Microsoft publishes an ephemeral GitHub Actions runner architecture on Azure Container Apps
Microsoft’s new implementation guide describes repository-scoped GitHub Actions runners that handle one workflow and then terminate, using Azure Container Apps event jobs and KEDA to scale from zero.
GitHub App authentication, private Key Vault access and separate deployment identities protect the authentication flow, while GitHub OIDC avoids long-lived Azure deployment secrets.
The example uses a Microsoft Container Registry base image with runtime installation of tools, avoiding a dedicated customer registry. It also explains the trade-off: slower cold starts and dependence on download endpoints.
The guidance targets teams needing private network access or tighter runner controls.
Partner briefing
- What it is
An implementation guide for ephemeral GitHub Actions runners on Azure Container Apps.
- What’s changing
The documented pattern combines event-driven scaling, GitHub App authentication, private secret retrieval and OIDC.
- Why it matters
One-workflow executions remove idle runners; runtime bootstrap has latency and dependency trade-offs.
- Who it affects
Azure infrastructure, platform engineering and DevOps teams.