stage-4-deploy-app.yaml

name: Deployment stage (app)

on:
  workflow_call:
    inputs:
      environments:
        description: List of environments to deploy to (JSON string array)
        required: true
        type: string
      release_tag:
        description: GitHub release tag to deploy (e.g. v1.2.3 or pr-42)
        required: true
        type: string
      commit_sha:
        description: Commit SHA used to trigger the ADO pipeline
        required: true
        type: string
      branch_name:
        description: Git branch containing commit_sha
        required: false
        default: "main"
        type: string

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    strategy:
      matrix:
        environment: ${{ fromJson(inputs.environments) }}
      max-parallel: 1
    environment: ${{ matrix.environment }}
    # Prevent concurrent app deployments to the same environment
    concurrency: deploy-app-${{ matrix.environment }}
    permissions:
      id-token: write

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Azure login
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Call deployment pipeline
        env:
          ENVIRONMENT: ${{ matrix.environment }}
          RELEASE_TAG: ${{ inputs.release_tag }}
          COMMIT_SHA: ${{ inputs.commit_sha }}
          BRANCH_NAME: ${{ inputs.branch_name }}
          ADO_PROJECT: ${{ github.event.repository.name }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          source "infrastructure/environments/${ENVIRONMENT}/variables.sh"
          SOURCE_BRANCH="${BRANCH_NAME:-main}"

          echo "Starting Azure DevOps pipeline \"Deploy Gateway App - ${ENVIRONMENT}\"..."
          RUN_ID=$(az pipelines run \
            --branch "${SOURCE_BRANCH}" \
            --commit-id "${COMMIT_SHA}" \
            --name "Deploy Gateway App - ${ENVIRONMENT}" \
            --org https://dev.azure.com/nhse-dtos \
            --project "${ADO_PROJECT}" \
            --parameters releaseTag="${RELEASE_TAG}" environment="${ENVIRONMENT}" pool="${ADO_MANAGEMENT_POOL}" githubToken="${GITHUB_TOKEN}" \
            --output tsv --query id)

          echo "See pipeline run in Azure DevOps: https://dev.azure.com/nhse-dtos/${ADO_PROJECT}/_build/results?buildId=${RUN_ID}&view=results"

          scripts/bash/wait_ado_pipeline.sh "$RUN_ID" https://dev.azure.com/nhse-dtos "${ADO_PROJECT}"