deploy.yml

name: Deploy to environment

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      environment:
        type: environment
        description: "Choose an environment to deploy to"
        required: true

concurrency:
  group: ${{ github.workflow }}-${{ github.event.inputs.environment }}-${{ github.run_number }}

env:
  IMAGE_NAME: flexformsapi

permissions:
  contents: read
  packages: read

jobs:
  set-env:
    name: Preflight
    runs-on: ubuntu-24.04
    outputs:
      environment: ${{ steps.var.outputs.environment }}
      environment-lower: ${{ steps.var.outputs.environment-lower }}
      branch: ${{ steps.var.outputs.branch }}
      checked-out-sha: ${{ steps.var.outputs.checked-out-sha }}
      image-name: ${{ steps.var.outputs.image-name }}
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - id: var
        run: |
          GIT_REF=${{ github.ref_name }}
          GIT_BRANCH=${GIT_REF##*/}
          INPUT="${{ github.event.inputs.environment }}"
          ENVIRONMENT=${INPUT:-"development"}
          CHECKED_OUT_SHA="$(git log -1 '--format=format:%H')"
          TIME="$(date)"
          echo "environment=${ENVIRONMENT}" >> $GITHUB_OUTPUT
          echo "environment-lower=${ENVIRONMENT,,}" >> $GITHUB_OUTPUT
          echo "branch=$GIT_BRANCH" >> $GITHUB_OUTPUT
          echo "checked-out-sha=${CHECKED_OUT_SHA}" >> $GITHUB_OUTPUT
          if [[ "$ENVIRONMENT" == fe-saas-api* ]]
          then
            echo "image-name=fe-saas-api" >> $GITHUB_OUTPUT
          else
            echo "image-name=${{ env.IMAGE_NAME }}" >> $GITHUB_OUTPUT
          fi

  validate-packages:
    runs-on: windows-latest
    name: Package Validation
    permissions:
      contents: read
    needs: [ set-env ]
    if: needs.set-env.outputs.environment-lower == 'production'
    steps:
      - name: Validate Packages
        uses: DFE-Digital/rsd-github-actions/.github/actions/validate-packages@v1
        with:
          environment: ${{ needs.set-env.outputs.environment }}

  test:
    name: Run tests
    needs: [ set-env ]
    if: needs.set-env.outputs.environment-lower == 'production'
    uses: ./.github/workflows/test-solution.yml
    secrets: inherit

  build-import:
    name: Build & import (${{ matrix.target }}) → ${{ needs.set-env.outputs.environment }}
    runs-on: ubuntu-24.04
    needs: [ set-env, validate-packages, test ]
    if: |
      always() &&
      needs.set-env.result == 'success' &&
      (needs.validate-packages.result == 'success' || needs.validate-packages.result == 'skipped') &&
      (needs.test.result == 'success' || needs.test.result == 'skipped')
    environment: ${{ needs.set-env.outputs.environment }}
    permissions:
      attestations: write
      packages: write
      id-token: write
    strategy:
      matrix:
        target: [
          "final",
          "initcontainer"
        ]
        include:
          - target: "final"
            tag-prefix: ""
          - target: "initcontainer"
            tag-prefix: "init-"
    steps:
      - name: Build
        uses: DFE-Digital/deploy-azure-container-apps-action/.github/actions/build@8e72e403f05ff9da09668207eef1d79e1ce9d1a7 # v5.2.1
        with:
          image-name: ${{ needs.set-env.outputs.image-name }}
          build-args: CI=true
          build-target: ${{ matrix.target }}
          tag-prefix: ${{ matrix.tag-prefix }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Import
        uses: DFE-Digital/deploy-azure-container-apps-action/.github/actions/import@8e72e403f05ff9da09668207eef1d79e1ce9d1a7 # v5.2.1
        with:
          image-name: ${{ needs.set-env.outputs.image-name }}
          tag-prefix: ${{ matrix.tag-prefix }}
          azure-acr-name: ${{ secrets.ACR_NAME }}
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          azure-acr-client-id: ${{ secrets.ACR_CLIENT_ID }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
        env:
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID || '' }}
          AZURE_SUBSCRIPTION: ${{ secrets.AZURE_SUBSCRIPTION_ID || '' }}
          AZURE_ACR_CLIENT_ID: ${{ secrets.ACR_CLIENT_ID || '' }}

  deploy:
    name: Release → ${{ needs.set-env.outputs.environment }}
    runs-on: ubuntu-24.04
    needs: [ build-import, set-env ]
    if: |
      always() &&
      needs.set-env.result == 'success' &&
      needs.build-import.result == 'success'
    environment: ${{ needs.set-env.outputs.environment }}
    permissions:
      id-token: write
    steps:
      - name: Release
        uses: DFE-Digital/deploy-azure-container-apps-action/.github/actions/deploy@8e72e403f05ff9da09668207eef1d79e1ce9d1a7 # v5.2.1
        with:
          image-name: ${{ needs.set-env.outputs.image-name }}
          annotate-release: 'yes'
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          azure-acr-name: ${{ secrets.ACR_NAME }}
          azure-aca-client-id: ${{ secrets.ACA_CLIENT_ID }}
          azure-aca-name: ${{ secrets.ACA_NAME }}
          azure-aca-resource-group: ${{ secrets.ACA_RESOURCE_GROUP }}
        env:
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID || '' }}
          AZURE_SUBSCRIPTION: ${{ secrets.AZURE_SUBSCRIPTION_ID || '' }}
          AZURE_ACA_CLIENT_ID: ${{ secrets.ACA_CLIENT_ID || '' }}