azure_secrets_setup
Configure GitHub secrets to enable automated Azure deployments by securely storing required credentials and connection details.
Instructions
Set up GitHub secrets for Azure deployment
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Implementation Reference
- src/index.js:1545-1617 (registration)Registration of the azure_secrets_setup MCP tool, including schema and inline handler implementation.
"azure_secrets_setup", "Set up GitHub secrets for Azure deployment", { resource_group: { type: "string", description: "Azure resource group" }, acr_name: { type: "string", description: "Azure Container Registry name" }, sp_name: { type: "string", description: "Service principal name", default: "github-actions" } }, async ({ resource_group, acr_name, sp_name }) => { // Get subscription ID const subId = await runCommand("az account show --query id -o tsv"); if (!subId.success) { return { content: [{ type: "text", text: `Not logged in to Azure!\n\nRun: az login` }] }; } return { content: [{ type: "text", text: `AZURE GITHUB SECRETS SETUP ========================== Run these commands to set up secrets for GitHub Actions: STEP 1: Create Service Principal --------------------------------- az ad sp create-for-rbac --name "${sp_name}" \\ --role contributor \\ --scopes /subscriptions/${subId.stdout}/resourceGroups/${resource_group} \\ --json-auth > azure-creds.json STEP 2: Add AZURE_CREDENTIALS secret ------------------------------------ gh secret set AZURE_CREDENTIALS < azure-creds.json rm azure-creds.json # Delete after setting secret! STEP 3: Grant ACR Access ------------------------ # Get the service principal ID SP_ID=$(az ad sp list --display-name "${sp_name}" --query [0].appId -o tsv) # Grant push/pull access to ACR az role assignment create \\ --assignee $SP_ID \\ --role AcrPush \\ --scope $(az acr show -n ${acr_name} --query id -o tsv) STEP 4: Optional - Add individual secrets ----------------------------------------- gh secret set AZURE_ACR_NAME -b "${acr_name}" gh secret set AZURE_ACR_LOGIN_SERVER -b "${acr_name}.azurecr.io" gh secret set AZURE_RESOURCE_GROUP -b "${resource_group}" gh secret set AZURE_SUBSCRIPTION_ID -b "${subId.stdout}" VERIFY SECRETS: --------------- gh secret list SECURITY NOTES: --------------- - Service principal has contributor access to the resource group only - Rotate credentials periodically: az ad sp credential reset --id $SP_ID - For production, consider using managed identities instead` }] }; } ); // ============================================ // GITHUB ACTIONS TOOLS - src/index.js:1553-1616 (handler)Handler function that checks Azure login, retrieves subscription ID using runCommand helper, and returns step-by-step text instructions for creating service principal, setting GitHub secrets, and granting ACR access.
// Get subscription ID const subId = await runCommand("az account show --query id -o tsv"); if (!subId.success) { return { content: [{ type: "text", text: `Not logged in to Azure!\n\nRun: az login` }] }; } return { content: [{ type: "text", text: `AZURE GITHUB SECRETS SETUP ========================== Run these commands to set up secrets for GitHub Actions: STEP 1: Create Service Principal --------------------------------- az ad sp create-for-rbac --name "${sp_name}" \\ --role contributor \\ --scopes /subscriptions/${subId.stdout}/resourceGroups/${resource_group} \\ --json-auth > azure-creds.json STEP 2: Add AZURE_CREDENTIALS secret ------------------------------------ gh secret set AZURE_CREDENTIALS < azure-creds.json rm azure-creds.json # Delete after setting secret! STEP 3: Grant ACR Access ------------------------ # Get the service principal ID SP_ID=$(az ad sp list --display-name "${sp_name}" --query [0].appId -o tsv) # Grant push/pull access to ACR az role assignment create \\ --assignee $SP_ID \\ --role AcrPush \\ --scope $(az acr show -n ${acr_name} --query id -o tsv) STEP 4: Optional - Add individual secrets ----------------------------------------- gh secret set AZURE_ACR_NAME -b "${acr_name}" gh secret set AZURE_ACR_LOGIN_SERVER -b "${acr_name}.azurecr.io" gh secret set AZURE_RESOURCE_GROUP -b "${resource_group}" gh secret set AZURE_SUBSCRIPTION_ID -b "${subId.stdout}" VERIFY SECRETS: --------------- gh secret list SECURITY NOTES: --------------- - Service principal has contributor access to the resource group only - Rotate credentials periodically: az ad sp credential reset --id $SP_ID - For production, consider using managed identities instead` }] }; } ); // ============================================ - src/index.js:1548-1551 (schema)Input schema for the tool parameters: resource_group, acr_name, and sp_name.
resource_group: { type: "string", description: "Azure resource group" }, acr_name: { type: "string", description: "Azure Container Registry name" }, sp_name: { type: "string", description: "Service principal name", default: "github-actions" } },