Deploying Azure Functions — GitHub Actions CI/CD

Consumption Plan:
  → Pay per execution (first 1M free/month)
  → Auto-scale to 0 — no cost when idle
  → Cold start: 1-10 seconds on first invocation after idle
  → Max timeout: 10 minutes (configurable to 60 with host.json)
  → Not suitable for: Timer triggers with strict timing, WebSocket connections

Premium Plan:
  → Pre-warmed instances — no cold start
  → Longer max timeout (unlimited with Dedicated plan)
  → VNet integration — access to private resources (SQL, Service Bus)
  → More expensive: pay per instance hour, not per execution
  → Use when: cold start is unacceptable, VNet integration required

Dedicated (App Service) Plan:
  → Run on your existing App Service plan
  → No cold start (always warm)
  → Cost included in App Service plan
  → Use when: you already pay for App Service and want to co-host functions

Clinical recommendation:
  → HTTP webhooks on Consumption (low volume, cold start acceptable for callbacks)
  → Timer triggers on Premium (no missed runs, no cold start delays)
  → Service Bus consumers on Consumption (auto-scale to demand, cost-effective)

# .github/workflows/deploy-functions.yml
name: Deploy Azure Functions

on:
  push:
    branches: [main]
    paths:
      - 'src/Functions/**'
      - '.github/workflows/deploy-functions.yml'

env:
  DOTNET_VERSION: '8.x'
  FUNCTION_APP_NAME: 'clinical-functions'
  AZURE_RESOURCE_GROUP: 'clinical-rg'

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Build and publish Functions
        run: |
          dotnet publish \
            src/Functions/ClinicalFunctions/ClinicalFunctions.csproj \
            --configuration Release \
            --output ./functions-publish

      - name: Login to Azure
        uses: azure/login@v2
        with:
          client-id:       ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id:       ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Deploy to staging slot
        uses: azure/functions-action@v1
        with:
          app-name:    ${{ env.FUNCTION_APP_NAME }}
          slot-name:   staging
          package:     './functions-publish'
          respect-pom-xml: false

      - name: Run smoke tests against staging
        run: |
          curl -f "https://${{ env.FUNCTION_APP_NAME }}-staging.azurewebsites.net/api/health" \
            -H "x-functions-key: ${{ secrets.FUNCTIONS_STAGING_KEY }}"

      - name: Swap staging to production
        uses: azure/cli@v2
        with:
          inlineScript: |
            az functionapp deployment slot swap \
              --resource-group ${{ env.AZURE_RESOURCE_GROUP }} \
              --name ${{ env.FUNCTION_APP_NAME }} \
              --slot staging \
              --target-slot production

{
  "version": "2.0",
  "functionTimeout": "00:10:00",
  "logging": {
    "applicationInsights": {
      "samplingSettings": {
        "isEnabled": true,
        "maxTelemetryItemsPerSecond": 20
      }
    }
  },
  "extensions": {
    "serviceBus": {
      "prefetchCount": 5,
      "messageHandlerOptions": {
        "maxConcurrentCalls": 4,
        "autoComplete": false
      }
    }
  },
  "concurrency": {
    "dynamicConcurrencyEnabled": true,
    "snapshotPersistenceEnabled": true
  }
}

{
  "IsEncrypted": false,
  "Values": {
    "AzureWebJobsStorage": "UseDevelopmentStorage=true",
    "FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated",
    "ServiceBus": "Endpoint=sb://clinical-servicebus.servicebus.windows.net/;...",
    "ConnectionStrings__Clinical": "Server=localhost;Database=ClinicalDev;...",
    "KeyVaultUri": "https://clinical-kv.vault.azure.net/"
  }
}

IMPORTANT:
  → local.settings.json is NOT deployed to Azure (it's listed in .gitignore)
  → All settings in local.settings.json["Values"] become environment variables
  → In Azure, set these via Function App → Configuration → Application Settings
  → For secrets: use Key Vault references in Application Settings
    Value: @Microsoft.KeyVault(SecretUri=https://clinical-kv.vault.azure.net/secrets/ServiceBus/...)

// In Program.cs — environment-aware configuration
var host = new HostBuilder()
    .ConfigureFunctionsWebApplication()
    .ConfigureAppConfiguration((context, config) =>
    {
        config.AddEnvironmentVariables();

        // Load Key Vault in non-development environments
        var keyVaultUri = Environment.GetEnvironmentVariable("KeyVaultUri");
        if (!string.IsNullOrEmpty(keyVaultUri))
        {
            config.AddAzureKeyVault(
                new Uri(keyVaultUri),
                new DefaultAzureCredential());
        }

        // Local development: use Azurite for storage
        if (context.HostingEnvironment.IsDevelopment())
        {
            Environment.SetEnvironmentVariable(
                "AzureWebJobsStorage", "UseDevelopmentStorage=true");
        }
    })
    // ...
    .Build();

// Health check endpoint for smoke tests after deployment
[Function("Health")]
public HttpResponseData Run(
    [HttpTrigger(AuthorizationLevel.Function, "get", Route = "health")]
    HttpRequestData req)
{
    var response = req.CreateResponse(HttpStatusCode.OK);
    response.WriteAsJsonAsync(new
    {
        Status  = "Healthy",
        Version = Assembly.GetExecutingAssembly()
                    .GetName().Version?.ToString(),
        Timestamp = DateTime.UtcNow
    });
    return response;
}