From a76776b484009a5dc3accadfb53dbbc4d953d9e2 Mon Sep 17 00:00:00 2001
From: arjundashrath <54043589+arjundashrath@users.noreply.github.com>
Date: Wed, 2 Feb 2022 23:49:53 +0530
Subject: [PATCH 01/15] Update codacy.yml

---
 code-scanning/codacy.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/code-scanning/codacy.yml b/code-scanning/codacy.yml
index 50185ad..4892930 100644
--- a/code-scanning/codacy.yml
+++ b/code-scanning/codacy.yml
@@ -22,8 +22,14 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+
 jobs:
   codacy-security-scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     name: Codacy Security Scan
     runs-on: ubuntu-latest
     steps:

From 14ce90e99f9db28d05cc0a81e2b63370e034db38 Mon Sep 17 00:00:00 2001
From: h0x0er <84621253+h0x0er@users.noreply.github.com>
Date: Mon, 14 Feb 2022 11:13:30 +0530
Subject: [PATCH 02/15] added github_token permissions

---
 code-scanning/semgrep.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/code-scanning/semgrep.yml b/code-scanning/semgrep.yml
index 827387b..f99d441 100644
--- a/code-scanning/semgrep.yml
+++ b/code-scanning/semgrep.yml
@@ -19,8 +19,14 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+
 jobs:
   semgrep:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     name: Scan
     runs-on: ubuntu-latest
     steps:

From b90ea0582ae3866c2a11e47fc3708e4d97a5ad3f Mon Sep 17 00:00:00 2001
From: arjundashrath <54043589+arjundashrath@users.noreply.github.com>
Date: Mon, 14 Feb 2022 12:43:26 +0530
Subject: [PATCH 03/15] Update veracode.yml

---
 code-scanning/veracode.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/code-scanning/veracode.yml b/code-scanning/veracode.yml
index e38fffd..073d1b6 100644
--- a/code-scanning/veracode.yml
+++ b/code-scanning/veracode.yml
@@ -17,10 +17,16 @@ on:
     - cron: $cron-weekly
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
+permissions:
+  contents: read
+
 jobs:
   # This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter
   build-and-pipeline-scan:
     # The type of runner that the job will run on
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     runs-on: ubuntu-latest
     steps:
 

From d8a2673986720cf4f579448519c77a37d861d53e Mon Sep 17 00:00:00 2001
From: arjundashrath <54043589+arjundashrath@users.noreply.github.com>
Date: Mon, 14 Feb 2022 12:59:51 +0530
Subject: [PATCH 04/15] Update prisma.yml

---
 code-scanning/prisma.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/code-scanning/prisma.yml b/code-scanning/prisma.yml
index 5323d1b..5b11482 100644
--- a/code-scanning/prisma.yml
+++ b/code-scanning/prisma.yml
@@ -21,8 +21,14 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+
 jobs:
   prisma_cloud_iac_scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     runs-on: ubuntu-latest
     name: Run Prisma Cloud IaC Scan to check
     steps:

From 4333c79965dc3415883fbb3d4c4b2d4e6d6f2e3f Mon Sep 17 00:00:00 2001
From: arjundashrath <54043589+arjundashrath@users.noreply.github.com>
Date: Mon, 14 Feb 2022 13:08:08 +0530
Subject: [PATCH 05/15] Update codacy.yml

---
 code-scanning/codacy.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/code-scanning/codacy.yml b/code-scanning/codacy.yml
index 50185ad..4892930 100644
--- a/code-scanning/codacy.yml
+++ b/code-scanning/codacy.yml
@@ -22,8 +22,14 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+
 jobs:
   codacy-security-scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     name: Codacy Security Scan
     runs-on: ubuntu-latest
     steps:

From b93e51dac62613e75ab7b232cead7c400368d461 Mon Sep 17 00:00:00 2001
From: arjundashrath <54043589+arjundashrath@users.noreply.github.com>
Date: Mon, 14 Feb 2022 13:11:47 +0530
Subject: [PATCH 06/15] Update msvc.yml

---
 code-scanning/msvc.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/code-scanning/msvc.yml b/code-scanning/msvc.yml
index 1503319..83d4571 100644
--- a/code-scanning/msvc.yml
+++ b/code-scanning/msvc.yml
@@ -20,8 +20,14 @@ env:
   # Path to the CMake build directory.
   build: '${{ github.workspace }}/build'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     name: Analyze
     runs-on: windows-latest
 

From ab9bdce2e320816516a6b28bf58c3f503daa0bb3 Mon Sep 17 00:00:00 2001
From: Shubham malik <shubhammalik24619@gmail.com>
Date: Mon, 14 Feb 2022 15:19:56 +0530
Subject: [PATCH 07/15] Update apisec-scan.yml

---
 code-scanning/apisec-scan.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/code-scanning/apisec-scan.yml b/code-scanning/apisec-scan.yml
index 3aa06ca..4737d06 100644
--- a/code-scanning/apisec-scan.yml
+++ b/code-scanning/apisec-scan.yml
@@ -42,8 +42,13 @@ on:
   workflow_dispatch:
 
 
+permissions:
+  contents: read
+
 jobs:
   Trigger APIsec scan:
+    permissions:
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     runs-on: ubuntu-latest
 
     steps:
@@ -61,4 +66,4 @@ jobs:
        - name: Import results
          uses: github/codeql-action/upload-sarif@v1
          with:
-          sarif_file: ./apisec-results.sarif
\ No newline at end of file
+          sarif_file: ./apisec-results.sarif

From f6474e2bfa207cc53531f4de21c1f9243ec7c46a Mon Sep 17 00:00:00 2001
From: Shubham malik <shubhammalik24619@gmail.com>
Date: Mon, 14 Feb 2022 15:23:03 +0530
Subject: [PATCH 08/15] Update brakeman.yml

---
 code-scanning/brakeman.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/code-scanning/brakeman.yml b/code-scanning/brakeman.yml
index ae5215a..d0b25ac 100644
--- a/code-scanning/brakeman.yml
+++ b/code-scanning/brakeman.yml
@@ -17,8 +17,14 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+
 jobs:
   brakeman-scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     name: Brakeman Scan
     runs-on: ubuntu-latest
     steps:

From aa4aa29543b6a72c397d9285abd94d91c41984fd Mon Sep 17 00:00:00 2001
From: Shubham malik <shubhammalik24619@gmail.com>
Date: Mon, 14 Feb 2022 15:51:06 +0530
Subject: [PATCH 09/15] Update stackhawk.yml

---
 code-scanning/stackhawk.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/code-scanning/stackhawk.yml b/code-scanning/stackhawk.yml
index 9701b1f..af220c0 100644
--- a/code-scanning/stackhawk.yml
+++ b/code-scanning/stackhawk.yml
@@ -37,8 +37,14 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+
 jobs:
   stackhawk:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for stackhawk/hawkscan-action to upload code scanning alert info
     name: StackHawk
     runs-on: ubuntu-20.04
     steps:

From 6706b36121ab6c4b497c145160f85b056fe12347 Mon Sep 17 00:00:00 2001
From: Shubham malik <shubhammalik24619@gmail.com>
Date: Tue, 15 Feb 2022 16:04:39 +0530
Subject: [PATCH 10/15] Update njsscan.yml

---
 code-scanning/njsscan.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/code-scanning/njsscan.yml b/code-scanning/njsscan.yml
index 8077f76..a6da087 100644
--- a/code-scanning/njsscan.yml
+++ b/code-scanning/njsscan.yml
@@ -17,8 +17,14 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+
 jobs:
   njsscan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     runs-on: ubuntu-latest
     name: njsscan code scanning
     steps:

From 3394a8e62f54f84b23c843b970d4ca143013db12 Mon Sep 17 00:00:00 2001
From: Shubham malik <shubhammalik24619@gmail.com>
Date: Tue, 15 Feb 2022 16:38:05 +0530
Subject: [PATCH 11/15] Update mobsf.yml

---
 code-scanning/mobsf.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/code-scanning/mobsf.yml b/code-scanning/mobsf.yml
index 689a1a0..d8eaa92 100644
--- a/code-scanning/mobsf.yml
+++ b/code-scanning/mobsf.yml
@@ -13,8 +13,14 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+
 jobs:
   mobile-security:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     runs-on: ubuntu-latest
 
     steps:
@@ -33,4 +39,4 @@ jobs:
       - name: Upload mobsfscan report
         uses: github/codeql-action/upload-sarif@v1
         with:
-          sarif_file: results.sarif
\ No newline at end of file
+          sarif_file: results.sarif

From 6a5dc3a7538ff504a39f33cc73855ad4dedcf3e0 Mon Sep 17 00:00:00 2001
From: arjundashrath <54043589+arjundashrath@users.noreply.github.com>
Date: Thu, 17 Feb 2022 08:50:23 +0530
Subject: [PATCH 12/15] Update sysdig-scan.yml

---
 code-scanning/sysdig-scan.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/code-scanning/sysdig-scan.yml b/code-scanning/sysdig-scan.yml
index 49841d7..f9b29fc 100644
--- a/code-scanning/sysdig-scan.yml
+++ b/code-scanning/sysdig-scan.yml
@@ -13,10 +13,17 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+
 jobs:
 
   build:
 
+    permissions:
+      checks: write # for sysdiglabs/scan-action to publish the checks
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     runs-on: ubuntu-latest
 
     steps:
@@ -51,4 +58,4 @@ jobs:
       #Upload SARIF file
       if: always()
       with:
-        sarif_file: ${{ steps.scan.outputs.sarifReport }}
\ No newline at end of file
+        sarif_file: ${{ steps.scan.outputs.sarifReport }}

From ed9202263d2954cd84dc11e0068ea5744268e8ab Mon Sep 17 00:00:00 2001
From: laurentsimon <laurentsimon@google.com>
Date: Fri, 18 Feb 2022 01:00:27 +0000
Subject: [PATCH 13/15] Update hash for scorecard's v1.0.4 release

---
 code-scanning/scorecards.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/code-scanning/scorecards.yml b/code-scanning/scorecards.yml
index 618ce28..d63b462 100644
--- a/code-scanning/scorecards.yml
+++ b/code-scanning/scorecards.yml
@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@c8416b0b2bf627c349ca92fc8e3de51a64b005cf # v1.0.2
+        uses: ossf/scorecard-action@c1aec4ac820532bab364f02a81873c555a0ba3a1 # v1.0.4
         with:
           results_file: results.sarif
           results_format: sarif

From 300f303442f956de563b7f301f652d94acb60cde Mon Sep 17 00:00:00 2001
From: Atul Malaviya <azooinmyluggage@users.noreply.github.com>
Date: Sun, 20 Feb 2022 02:18:18 -0600
Subject: [PATCH 14/15] Added PR trigger (#1448)

---
 ci/msbuild.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/ci/msbuild.yml b/ci/msbuild.yml
index 29b6ace..e650e2a 100644
--- a/ci/msbuild.yml
+++ b/ci/msbuild.yml
@@ -1,6 +1,10 @@
 name: MSBuild
 
-on: [push]
+on:
+  push:
+    branches: [ $default-branch ]
+  pull_request:
+    branches: [ $default-branch ]
 
 env:
   # Path to the solution file relative to the root of the project.

From 0d462e1c6b547f7df41b16f6ef94d08d27f26176 Mon Sep 17 00:00:00 2001
From: Bishal Prasad <bishal-pdmsft@github.com>
Date: Thu, 3 Mar 2022 22:43:12 +0530
Subject: [PATCH 15/15] Port reworked AKS templates to main (#1450)

---
 deployments/azure-kubernetes-service-helm.yml | 122 +++++++++++++++++
 .../azure-kubernetes-service-kompose.yml      | 111 +++++++++++++++
 .../azure-kubernetes-service-kustomize.yml    | 117 ++++++++++++++++
 deployments/azure-kubernetes-service.yml      | 127 +++++++++++-------
 ...re-kubernetes-service-helm.properties.json |   7 +
 ...kubernetes-service-kompose.properties.json |   7 +
 ...bernetes-service-kustomize.properties.json |   7 +
 .../azure-kubernetes-service.properties.json  |   6 +-
 8 files changed, 450 insertions(+), 54 deletions(-)
 create mode 100644 deployments/azure-kubernetes-service-helm.yml
 create mode 100644 deployments/azure-kubernetes-service-kompose.yml
 create mode 100644 deployments/azure-kubernetes-service-kustomize.yml
 create mode 100644 deployments/properties/azure-kubernetes-service-helm.properties.json
 create mode 100644 deployments/properties/azure-kubernetes-service-kompose.properties.json
 create mode 100644 deployments/properties/azure-kubernetes-service-kustomize.properties.json

diff --git a/deployments/azure-kubernetes-service-helm.yml b/deployments/azure-kubernetes-service-helm.yml
new file mode 100644
index 0000000..506819d
--- /dev/null
+++ b/deployments/azure-kubernetes-service-helm.yml
@@ -0,0 +1,122 @@
+# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code
+#
+# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR)
+# For instructions see:
+#   - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal
+#   - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal
+#   - https://github.com/Azure/aks-create-action
+#
+# To configure this workflow:
+#
+# 1. Set the following secrets in your repository (instructions for getting these 
+#    https://github.com/Azure/login#configure-a-service-principal-with-a-federated-credential-to-use-oidc-based-authentication):
+#    - AZURE_CLIENT_ID
+#    - AZURE_TENANT_ID
+#    - AZURE_SUBSCRIPTION_ID
+#
+# 2. Set the following environment variables (or replace the values below):
+#    - AZURE_CONTAINER_REGISTRY (name of your container registry / ACR)
+#    - RESOURCE_GROUP (where your cluster is deployed)
+#    - CLUSTER_NAME (name of your AKS cluster)
+#    - CONTAINER_NAME (name of the container image you would like to push up to your ACR)
+#    - SECRET_NAME (name of the secret associated with pulling your ACR image)
+#
+# 3. Choose the appropriate render engine for the bake step https://github.com/Azure/k8s-bake. The config below assumes Helm.
+#    Set your helmChart, overrideFiles, overrides, and helm-version to suit your configuration.
+#    - CHART_PATH (path to your helm chart)
+#    - CHART_OVERRIDE_PATH (path to your helm chart with override values)
+#
+# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions
+# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples
+# For more options with the actions used below please refer to https://github.com/Azure/login
+
+name: Build and deploy an app to AKS with Helm
+
+on:
+  push:
+    branches:
+      - $default-branch
+  workflow_dispatch:
+
+env:
+  AZURE_CONTAINER_REGISTRY: "your-azure-container-registry"
+  CONTAINER_NAME: "your-container-name"
+  RESOURCE_GROUP: "your-resource-group"
+  CLUSTER_NAME: "your-cluster-name"
+  IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name"
+  CHART_PATH: "your-chart-path"
+  CHART_OVERRIDE_PATH: "your-chart-override-path"
+
+jobs:
+  build:
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      
+    runs-on: ubuntu-latest
+    steps:
+    # Checks out the repository this file is in
+    - uses: actions/checkout@master
+    
+    # Logs in with your Azure credentials
+    - name: Azure login
+      uses: azure/login@v1.4.3
+      with:
+        client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+    
+    # Builds and pushes an image up to your Azure Container Registry
+    - name: Build and push image to ACR
+      run: |
+        az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} .
+
+    # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
+    - name: Get K8s context
+      uses: azure/aks-set-context@v2.0
+      with:
+        resource-group: ${{ env.RESOURCE_GROUP }}
+        cluster-name: ${{ env.CLUSTER_NAME }}
+
+    # Retrieves the credentials for pulling images from your Azure Container Registry
+    - name: Get ACR credentials
+      run: |
+        az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true
+        ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv)
+        ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv)
+        echo "::set-output name=username::${ACR_USERNAME}"
+        echo "::set-output name=password::${ACR_PASSWORD}"
+      id: get-acr-creds
+
+    # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step
+    - name: Create K8s secret for pulling image from ACR
+      uses: Azure/k8s-create-secret@v1.1
+      with:
+        container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io
+        container-registry-username: ${{ steps.get-acr-creds.outputs.username }}
+        container-registry-password: ${{ steps.get-acr-creds.outputs.password }}
+        secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }}
+
+    # Runs Helm to create manifest files
+    - name: Bake deployment
+      uses: azure/k8s-bake@v2.1
+      with:
+        renderEngine: 'helm'
+        helmChart: ${{ env.CHART_PATH }}
+        overrideFiles: ${{ env.CHART_OVERRIDE_PATH }}
+        overrides: |     
+          replicas:2
+        helm-version: 'latest' 
+      id: bake
+
+    # Deploys application based on manifest files from previous step
+    - name: Deploy application
+      uses: Azure/k8s-deploy@v3.0
+      with:
+        action: deploy
+        manifests: ${{ steps.bake.outputs.manifestsBundle }}
+        images: |
+          ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
+        imagepullsecrets: |
+          ${{ env.IMAGE_PULL_SECRET_NAME }}
diff --git a/deployments/azure-kubernetes-service-kompose.yml b/deployments/azure-kubernetes-service-kompose.yml
new file mode 100644
index 0000000..1d33fe3
--- /dev/null
+++ b/deployments/azure-kubernetes-service-kompose.yml
@@ -0,0 +1,111 @@
+# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code
+#
+# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR)
+# For instructions see:
+#   - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal
+#   - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal
+#   - https://github.com/Azure/aks-create-action
+#
+# To configure this workflow:
+#
+# 1. Set the following secrets in your repository (instructions for getting these 
+#    https://github.com/Azure/login#configure-a-service-principal-with-a-federated-credential-to-use-oidc-based-authentication):
+#    - AZURE_CLIENT_ID
+#    - AZURE_TENANT_ID
+#    - AZURE_SUBSCRIPTION_ID
+#
+# 2. Set the following environment variables (or replace the values below):
+#    - AZURE_CONTAINER_REGISTRY (name of your container registry / ACR)
+#    - RESOURCE_GROUP (where your cluster is deployed)
+#    - CLUSTER_NAME (name of your AKS cluster)
+#    - CONTAINER_NAME (name of the container image you would like to push up to your ACR)
+#    - SECRET_NAME (name of the secret associated with pulling your ACR image)
+#
+# 3. Choose the appropriate render engine for the bake step https://github.com/Azure/k8s-bake. The config below assumes Kompose.
+#    Set your dockerComposeFile and kompose-version to suit your configuration.
+#    - DOCKER_COMPOSE_FILE_PATH (the path where your Kompose deployment manifest is located)
+#
+# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions
+# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples
+# For more options with the actions used below please refer to https://github.com/Azure/login
+
+name: Build and deploy an app to AKS with Kompose
+
+env:
+  AZURE_CONTAINER_REGISTRY: "your-azure-container-registry"
+  CONTAINER_NAME: "your-container-name"
+  RESOURCE_GROUP: "your-resource-group"
+  CLUSTER_NAME: "your-cluster-name"
+  IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name"
+  DOCKER_COMPOSE_FILE_PATH: "your-docker-compose-file-path"
+
+jobs:
+  build:
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      
+    runs-on: ubuntu-latest
+    steps:
+    # Checks out the repository this file is in
+    - uses: actions/checkout@master
+    
+    # Logs in with your Azure credentials
+    - name: Azure login
+      uses: azure/login@v1.4.3
+      with:
+        client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      
+    # Builds and pushes an image up to your Azure Container Registry
+    - name: Build and push image to ACR
+      run: |
+        az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} .
+
+    # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
+    - name: Get K8s context
+      uses: azure/aks-set-context@v2.0
+      with:
+        resource-group: ${{ env.RESOURCE_GROUP }}
+        cluster-name: ${{ env.CLUSTER_NAME }}
+
+    # Retrieves the credentials for pulling images from your Azure Container Registry
+    - name: Get ACR credentials
+      run: |
+        az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true
+        ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv)
+        ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv)
+        echo "::set-output name=username::${ACR_USERNAME}"
+        echo "::set-output name=password::${ACR_PASSWORD}"
+      id: get-acr-creds
+
+    # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step
+    - name: Create K8s secret for pulling image from ACR
+      uses: Azure/k8s-create-secret@v1.1
+      with:
+        container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io
+        container-registry-username: ${{ steps.get-acr-creds.outputs.username }}
+        container-registry-password: ${{ steps.get-acr-creds.outputs.password }}
+        secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }}
+
+    # Runs Kompose to create manifest files
+    - name: Bake deployment
+      uses: azure/k8s-bake@v2.1
+      with:
+        renderEngine: 'kompose'
+        dockerComposeFile: ${{ env.DOCKER_COMPOSE_FILE_PATH }}
+        kompose-version: 'latest'   
+      id: bake
+
+    # Deploys application based on manifest files from previous step
+    - name: Deploy application
+      uses: Azure/k8s-deploy@v3.0
+      with:
+        action: deploy
+        manifests: ${{ steps.bake.outputs.manifestsBundle }}
+        images: |
+          ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
+        imagepullsecrets: |
+          ${{ env.IMAGE_PULL_SECRET_NAME }}
diff --git a/deployments/azure-kubernetes-service-kustomize.yml b/deployments/azure-kubernetes-service-kustomize.yml
new file mode 100644
index 0000000..51b7d69
--- /dev/null
+++ b/deployments/azure-kubernetes-service-kustomize.yml
@@ -0,0 +1,117 @@
+# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code
+#
+# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR)
+# For instructions see:
+#   - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal
+#   - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal
+#   - https://github.com/Azure/aks-create-action
+#
+# To configure this workflow:
+#
+# 1. Set the following secrets in your repository (instructions for getting these 
+#    https://github.com/Azure/login#configure-a-service-principal-with-a-federated-credential-to-use-oidc-based-authentication):
+#    - AZURE_CLIENT_ID
+#    - AZURE_TENANT_ID
+#    - AZURE_SUBSCRIPTION_ID
+#
+# 2. Set the following environment variables (or replace the values below):
+#    - AZURE_CONTAINER_REGISTRY (name of your container registry / ACR)
+#    - RESOURCE_GROUP (where your cluster is deployed)
+#    - CLUSTER_NAME (name of your AKS cluster)
+#    - CONTAINER_NAME (name of the container image you would like to push up to your ACR)
+#    - SECRET_NAME (name of the secret associated with pulling your ACR image)
+#
+# 3. Choose the appropriate render engine for the bake step https://github.com/Azure/k8s-bake. The config below assumes Kustomize.
+#    Set your kustomizationPath and kubectl-version to suit your configuration.
+#    - KUSTOMIZE_PATH (the path where your Kustomize manifests are located)
+#
+# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions
+# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples
+# For more options with the actions used below please refer to https://github.com/Azure/login
+
+name: Build and deploy an app to AKS with Kustomize
+
+on:
+  push:
+    branches:
+      - $default-branch
+  workflow_dispatch:
+
+env:
+  AZURE_CONTAINER_REGISTRY: "your-azure-container-registry"
+  CONTAINER_NAME: "your-container-name"
+  RESOURCE_GROUP: "your-resource-group"
+  CLUSTER_NAME: "your-cluster-name"
+  IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name"
+  KUSTOMIZE_PATH: "your-kustomize-path"
+
+jobs:
+  build:
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      
+    runs-on: ubuntu-latest
+    steps:
+    # Checks out the repository this file is in
+    - uses: actions/checkout@master
+
+    # Logs in with your Azure credentials
+    - name: Azure login
+      uses: azure/login@v1.4.3
+      with:
+        client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      
+    # Builds and pushes an image up to your Azure Container Registry
+    - name: Build and push image to ACR
+      run: |
+        az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} .
+
+    # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
+    - name: Get K8s context
+      uses: azure/aks-set-context@v2.0
+      with:
+        resource-group: ${{ env.RESOURCE_GROUP }}
+        cluster-name: ${{ env.CLUSTER_NAME }}
+
+    # Retrieves the credentials for pulling images from your Azure Container Registry
+    - name: Get ACR credentials
+      run: |
+        az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true
+        ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv)
+        ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv)
+        echo "::set-output name=username::${ACR_USERNAME}"
+        echo "::set-output name=password::${ACR_PASSWORD}"
+      id: get-acr-creds
+
+    # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step
+    - name: Create K8s secret for pulling image from ACR
+      uses: Azure/k8s-create-secret@v1.1
+      with:
+        container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io
+        container-registry-username: ${{ steps.get-acr-creds.outputs.username }}
+        container-registry-password: ${{ steps.get-acr-creds.outputs.password }}
+        secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }}
+
+    # Runs Kustomize to create manifest files
+    - name: Bake deployment
+      uses: azure/k8s-bake@v2.1
+      with:
+        renderEngine: 'kustomize'
+        kustomizationPath: ${{ env.KUSTOMIZE_PATH }}
+        kubectl-version: latest
+      id: bake
+
+    # Deploys application based on manifest files from previous step
+    - name: Deploy application
+      uses: Azure/k8s-deploy@v3.0
+      with:
+        action: deploy
+        manifests: ${{ steps.bake.outputs.manifestsBundle }}
+        images: |
+          ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
+        imagepullsecrets: |
+          ${{ env.IMAGE_PULL_SECRET_NAME }}
diff --git a/deployments/azure-kubernetes-service.yml b/deployments/azure-kubernetes-service.yml
index 08988ff..e61e64e 100644
--- a/deployments/azure-kubernetes-service.yml
+++ b/deployments/azure-kubernetes-service.yml
@@ -1,80 +1,105 @@
 # This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code
 #
 # This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR)
-# For instructions see https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal
-# https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal
-# https://github.com/Azure/aks-create-action
+# For instructions see:
+#   - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal
+#   - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal
+#   - https://github.com/Azure/aks-create-action
 #
 # To configure this workflow:
 #
-# 1. Set the following secrets in your repository:
-#    - AZURE_CREDENTIALS (instructions for getting this https://github.com/Azure/login#configure-a-service-principal-with-a-secret)
+# 1. Set the following secrets in your repository (instructions for getting these 
+#    https://github.com/Azure/login#configure-a-service-principal-with-a-federated-credential-to-use-oidc-based-authentication):
+#    - AZURE_CLIENT_ID
+#    - AZURE_TENANT_ID
+#    - AZURE_SUBSCRIPTION_ID
 #
 # 2. Set the following environment variables (or replace the values below):
-#    - AZURE_CONTAINER_REGISTRY (name of your container registry)
-#    - PROJECT_NAME
+#    - AZURE_CONTAINER_REGISTRY (name of your container registry / ACR)
 #    - RESOURCE_GROUP (where your cluster is deployed)
 #    - CLUSTER_NAME (name of your AKS cluster)
-#
-# 3. Choose the approrpiate render engine for the bake step https://github.com/Azure/k8s-bake. The config below assumes helm, then set
-#    any needed environment variables such as:
-#    - CHART_PATH 
-#    - CHART_OVERRIDE_PATH
+#    - CONTAINER_NAME (name of the container image you would like to push up to your ACR)
+#    - SECRET_NAME (name of the secret associated with pulling your ACR image)
+#    - DEPLOYMENT_MANIFEST_PATH (path to the manifest yaml for your deployment)
 #
 # For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions
 # For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples
-# For more options with the actions used below please see the folllowing
-# https://github.com/Azure/login
-# https://github.com/Azure/aks-set-context
-# https://github.com/marketplace/actions/azure-cli-action
-# https://github.com/Azure/k8s-bake
-# https://github.com/Azure/k8s-deploy   
+# For more options with the actions used below please refer to https://github.com/Azure/login
 
-on: [push]
+name: Build and deploy an app to AKS
+
+on:
+  push:
+    branches:
+      - $default-branch
+  workflow_dispatch:
+
+env:
+  AZURE_CONTAINER_REGISTRY: "your-azure-container-registry"
+  CONTAINER_NAME: "your-container-name"
+  RESOURCE_GROUP: "your-resource-group"
+  CLUSTER_NAME: "your-cluster-name"
+  IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name"
+  DEPLOYMENT_MANIFEST_PATH: 'your-deployment-manifest-path'
 
 jobs:
   build:
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+
     runs-on: ubuntu-latest
     steps:
+    # Checks out the repository this file is in
     - uses: actions/checkout@master
     
-    - name: Azure Login
-      uses: azure/login@v1
+    # Logs in with your Azure credentials
+    - name: Azure login
+      uses: azure/login@v1.4.3
       with:
-        creds: ${{ secrets.AZURE_CREDENTIALS }}
-    
-    - name: Build image on ACR
-      uses: azure/CLI@v1
-      with:
-        azcliversion: 2.29.1
-        inlineScript: |
-          az configure --defaults acr=${{ env.AZURE_CONTAINER_REGISTRY }}
-          az acr build -t  -t ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.PROJECT_NAME }}:${{ github.sha }}
-    
-    - name: Gets K8s context
-      uses: azure/aks-set-context@v1
-      with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
-          resource-group: ${{ env.RESOURCE_GROUP }}
-          cluster-name: ${{ env.CLUSTER_NAME }}
-      id: login
+        client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      
+    # Builds and pushes an image up to your Azure Container Registry
+    - name: Build and push image to ACR
+      run: |
+        az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} .
 
-    - name: Configure deployment
-      uses: azure/k8s-bake@v1
+    # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
+    - name: Get K8s context
+      uses: azure/aks-set-context@v2.0
       with:
-        renderEngine: 'helm'
-        helmChart: ${{ env.CHART_PATH }}
-        overrideFiles: ${{ env.CHART_OVERRIDE_PATH }}
-        overrides: |     
-          replicas:2
-        helm-version: 'latest' 
-      id: bake
+        resource-group: ${{ env.RESOURCE_GROUP }}
+        cluster-name: ${{ env.CLUSTER_NAME }}
 
+    # Retrieves the credentials for pulling images from your Azure Container Registry
+    - name: Get ACR credentials
+      run: |
+        az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true
+        ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv)
+        ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv)
+        echo "::set-output name=username::${ACR_USERNAME}"
+        echo "::set-output name=password::${ACR_PASSWORD}"
+      id: get-acr-creds
+
+    # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step
+    - name: Create K8s secret for pulling image from ACR
+      uses: Azure/k8s-create-secret@v1.1
+      with:
+        container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io
+        container-registry-username: ${{ steps.get-acr-creds.outputs.username }}
+        container-registry-password: ${{ steps.get-acr-creds.outputs.password }}
+        secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }}  
+
+    # Deploys application based on given manifest file
     - name: Deploys application
-    - uses: Azure/k8s-deploy@v1
+      uses: Azure/k8s-deploy@v3.0
       with:
-        manifests: ${{ steps.bake.outputs.manifestsBundle }}
+        action: deploy
+        manifests: ${{ env.DEPLOYMENT_MANIFEST_PATH }}
         images: |
-          ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.PROJECT_NAME }}:${{ github.sha }}
+          ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
         imagepullsecrets: |
-          ${{ env.PROJECT_NAME }}
+          ${{ env.IMAGE_PULL_SECRET_NAME }}
diff --git a/deployments/properties/azure-kubernetes-service-helm.properties.json b/deployments/properties/azure-kubernetes-service-helm.properties.json
new file mode 100644
index 0000000..92478b3
--- /dev/null
+++ b/deployments/properties/azure-kubernetes-service-helm.properties.json
@@ -0,0 +1,7 @@
+{
+    "name": "Deploy to AKS with Helm",
+    "description": "Deploy an application to an Azure Kubernetes Service cluster using Helm",
+    "creator": "Microsoft Azure",
+    "iconName": "azure",
+    "categories": ["Deployment", "Helm", "Kubernetes", "Dockerfile"]
+}
diff --git a/deployments/properties/azure-kubernetes-service-kompose.properties.json b/deployments/properties/azure-kubernetes-service-kompose.properties.json
new file mode 100644
index 0000000..de246c3
--- /dev/null
+++ b/deployments/properties/azure-kubernetes-service-kompose.properties.json
@@ -0,0 +1,7 @@
+{
+    "name": "Deploy to AKS with Kompose",
+    "description": "Deploy an application to an Azure Kubernetes Service cluster using Kompose",
+    "creator": "Microsoft Azure",
+    "iconName": "azure",
+    "categories": ["Deployment", "Kompose", "Kubernetes", "Dockerfile"]
+}
diff --git a/deployments/properties/azure-kubernetes-service-kustomize.properties.json b/deployments/properties/azure-kubernetes-service-kustomize.properties.json
new file mode 100644
index 0000000..bfc71cc
--- /dev/null
+++ b/deployments/properties/azure-kubernetes-service-kustomize.properties.json
@@ -0,0 +1,7 @@
+{
+    "name": "Deploy to AKS with Kustomize",
+    "description": "Deploy an application to an Azure Kubernetes Service cluster using Kustomize",
+    "creator": "Microsoft Azure",
+    "iconName": "azure",
+    "categories": ["Deployment", "Kustomize", "Kubernetes", "Dockerfile"]
+}
diff --git a/deployments/properties/azure-kubernetes-service.properties.json b/deployments/properties/azure-kubernetes-service.properties.json
index 28f3725..45d4a69 100644
--- a/deployments/properties/azure-kubernetes-service.properties.json
+++ b/deployments/properties/azure-kubernetes-service.properties.json
@@ -1,7 +1,7 @@
 {
-    "name": "Deploy to a AKS Cluster",
-    "description": "Deploy an application to a Azure Kubernetes Service Cluster using Azure Credentials",
+    "name": "Deploy to AKS",
+    "description": "Deploy an application to an Azure Kubernetes Service cluster",
     "creator": "Microsoft Azure",
     "iconName": "azure",
-    "categories": ["Deployment", "Kompose", "Helm", "Kustomize", "Kubernetes", "Dockerfile"]
+    "categories": ["Deployment", "Kubernetes", "Dockerfile"]
 }