Free tools Windows power users keep installed
One-click scans. No signup required.
GitHub Actions can continuously deploy code for an existing Microsoft Foundry hosted agent and then run a smoke test against the deployed agent. The documented pattern uses Azure Developer CLI (azd) and GitHub OpenID Connect (OIDC) so the workflow can authenticate to Azure without a long-lived Azure credential stored as a GitHub secret. It does not provision an entire Foundry environment from scratch, and a non-empty smoke-test response is not proof that the agent is correct or production-ready.
What the GitHub Actions pipeline does
Microsoft’s hosted-agent CI/CD quickstart describes a pipeline with two tasks: deploy updated hosted-agent code, then invoke the deployed agent to check that it returns a response. The template uses azd to select the project environment, deploy the agent, report deployment status, and send a smoke-test message. It is intended for a project and hosted agent that have already been provisioned and deployed successfully once.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters: use the workflow to automate subsequent code deployments, not as a substitute for the initial setup of the Foundry project and its cloud resources. Microsoft’s guidance is specifically about hosted agents. Managed prompt agents and voice-based prompt agents have different deployment needs.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Prepare the hosted-agent project
The own-code quickstart supports Python and .NET hosted-agent code. It lists frameworks including Microsoft Agent Framework, LangGraph, GitHub Copilot SDK, and OpenAI Agents SDK, as well as custom code that calls a model directly. The documented prerequisites include an Azure subscription, an authenticated azd session, Azure Developer CLI 1.27.1 or later, and the Microsoft Foundry azd extension. The Python path lists Python 3.13 or later; the C# path lists .NET 10 SDK or later. These are version-sensitive requirements, so check the current quickstart before setting up a new development environment: Microsoft Foundry hosted-agent CI/CD quickstart and hosted-agent quickstart.
#1 Best Overall
Choose how to package the agent
For source-code deployment, Microsoft documents uploading a ZIP for Python or .NET; the platform can build dependencies or use dependencies bundled with the upload. azd and the Foundry VS Code toolkit automate packaging, upload, status polling, and role configuration. Choose a container when the team needs control over the runtime image or already maintains a Dockerfile. Container deployment adds image-build and registry access requirements to the identity permissions.
Set up OIDC and scope Azure access
Create or configure a Microsoft Entra application with a federated credential that trusts the intended GitHub Actions workflow. The workflow requests an OIDC token rather than relying on a stored, long-lived Azure credential. GitHub’s id-token: write permission allows the job to request that token; by itself, it does not grant the job permission to change Azure resources. The cloud-side trust policy must include at least one condition, so an untrusted repository cannot use it to request access tokens.
For source-code deployment, Microsoft’s quickstart specifies the Foundry User role and Contributor role on the target Foundry project. Container deployment also needs the Azure RBAC permissions required to build, push, and deploy the image and access related resources. Confirm the current role scope and project-specific requirements before assigning access. See Microsoft’s role and identity setup and GitHub’s OIDC configuration for Azure.
Recommended Free Tools
Keep workflow permissions and trust narrow
- Grant only the GitHub permissions the workflow or job needs. The Microsoft template includes
contents: readandid-token: write; treat these as template choices to adapt to repository policy. - Constrain the federated credential to the intended repository and branch, tag, or deployment environment. Avoid trust rules broad enough to authorize unrelated workflows.
- Use GitHub deployment-environment protection rules where appropriate to limit which branches or tags can deploy or access environment secrets.
- Review third-party actions and workflow changes through the same controls used for other production-sensitive code.
GitHub’s guidance explains OIDC and workflow hardening at OIDC security hardening and secure use of GitHub Actions.
Configure and run the deployment workflow
Start from Microsoft’s hosted-agent workflow template, then adapt its triggers and configuration to your repository. The quickstart shows a push to the main branch and a manual trigger. Those are examples, not requirements for every team. Store non-secret project configuration as repository variables and put any required application secrets in the appropriate GitHub secret or protected environment. Keep Azure authentication on OIDC rather than adding a long-lived Azure client credential.
- Complete the initial deployment. Provision the Foundry project and deploy the hosted agent successfully before relying on the CI/CD workflow.
- Configure the federated identity. Add a Microsoft Entra federated credential whose trust conditions match the intended GitHub repository and workflow context, then assign the Azure roles required for the chosen deployment method.
- Add workflow configuration. Set the project environment and other non-secret values as repository variables; configure required application secrets separately. Grant the job only the needed GitHub permissions, including OIDC token access.
- Deploy with
azd. Have the workflow select the configured project environment and deploy the agent code. Retain the template’s status reporting so a failed deployment is visible before testing. - Invoke the deployed agent. Send a safe, deterministic smoke-test prompt that should produce a response without requiring unpredictable external data or side effects.
- Fail on an empty response. Treat a missing or empty reply as a failed smoke test and fail the workflow. A non-empty reply shows that the basic invocation path returned something; it does not establish that the content is correct.
Interpret the smoke test correctly
A smoke test answers a narrow operational question: after deployment, can the workflow invoke the hosted agent and receive a response? Checking for an empty result can catch a broken deployment or invocation path. It cannot, on its own, verify factual accuracy, instruction-following, safety, tool behavior, latency, or performance across a representative set of user tasks. The quickstart describes this basic response check, not a full agent evaluation. Build broader evaluation separately if the release decision depends on quality or safety criteria.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose the delivery tools that fit the team
Microsoft’s Azure Developer CLI CI/CD guide covers GitHub Actions and Azure DevOps, and infrastructure options including Bicep and Terraform. Choose GitHub Actions or Azure DevOps based on where the repository and existing delivery process live. Choose Bicep or Terraform based on the team’s infrastructure workflow and familiarity; the guide also includes Terraform state setup guidance. Review the guide’s preview notices feature by feature: some content is identified as public preview, without a service-level agreement and not recommended for production workloads. That warning should not be generalized to every Foundry feature. Check the current status before adopting a preview capability: Azure Developer CLI CI/CD guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
