使用GitHub CI/CD部署Azure函数到API管理失败求助

错误核心原因 #

部署阶段的登录失败，本质是GitHub Secrets中配置的服务主体凭据格式不完整或错误。azure/login@v1 要求 creds 参数必须是包含 clientId、clientSecret、tenantId、subscriptionId 的完整JSON结构，你的配置中 secrets.KimaAPI_SPN 大概率缺少必要字段或格式不符合要求，导致服务主体认证失败。

修复步骤 #

1. 正确配置GitHub Secrets的服务主体凭据 #

• 在Azure Cloud Shell中生成服务主体完整凭据：
  执行以下命令（替换<你的订阅ID>为实际值）：

  az ad sp create-for-rbac --name "KimaAPI-SPN" --role "API Management Contributor" --scopes /subscriptions/<你的订阅ID>/resourceGroups/HeritageBrowserIL
  

  复制输出的JSON内容，格式示例：

  {
    "clientId": "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "clientSecret": "xxxxxx~xxxxxx-xxxxxx-xxxxxx",
    "tenantId": "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "subscriptionId": "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  }
  

• 进入GitHub仓库的「Settings」→「Secrets and variables」→「Actions」，创建名为 KimaAPI_SPN 的Secret，粘贴上述完整JSON内容。

2. 修复工作流中的潜在问题 #

（1）补充Swagger URL参数

当前 AZURE_APIM_SWAGGERURL 为空，导入API时需要指定函数应用的Swagger端点，例如：

AZURE_APIM_SWAGGERURL: 'https://NewKimaAPI.azurewebsites.net/admin/swagger.json'

注：需确保函数应用已启用Swagger（.NET 8独立模式函数默认会暴露该端点）。

（2）统一Dotnet工具版本

将工作流中旧版的 setup-dotnet@v1 替换为 setup-dotnet@v3，保持工具版本一致：

- name: Setup .NET Core (for inproc extensions)
  uses: actions/setup-dotnet@v3
  with:
    dotnet-version: ${{ env.DOTNET_CORE_VERSION_INPROC }}

（3）验证服务主体权限

确认服务主体已被授予目标资源组的「API Management Contributor」角色，否则无法执行API导入操作。

修正后的完整工作流示例 #

name: Build and deploy .NET Core application to Function App NewKimaAPI with API Management Service KimaAPI-NewKimaAPI
on:
  push:
    branches:
    - master
env:
  AZURE_FUNCTIONAPP_NAME: NewKimaAPI
  AZURE_FUNCTIONAPP_PACKAGE_PATH: NewKimaAPI
  CONFIGURATION: Release
  DOTNET_CORE_VERSION: 8.0.x
  WORKING_DIRECTORY: NewKimaAPI
  DOTNET_CORE_VERSION_INPROC: 8.0.x
  AZURE_APIM_RESOURCEGROUP: HeritageBrowserIL
  AZURE_APIM_SERVICENAME: KimaAPI
  AZURE_APIM_API_ID: NewKimaAPI
  AZURE_APIM_RESOURCE_PATH: /
  AZURE_APIM_SWAGGERURL: 'https://NewKimaAPI.azurewebsites.net/admin/swagger.json'
jobs:
  build:
    runs-on: windows-latest
    steps:
    - uses: actions/checkout@v4
    - name: Setup .NET SDK
      uses: actions/setup-dotnet@v3
      with:
        dotnet-version: ${{ env.DOTNET_CORE_VERSION }}
    - name: Setup .NET Core (for inproc extensions)
      uses: actions/setup-dotnet@v3
      with:
        dotnet-version: ${{ env.DOTNET_CORE_VERSION_INPROC }}
    - name: Restore
      run: dotnet restore "${{ env.WORKING_DIRECTORY }}"
    - name: Build
      run: dotnet build "${{ env.WORKING_DIRECTORY }}" --configuration ${{ env.CONFIGURATION }} --no-restore
    - name: Publish
      run: dotnet publish "${{ env.WORKING_DIRECTORY }}" --configuration ${{ env.CONFIGURATION }} --no-build --output "${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}"
    - name: Publish Artifacts
      uses: actions/upload-artifact@v3
      with:
        name: functionapp
        path: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
  deploy:
    runs-on: windows-latest
    needs: build
    steps:
    - name: Download artifact from build job
      uses: actions/download-artifact@v3
      with:
        name: functionapp
        path: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
    - name: Deploy to Azure Function App
      uses: Azure/functions-action@v1
      with:
        app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }}
        publish-profile: ${{ secrets.NewKimaAPI_AABB }}
        package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
    - name: Azure Login
      uses: azure/login@v1
      with:
        creds: ${{ secrets.KimaAPI_SPN }}
    - name: Import API into Azure API Management
      run: az apim api import --path "${{ env.AZURE_APIM_RESOURCE_PATH }}" --resource-group ${{ env.AZURE_APIM_RESOURCEGROUP }} --service-name ${{ env.AZURE_APIM_SERVICENAME }} --api-id ${{ env.AZURE_APIM_API_ID }} --specification-url "${{ env.AZURE_APIM_SWAGGERURL }}" --specification-format OpenApi --subscription-required false

内容的提问来源于stack exchange，提问作者GilShalit