[Python] Deploying from GitHub to Azure and use SSH

I am trying to create a simple python package we can reuse by doing pip install in our organization like:

pip install git+ssh://github.com/xxx-dna/dna-utils.git@main


I have created a public and a private ssh key, and added the public key to GitHub deploy keys. When running the pip install locally everything works as expected. Now we have a fast API project that has the pip install in it:

annotated-types==0.7.0
anyio==4.7.0
certifi==2024.8.30
cffi==1.17.1
click==8.1.7
colorama==0.4.6
cryptography==44.0.0
fastapi==0.115.6
fastapi-azure-auth==5.0.1
h11==0.14.0
httpcore==1.0.7
httpx==0.28.1
idna==3.10
pycparser==2.22
pydantic==2.10.3
pydantic-settings==2.6.1
pydantic_core==2.27.1
PyJWT==2.10.1
python-dotenv==1.0.1
sniffio==1.3.1
starlette==0.41.3
typing_extensions==4.12.2
uvicorn==0.32.1
azure-monitor-opentelemetry
databricks
databricks.sdk
databricks-sql-connector
pyarrow
pandas
sqlalchemy
numpy
azure-identity
opencensus-ext-azure
opentelemetry-api
opentelemetry-sdk
opentelemetry-instrumentation-fastapi

git+ssh://github.com/xxx-dna/dna-utils.git@main


And here is my yaml file:

# Docs for the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy
# More GitHub Actions for Azure: https://github.com/Azure/actions
# More info on Python, GitHub Actions, and Azure App Service: https://aka.ms/python-webapps-actions

name: Build and deploy Python app to Azure Web App - app-dna-port-api-dev

on:
push:
branches:
- dev
workflow_dispatch:

jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read #This is required for actions/checkout

steps:
- uses: actions/checkout@v4

- name: Set up Python version
uses: actions/setup-python@v5
with:
python-version: '3.12'

- name: Create and start virtual environment
run: |
python -m venv venv
source venv/bin/activate

- name: Install dependencies
run: pip install -r requirements.txt

# Optional: Add step to run tests here (PyTest, Django test suites, etc.)

- name: Zip artifact for deployment
run: zip release.zip ./* -r

- name: Upload artifact for deployment jobs
uses: actions/upload-artifact@v4
with:
name: python-app
path: |
release.zip
!venv/

deploy:
runs-on: ubuntu-latest
needs: build
environment:
name: 'Production'
url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}
permissions:
id-token: write #This is required for requesting the JWT
contents: read #This is required for actions/checkout

steps:
- name: Download artifact from build job
uses: actions/download-artifact@v4
with:
name: python-app

- name: Unzip artifact for deployment
run: unzip release.zip


- name: Login to Azure
uses: azure/login@v2
with:
client-id: ${{ secrets.AZUREAPPSERVICE_CLIENTID_287B3C33E9394D50A28003D97EED8D31 }}
tenant-id: ${{ secrets.AZUREAPPSERVICE_TENANTID_C0DD106B52C544378FECE6B5AD3ED864 }}
subscription-id: ${{ secrets.AZUREAPPSERVICE_SUBSCRIPTIONID_17A8D26733A54308AA79868CDEF11D6D }}

- name: 'Deploy to Azure Web App'
uses: azure/webapps-deploy@v3
id: deploy-to-webapp
with:
app-name: 'app-dna-port-api-dev'
slot-name: 'Production'


I have tried stuff like this but nothing works. Anyone has an idea on how to do this?

# Docs for the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy
# More GitHub Actions for Azure: https://github.com/Azure/actions
# More info on Python, GitHub Actions, and Azure App Service: https://aka.ms/python-webapps-actions

name: Build and deploy Python app to Azure Web App - app-dna-port-api-dev

on:
push:
branches:
- dev
workflow_dispatch:

jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read #This is required for actions/checkout

steps:
- uses: actions/checkout@v4

- name: Set up Python version
uses: actions/setup-python@v5
with:
python-version: '3.12'

- name: Configure SSH for private repositories
env:
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
run: |
mkdir -p ~/.ssh
echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa
ssh-keyscan github.com >> ~/.ssh/known_hosts
git config --global url."git@github.com:".insteadOf "https://github.com/"

- name: Create and start virtual environment
run: |
python -m venv venv
source venv/bin/activate

- name: Install dependencies
run: pip install -r requirements.txt

# Optional: Add step to run tests here (PyTest, Django test suites, etc.)

- name: Create deployment package
run: |
mkdir -p deployment
cp requirements.txt deployment/
cp -r *.py deployment/
cp -r routers deployment/
cp -r utils deployment/
cp -r data deployment/
cp startup_combined.sh deployment/
cd deployment && zip -r ../release.zip ./*

- name: Upload artifact for deployment jobs
uses: actions/upload-artifact@v4
with:
name: python-app
path: release.zip

deploy:
runs-on: ubuntu-latest
needs: build
environment:
name: 'Production'
url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}
permissions:
id-token: write #This is required for requesting the JWT
contents: read #This is required for actions/checkout

steps:
- name: Download artifact from build job
uses: actions/download-artifact@v4
with:
name: python-app

- name: Unzip artifact for deployment
run: unzip release.zip


- name: Login to Azure
uses: azure/login@v2
with:
client-id: ${{ secrets.AZUREAPPSERVICE_CLIENTID_287B3C33E9394D50A28003D97EED8D31 }}
tenant-id: ${{ secrets.AZUREAPPSERVICE_TENANTID_C0DD106B52C544378FECE6B5AD3ED864 }}
subscription-id: ${{ secrets.AZUREAPPSERVICE_SUBSCRIPTIONID_17A8D26733A54308AA79868CDEF11D6D }}

- name: 'Deploy to Azure Web App'
uses: azure/webapps-deploy@v3
id: deploy-to-webapp
with:
app-name: 'app-dna-port-api-dev'
slot-name: 'Production'
startup-command: 'chmod +x startup_combined.sh && ./startup_combined.sh'
app-settings: |
SSH_PRIVATE_KEY="${{ secrets.SSH_PRIVATE_KEY }}"

Continue reading...