Onboarded MS Cli actions

[jbujula]

Summary

Onboards three new GitHub Actions wrapping the MAAF ms CLI (@microsoft/managed-apps-cli) for code-app build and deploy workflows:

• install-ms-cli — installs the ms CLI from public npm (or an internal Azure DevOps feed for preview builds)
• ms-app-pack — runs ms app pack to build and pack the app into a deployable artifact
• ms-app-deploy — runs ms app deploy, with optional --artifact <zip> support for byoBuild flows

ms-app-create is intentionally not in this PR; it's tracked separately on branch onboard-maaf-create-app and will land in a follow-up.

Requires @microsoft/managed-apps-cli@>=0.7.0 for the artifact-path input (deploy --artifact flag).

Action reference

install-ms-cli

Installs @microsoft/managed-apps-cli (binary: ms) on the runner. Zero inputs required for the public npm install path; overridable for internal Azure DevOps feeds.

- uses: microsoft/powerplatform-actions/install-ms-cli@v1

Internal feed (preview/dev builds):

- uses: microsoft/powerplatform-actions/install-ms-cli@v1
  with:
    version: '0.7.0-dev.20260601.1'
    registry-url: 'https://pkgs.dev.azure.com/msazure/OneAgile/_packaging/PowerPlatform-Managed-Host-consumption/npm/registry/'
    registry-auth-token: ${{ secrets.AZURE_DEVOPS_PAT }}

Inputs: version (default latest), registry-url, registry-auth-token, npm-package-name (default @microsoft/managed-apps-cli).
Outputs: cli-version.

ms-app-pack

Runs ms app pack — executes the buildCommand from ms.config.json (default npm run build) and copies the build output to .ms/packed/apps/<appId>/client/. Requires a prior npm ci so the build can resolve dependencies.

- uses: microsoft/powerplatform-actions/ms-app-pack@v1
  with:
    working-directory: 'apps/my-maaf-app'
    app-id:        ${{ secrets.PP_SP_CLIENT_ID }}
    client-secret: ${{ secrets.PP_SP_CLIENT_SECRET }}
    tenant-id:     ${{ secrets.PP_SP_TENANT_ID }}

Inputs: working-directory, SPN auth triple (app-id, client-secret, tenant-id).

ms-app-deploy

Runs ms app deploy. Three modes are selected automatically from inputs and the repoType in ms.config.json:

Mode	Trigger	CLI call
Artifact upload	repoType:'none' + artifact-path input	ms app deploy --artifact <zip>
CLI-packed deploy	repoType:'none', no artifact-path	ms app deploy (CLI packs internally)
Git-backed deploy	repoType:'native' or 'github'	ms app deploy --commit <sha>

Mutual-exclusion guards mirror the CLI's UsageError semantics:

• commit-sha + artifact-path together → action error
• artifact-path on a non-'none' repoType → action error

# byoBuild — CLI packs internally
- uses: microsoft/powerplatform-actions/ms-app-deploy@v1
  with:
    working-directory: 'apps/my-maaf-app'
    app-id:        ${{ secrets.PP_SP_CLIENT_ID }}
    client-secret: ${{ secrets.PP_SP_CLIENT_SECRET }}
    tenant-id:     ${{ secrets.PP_SP_TENANT_ID }}

# byoBuild — pre-built artifact
- uses: microsoft/powerplatform-actions/ms-app-deploy@v1
  with:
    working-directory: 'apps/my-maaf-app'
    artifact-path: '../app.zip'
    app-id:        ${{ secrets.PP_SP_CLIENT_ID }}
    client-secret: ${{ secrets.PP_SP_CLIENT_SECRET }}
    tenant-id:     ${{ secrets.PP_SP_TENANT_ID }}

Inputs: working-directory, commit-sha (defaults to GITHUB_SHA), artifact-path, cloud (default test), app-name, SPN auth triple.
Outputs: app-id, environment-id, commit-sha.

End-to-end demo workflow

name: Deploy MAAF App

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4

    - name: Setup Node 22
      uses: actions/setup-node@v4
      with:
        node-version: '22'

    - name: Install app dependencies
      working-directory: apps/my-maaf-app
      run: npm install

    - name: Install ms CLI
      uses: microsoft/powerplatform-actions/install-ms-cli@v1

    - name: Pack MAAF App
      uses: microsoft/powerplatform-actions/ms-app-pack@v1
      with:
        working-directory: 'apps/my-maaf-app'
        app-id:        ${{ secrets.PP_SP_CLIENT_ID }}
        client-secret: ${{ secrets.PP_SP_CLIENT_SECRET }}
        tenant-id:     ${{ secrets.PP_SP_TENANT_ID }}

    - name: Deploy MAAF App
      uses: microsoft/powerplatform-actions/ms-app-deploy@v1
      with:
        working-directory: 'apps/my-maaf-app'
        app-id:        ${{ secrets.PP_SP_CLIENT_ID }}
        client-secret: ${{ secrets.PP_SP_CLIENT_SECRET }}
        tenant-id:     ${{ secrets.PP_SP_TENANT_ID }}

Prerequisites for consumers

1. MAAF app must already exist with ms.config.json committed in the repo (created via ms app create --repo none).
2. Service Principal added as Application User on the target Power Platform environment with appropriate roles.
3. Tenant admin has enabled AllowExternalArtifactsDeployment on the target environment for byoBuild / artifact deploy flows. Setup wiki: microsoft.ghe.com/bic/Managed-Ops-Internal/blob/main/docs/devops/MAAF/allowExternalArtifactDeployment-powershell.md
4. SPN permissions: the SPN needs Repositories.MicrosoftApps.Deploy.Write (and Repositories.MicrosoftApps.Build.Write for git-backed flows). This is currently the most common failure mode; tracked separately with the RP team.

Test plan

• Public npm install path proven end-to-end (CI log shows @microsoft/managed-apps-cli@latest resolving to 0.7.0 and installing cleanly).
• Internal Azure DevOps feed install path proven with PAT-based auth.
• ms-app-pack runs npm run build via the configured buildCommand and emits the packed artifact.
• ms-app-deploy issues the correct CLI invocation per mode (commit / no-flags / artifact).
• Mutual-exclusion validation (commit-sha + artifact-path → action error before any CLI call).
• CodeQL alert on install-ms-cli regex cleared (strict URL.hostname match).
• End-to-end deploy succeeds once SPN has the required Repositories.MicrosoftApps.Deploy.Write permission.
• Add ms-app-create action in a follow-up PR.

Follow-ups

• ms-app-create action on branch onboard-maaf-create-app — provisions a new app via ms app create --repo none. Separate PR.
• Public doc describing the action family, demo workflow, and prerequisites — planned after this lands.
• Drop ms-app-pack step once the CLI's ms app deploy (no --artifact) handles internal pack reliably for repoType:none apps in production builds; today we keep both for explicit control.