Use Azure Pipelines to build and deploy a Python web app to Azure App Service

Configure a self-hosted agent

Downloading Python versions isn't supported on self-hosted build agents. To use your own self-hosted agent, you need to configure the agent to run Python.

To avoid compatibility issues, match the Python version with the runtime version in your Azure App Services web app, 3.11 in this case. You must preinstall the Python version. Use the full installer to get a pip-compatible version of Python.

The desired Python version needs to be added to the tool cache on the self-hosted agent so the pipeline task can use it. Normally, the tool cache is located under the _work/_tool directory of the agent. Alternatively, you can override the path with the environment variable AGENT_TOOLSDIRECTORY. Under the tools directory, create the following directory structure based on your Python version:

$AGENT_TOOLSDIRECTORY/
    Python/
        {version number}/
            {platform}/
                {tool files}
            {platform}.complete

The version number should follow the format of 1.2.3. The platform should either be x86 or x64. The tool files should be the unzipped Python version files. The {platform}.complete should be a 0-byte file that looks like x86.complete or x64.complete and just signifies the tool is properly installed in the cache.

For example, to use Python 3.11 on a 64-bit Windows machine, create the following directory structure:

$AGENT_TOOLSDIRECTORY/
    Python/
        3.11.4/
            x64/
                {python files}
            x64.complete

If the machine hosting your agent already has the Python version you want to use, you can copy the files to the tool cache. If you don't have the Python version, you can download it from the Python website.

Create a service principal

A service principal is an identity created for applications, hosted services, and automated tools to access Azure resources. This access is restricted to the roles assigned to the service principal, giving you control over which resources can be accessed at which level.

To create a service principal, run the following command in Bash Cloud Shell. Replace <service-principal-name> with a name for your service principal, <your-subscription-id> with your Azure subscription ID, and <your-resource-group> with the resource group for the web app.

az ad sp create-for-rbac --display-name <service-principal-name> --role contributor --scopes /subscriptions/<your-subscription-id>/resourceGroups/<your-resource-group>

The command returns the following JSON object:

{
  "appId": "<client GUID>",
  "displayName": "<service-principal-name">,
  "password": "<password-string>",
  "tenant": "<tenant GUID>"
  ...
}

Make a note of the appId, password, and tenantId values to use for creating a service connection in the next section.

1. On your Azure DevOps project page, select Project settings.

2. From Project Settings, select Pipelines > Service connections.

3. On the Service connections page, select New service connection or Create service connection if this service connection is the first in the project.

   

4. On the New service connection screen, select Azure Resource Manager and then select Next.

   

5. On the New Azure service connection screen, select your Identity type. This example uses App registration (automatic), which is recommended. For more information about authentication methods, see Connect to Azure by using an Azure Resource Manager service connection.

6. For Credential, select Workload identity federation (automatic).

7. Complete the following fields:

   • Scope level: Select Subscription.
   • Subscription: Select your Azure subscription.
   • Resource group: Select the resource group that contains your web app.
   • Service Connection Name: Enter a descriptive name for the connection.
   • Grant access permissions to all pipelines: Select this check box to grant access to all pipelines in the project.

8. Select Save.

   

1. On your Azure DevOps project page, select Project settings.

2. From Project Settings, select Pipelines > Service connections.

3. On the Service connections page, select New service connection or Create service connection if this service connection is the first in the project.

   

4. On the New service connection screen, select Azure Resource Manager and then select Next.

   

5. Select Service principal (manual) and then select Next.

   

6. On the New Azure service connection screen, complete the following fields:

   • Environment: Select Azure Cloud.
   • Scope Level: Select Subscription.
   • Subscription Id: Enter your Azure subscription ID.
   • Subscription Name: Enter your Azure subscription name.

7. In the Authentication section, complete the following fields:

   • Service Principal Id: Enter the appId value returned by the az ad sp create-for-rbac command.
   • Credential: Select Service principal key.
   • Service principal key: Enter the password value returned by the az ad sp create-for-rbac command.
   • Tenant Id: Enter the tenant value returned by the az ad sp create-for-rbac command.
   • Select Verify to verify the connection.

8. In the Details section, under Service Connection Name, enter a name for the service connection.

9. Select the check box for Grant access permissions to all pipelines.

10. Select Verify and save.

    

1. On the left navigation menu for your project, select Pipelines.

2. On the Pipelines page, select New pipeline, or Create pipeline if this pipeline is the first in the project.

   

3. On the Where is your code screen, select GitHub. You might be prompted to sign into GitHub.

   

4. On the Select a repository screen, select your forked sample repository. GitHub might prompt you to enter your GitHub password again, or to install the Azure Pipelines GitHub app. Follow onscreen instructions to install the app. For more information, see GitHub app authentication.

   

5. On the Configure your pipeline page, select Python to Linux Web App on Azure.

6. On the next screen, select your Azure subscription and select Continue.

7. On the next screen, select your Azure web app and select Validate and configure.

Azure Pipelines creates an azure-pipelines.yml file and displays it in the YAML pipeline editor.

1. On the left navigation menu for your project, select Pipelines.

2. On the Pipelines page, select New pipeline, or Create pipeline if this pipeline is the first in the project.

   

3. On the Where is your code page, select GitHub Enterprise Server. You might be prompted to sign into GitHub.

   

4. On the Select a repository tab, select your forked sample repository. GitHub might prompt you to enter your GitHub password again or install the Azure Pipelines GitHub extension or app. Follow onscreen instructions to install the app. For more information, see Access to GitHub repositories.

   

5. On the Configure your pipeline page, select Starter pipeline.

6. On the Review your pipeline YAML page, replace the contents of the starter azure-pipelines.yml file with the following YAML pipeline file. In the YAML file:

   • Replace the <your-service-connection-name> and <your-web-app-name> placeholders with your own values.

   • Replace <your-pool-name> with the name of the agent pool you want to use, and replace <your-python-version> with the version of Python running on your agent. This version should match the runtime_version from the JSON output of the az webapp up command.

The following complete example YAML pipeline file defines your CI/CD pipeline as a series of stages, jobs, and steps, where each step contains the details for different tasks and scripts. The generated YAML code automatically populates the placeholders with values for your app and connection.

trigger:
- main

variables:
  # Azure Resource Manager connection created during pipeline creation
  azureServiceConnectionId: '<GUID>'

  # Web app name
  webAppName: '<your-webapp-name>'

  # Agent VM image name
  vmImageName: 'ubuntu-latest'

  # Environment name
  environmentName: '<your-webapp-name>'

  # Project root folder. Point to the folder containing manage.py file.
  projectRoot: $(System.DefaultWorkingDirectory)

  pythonVersion: '3.11'

stages:
- stage: Build
  displayName: Build stage
  jobs:
  - job: BuildJob
    pool:
      vmImage: $(vmImageName)
    steps:
    - task: UsePythonVersion@0
      inputs:
        versionSpec: '$(pythonVersion)'
      displayName: 'Use Python $(pythonVersion)'

    - script: |
        python -m venv antenv
        source antenv/bin/activate
        python -m pip install --upgrade pip
        pip install setuptools
        pip install -r requirements.txt
      workingDirectory: $(projectRoot)
      displayName: "Install requirements"

    - task: ArchiveFiles@2
      displayName: 'Archive files'
      inputs:
        rootFolderOrFile: '$(projectRoot)'
        includeRootFolder: false
        archiveType: zip
        archiveFile: $(Build.ArtifactStagingDirectory)/$(Build.BuildId).zip
        replaceExistingArchive: true

    - upload: $(Build.ArtifactStagingDirectory)/$(Build.BuildId).zip
      displayName: 'Upload package'
      artifact: drop

- stage: Deploy
  displayName: 'Deploy Web App'
  dependsOn: Build
  condition: succeeded()
  jobs:
  - deployment: DeploymentJob
    pool:
      vmImage: $(vmImageName)
    environment: $(environmentName)
    strategy:
      runOnce:
        deploy:
          steps:

          - task: UsePythonVersion@0
            inputs:
              versionSpec: '$(pythonVersion)'
            displayName: 'Use Python version'

          - task: AzureWebApp@1
            displayName: 'Deploy Azure Web App : $(webAppName)'
            inputs:
              azureSubscription: $(azureServiceConnectionId)
              appName: $(webAppName)
              package: $(Pipeline.Workspace)/drop/$(Build.BuildId).zip

trigger:
- main

variables:
  # Azure Resource Manager connection created during pipeline creation
  azureServiceConnectionId: '<your-service-connection-name>'

  # Web app name
  webAppName: '<your-web-app-name>'

  # Environment name
  environmentName: '<your-web-app-name>'

  # Project root folder. 
  projectRoot: $(System.DefaultWorkingDirectory)

  # Python version: 
  pythonVersion: '<your-python-version>'

stages:
- stage: Build
  displayName: Build stage
  jobs:
  - job: BuildJob
pool:
      name: '<your-pool-name>'
      demands: python
    steps:
    - task: UsePythonVersion@0
      inputs:
        versionSpec: '$(pythonVersion)'
      displayName: 'Use Python $(pythonVersion)'

    - script: |
        python -m venv antenv
        source antenv/bin/activate
        python -m pip install --upgrade pip
        pip install -r requirements.txt
      workingDirectory: $(projectRoot)
      displayName: "Install requirements"

    - task: ArchiveFiles@2
      displayName: 'Archive files'
      inputs:
        rootFolderOrFile: '$(projectRoot)'
        includeRootFolder: false
        archiveType: zip
        archiveFile: $(Build.ArtifactStagingDirectory)/$(Build.BuildId).zip
        replaceExistingArchive: true

    - task: PublishBuildArtifacts@1
      inputs:
        PathtoPublish: '$(Build.ArtifactStagingDirectory)'
        ArtifactName: 'drop'
        publishLocation: 'Container'

- stage: Deploy
  displayName: 'Deploy Web App'
  dependsOn: Build
  condition: succeeded()
  jobs:
  - deployment: DeploymentJob
    pool:
      name: '<your-pool-name'
    environment: $(environmentName)
    strategy:
      runOnce:
        deploy:
          steps:

          - task: UsePythonVersion@0
            inputs:
              versionSpec: '$(pythonVersion)'
            displayName: 'Use Python version'

          - task: AzureWebApp@1
            displayName: 'Deploy Azure Web App : <your-web-app-name>'
            inputs:
              azureSubscription: $(azureServiceConnectionId)
              appName: $(webAppName)
              package: $(Pipeline.Workspace)/drop/$(Build.BuildId).zip
              startUpCommand: 'startup.txt'

The build stage contains a single job that runs on the operating system defined in the vmImageName variable, in this case ubuntu-latest.

  - job: BuildJob
    pool:
      vmImage: $(vmImageName)

The build stage contains a single job that runs on an agent in the pool identified by the name parameter.

You can specify the agent capabilities with the demands keyword. For example, demands: python specifies that the agent must have Python installed. To specify a self-hosted agent by name, you can use demands: Agent.Name -equals <agent-name>.

  - job: BuildJob
    pool:
      name: <your-pool-name>
      demands: python

  - deployment: DeploymentJob
    pool:
      vmImage: $(vmImageName)
    environment: $(environmentName)

• The deployment keyword indicates that the job is a deployment job targeting an environment to deploy to. The environment is automatically created in your project when the job is run.

• The pool parameter specifies the deployment agent pool and uses the default agent pool if a name isn't specified. The agent runs on the operating system defined in the vmImageName variable, in this case ubuntu-latest.

  - deployment: DeploymentJob
    pool:
      name: <your-pool-name>
    environment: $(environmentName)

• The deployment keyword indicates that the job is a deployment job targeting an environment to deploy to. The environment is automatically created in your project when the job is run.

• The pool parameter specifies the deployment agent pool and must contain an agent with the capability to run the Python version specified in the pipeline.