Github action with federated OIDC flow to publish hugo to azure storage

main.yaml

# This is a basic workflow to help you get started with Actions

name: CIforHugoStaticSite

# Controls when the action will run. Triggers the workflow on push or pull request
# events but only for the master branch 
on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

#permissions needed for OIDC federated sign-in
permissions:
      id-token: write
      contents: read
jobs: 
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
    - uses: actions/checkout@v2

    - name: 'Az CLI login'
      uses: azure/login@v1
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

    - name: 'Install hugo'
      run: |
        echo "installing hugo v0.101.0"
        sudo mkdir -p /home/hugo/
        curl -L https://github.com/gohugoio/hugo/releases/download/v0.101.0/hugo_0.101.0_Linux-64bit.tar.gz | sudo tar -zxf - --directory /home/hugo/
        sudo mv /home/hugo/hugo /usr/bin/

    - name: 'Run hugo + az storage blob sync'
      env:
        SOURCE_DIRECTORY: public/
        AZURE_STORAGE_CONTAINER: $web
        AZURE_STORAGE_ACCOUNTNAME: ${{ secrets.AZURE_STORAGE_ACCOUNTNAME }}
        BASE_URL: ${{ secrets.BASE_URL }}
      run: |
        cd $PWD
        export HUGO_ENV='production'
        hugo -v --baseUrl "${BASE_URL}"
        az storage blob sync --container "${AZURE_STORAGE_CONTAINER}" --account-name "${AZURE_STORAGE_ACCOUNTNAME}" --source "${SOURCE_DIRECTORY}" --delete-destination true

    - name: 'Purge CDN'
      env:
        CDN_PROFILE_NAME: ${{ secrets.CDN_PROFILE_NAME }} 
        CDN_ENDPOINT_NAME: ${{ secrets.CDN_ENDPOINT_NAME }}
        CDN_RESOURCE_GROUP: ${{ secrets.CDN_RESOURCE_GROUP }}

      run: az cdn endpoint purge --profile-name "${CDN_PROFILE_NAME}" --name "${CDN_ENDPOINT_NAME}" --resource-group "${CDN_RESOURCE_GROUP}" --content-paths "/*"