使用GitHub Actions部署Azure WebApp时私有仓库二次安装权限问题求助

我正尝试通过GitHub Actions部署至Azure WebApp。在工作流中已成功完成私有仓库的依赖安装，但执行azure/webapps-deploy步骤时出现错误：Oryx构建过程会再次尝试安装该私有仓库，却因无访问权限失败。

我的YAML配置 #

name: Deploy staging
on:
  push:
    branches:
      - development

env:
  AZURE_WEBAPP_NAME: webapp
  WORKING_DIRECTORY: '.'
  PYTHON_VERSION: '3.10'
  STARTUP_COMMAND: ''

jobs:
 build-and-deploy:
  runs-on: ubuntu-latest
  steps:
  - uses: actions/checkout@master

  - name: Setup Python
    uses: actions/setup-python@v4
    with:
     python-version: ${{ env.PYTHON_VERSION }}

  - name: python install
    working-directory: ${{ env.WORKING_DIRECTORY }}
    run: |
      pushd './${{ env.WORKING_DIRECTORY }}'
      python -m pip install --upgrade pip
      git config --global url."https://${{ secrets.ACCESS_TOKEN }}@github".insteadOf https://github
      pip install -r requirements.txt --target=".python_packages/lib/site-packages"
      popd

  - name: Setup Node 18.x
    uses: actions/setup-node@v3
    with:
      node-version: 18
  - name: Install NPM
    run: |
      npm install
      npx tailwindcss -i ./src/static/input.css -o ./src/static/dist/output.css

  - uses: azure/login@v1
    with:
     creds: ${{ secrets.AZURE_SERVICE_PRINCIPAL_WEBAPP }}
  - uses: azure/appservice-settings@v1
    with:
     app-name: ${{ env.AZURE_WEBAPP_NAME }}
     mask-inputs: false
     general-settings-json: '{"linuxFxVersion": "PYTHON|${{ env.PYTHON_VERSION }}"}' #'General configuration settings as Key Value pairs'
  # deploy web app
  - uses: azure/webapps-deploy@v2
    with:
     app-name: ${{ env.AZURE_WEBAPP_NAME }}
     slot-name: 'dev'
     package: ${{ env.WORKING_DIRECTORY }}
     startup-command: ${{ env.STARTUP_COMMAND }}
  # Azure logout
  - name: logout
    run: |
     az logout

错误日志 #

Package deployment using ZIP Deploy initiated.
Updating submodules.
Preparing deployment for commit id '3bf7d247-a'.
PreDeployment: context.CleanOutputPath False
PreDeployment: context.OutputPath /home/site/wwwroot
Repository path is /tmp/zipdeploy/extracted
Running oryx build...
Command: oryx build /tmp/zipdeploy/extracted -o /home/site/wwwroot --platform python --platform-version 3.10 -p virtualenv_name=antenv --log-file /tmp/build-debug.log  -i /tmp/8db894f894ef4e2 --compress-destination-dir | tee /tmp/oryx-build.log
Operation performed by Microsoft Oryx, https://github.com/Microsoft/Oryx
You can report issues at https://github.com/Microsoft/Oryx/issues

Oryx Version: 0.2.20230508.1, Commit: 7fe2bf39b357dd68572b438a85ca50b5ecfb4592, ReleaseTagName: 20230508.1

Build Operation ID: 7b6faa414a4450ba
Repository Commit : 3bf7d247-a0b4-4afd-9325-d2e7b5c8eaec
OS Type           : bullseye
Image Type        : githubactions

Detecting platforms...
Detected following platforms:
  nodejs: 16.20.1
  python: 3.10.8

Using intermediate directory '/tmp/8db894f894ef4e2'.

Copying files to the intermediate directory...
Done in 3 sec(s).

Source directory     : /tmp/8db894f894ef4e2
Destination directory: /home/site/wwwroot

Python Version: /tmp/oryx/platforms/python/3.10.8/bin/python3.10
Creating directory for command manifest file if it does not exist
Removing existing manifest file
Python Virtual Environment: antenv
Creating virtual environment...
Activating virtual environment...
Running pip install...
[18:31:46+0000] Collecting app_base_templates
[18:31:46+0000]   Cloning https://github.com/org/app_base_templates.git to /tmp/pip-install-6ji8be4t/app_96b6a45facdb46e49333e02b79e241e9
  Running command git clone --filter=blob:none --quiet https://github.com/org/app.git /tmp/pip-install-6ji8be4t/app96b6a45facdb46e49333e02b79e241e9
  fatal: could not read Username for 'https://github.com': No such device or address
  error: subprocess-exited-with-error
  
  × git clone --filter=blob:none --quiet https://github.com/org/app.git /tmp/pip-install-6ji8be4t/app_96b6a45facdb46e49333e02b79e241e9 did not run successfully.
  │ exit code: 128
  ╰─> See above for output.

问题核心是Azure的Oryx构建引擎默认会在部署阶段重新执行依赖安装流程，但它的运行环境没有你在GitHub Actions中配置的私有仓库访问令牌，导致拉取私有依赖失败。提供两种可行解决思路：

方案一：禁用Oryx自动构建 #

直接让Oryx跳过部署时的自动构建，使用你在GitHub Actions中已经安装好的依赖包。只需在Azure WebApp的应用设置中添加SCM_DO_BUILD_DURING_DEPLOYMENT = false即可。

在你的工作流里，修改azure/appservice-settings步骤的general-settings-json配置：

general-settings-json: '{"linuxFxVersion": "PYTHON|${{ env.PYTHON_VERSION }}", "SCM_DO_BUILD_DURING_DEPLOYMENT": false}'

方案二：给Oryx提供私有仓库访问权限 #

如果必须保留Oryx的自动构建流程，需要把GitHub访问令牌传递到Oryx的运行环境中：

1. 在Azure WebApp的应用设置里新增配置项GITHUB_ACCESS_TOKEN，值与你GitHub Secrets中的ACCESS_TOKEN一致。
2. 在项目根目录创建.oryx_config.yaml文件，添加预构建命令自动配置git访问：

pre-build-commands: |
  git config --global url."https://${GITHUB_ACCESS_TOKEN}@github.com".insteadOf https://github.com

这样Oryx在执行构建前会自动配置git的令牌，就能正常拉取私有仓库依赖了。

额外注意事项 #

• 确保你安装依赖时指定的--target=".python_packages/lib/site-packages"目录会被包含在部署包中，禁用自动构建后Azure会直接使用该目录下的依赖。
• 检查项目的.gitignore文件，不要将.python_packages目录排除，否则部署时已安装的依赖不会被上传到Azure。

内容的提问来源于stack exchange，提问作者Zal