Manage-AutomationWebHook GitHub Action

The Manage-AutomationWebHook action provides a seamless experience for managing Azure Automation Account Webhooks. It checks for webhook expiration in the automation account and automatically creates a new instance when the webhook is about to expire.

Integrate this action into your GitHub workflow to fully automate your Webhook deployments!

How does it work?

The logic of this action relies on a predefined directory structure, primarily focusing on the Definitions folder where your webhook JSON definitions are stored.

Directory tree example:

text
-Definitions
    -Webhooks
        -my-webhook.json
-Source
    -Common

Webhook Definition Example

Example of a webhook file named my-webhook.json:

json
{
    "Name": "my-webhook",
    "RunbookName": "test",
    "IsEnabled": true,
    "ExpiryTime": "2026-12-31T00:00:00Z"
}

Authentication with Azure

Unlike Azure DevOps, which uses Service Connections natively, GitHub Actions requires Azure Service Principal credentials to authenticate. You need to create an Azure Service Principal with Contributor rights to your subscription and store its details in GitHub Secrets or Variables Settings -> Secrets and variables -> Actions

You will need to configure the following secrets/variables:

AZURE_CLIENT_ID        | Secret
AZURE_CLIENT_SECRET    | Secret
AZURE_TENANT_ID        | Secret
AZURE_SUBSCRIPTION_ID  | Variable

Action Inputs

• environmentName (required) - Defines the environment for which you want to perform synchronization
• projectDir (required) - Defines the path where the predefined directory structure is located
• subscription (required) - Defines the subscription in which Azure Automation resides
• azureClientId (required) - Client ID (App ID) of the service principal with contributor rights for defined subscription
• azureClientSecret (required) - Client secret of the service principal
• azureTenantId (required) - Azure AD tenant ID of the service principal
• azureSubscriptionId (required) - Subscription ID where the automation account is located
• resourceGroup (required) - Defines the resource group
• automationAccount (required) - The name of the Azure Automation account
• fullSync - Defines whether or not to remove any existing items from the automation account that are not source-controlled
• cloudEnvironment - Select the target Azure cloud environment (e.g., AzureCloud, AzureUSGovernment, AzureChinaCloud). Default is AzureCloud

Example Usage

Here is an example of how to use this action in your GitHub workflow. Make sure to pass the credentials using GitHub Secrets ${{ secrets.SECRET_NAME }} name: Deploy Automation Webhooks

on:
  push:
    branches:
      - main

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: windows-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Manage Automation WebHooks
        uses: Greycorbel/Manage-AutomationAccountWebHook@v1 # Replace with your actual repository name and tag/branch
        with:
          environmentName: 'Prod'
          projectDir: './Automation/Default'
          subscription: 'My-Azure-Subscription-Name'
          azureClientId: ${{ secrets.AZURE_CLIENT_ID }}
          azureClientSecret: ${{ secrets.AZURE_CLIENT_SECRET }}
          azureTenantId: ${{ secrets.AZURE_TENANT_ID }}
          azureSubscriptionId: ${{ vars.AZURE_SUBSCRIPTION_ID }}
          resourceGroup: 'my-rg-automation'
          automationAccount: 'my-automation-acc'
          fullSync: 'true'