azure-dev.yml

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - 'azure.yaml' 
      - 'infra/**'
      - 'src/**'
      - '.github/workflows/azure-dev.yml'

# https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-portal%2Clinux#set-up-azure-login-with-openid-connect-authentication
permissions:
  id-token: write
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: mcr.microsoft.com/azure-dev-cli-apps:latest
    env:
      AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
      AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        
      - name: Helm tool installer
        uses: Azure/setup-helm@v3
        with:
           token: ${{ secrets.GITHUB_TOKEN }}
        
      - name: Log in with Azure
        if: ${{ env.AZURE_CLIENT_ID != '' }}
        run: |
          azd auth login `
            --client-id "$Env:AZURE_CLIENT_ID" `
            --federated-credential-provider "github" `
            --tenant-id "$Env:AZURE_TENANT_ID"
        shell: pwsh

      - name: Azure login (for the preprovision script)
        uses: azure/login@v1
        with:
          client-id: ${{ env.AZURE_CLIENT_ID }}
          subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}
          tenant-id: ${{ env.AZURE_TENANT_ID }}

      - name: Azure Dev Provision
        run: azd provision --no-prompt
        env:
          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}
          AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
          AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
          
      - name: Azure login (to refresh the token for the predeploy script)
        uses: azure/login@v1
        with:
          client-id: ${{ env.AZURE_CLIENT_ID }}
          subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}
          tenant-id: ${{ env.AZURE_TENANT_ID }}
          
      - name: Azure Dev Deploy
        run: azd deploy --no-prompt
        env:
          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}
          AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
          AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}