cd.yml

name: cd
on:
  push:
    branches: [main]
  pull_request:
    paths:
      - "examples"
  workflow_dispatch:

jobs:
  cd:
    env:
      TF_IN_AUTOMATION: true
      TF_INPUT: false
      TF_CLI_ARGS_init: "-backend-config=storage_account_name=${{ secrets.STORAGE_NAME }} -backend-config=resource_group_name=cgc-cd -backend-config=container_name=tfstate -backend-config=key=policy.tfstate"
      TF_CLI_ARGS_apply: "-auto-approve -parallelism=30"
      ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
      ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
      ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
      ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ~1.3.0

      - name: Terraform Init
        id: init
        run: terraform init -no-color
        working-directory: examples

      - name: Terraform Apply
        id: apply
        if: ${{ success() }}
        run: terraform apply
        working-directory: examples

      - name: Azure Login
        uses: azure/login@v1
        if: ${{ failure() }} || ${{ success() }}
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          enable-AzPSSession: true

      # Used by GitHub Workflows to clean deployed resources quicker than tf destroy
      # Quicker during CD as remediation tasks must be in a terminal provisioning state (Succeeded, Canceled, Failed) before they can be deleted.
      - name: Clean Resources with PowerShell
        id: destroy
        uses: azure/powershell@v1
        if: ${{ failure() }} || ${{ success() }}
        with:
          azPSVersion: "latest"
          inlineScript: |
            Get-AzPolicyAssignment -Scope "/providers/Microsoft.Management/managementgroups/team_a" | Remove-AzPolicyAssignment -Verbose
            Get-AzPolicyAssignment -Scope "/providers/Microsoft.Management/managementgroups/policy_dev" | Remove-AzPolicyAssignment -Verbose
            Get-AzPolicySetDefinition -ManagementGroupName "policy_dev" -Custom | Remove-AzPolicySetDefinition -Force -Verbose
            Get-AzPolicyDefinition -ManagementGroupName "policy_dev" -Custom | Remove-AzPolicyDefinition -Force -Verbose
            Remove-AzPolicyExemption -Name "Subscription Diagnostic Settings Exemption" -Scope ("/subscriptions/" + (Get-AzContext).Subscription.Id) -Force -Verbose -ErrorAction SilentlyContinue