deploy.yml

name: Publish Hosted Agent Image To ACR

on:
  workflow_dispatch:
    inputs:
      acrName:
        description: Azure Container Registry name. Leave blank to use the AZURE_CONTAINER_REGISTRY_NAME repository variable.
        required: false
        type: string
      imageRepository:
        description: Repository name to push inside ACR.
        required: false
        default: workshoplab-agent
        type: string
  push:
    branches: [main]
    paths:
      - .github/workflows/deploy.yml
      - src/WorkshopLab.AgentHost/**
      - azure.yaml
      - infra/**

concurrency:
  group: deploy-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      id-token: write
      contents: read

    env:
      ACR_NAME: ${{ inputs.acrName != '' && inputs.acrName || vars.AZURE_CONTAINER_REGISTRY_NAME }}
      IMAGE_REPOSITORY: ${{ inputs.imageRepository != '' && inputs.imageRepository || 'workshoplab-agent' }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          dotnet-version: "10.0.x"

      - name: Restore
        run: dotnet restore WorkshopLab.sln

      - name: Build
        run: dotnet build WorkshopLab.sln --no-restore

      - name: Test
        run: dotnet test WorkshopLab.sln --no-build --verbosity normal

      - name: Validate ACR configuration
        shell: bash
        run: |
          if [ -z "$ACR_NAME" ]; then
            echo "AZURE_CONTAINER_REGISTRY_NAME is not configured." >&2
            echo "Set it as a workflow input or repository variable." >&2
            exit 1
          fi

      - name: Azure login
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Compute image tag
        id: image
        shell: bash
        run: |
          timestamp=$(date -u +'%Y%m%d%H%M%S')
          short_sha=${GITHUB_SHA::7}
          echo "tag=${timestamp}-${short_sha}" >> "$GITHUB_OUTPUT"

      - name: Publish linux amd64 image with ACR build
        shell: bash
        run: |
          az acr build \
            --registry "$ACR_NAME" \
            --image "$IMAGE_REPOSITORY:${{ steps.image.outputs.tag }}" \
            --platform linux/amd64 \
            --source-acr-auth-id "[caller]" \
            --file src/WorkshopLab.AgentHost/Dockerfile \
            ./src

      - name: Summarize published image
        shell: bash
        run: |
          login_server=$(az acr show --name "$ACR_NAME" --query loginServer -o tsv)
          {
            echo "## Hosted Agent Image Published"
            echo
            echo "- Registry: $ACR_NAME"
            echo "- Image: $login_server/$IMAGE_REPOSITORY:${{ steps.image.outputs.tag }}"
            echo "- Next step: run scripts/deploy-foundry-agent.ps1 to create or update the Foundry hosted agent manifest."
          } >> "$GITHUB_STEP_SUMMARY"