What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
GitHub Actions can continuously deploy an existing Microsoft Foundry hosted-agent project and run a smoke test against the deployed agent. The documented pattern uses Azure Developer CLI (azd) and GitHub OpenID Connect (OIDC): it does not create the entire Foundry environment from scratch, and a non-empty test response is only a basic deployment check—not proof that the agent is correct or production-ready.
What the GitHub Actions pipeline does
Microsoft’s hosted-agent CI/CD quickstart describes a workflow that deploys updated agent code, checks deployment status, then invokes the deployed agent and verifies that it returns a response. Its template uses azd to deploy, with GitHub Actions authenticating to Azure through OIDC. The starting point is an already provisioned and successfully deployed Foundry project with a hosted agent.
The workflow’s example triggers on pushes to the main branch and also supports manual runs. It requests id-token: write and contents: read. Treat those as template settings to adapt to your repository’s branch, approval, and permission policies, rather than universal requirements. See Microsoft’s hosted-agent CI/CD quickstart.
Prepare the hosted-agent project
Provision and deploy once before automating
Start with a working hosted-agent project and deploy it successfully using the workflow your team already uses, or a supported Foundry development tool. The GitHub Actions template automates later deployments of the project; it is not a zero-to-one environment provisioning recipe.
#1 Best Overall
Check the current toolchain requirements
Microsoft’s own-code quickstart documents Python and .NET hosted-agent projects, including projects built with Microsoft Agent Framework, LangGraph, GitHub Copilot SDK, OpenAI Agents SDK, or custom code that calls a model directly. Its listed prerequisites include Azure Developer CLI 1.27.1 or later, the Microsoft Foundry azd extension, an authenticated azd session, and an Azure subscription. The Python path lists Python 3.13 or later; the C# path lists the .NET 10 SDK or later. Versions and prerequisites can change, so check the current own-code quickstart before setting up a runner.
Choose a deployment and infrastructure approach
| Decision | Documented options | Choose based on |
|---|---|---|
| Agent packaging | Source-code ZIP deployment for Python or .NET; container deployment | ZIP deployment lets the platform build dependencies or use bundled dependencies. A container gives the team control over the runtime image and fits projects that already have a Dockerfile. |
| Infrastructure as code | Bicep; Terraform | Use the approach that fits the team’s infrastructure workflow and experience. Microsoft’s Azure Developer CLI CI/CD guide covers both and includes Terraform state setup guidance. |
| CI/CD service | GitHub Actions; Azure DevOps | Choose based on where the repository and existing delivery process live; Microsoft documents both options. |
For source-code deployment, Azure Developer CLI and the Foundry VS Code toolkit can automate packaging, upload, status polling, and role configuration. Container deployments also need the Azure permissions required to build and push the image and access related resources. Microsoft notes that some content in its Azure Developer CLI CI/CD guide is public preview, without a service-level agreement, and not recommended for production workloads. That warning applies to the preview content, not automatically to every Foundry or GitHub Actions feature; check each feature’s current status before relying on it.
Configure GitHub-to-Azure authentication with OIDC
Rather than storing a long-lived Azure credential as a GitHub secret, configure a Microsoft Entra application or federated credential to trust the intended GitHub Actions identity. The Foundry quickstart specifies the Foundry User role and Contributor role on the target Foundry project for source-code deployment. Container deployment needs additional Azure RBAC permissions for its image and related resources. Confirm the appropriate scope and permissions for your project before assigning roles.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Create a narrowly scoped federated trust. Configure Microsoft Entra to trust the intended GitHub repository and deployment identity. GitHub says the cloud trust policy needs at least one condition so an untrusted repository cannot request an access token. Limit trust to the relevant repository and branch, tag, or environment as appropriate.
- Grant only the required Azure roles. Assign the roles and scope required for the deployment path you selected. Avoid broad permissions that the workflow does not need.
- Set workflow permissions deliberately. The job requesting an OIDC token needs
id-token: write. This permission allows the workflow to request a token; it does not itself grant access to Azure resources. Keep other workflow permissions, such ascontents: read, limited to what the job needs. - Protect deployment environments where used. Use GitHub environment protection rules to restrict which branches or tags can deploy or access environment secrets. Review third-party actions and workflow changes through your organization’s normal controls.
See GitHub’s Azure OIDC configuration guidance and secure-use recommendations. OIDC removes the need for a stored long-lived Azure credential in GitHub; it does not remove the need to secure the trust relationship or scope Azure access.
Store configuration and secrets appropriately
Keep non-secret project configuration in GitHub repository variables, as appropriate for the workflow template, and store any required application secrets as secrets—not as plain-text variables. Azure sign-in through OIDC should use federated identity rather than a long-lived Azure client secret. Limit access to secrets and deployment environments to the branches and people that need them.
Deploy, check status, and smoke-test the agent
The workflow should deploy the project with azd, inspect the resulting agent status, and then invoke the deployed agent with a safe, dependable prompt. Follow Microsoft’s quickstart template for the exact commands and project-specific configuration; adapt its trigger and permissions to your repository rather than copying them blindly.
- Run the workflow after a qualifying push or start it manually, according to your configured trigger.
- Authenticate to Azure through the federated OIDC identity, then select or set the intended Foundry project environment.
- Deploy the updated hosted-agent code using
azd. - Wait for deployment status and treat an unsuccessful status as a failure, not as a successful rollout.
- Invoke the deployed agent with a prompt designed to produce a safe, reliable response without depending on external services or unpredictable facts.
- Fail the workflow if the response is empty. Record enough output to diagnose a deployment or invocation failure without exposing secrets or sensitive user data in logs.
What a smoke test proves—and what it does not
A successful smoke test establishes that the deployed agent could be invoked through the tested path and returned a non-empty response at that time. It can catch failures such as a deployment that did not become available or an invocation path that returns nothing.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteIt does not establish that the answer is factually correct, follows instructions across cases, handles edge cases, meets latency or availability goals, or is safe for production use. Use a broader evaluation process and operational checks for those questions; the quickstart’s smoke test is not a substitute for them.
Common implementation choices
ZIP deployment or container
Use source-code ZIP deployment when platform-managed packaging and dependency handling suit the project. Choose a container when runtime-image control matters or a Dockerfile is already part of the build. The container path brings additional image build, push, and access permissions to manage.
GitHub Actions or Azure DevOps
The documented delivery pattern is not exclusive to GitHub Actions: Microsoft’s Azure Developer CLI CI/CD guide also covers Azure DevOps. Prefer the service that fits your repository location and established delivery controls.
Keep preview status specific
Azure Developer CLI’s CI/CD documentation identifies some material as public preview and says that preview content lacks an SLA and is not recommended for production workloads. Verify the current status of the particular feature you plan to use instead of treating that qualification as a blanket statement about all Foundry deployments.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
