azure-dev.yml

on:
  push:
    branches:
      - main
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

name: Test and deploy

permissions:
  contents: read
  issues: read
  id-token: write
  actions: write
  checks: write
  pull-requests: write

# Set up environment variables
env:
  IMAGE_NAME: data-management-suite/web-${{ vars.AZURE_ENV_NAME }}
  IMAGE_TAG: ${{ github.sha }}
  LATEST_IMAGE_TAG: latest
  CONTAINER_REGISTRY_ADDRESS: ${{ vars.AZURE_CONTAINER_REGISTRY_NAME }}.azurecr.io
  FULL_IMAGE_NAME: ${{ vars.AZURE_CONTAINER_REGISTRY_NAME }}.azurecr.io/data-management-suite/web-${{ vars.AZURE_ENV_NAME }}:${{ github.sha }}
  PLAYWRIGHT_USER_PASSWORD: ${{ secrets.PLAYWRIGHT_USER_PASSWORD }}

jobs:
  end2endtest:
    name: End 2 end test
    timeout-minutes: 10
    runs-on: ubuntu-latest
    services:
      # Label used to access the service container
      postgres:
        # Docker Hub image
        image: postgis/postgis:15-3.3
        # Provide the password for postgres
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_USER: postgres
          POSTGRES_DB: remix
        # Set health checks to wait until postgres has started
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          # Maps tcp port 5432 on service container to the host
          - 5432:5432

    env:
      DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/remix'
      SESSION_SECRET: super-duper-s3cret
      NODE_VERSION: 18

    steps:
      - name: 🛑 Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.11.0
        with:
          access_token: ${{ github.token }}

      - name: ⬇️ Checkout repo
        uses: actions/checkout@v3

      - name: ⎔ Setup node
        uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: 📥 Download deps
        uses: bahmutov/npm-install@v1

      - name: 🛠 Setup Database
        run: npx prisma migrate reset --force

      - name: 🌱 Seed the Database
        run: npx prisma db seed

      - name: ⚙️ Build
        run: npm run build

      - name: Install Playwright Browsers
        run: npx playwright install --with-deps

      - name: Run Playwright tests
        run: npx remix-serve ./build/index.js & npx playwright test
        env:
          AZURE_TENANT_ID: ${{ vars.ARM_TENANT_ID }}
          AZURE_CLIENT_ID: ${{ vars.AZURE_APP_CLIENT_ID }}
          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_APP_CLIENT_SECRET }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v3
        if: always()
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 30

  provision:
    runs-on: ubuntu-latest
    needs:
      - end2endtest
    if: github.actor != 'dependabot[bot]'
    defaults:
      run:
        shell: bash
        # We keep Terraform files in the infra directory.
        working-directory: ./infra
    env:
      ARM_CLIENT_ID: ${{ vars.ARM_CLIENT_ID }}
      ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
      ARM_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
      ARM_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
      AZURE_ENV_NAME: dev
      RS_RESOURCE_GROUP: ${{ vars.RS_RESOURCE_GROUP }}
      RS_STORAGE_ACCOUNT: ${{ vars.RS_STORAGE_ACCOUNT }}
      RS_CONTAINER_NAME: ${{ vars.RS_CONTAINER_NAME }}
      TF_VAR_location: ${{ vars.AZURE_LOCATION }}
      TF_VAR_environment_name: dev
      TF_VAR_database_password: ${{ secrets.DATABASE_PASSWORD }}
      TF_VAR_session_secret: ${{ secrets.SESSION_SECRET }}
      TF_VAR_app_client_id: ${{ vars.AZURE_APP_CLIENT_ID }}
      TF_VAR_app_client_secret: ${{ secrets.AZURE_APP_CLIENT_SECRET }}
      TF_VAR_web_app_exists: true
    steps:
      - name: Checkout
        uses: actions/checkout@v2

      - name: Login to Azure
        uses: azure/login@v1
        with:
          creds: '${{ secrets.AZURE_CREDENTIALS }}'

      - name: Install Terraform
        uses: hashicorp/setup-terraform@v1
        with:
          terraform_version: '1.5.7'

      - name: Terraform Init
        id: init
        run: |
          terraform init \
          -backend-config="storage_account_name=${{ env.RS_STORAGE_ACCOUNT }}" \
          -backend-config="container_name=${{ env.RS_CONTAINER_NAME }}" \
          -backend-config="key=data-management-suite/${{ env.AZURE_ENV_NAME }}/azdremotestate.tfstate" \
          -backend-config="resource_group_name=${{ env.RS_RESOURCE_GROUP }}"

      - name: Terraform format
        id: fmt
        run: terraform fmt -check

      - name: Terraform validate
        id: validate
        run: terraform validate

      - name: Terraform plan
        id: plan
        if: github.event_name == 'pull_request'
        run: terraform plan -no-color -input=false
        continue-on-error: true

      - uses: actions/github-script@v6
        if: github.event_name == 'pull_request'
        env:
          PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
        with:
          script: |
            const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
            #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`

            <details><summary>Show Plan</summary>

            \`\`\`\n
            ${process.env.PLAN}
            \`\`\`

            </details>
            *Pushed by: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })
      - name: Terraform Plan Status
        if: steps.plan.outcome == 'failure'
        run: exit 1

      - name: Terraform Apply
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        run: terraform apply -auto-approve -input=false

      - name: Get outputs
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        uses: dflook/terraform-output@v1
        id: outputs
        with:
          path: ./infra
          backend_config: |
            storage_account_name=${{ env.RS_STORAGE_ACCOUNT }}
            container_name=${{ env.RS_CONTAINER_NAME }}
            key=data-management-suite/${{ env.AZURE_ENV_NAME }}/azdremotestate.tfstate
            resource_group_name=${{ env.RS_RESOURCE_GROUP }}

    outputs:
      azure_container_registry_name: ${{ steps.outputs.outputs.azure_container_registry_name }}
      container_app_name: ${{ steps.outputs.outputs.container_app_name }}
      resource_group_name: ${{ steps.outputs.outputs.resource_group_name }}
      container_app_environment_name: ${{ steps.outputs.outputs.container_app_environment_name }}
      web_container_name: ${{ steps.outputs.outputs.web_container_name }}

  build:
    name: Build and push container image
    runs-on: ubuntu-latest
    needs:
      - end2endtest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - name: Checkout
        uses: actions/checkout@v2

      - name: Login to Azure
        uses: azure/login@v1
        with:
          creds: '${{ secrets.AZURE_CREDENTIALS }}'

      - name: Login to ACR
        run: |
          az acr login --name ${{ vars.AZURE_CONTAINER_REGISTRY_NAME }}

      - name: Build and push container image
        run: |
          docker build -t ${{ env.FULL_IMAGE_NAME }} .
          docker push ${{ env.FULL_IMAGE_NAME }}

  deploy:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    env:
      AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
      AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
    needs:
      - build
      - provision
    steps:
      - name: Checkout
        uses: actions/checkout@v2

      - name: Login to Azure
        uses: azure/login@v1
        with:
          creds: '${{ secrets.AZURE_CREDENTIALS }}'

      - name: Update Container image
        run: |
          az containerapp update \
            --name ${{ needs.provision.outputs.container_app_name }} \
            --resource-group ${{ needs.provision.outputs.resource_group_name }} \
            --container-name web \
            --image ${{ env.FULL_IMAGE_NAME }}