Summary
azure/webapps-deploy@v3 failed during OneDeploy with 409 Conflict and left a Linux Python App Service in a broken partial deployment state.
After the failed deploy, /home/site/wwwroot contained only:
.ostype
hostingstart.html
output.tar.zst
The expected app files were inside output.tar.zst, but were not extracted/activated into wwwroot. Because the App Service startup command was startup.sh, the app failed to boot with:
/opt/startup/startup.sh: 23: startup.sh: not found
Environment
- Azure App Service on Linux
- Python 3.12
- Deployment via GitHub Actions
- Action:
azure/webapps-deploy@v3
- Deployment backend: OneDeploy
- Startup command:
startup.sh
Deploy failure
Package deployment using OneDeploy initiated.
Error: Failed to deploy web package to App Service.
Error: Deployment Failed, Error: Failed to deploy web package using OneDeploy to App Service.
Conflict (CODE: 409)
Runtime failure
Site's appCommandLine: startup.sh
Launching oryx with: create-script -appPath /home/site/wwwroot -output /opt/startup/startup.sh -virtualEnvName antenv -defaultApp /opt/defaultsite -userStartupCommand 'startup.sh'
WARNING: Could not find virtual environment directory /home/site/wwwroot/antenv.
/opt/startup/startup.sh: 23: startup.sh: not found
Kudu findings
Deployment state appeared stuck/incomplete:
/home/site/deployments/pending
/home/site/deployments/temp-*
/home/site/locks/status.lock
The compressed artifact did contain the expected files:
./startup.sh
./pyproject.toml
./antenv/
./app/app.py
Manual recovery
The app was recovered by clearing the stale deployment state and manually extracting the artifact:
rm -f /home/site/locks/status.lock
rm -f /home/site/locks/info.lock
rm -f /home/site/deployments/pending
rm -rf /home/site/deployments/temp-*
cd /home/site/wwwroot
tar --zstd -xf output.tar.zst
chmod +x startup.sh
After restarting, App Service successfully found the startup file and virtual environment.
Expected behavior
If OneDeploy fails, the App Service should either:
- Complete extraction/activation of the artifact, or
- Fail atomically and preserve the previous working deployment.
It should not leave wwwroot containing only output.tar.zst while the configured startup command points to a file that exists only inside the archive.
Questions
- Is this a known issue with
azure/webapps-deploy@v3, OneDeploy, Linux App Service, Python/Oryx, or output.tar.zst activation?
- Under what conditions can OneDeploy leave
wwwroot in this compressed-only state?
- What is the recommended production-safe deployment configuration to prevent this?
- Should the action detect or recover from stale
pending, temp-*, or status.lock deployment state?
Impact
This caused a production outage and required manual Kudu intervention to restore service.
Summary
azure/webapps-deploy@v3failed during OneDeploy with409 Conflictand left a Linux Python App Service in a broken partial deployment state.After the failed deploy,
/home/site/wwwrootcontained only:The expected app files were inside
output.tar.zst, but were not extracted/activated intowwwroot. Because the App Service startup command wasstartup.sh, the app failed to boot with:Environment
azure/webapps-deploy@v3startup.shDeploy failure
Runtime failure
Kudu findings
Deployment state appeared stuck/incomplete:
The compressed artifact did contain the expected files:
Manual recovery
The app was recovered by clearing the stale deployment state and manually extracting the artifact:
After restarting, App Service successfully found the startup file and virtual environment.
Expected behavior
If OneDeploy fails, the App Service should either:
It should not leave
wwwrootcontaining onlyoutput.tar.zstwhile the configured startup command points to a file that exists only inside the archive.Questions
azure/webapps-deploy@v3, OneDeploy, Linux App Service, Python/Oryx, oroutput.tar.zstactivation?wwwrootin this compressed-only state?pending,temp-*, orstatus.lockdeployment state?Impact
This caused a production outage and required manual Kudu intervention to restore service.