CI/CD · Guide
GitHub Actions OIDC to Azure: the passwordless setup, end to end
By Captain O
Drop the stored client secret — wire GitHub Actions to Azure with a short-lived OIDC token instead.
Short, honest write-ups of the ideas that come up in interviews and on the job. Each one teaches the concept properly, cites the Microsoft documentation, and points back to the class that drills it until it sticks.
Drop the stored client secret — wire GitHub Actions to Azure with a short-lived OIDC token instead.
Everyone lists the tools — Terraform, Bicep, pipelines, runners. Almost nobody sequences them. Here is the DevOps ladder rung by rung: Git → IaC → CI/CD → OIDC → runners → a GitOps build, each mapped to a free class.
The role plus the Azure DevOps suite — Pipelines, Repos, Artifacts, Boards — used to build, test, and release onto Azure with Bicep/Terraform. Azure DevOps vs GitHub Actions.
A free, stage-by-stage curriculum — Linux/Git, scripting, containers, CI/CD and IaC, one cloud — built on Microsoft Learn and hands-on labs, capped by a real project.
Seven REST principles with Do vs Don’t code: resource nouns and HTTP verbs, correct status codes, versioning, pagination, consistent errors, validation, and auth.
The az commands you actually use, grouped: sign-in, resource groups, VMs, AKS, Key Vault — plus --query and -o table for output. Same in a terminal or a pipeline.
A plain-English explanation of Git: the working directory, staging, and commit model, why "distributed" matters, and your first repo command by command.
git fetch downloads commits into your remote-tracking branch without touching your files; git pull fetches and then merges. The safe look-first workflow.
git stash push with a path sets aside only the files you name; -p stashes partial hunks. Naming, inspecting, and restoring with pop vs apply.
Merge keeps both histories with a merge commit; rebase replays commits into a linear history but rewrites hashes. The golden rule and how to handle conflicts.
Most junior portfolios are a screenshot of a VM and a README that says “deployed a web app to Azure.” This is the project that clears that bar in one line: a real CI/CD pipeline with no stored secrets.
People say "Azure DevOps" meaning the pipeline, but that is one of five services. The suite covers the whole journey a feature takes — planned, coded, built, tested, shipped — and the integration is the point.
You built an image; now it needs a home your pipeline can push to and production can pull from — privately, securely, close to where it runs. That home is a registry, and Azure's is ACR.
Microsoft owns both, both build-test-deploy your code, and both deploy beautifully to Azure. The choice is rarely capability — it is where your code already lives and what else you need around the pipeline.
Connecting a pipeline to Azure used to mean pasting a client secret and praying. Workload identity federation ends that — your workflow trades a short-lived token for an Azure token at run time, with nothing to store, rotate, or steal.
One short, honest Azure note at a time — plus the occasional hiring signal. No spam, no card, unsubscribe in one click.