CICD Improvements with GitHub support in Azure Government and Azure China

[Abhishek Narain]

We have added support for GitHub in Azure for U.S. Government and Azure China. 

Due to compliance reasons, we suggest customers get their OAuth application to authenticate against their own GitHub accounts. To use GitHub in Azure Gov and Azure China, you can bring your own (BYO) GitHub OAuth application.

Note: BYO GitHub OAuth application capability is not available in Azure public. In Azure public, we use Microsoft managed GitHub OAuth app which simplifies the setup by not requiring customers to bring and manage their own OAuth applications.

Getting started steps:

• Create a GitHub OAuth application [Prerequisite]
  Detailed steps -> https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app
  Make sure you enter the below properties accurately while creating the OAuth application.

1. Application Name: <Your desired application name>
2. Homepage URL: <Your Data Factory's web URL (domain), ex. "https://adf.azure.us">
   Note: if you use ADF in multiple environments, you will need an app per environment (Azure China, Azure Gov, etc.).
3. Application Description: Optional description
4. Authorization callback URL: Same as Homepage URL. 

         Copy the client id and client secret for use in the next step.

• Create or use existing Azure Key Vault in the same Azure environment (Azure Gov or Azure China) as your Azure Data Factory. 

1. Use an existing Azure Key Vault or create a new one in the Azure Portal.
2. Create a new secret name and set the value equal to the GitHub client secret you generated earlier. 
   
   
   
3. Copy the full secret URL, ex. https://<account name>.vault.azure.net/secrets/github-client-secret-local2/37f145c97a134698ad74f1053.... 
   
   
   
4. Update the Access Policies on the left sidebar and click "+ Add Access Policy".
5. Under secret permissions, grant "List, Get" permissions and select the principal as your Azure Data Factory. It will allow the data factory to access your GitHub client secret during GitHub authentication. Click add and return to the data factory. 
   

• Configure the GitHub repository in Azure Data Factory

1. In the ADF management tab, select "Git configuration" and click "Configure."
   
   
2. Select repository type as GitHub and enter the GitHub account associated with your repository, then click continue.
   
3. In the "Azure Government Cloud BYOA" popup, enter your GitHub client id and the secret URL, ex. https://<account name>.vault.azure.net/secrets/github-client-secret-local2/37f145c97a134698ad74f1053... 
   
4. Click verify and log into GitHub in the popup window.
   
5. If your OAuth app and key vault are correctly configured, you will then be able to complete your repository setup on the next screen.

Common issue:
Ensure your call back URL is correct and does not include a "/" at the end, ex. https://adf.azure.com is a valid URL, and https://adf.azure.com/ is not