azure-dev.yml

on:
  workflow_dispatch:
  push:
    # Run when commits are pushed to main branch
    branches:
      - main

# GitHub Actions workflow to deploy to Azure using azd
# To configure required secrets for connecting to Azure, run `azd pipeline config`

# Set up permissions for deploying with secretless Azure federated credentials
# https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-portal%2Clinux#set-up-azure-login-with-openid-connect-authentication
permissions:
  id-token: write
  contents: read

jobs:
  init:
    runs-on: ubuntu-latest
    steps:
      - name: Set environment
        id: set_env
        run: |
          Write-Output "Running on branch $env:GITHUB_REF"
          if ($env:GITHUB_REF -eq "refs/heads/main") {
            Add-Content $env:GITHUB_OUTPUT "env_name=production"
          } else {
            Add-Content $env:GITHUB_OUTPUT "env_name=unknown"
          }
        shell: pwsh
        env:
            GITHUB_REF: ${{ github.ref }}

      - name: Show environment
        run: echo "environment is set to '${{ steps.set_env.outputs.env_name }}'"
        shell: pwsh

    outputs:
      env_name: ${{ steps.set_env.outputs.env_name }}

  deploy:
    needs: [init]
    if: needs.init.outputs.env_name != 'unknown'
    runs-on: ubuntu-latest
    environment:
      name: ${{ needs.init.outputs.env_name }}
    env:
      AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
      AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
      AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
    steps:
      - name: Show environment
        run: echo "environment is set to '${{ needs.init.outputs.env_name }}'"

      - name: Checkout
        uses: actions/checkout@v3

      - name: Install azd
        uses: Azure/setup-azd@v0.1.0

      - name: Install Nodejs
        uses: actions/setup-node@v3
        with:
          node-version: 18

      - name: Log in with Azure (Federated Credentials)
        if: ${{ env.AZURE_CLIENT_ID != '' }}
        run: |
          azd auth login `
            --client-id "$Env:AZURE_CLIENT_ID" `
            --federated-credential-provider "github" `
            --tenant-id "$Env:AZURE_TENANT_ID"
        shell: pwsh

      - name: Log in with Azure (Client Credentials)
        if: ${{ env.AZURE_CREDENTIALS != '' }}
        run: |
          $info = $Env:AZURE_CREDENTIALS | ConvertFrom-Json -AsHashtable;
          Write-Host "::add-mask::$($info.clientSecret)"

          azd auth login `
            --client-id "$($info.clientId)" `
            --client-secret "$($info.clientSecret)" `
            --tenant-id "$($info.tenantId)"
        shell: pwsh
        env:
          AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Create .env.local file
        run: npm run env:init
        shell: pwsh
        env:
          SERVICE_WEB_MIN_LOG_LEVEL: ${{ vars.SERVICE_WEB_MIN_LOG_LEVEL }}
          SERVICE_WEB_CONTAINER_CPU_CORE_COUNT: ${{ vars.SERVICE_WEB_CONTAINER_CPU_CORE_COUNT }}
          SERVICE_WEB_CONTAINER_MEMORY: ${{ vars.SERVICE_WEB_CONTAINER_MEMORY }}
          SERVICE_WEB_CONTAINER_MIN_REPLICAS: ${{ vars.SERVICE_WEB_CONTAINER_MIN_REPLICAS }}
          SERVICE_WEB_CONTAINER_MAX_REPLICAS: ${{ vars.SERVICE_WEB_CONTAINER_MAX_REPLICAS }}
          SERVICE_WEB_CUSTOM_DOMAIN_NAME: ${{ vars.SERVICE_WEB_CUSTOM_DOMAIN_NAME }}
          SERVICE_WEB_CUSTOM_DOMAIN_CERT_ID: ${{ vars.SERVICE_WEB_CUSTOM_DOMAIN_CERT_ID }}

      - name: Provision Infrastructure
        run: azd provision --no-prompt
        shell: pwsh
        env:
          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}
          AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
          AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}

      - name: Domain Verification
        run: npm run env:dv
        shell: pwsh
        env:
          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}

      - name: Deploy Application
        run: azd deploy --no-prompt
        shell: pwsh
        env:
          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}
          AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
          AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}