sync-data.yaml

name: "Sync Data"

# Note on authentication:
#
# This action uses OIDC federated credentials for authenticating with Azure.
#
# In Azure there is a managed identity which has been created and is set to allow federated
# credentials from this repo when the environment is "sync-data".
#
# That managed identity has been granted Storage Blob Data Contributor role to the storage account
# which is being synced with azcopy.
#
# So long as those credentials are in place, this action should be able to authenticate with Azure
# and sync data between the specified container. These permissions do not expire.
on:
  workflow_dispatch:
    inputs:
      from:
        required: true
        type: string
        default: "dev"
      to:
        required: true
        type: string
        default: "vX.Y"

  workflow_call:
    inputs:
      from:
        required: true
        type: string
      to:
        required: true
        type: string

permissions:
  id-token: write
  contents: read

jobs:
  sync-data:
    name: "Sync Data"
    runs-on: ubuntu-latest
    environment: sync-data

    steps:
      - name: Azure Login
        uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Download azcopy
        run: |
          curl -s -L https://aka.ms/downloadazcopy-v10-linux | tar zx --strip-components 1

      # NOTE: storage ep should end in a /, so we do not need a slash between ep and container
      - name: Sync Data
        env:
          AZCOPY_AUTO_LOGIN_TYPE: AZCLI
        run: |
          echo "Syncing from ${{ inputs.from }} to ${{ inputs.to }}"
          ./azcopy sync --recursive \
            "${{ secrets.AZ_STORAGE_EP }}${{ secrets.AZ_STORAGE_CONTAINER }}/${{ inputs.from }}" \
            "${{ secrets.AZ_STORAGE_EP }}${{ secrets.AZ_STORAGE_CONTAINER }}/${{ inputs.to }}"