使用GitHub Actions配置Teams Toolkit CI/CD遇权限问题求助

一、M365账户GitHub Secrets格式确认 #

你的格式方向正确，但需注意不要使用中文引号，直接填写纯文本值即可：

• M365_ACCOUNT_NAME: user.name@org.microsoft.com（直接填邮箱，无多余引号）
• M365_ACCOUNT_PASSWORD: your-password（直接填密码，无多余引号）
• M365_TENANT_ID: 必须填写你的M365租户ID，不能留空

二、部署错误GetPublishingCredentialsError分析与解决 #

即便账户有Azure订阅参与者权限，仍可能因以下原因触发该错误，按优先级排查：

1. 资源级权限不足 #

订阅级参与者权限无法直接获取App Service的发布凭据，需给账户单独授予目标App Service资源的网站参与者或应用服务贡献者角色：

• 登录Azure门户，找到目标App Service
• 左侧菜单进入「访问控制(IAM)」→「角色分配」
• 确认你的账户已被添加上述角色

2. 凭据配置问题 #

• 若Azure账户启用了MFA（多重身份验证），直接填密码无效，需为账户创建应用密码替代，或改用服务主体认证（更适合CI/CD场景）
• 核对AZURE_ACCOUNT_NAME、AZURE_ACCOUNT_PASSWORD、AZURE_TENANT_ID、AZURE_SUBSCRIPTION_ID的准确性，确保与目标资源所属租户/订阅完全匹配

3. 工作流配置优化（推荐方案） #

用户名密码认证稳定性差，建议改用Azure服务主体：

1. 在Azure中创建服务主体，授予目标App Service资源的「网站参与者」角色
2. 在GitHub Secrets中配置AZURE_CLIENT_ID、AZURE_CLIENT_SECRET、AZURE_TENANT_ID、AZURE_SUBSCRIPTION_ID
3. 修改工作流环境变量，替换原有的用户名密码认证项

4. 基础信息核对 #

• 确认AZURE_RESOURCE_GROUP_NAME和App Service名称与错误提示中的ME***、***完全匹配
• 检查BOT_AZURE_APP_SERVICE_RESOURCE_ID格式是否正确，应为/subscriptions/{订阅ID}/resourceGroups/{资源组名}/providers/Microsoft.Web/sites/{App服务名}

附：整理后的工作流配置 #

# This is just an example workflow for continuous deployment.
# You should customize it to meet your own requirements.
name: 'Continuous Deployment'
on:
  # When new commits are pushed onto the main branch.
  push:
    branches:
      - main
jobs:
  buildAndPublish:
    runs-on: ubuntu-latest
    # You can uncomment the line below to use environments (refer to https://docs.github.com/en/actions/reference/environments). 
    environment: pkb-environment
    env:
      AZURE_ACCOUNT_NAME: ${{secrets.AZURE_ACCOUNT_NAME}}
      AZURE_ACCOUNT_PASSWORD: ${{secrets.AZURE_ACCOUNT_PASSWORD}}
      AZURE_SUBSCRIPTION_ID: ${{secrets.AZURE_SUBSCRIPTION_ID}}
      AZURE_TENANT_ID: ${{secrets.AZURE_TENANT_ID}}
      M365_ACCOUNT_NAME: ${{secrets.M365_ACCOUNT_NAME}}
      M365_ACCOUNT_PASSWORD: ${{secrets.M365_ACCOUNT_PASSWORD}}
      SECRET_BOT_PASSWORD: ${{secrets.SECRET_BOT_PASSWORD}}
      TEMAS_APP_UPDATE_TIME: ${{secrets.TEMAS_APP_UPDATE_TIME}}
      FUNCTION_APP_KEY: ${{secrets.FUNCTION_APP_KEY}}
      FUNCTION_APP_URL: ${{secrets.FUNCTION_APP_URL}}

      BOT_ID: ${{secrets.BOT_ID}}
      TEAMS_APP_ID: ${{secrets.TEAMS_APP_ID}}
      BOT_AZURE_APP_SERVICE_RESOURCE_ID: ${{ secrets.BOT_AZURE_APP_SERVICE_RESOURCE_ID}}
      BOT_DOMAIN: ${{secrets.BOT_DOMAIN}}
      TEAMS_APP_TENANT_ID: ${{secrets.TEAMS_APP_TENANT_ID}}
      M365_TITLE_ID: ${{secrets.M365_TITLE_ID}}
      M365_APP_ID: ${{secrets.M365_APP_ID}}
      TEAMS_APP_PUBLISHED_APP_ID: ${{secrets.TEAMS_APP_PUBLISHED_APP_ID}}
      
      AZURE_RESOURCE_GROUP_NAME: ${{secrets.AZURE_RESOURCE_GROUP_NAME}}
      RESOURCE_SUFFIX: ${{secrets.RESOURCE_SUFFIX}}

      TEAMSFX_ENV: dev
      APP_NAME_SUFFIX: dev

      TEAMSFX_ENV_NAME: 'dev'
      TEAMSFX_CLI_VERSION: 2.*
      CI_ENABLED: true
  
    steps:
      # Setup environment.
      - uses: actions/setup-node@v2
        with:
          node-version: '18'
          
      - name: Checkout the code
        uses: actions/checkout@v2
        
      # Build the project.
      # The way to build the current project depends on how you scaffold it.
      # Different folder structures require different commands set.
      # 'npm ci' is used here to install dependencies and it depends on package-lock.json.
      # If you prefer to use 'npm ci', please make sure to commit package-lock.json first, or just change it to 'npm install'.
      - name: Build the project
        run: npm ci && npm run build
     
     
      - name: Deploy to hosting environment
        uses: OfficeDev/teamsfx-cli-action@v1
        with:
          cli-version: ${{env.TEAMSFX_CLI_VERSION}}
          commands: deploy
          env: ${{env.TEAMSFX_ENV_NAME}}

内容的提问来源于stack exchange，提问作者Paul Bullock