Deploy a Fabric app with GitHub Actions

1. The sample workflow doesn't run as written

- The login step is missing line continuations: -t $TENANT_ID has no trailing \, so -u/-p never reach rayfin login. The run fails with "--client-id is required for service principal authentication". -p CLIENT_SECRET is also missing its $.

- On ubuntu-latest, sign-in also needed libsecret-1-0 installed and --encryption-fallback-enabled (there's no OS keychain). Neither is mentioned.

- The sample assumes the Rayfin project is at the repo root and never installs dependencies, although rayfin up builds the static site. A working-directory and an install step should be shown.

2. Service principal deploy fails for a Fabric app with a fabric-semanticmodel connector

After fixing the above, sign-in, workspace resolution and item resolution all succeed, but the settings step fails:

❌ Deployment failed: Runtime settings sync failed: 403 Forbidden

Details: Could not verify Build permission on semantic model '895b9183-5943-4cff-a0e0-5d322ed02c50'.

Ensure you have Build access, then re-add the connector.

RootActivityId: 2242ea58-00ee-4d2f-bfbf-0d4194be368d (also 2d4d50f1-b8d3-4efd-8071-6b03feda694e), 2026-10-14

- CLI: Microsoft/rayfin-cli 1.36.2.

- Workspace role: the service principal is a Membet in the target workspace.

- Model permission: the service principal already has Build on the semantic model (ReadWriteReshareExplore, confirmed with the Power BI REST API).

- Same app as a user: the identical rayfin up succeeds when run interactively by a user.

Questions:

- Are service principal deployments supported for apps with a delegated fabric-semanticmodel connector?

- If yes, which tenant setting or permission is missing? If no, please state it under "Considerations and limitations".