provision-deploy.yml

name: 'Infrastructure and App Deployment'

on:
  workflow_dispatch: # allows to manually trigger the workflow
  push:
    branches:
    - main

#Special permissions required for OIDC authentication
permissions:
  id-token: write
  contents: read

env:
  # The ARM_* environment variables are used by the Terraform AzureRM provider for authentication
  ARM_CLIENT_ID: "${{ secrets.AZURE_CLIENT_ID }}"
  ARM_CLIENT_SECRET: "${{ secrets.AZURE_CLIENT_SECRET }}"
  ARM_SUBSCRIPTION_ID: "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
  ARM_TENANT_ID: "${{ secrets.AZURE_TENANT_ID }}"

  AZURE_FUNCTIONAPP_PACKAGE_PATH: published
  CONFIGURATION: Release
  DOTNET_CORE_VERSION: 8.0.x
  WORKING_DIRECTORY: ./src
  FUNC_PROJECT: TimeTrackerBot/TimeTrackerBot.csproj

jobs:
  provision:
    name: Terraform provision
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: infra
    env:
      # this is needed since we are running Terraform with read-only permissions
      ARM_SKIP_PROVIDER_REGISTRATION: true
      TF_IN_AUTOMATION: 1
    outputs:
      tfplanExitCode: ${{ steps.tf-plan.outputs.exitcode }}
      functionAppName: ${{ steps.terraformOutputsStep.outputs.FUNCTIONS_APP_NAME }}

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v4

    # Install the latest version of the Terraform CLI
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3
      with:
        terraform_wrapper: false

    # bug with act and terraform permissions: https://github.com/nektos/act/issues/491
    - name: fix terraform file permissions
      if: ${{ vars.IS_LOCAL_ACT_CLI }} == false
      run: find /tmp -name "terraform" -type f -exec chmod 755 {} +
      continue-on-error: true

    # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
    - name: Terraform Init
      run: terraform init -input=false

    # Checks that all Terraform configuration files adhere to a canonical format
    # Will fail the build if not
    - name: Terraform Format
      run: terraform fmt -check -recursive

    # Generates an execution plan for Terraform
    # An exit code of 0 indicated no changes, 1 a terraform failure, 2 there are pending changes.
    - name: Terraform Plan
      id: tf-plan
      run: |
        export exitcode=0
        terraform plan -input=false -var="TelegramBotApiKey={{ secrets.TELEGRAM_BOT_API_KEY }}" -var="resource_group=${{ vars.RESOURCE_GROUP }}" -detailed-exitcode -no-color -out tfplan || export exitcode=$?

        echo "exitcode=$exitcode" >> $GITHUB_OUTPUT
        
        if [ $exitcode -eq 1 ]; then
          echo Terraform Plan Failed!
          exit 1
        else 
          exit 0
        fi
        
    # Save plan to artifacts  
    - name: Publish Terraform Plan
      uses: actions/upload-artifact@v4
      with:
        name: tfplan
        path: infra/tfplan
        
    # Create string output of Terraform Plan
    - name: Create String Output
      id: tf-plan-string
      run: |
        TERRAFORM_PLAN=$(terraform show -no-color tfplan)
        
        delimiter="$(openssl rand -hex 8)"
        echo "summary<<${delimiter}" >> $GITHUB_OUTPUT
        echo "## Terraform Plan Output" >> $GITHUB_OUTPUT
        echo "<details><summary>Click to expand</summary>" >> $GITHUB_OUTPUT
        echo "" >> $GITHUB_OUTPUT
        echo '```terraform' >> $GITHUB_OUTPUT
        echo "$TERRAFORM_PLAN" >> $GITHUB_OUTPUT
        echo '```' >> $GITHUB_OUTPUT
        echo "</details>" >> $GITHUB_OUTPUT
        echo "${delimiter}" >> $GITHUB_OUTPUT
        
    - name: Publish Terraform Plan to Task Summary
      env:
        SUMMARY: ${{ steps.tf-plan-string.outputs.summary }}
      run: |
        echo "$SUMMARY" >> $GITHUB_STEP_SUMMARY

    - name: Terraform Apply
      run: terraform apply -input=false -auto-approve tfplan

    - name: Get Terraform Outputs
      id: terraformOutputsStep
      run: |
        echo "FUNCTIONS_APP_NAME=$(terraform output -raw function_app_name)" >> "$GITHUB_OUTPUT"

  build:
    name: Build
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@v3
      with:
        dotnet-version: ${{ env.DOTNET_CORE_VERSION }}

    - name: Build
      run: dotnet build "${{ env.WORKING_DIRECTORY }}" --configuration ${{ env.CONFIGURATION }}

    - name: Test
      run: dotnet test --no-build "${{ env.WORKING_DIRECTORY }}"
        
    - name: Publish
      run: dotnet publish "${{ env.WORKING_DIRECTORY }}/${{ env.FUNC_PROJECT }}" --configuration ${{ env.CONFIGURATION }} --output "${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}"

    - name: Upload
      uses: actions/upload-artifact@v4
      with:
        name: published
        path: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}

  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    needs: [provision, build]
    env:
      FUNCTIONS_APP_NAME: ${{ needs.provision.outputs.functionAppName }}

    steps:
    - name: Download
      uses: actions/download-artifact@v4
      with:
        name: published
        path: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}

    - name: 'Login via Azure CLI'
      uses: azure/login@v1
      with:
        creds: ${{ secrets.AZURE_RBAC_CREDENTIALS }}

    - name: Deploy to Azure Function App
      uses: Azure/functions-action@v1
      with:
        app-name: ${{ env.FUNCTIONS_APP_NAME }}
        package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}