GitHub Actions Deployment: AWS, Azure, GCP & Kubernetes

GitHub Actions can deploy applications to any cloud provider using official and community actions, supporting blue-green deployments, canary releases, and rolling updates.

What You'll Learn

In this tutorial, you'll learn how to deploy to AWS using the AWS CLI action, deploy to Azure with Azure Web Apps, deploy to GCP with Cloud Run, and deploy to Kubernetes with kubectl. You will also learn deployment strategies and rollback procedures.

Why It Matters

Manual deployment is the leading cause of production incidents. Automating deployments through GitHub Actions ensures every deployment follows the same steps, uses the same tools, and can be audited. A failed deployment can be rolled back with a single command.

Real-World Use

Doda Browser deploys its API Gateway to AWS ECS Fargate, its frontend to AWS S3 and CloudFront, its background workers to Google Cloud Run, and its internal dashboards to Azure App Service -- all triggered from the same monorepo with different workflow files.

Deploying to AWS

Deploy to S3 using OIDC authentication:

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/DeployRole
          aws-region: us-east-1
      - run: aws s3 sync ./build s3://my-bucket
      - run: aws cloudfront create-invalidation --distribution-id ABC123 --path "/*"

Deploying to Azure

Deploy to Azure Web Apps:

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/webapps-deploy@v3
        with:
          app-name: my-app
          slot-name: staging
          publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }}

Deploying to GCP

Deploy to Google Cloud Run:

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: google-github-actions/auth@v2
        with:
          workload-identity-provider: projects/123/locations/global/workloadIdentityPools/my-pool/providers/my-provider
      - uses: google-github-actions/deploy-cloudrun@v2
        with:
          service: my-service
          source: .

Deploying to Kubernetes

Use kubectl with kubeconfig:

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-kubectl@v4
      - run: kubectl set image deployment/my-app app=ghcr.io/myorg/my-app:${{ github.sha }}

Practice Questions

1. Why is OIDC preferred over static credentials for cloud deployments? OIDC provides short-lived tokens tied to the specific workflow run, eliminating the risk of stolen static credentials.

2. What is a deployment slot? A separate environment for staging a deployment before swapping it to production, enabling zero-downtime deployments.

3. How do you roll back a failed Kubernetes deployment? Use kubectl rollout undo deployment/my-app to revert to the previous revision.

4. What is the benefit of using CloudFront invalidation after an S3 deployment? It ensures users receive the latest files immediately instead of cached stale versions.

5. Challenge: Create a workflow that builds a Docker image, pushes it to a registry, and deploys it to a Kubernetes cluster. The workflow should wait for the deployment to roll out successfully.

Mini Project: Multi-Cloud Deployment Pipeline

Build a single workflow that deploys a static site to AWS S3, an API server to Google Cloud Run, and a management dashboard to Azure App Service. Each deployment should use OIDC authentication where available. The workflow should notify a Slack webhook on success or failure.

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro.