azure-dev.yml

on:
  workflow_dispatch:
  push:
    # Run when commits are pushed to main branch
    branches:
      - main

# GitHub Actions workflow to deploy to Azure using azd

# Set up permissions for deploying with secretless Azure federated credentials
# https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-portal%2Clinux#set-up-azure-login-with-openid-connect-authentication
permissions:
  id-token: write
  contents: read

jobs:
  init:
    runs-on: ubuntu-latest
    steps:
      - name: 'Set environment'
        id: set_env
        run: |
          Write-Output "Running on branch $env:GITHUB_REF"
          if ($env:GITHUB_REF -eq "refs/heads/main") {
            Add-Content $env:GITHUB_OUTPUT "APP_ENV=production"
          } else {
            Add-Content $env:GITHUB_OUTPUT "APP_ENV=unknown"
          }
        shell: pwsh
        env:
            GITHUB_REF: ${{ github.ref }}

      - name: 'Show target environment'
        run: echo "`APP_ENV` is set to '${{ steps.set_env.outputs.APP_ENV }}'"
        shell: pwsh

    outputs:
      APP_ENV: ${{ steps.set_env.outputs.APP_ENV }}

  deploy:
    needs: [init]
    if: needs.init.outputs.APP_ENV != 'unknown'
    runs-on: ubuntu-latest
    environment:
      name: ${{ needs.init.outputs.APP_ENV }}
    env:
      AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}
      AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
      AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
      AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
      AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
      APP_ENV: ${{ needs.init.outputs.APP_ENV }}
      MIN_LOG_LEVEL: ${{ vars.MIN_LOG_LEVEL }}
      SERVICE_WEB_APP_CONTAINER_CPU_CORE_COUNT: ${{ vars.SERVICE_WEB_APP_CONTAINER_CPU_CORE_COUNT }}
      SERVICE_WEB_APP_CONTAINER_MEMORY: ${{ vars.SERVICE_WEB_APP_CONTAINER_MEMORY }}
      SERVICE_WEB_APP_CONTAINER_MIN_REPLICAS: ${{ vars.SERVICE_WEB_APP_CONTAINER_MIN_REPLICAS }}
      SERVICE_WEB_APP_CONTAINER_MAX_REPLICAS: ${{ vars.SERVICE_WEB_APP_CONTAINER_MAX_REPLICAS }}
      SERVICE_WEB_APP_CUSTOM_DOMAIN_NAME: ${{ vars.SERVICE_WEB_APP_CUSTOM_DOMAIN_NAME }}
      SERVICE_WEB_APP_CUSTOM_DOMAIN_CERT_ID: ${{ vars.SERVICE_WEB_APP_CUSTOM_DOMAIN_CERT_ID }}
    steps:
      - name: 'Checkout'
        uses: actions/checkout@v3

      - name: 'Install azd'
        uses: Azure/setup-azd@v0.1.0

      - name: 'Install Nodejs'
        uses: actions/setup-node@v3
        with:
          node-version: 18

      - name: 'Log in with Azure (federated credentials)'
        if: ${{ env.AZURE_CLIENT_ID != '' }}
        run: |
          azd auth login `
            --client-id "$Env:AZURE_CLIENT_ID" `
            --federated-credential-provider "github" `
            --tenant-id "$Env:AZURE_TENANT_ID"
        shell: pwsh

      - name: 'Log in with Azure (client credentials)'
        if: ${{ env.AZURE_CREDENTIALS != '' }}
        run: |
          $info = $Env:AZURE_CREDENTIALS | ConvertFrom-Json -AsHashtable;
          Write-Host "::add-mask::$($info.clientSecret)"

          azd auth login `
            --client-id "$($info.clientId)" `
            --client-secret "$($info.clientSecret)" `
            --tenant-id "$($info.tenantId)"
        shell: pwsh

      - name: 'Create `.env` file'
        run: npm run env:init
        shell: pwsh

      - name: 'Provision infrastructure'
        run: azd provision --no-prompt
        shell: pwsh

      - name: 'Deploy application'
        run: azd deploy --no-prompt
        shell: pwsh