deploy.yml

name: Deploy

on:
  pull_request:
    branches: [master]

jobs:
  frontend-tests:
    name: Run frontend tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: 'frontend'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # Task 1.1:

  deploy-infrastructure:
    name: Deploy infrastructure with Terraform
    runs-on: ubuntu-latest
    # Task 1.2:
    env:
      TF_VAR_my_name: ${{ github.head_ref }}
      ARM_CLIENT_ID: ${{ vars.ARM_CLIENT_ID }}
      ARM_SUBSCRIPTION_ID: ${{ vars.ARM_SUBSCRIPTION_ID }}
      ARM_TENANT_ID: ${{ vars.ARM_TENANT_ID }}
      ARM_USE_OIDC: 'true'
    outputs:
      resource-group-name: ${{ steps.terraform-output.outputs.resource_group_name }}
      swa-name: ${{ steps.terraform-output.outputs.swa_name }}
    permissions:
      contents: read
      id-token: write
    environment: prod
    defaults:
      run:
        working-directory: 'terraform'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Init Terraform
        run: terraform init

      - name: Set Terraform workspace
        run: terraform workspace new "$TF_VAR_my_name" || terraform workspace select "$TF_VAR_my_name"

      - name: Run Terraform plan
        run: terraform plan

      # Task 2.3:

      - name: Get Terraform output
        id: terraform-output
        run: |
          echo "resource_group_name=$(terraform output -raw resource_group_name)" >> "$GITHUB_OUTPUT"
          echo "swa_name=$(terraform output -raw swa_name)" >> "$GITHUB_OUTPUT"

      - name: Unlock Terraform state on failure
        if: failure() || cancelled()
        run: |
          lock_id=$(terraform plan -no-color 2> >(grep -i 'ID:' | sed -e 's/ID:\s*//g' | tr -d ' '))
          echo "$lock_id"
          terraform force-unlock -force "$lock_id"

  deploy-frontend:
    name: Deploy frontend
    runs-on: ubuntu-latest
    needs:
      - deploy-infrastructure
    permissions:
      contents: read
      id-token: write
      pull-requests: write
    environment: prod
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js environment
        uses: actions/setup-node@v4
        with:
          node-version: '20.x'

      - name: Authenticate with Azure
        uses: azure/login@v2
        with:
          tenant-id: ${{ vars.ARM_TENANT_ID }}
          subscription-id: ${{ vars.ARM_SUBSCRIPTION_ID }}
          client-id: ${{ vars.ARM_CLIENT_ID }}

      - name: Get Azure Static Web Apps API token
        id: get-api-key
        run: |
          swa_api_key=$(az staticwebapp secrets list -n "$SWA_NAME" -g "$RESOURCE_GROUP" --query 'properties.apiKey' -o tsv)
          echo "::add-mask::$swa_api_key"
          echo "swa_api_key=$swa_api_key" >> "$GITHUB_OUTPUT"
        env:
          RESOURCE_GROUP: ${{ needs.deploy-infrastructure.outputs.resource-group-name }}
          SWA_NAME: ${{ needs.deploy-infrastructure.outputs.swa-name }}

      - name: Build and deploy to Azure Static Web Apps
        uses: Azure/static-web-apps-deploy@v1
        with:
          azure_static_web_apps_api_token: ${{ steps.get-api-key.outputs.swa_api_key }}
          repo_token: ${{ github.token }}
          action: 'upload'
          api_location: ''
          app_location: 'frontend'
          output_location: 'dist'