploy API", "deploy to app service", "deploy .NET"
See: .claude/skills/azure-deploy/appservice/SKILL.md
Architecture
GitHub Actions (OIDC)
│
▼
WIF Managed Identity
├── Contributor → Azure Static Web Apps ◄── UI build (npm run build)
└── Contributor → Azure App Service ◄── API build (dotnet publish)
Required GitHub Secrets
Set once via the wif subskill:
| Secret | How to retrieve |
|---|
AZURE_CLIENT_ID | az identity show --name <WIF> --resource-group <RG> --query clientId -o tsv |
AZURE_TENANT_ID | az account show --query tenantId -o tsv |
AZURE_SUBSCRIPTION_ID | az account show --query id -o tsv |