Repository navigation
Replace Azure Static Web App action with az + swa CLI - #3692
Open
Jake Bailey (jakebailey) wants to merge 6 commits into
Open
Jake Bailey (jakebailey) wants to merge 6 commits into
Jake Bailey (jakebailey) wants to merge 6 commits into
Conversation
Preview deployment should not depend on the stale Azure action release or a deployment token stored in GitHub. An isolated preview identity keeps deployment access separate from package-signing permissions. Artifact-provided CLI configuration must not be able to redirect uploads to privileged runner files.
These deployments are PR previews, not staging sites. Keep recognizing the old wording so redeployments do not leave duplicate bot comments.
Keep Azure resource selection with the isolated environment's identity settings instead of hardcoding it in both workflows. Missing settings must fail before deployment or cleanup.
Azure's delete command polls a subscription-scoped operation endpoint that the preview identity cannot read. Confirm deletion through the resource-scoped environment list without broadening its permissions.
The SWA CLI searches configuration directories recursively, so a nested fixture can override the intended root configuration. Isolate that root file before passing its directory to the deployment client.
There was a problem hiding this comment.
🟡 Changes recommended
The unconditional configuration-file copy fails because the Gatsby artifact lacks staticwebapp.config.json, aborting normal preview deployments before swa runs.
1 open issue
What changed in this PR
Replaces the Azure Static Web Apps action with Azure and SWA CLI commands, using OIDC authentication instead of a stored deployment token and avoiding the action’s preview-input warnings.
Changes:
- Deploys PR previews through the SWA CLI and retrieves their URLs from Azure.
- Deletes closed PR previews through Azure, with polling to confirm removal.
- Updates preview comment wording while retaining cleanup of legacy comments.
| File | Description |
|---|---|
.github/workflows/deploy-preview.yml |
Adds OIDC login, CLI deployment, URL lookup, and updated preview comments. |
.github/workflows/close-preview.yml |
Adds OIDC login and Azure-based preview deletion with completion polling. |
Review effort: Balanced
Normal Gatsby builds do not include staticwebapp.config.json. Treat its absence as an empty configuration while keeping nested artifact files out of runtime configuration discovery.
There was a problem hiding this comment.
🔵 Needs a closer look
A maintainer should validate deployment and deletion with the configured Azure identity because the required environment variables, OIDC federation, and RBAC grants cannot be verified from the diff.
No open issues 🎉
1 resolved since last review
Review effort: Balanced
Jake Bailey (jakebailey)
requested review from
Ryan Cavanaugh (RyanCavanaugh),
Andrew Branch (andrewbranch) and
navya9singh
November 5, 2026 17:22
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This allows us to get rid of a copied token in favor of OIDC, and has the side benefit of eliminating the problem that led to #3691.