deploy.yml

# -----------------------------------------------------------------------------------------
# GitHub Actions Workflow: Deploy
#
# Description:
# This workflow performs a full deployment cycle to a specified Azure Container App
# environment, supporting manual and programmatic triggers. It includes validation,
# deployment, rollback, DNS update, environment test triggering, and tagging.
#
# Triggers:
# - workflow_dispatch: Manual deploy with `ref`, `version`, `mode`, and `deploy_env`
# - repository_dispatch: Triggered programmatically using `trigger-deploy`
#
# Inputs:
# - ref: Git reference (commit SHA, tag, or branch) to deploy
# - version: Semantic version string (e.g., 1.2.3) for tagging
# - mode: Deployment mode (`release`, `ci-test`, or `dry-run`)
# - deploy_env: Target environment (e.g., `dev`, `qa`, `prod`)
#
# Key Steps:
# - Resolves and validates input parameters (supports both dispatch types)
# - Prevents version downgrade using semver comparison
# - Deploys to Azure Container App with automatic app creation or update
# - Marks GitHub deployment status (in progress / success / failure)
# - Waits for healthy revision before continuing
# - Performs rollback on failure (if applicable)
# - Updates private DNS zone with the internal FQDN of the deployed container app
# - Triggers follow-up `env-test` workflow via `repository_dispatch`
# - Tags current environment (`env/<env>`), deployment result, and CD status
#
# Tagging Format:
# - env/<env>                                     → latest deployed ref in env
# - <version>/CD/<env>/deploy/PASS or FAIL       → deployment result
# - <version>/CD/<env>/FAIL                      → any failure in CD for env
# - <version>/CD/FAIL                            → general CD failure
#
# Requirements:
# - Secrets: GITHUB_TOKEN, GH_PAT, AZURE_CREDENTIALS, REGISTRY_PASSWORD
# - Variables: AZURE_* (resource group, container app config), LOG_LEVEL, etc.
# - GitHub CLI (`gh`) and Azure CLI (`az`) must be available in the runner
# - Local scripts: `bootstrap.sh`, `start-aca-polling.sh`, `start-ssh-tunnel.sh`
#
# Notes:
# - `dry-run` mode skips actual deployment but follows validation and tagging logic
# - `ci-test` mode can deploy to non-production environments using a test app suffix
# - Rollback is automatic on deployment failure unless `dry-run` is enabled
# -----------------------------------------------------------------------------------------

name: Deploy

on:
  workflow_dispatch:
    inputs:
      ref:
        description: 'Git ref to deploy (default: v[version])'
        required: true
        type: string
      version:
        description: 'Version to deploy (e.g., 1.2.3)'
        required: true
        type: string
      mode:
        description: 'Deployment mode ("release", "ci-test", or "dry-run")'
        required: true
        default: 'release'
        type: string
      deploy_env:
        description: 'Target environment (e.g., dev, qa, prod)'
        required: true
        type: string
  repository_dispatch:
    types: [ trigger-deploy ]

jobs:

  # -----------------------------------------------
  # Resolve and validate input parameters
  # This job resolves input parameters from both workflow_dispatch and repository_dispatch
  # It sets outputs for use in subsequent jobs.
  # -----------------------------------------------
  resolve-params:
    runs-on: ubuntu-latest
    env:
      REF: ${{ github.event.inputs.ref || github.event.client_payload.ref }}
      VERSION: ${{ github.event.inputs.version || github.event.client_payload.version }}
      MODE: ${{ github.event.inputs.mode || github.event.client_payload.mode }}
      DEPLOY_ENV: ${{ github.event.inputs.deploy_env || github.event.client_payload.deploy_env }}
    outputs:
      ref: ${{ steps.setvars.outputs.ref }}
      version: ${{ steps.setvars.outputs.version }}
      mode: ${{ steps.setvars.outputs.mode }}
      deploy_env: ${{ steps.setvars.outputs.deploy_env }}
    steps:
      - name: Print resolved parameters
        run: |
          echo "Resolved parameters:"
          echo "  ref=$REF"
          echo "  version=$VERSION"
          echo "  mode=$MODE"
          echo "  deploy_env=$DEPLOY_ENV"

      - name: Validate required parameters
        run: |
          for var in REF VERSION MODE DEPLOY_ENV; do
            if [ -z "${!var}" ]; then
              echo "Missing required parameter: $var"
              exit 1
            fi
          done

      - name: Validate mode value
        run: |
          case "$MODE" in
            release|ci-test|dry-run)
              echo "Valid mode: $MODE"
              ;;
            *)
              echo "❌ Invalid mode: '$MODE'. Must be one of: release, ci-test, dry-run"
              exit 1
              ;;
          esac

      - name: Set output variables
        id: setvars
        run: |
          echo "ref=$REF" >> $GITHUB_OUTPUT
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "mode=$MODE" >> $GITHUB_OUTPUT
          echo "deploy_env=$DEPLOY_ENV" >> $GITHUB_OUTPUT           

  # -----------------------------------------------
  # Check if the candidate version is newer than the currently deployed version
  # -----------------------------------------------
  check-version:
    needs: resolve-params
    runs-on: ubuntu-latest
    env:
      DEPLOY_ENV: ${{ needs.resolve-params.outputs.deploy_env }}
      CANDIDATE_VERSION: ${{ needs.resolve-params.outputs.version }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      DRY_RUN: ${{ needs.resolve-params.outputs.mode == 'dry-run' }}
    steps:

      - name: Fetch deployed version for target environment
        if: ${{ env.DRY_RUN != 'true' }}
        run: |
          echo "Checking for downgrade in $DEPLOY_ENV"
          echo "Candidate version for deploy: $CANDIDATE_VERSION"
          
          DEPLOYED_REF=$(gh api repos/${{ github.repository }}/deployments \
            --jq 'map(select(.environment=="'"$DEPLOY_ENV"'")) | sort_by(.created_at) | last.ref')
          
          if [[ "$DEPLOYED_REF" == v* ]]; then
            DEPLOYED_VERSION="${DEPLOYED_REF:1}"
          else
            DEPLOYED_VERSION="$DEPLOYED_REF"
          fi
          
          echo "Currently deployed version in $DEPLOY_ENV: $DEPLOYED_VERSION"
          
          if [[ -z "$DEPLOYED_VERSION" ]]; then
            echo "No version currently deployed; continuing."
            exit 0
          fi
          
          if ! [[ "$DEPLOYED_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Deployed version '$DEPLOYED_VERSION' is not semver, treating as no deployment. Proceeding."
            exit 0
          fi
          
          if ! [[ "$CANDIDATE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "❌ Candidate version '$CANDIDATE_VERSION' is not semver. Refusing to deploy."
            exit 1
          fi
          
          HIGHEST=$(printf "%s\n%s\n" "$DEPLOYED_VERSION" "$CANDIDATE_VERSION" | sort -V | tail -1)
          
          if [[ "$CANDIDATE_VERSION" != "$HIGHEST" ]]; then
            echo "❌ ERROR: Refusing to deploy $CANDIDATE_VERSION to $DEPLOY_ENV because $DEPLOYED_VERSION is higher."
            exit 1
          fi
          
          if [[ "$CANDIDATE_VERSION" == "$DEPLOYED_VERSION" ]]; then
            echo "⚠️ WARNING: $CANDIDATE_VERSION is already deployed to $DEPLOY_ENV. Skipping redeploy."
            exit 1
          fi
          
          echo "✅ OK: $CANDIDATE_VERSION is newer than $DEPLOYED_VERSION. Proceeding."

  # -----------------------------------------------
  # Deploy to Azure Container App
  # -----------------------------------------------
  deploy:
    needs: [resolve-params, check-version]
    runs-on: ubuntu-latest
    environment: ${{ needs.resolve-params.outputs.deploy_env }}
    outputs:
      gh_deployment_id: ${{ steps.create_deploy.outputs.gh_deployment_id }}
      current_revision: ${{ steps.get_current_revision.outputs.current_revision }}
      app_name: ${{ steps.compute_app_name.outputs.app_name }}
    env:
      VERSION: ${{ needs.resolve-params.outputs.version }}
      REF: ${{ needs.resolve-params.outputs.ref }}
      MODE: ${{ needs.resolve-params.outputs.mode }}
      DEPLOY_ENV: ${{ needs.resolve-params.outputs.deploy_env }}
    steps:

      - name: Print selected params
        run: |
          echo "ref: $REF"
          echo "version: $VERSION"
          echo "mode: $MODE"          
          echo "deploy env: $DEPLOY_ENV"          

      - name: Create GitHub Deployment
        if: ${{ env.MODE != 'dry_run' }}
        id: create_deploy
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          RESPONSE=$(gh api repos/${{ github.repository }}/deployments \
            -f ref="$REF" \
            -f environment="$DEPLOY_ENV" \
            -f description="Deploy version $VERSION to $DEPLOY_ENV" \
            -F auto_merge=false \
            -F transient_environment=false \
            -F production_environment=$( [ "$DEPLOY_ENV" = "prod" ] && echo true || echo false ))
          DEPLOYMENT_ID=$(echo "$RESPONSE" | jq -r .id)
          echo "gh_deployment_id=$DEPLOYMENT_ID" >> $GITHUB_OUTPUT

      - name: Checkout repository
        if: ${{ env.MODE != 'dry_run' }}
        uses: actions/checkout@v4
        with:
          ref: ${{ env.REF }}
          fetch-depth: 1

      - name: Update permissions for scripts
        if: ${{ env.MODE != 'dry_run' }}
        run: find ./devops/scripts -type f -name '*.sh' -exec chmod +x {} +

      - name: Build environment variables string
        id: build_envvars
        if: ${{ env.MODE != 'dry_run' }}
        env:
          LOG_LEVEL: ${{ vars.LOG_LEVEL }}
          LOG_LEVEL_ROOT: ${{ vars.LOG_LEVEL_ROOT }}
          LOG_LEVEL_ACNTECH: ${{ vars.LOG_LEVEL_ACNTECH }}
          LOG_LEVEL_SPRING: ${{ vars.LOG_LEVEL_SPRING }}
          LOG_STDOUT_LEVEL: ${{ vars.LOG_STDOUT_LEVEL }}
          LOG_TRACE_LEVEL: ${{ vars.LOG_TRACE_LEVEL }}
        run: |
          ENV_VARS=()
          ENV_VARS+=("DEPLOY_ENV=${{ needs.resolve-params.outputs.deploy_env }}")
          ENV_VARS+=("APP_VERSION=${{ needs.resolve-params.outputs.version }}")
          ENV_VARS+=("SPRING_PROFILES_ACTIVE=${{ needs.resolve-params.outputs.deploy_env }}")
          [[ -n "$LOG_LEVEL" ]]         && ENV_VARS+=("LOG_LEVEL=$LOG_LEVEL")
          [[ -n "$LOG_LEVEL_ROOT" ]]    && ENV_VARS+=("LOG_LEVEL_ROOT=$LOG_LEVEL_ROOT")
          [[ -n "$LOG_LEVEL_ACNTECH" ]] && ENV_VARS+=("LOG_LEVEL_ACNTECH=$LOG_LEVEL_ACNTECH")
          [[ -n "$LOG_LEVEL_SPRING" ]]  && ENV_VARS+=("LOG_LEVEL_SPRING=$LOG_LEVEL_SPRING")
          [[ -n "$LOG_STDOUT_LEVEL" ]]  && ENV_VARS+=("LOG_STDOUT_LEVEL=$LOG_STDOUT_LEVEL")
          [[ -n "$LOG_TRACE_LEVEL" ]]   && ENV_VARS+=("LOG_TRACE_LEVEL=$LOG_TRACE_LEVEL")
          ENV_STRING="${ENV_VARS[*]}"
          echo "env_string=$ENV_STRING" >> "$GITHUB_OUTPUT"

      - name: Compute application name
        id: compute_app_name
        env:
          MODE: ${{ env.MODE }}
          DEPLOY_ENV: ${{ env.DEPLOY_ENV }}
        run: |
          source ./devops/scripts/bootstrap.sh
          
          if [ "$MODE" = "ci-test" ]; then
            APP_NAME="${{ vars.AZURE_CONTAINER_APP_NAME }}-ci-test-$DEPLOY_ENV"
          else
            APP_NAME="${{ vars.AZURE_CONTAINER_APP_NAME }}-$DEPLOY_ENV"
          fi

          log INFO "Determined application name: $APP_NAME"
          
          echo "app_name=$APP_NAME" >> $GITHUB_OUTPUT

      - name: Azure Login
        if: ${{ env.MODE != 'dry_run' }}
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Get current active revision
        id: get_current_revision
        env:
          APP_NAME: ${{ steps.compute_app_name.outputs.app_name }}
          AZURE_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}
        run: |
          source ./devops/scripts/bootstrap.sh
          
          REV=$(az containerapp revision list \
            --name "$APP_NAME" \
            --resource-group "$AZURE_RESOURCE_GROUP" \
            --query "[?properties.active==\`true\`].[name]" \
            --output tsv 2>/dev/null || true)
          
          log INFO "Current active revision for $APP_NAME: $REV"
          
          echo "current_revision=$REV" >> $GITHUB_OUTPUT

      - name: Deploy to Azure Container App
        if: ${{ env.MODE != 'dry_run' }}
        env:
          APP_NAME: ${{ steps.compute_app_name.outputs.app_name }}
          ENV_STRING: ${{ steps.build_envvars.outputs.env_string }}
          AZURE_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}
          AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
          AZURE_CONTAINER_APP_ENV: ${{ vars.AZURE_CONTAINER_APP_ENV }}
          IMAGE: ${{ vars.REGISTRY_SERVER }}/${{ vars.IMAGE_NAME }}:${{ needs.resolve-params.outputs.version }}
          CPU: ${{ vars.AZURE_CONTAINER_APP_CPU }}
          MEMORY: ${{ vars.AZURE_CONTAINER_APP_MEMORY }}
          REGISTRY_SERVER: ${{ vars.REGISTRY_SERVER }}
          REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          source ./devops/scripts/bootstrap.sh
          
          # if mode is "ci-test" and deploy_env is "prod" - skip deployment
          if [[ "$MODE" == "ci-test" && "$DEPLOY_ENV" == "prod" ]]; then
              log INFO "Skipping deployment to production in ci-test mode."
              exit 0
          fi
          
          log INFO "Deploying Azure Container App '$APP_NAME' $VERSION to $DEPLOY_ENV"
          
          if ! az containerapp show --name "$APP_NAME" --resource-group "$AZURE_RESOURCE_GROUP" > /dev/null 2>&1; then
            log INFO "Container App '$APP_NAME' does not exist in '$DEPLOY_ENV'. Creating it."
            az containerapp create \
              --name "$APP_NAME" \
              --resource-group "$AZURE_RESOURCE_GROUP" \
              --environment "$AZURE_CONTAINER_APP_ENV" \
              --registry-server "$REGISTRY_SERVER" \
              --registry-username "$REGISTRY_USERNAME" \
              --registry-password "$REGISTRY_PASSWORD" \
              --image "$IMAGE" \
              --cpu "$CPU" \
              --memory "$MEMORY" \
              --ingress internal \
              --target-port 8080 \
              --min-replicas 1 \
              --env-vars $ENV_STRING
          
          else
            log INFO "Container App '$APP_NAME' already exists in '$DEPLOY_ENV'. Updating it."
            
            log INFO "Setting registry credentials for $APP_NAME"
            az containerapp registry set \
              --name "$APP_NAME" \
              --resource-group "$AZURE_RESOURCE_GROUP" \
              --server "$REGISTRY_SERVER" \
              --username "$REGISTRY_USERNAME" \
              --password "$REGISTRY_PASSWORD"
            
            log INFO "Updating image, CPU, memory and min-replicas for $APP_NAME"
            az containerapp update \
              --name "$APP_NAME" \
              --resource-group "$AZURE_RESOURCE_GROUP" \
              --image "$IMAGE" \
              --cpu "$CPU" \
              --memory "$MEMORY" \
              --min-replicas 1 \
              --set-env-vars $ENV_STRING              
          fi

      - name: Mark deployment as in progress
        uses: ./.github/actions/deployment-status
        if: ${{ env.MODE == 'release' }}
        with:
          repo: ${{ github.repository }}
          deployment_id: ${{ steps.create_deploy.outputs.gh_deployment_id }}
          state: 'in_progress'
          desc: "Deployment of version ${{ needs.resolve-params.outputs.version }} to ${{ needs.resolve-params.outputs.deploy_env }} is in progress."
          gh_token: ${{ secrets.GITHUB_TOKEN }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Wait for successful deployment
        if: ${{ env.MODE != 'dry_run' && (env.MODE == 'release' || (env.MODE == 'ci-test' && env.DEPLOY_ENV != 'prod')) }}
        env:
          AZURE_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}
          APP_NAME: ${{ steps.compute_app_name.outputs.app_name }}
        run: |
          source ./devops/scripts/bootstrap.sh
          MAX_ATTEMPTS=60
          
          for ((i=1; i<=MAX_ATTEMPTS; i++)); do
            log INFO "Checking deployment status (attempt $i/$MAX_ATTEMPTS)..."
            
            STATUS_JSON=$(az containerapp show \
              --name "$APP_NAME" \
              --resource-group "$AZURE_RESOURCE_GROUP" \
              --query "{provisioningState:properties.provisioningState}" \
              --output json)
            
            PROVISIONING_STATE=$(echo "$STATUS_JSON" | jq -r '.provisioningState')
            
            if [[ "$PROVISIONING_STATE" == "Failed" ]]; then exit 1; fi
            
            log INFO "Deployment is in progress, checking revisions..."
            
            REVISION_STATUS=$(az containerapp revision list \
              --name "$APP_NAME" \
              --resource-group "$AZURE_RESOURCE_GROUP" \
              --query "[?properties.active==\`true\`].[name,properties.healthState,properties.provisioningState,properties.runningState]" \
              --output tsv)
            
            REVISION_HEALTH=$(echo "$REVISION_STATUS" | awk '{print $2}')
            
            REVISION_PROVISION=$(echo "$REVISION_STATUS" | awk '{print $3}')
            
            REVISION_RUNNING=$(echo "$REVISION_STATUS" | awk '{print $4}')
            
            log INFO "Revision status: Health=$REVISION_HEALTH, Provision=$REVISION_PROVISION, Running=$REVISION_RUNNING"
            
            if [[ "$REVISION_HEALTH" == "Healthy" && "$REVISION_PROVISION" == "Provisioned" && "$REVISION_RUNNING" == "Running" ]]; then exit 0; fi
            if [[ $i -eq $MAX_ATTEMPTS ]]; then exit 1; fi
            
            sleep 10
          done

  # -----------------------------------------------
  # Update the GitHub deployment status to success if the deployment succeeded (release only)
  # -----------------------------------------------
  update-github-deployment-success:
    needs: [deploy, resolve-params]
    if: ${{ needs.resolve-params.outputs.mode == 'release' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          ref: ${{ needs.resolve-params.outputs.ref }}

      - name: Update deployment status to success
        uses: ./.github/actions/deployment-status
        with:
          repo: ${{ github.repository }}
          deployment_id: ${{ needs.deploy.outputs.gh_deployment_id }}
          state: 'success'
          desc: "Deployment of version ${{ needs.resolve-params.outputs.version }} to ${{ needs.resolve-params.outputs.deploy_env }} completed successfully."
          gh_token: ${{ secrets.GITHUB_TOKEN }}

  # -----------------------------------------------
  # Update the GitHub deployment status to failure if the deployment failed (release only)
  # -----------------------------------------------
  update-github-deployment-failure:
    needs: [deploy, resolve-params]
    if:  ${{ (failure() || cancelled()) && needs.resolve-params.outputs.mode == 'release' }}
    runs-on: ubuntu-latest
    steps:

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          ref: ${{ needs.resolve-params.outputs.ref }}

      - name: Update deployment status to failure
        uses: ./.github/actions/deployment-status
        with:
          repo: ${{ github.repository }}
          deployment_id: ${{ needs.deploy.outputs.gh_deployment_id }}
          state: 'failure'
          desc: "Deployment of version ${{ needs.resolve-params.outputs.version }} to ${{ needs.resolve-params.outputs.deploy_env }} failed."
          gh_token: ${{ secrets.GITHUB_TOKEN }}

  # -----------------------------------------------
  # Rollback to previous revision if the deployment failed (release/ci-test only)
  # -----------------------------------------------
  rollback:
    runs-on: ubuntu-latest
    needs: [deploy, resolve-params]
    if: ${{ (failure() || cancelled()) && needs.resolve-params.outputs.mode != 'dry-run' }}
    env:
      APP_NAME: ${{ needs.deploy.outputs.app_name }}
      AZURE_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}
      PREV_REVISION: ${{ needs.deploy.outputs.current_revision }}
    steps:
      - name: Azure Login
        if: ${{ env.MODE != 'dry_run' }}
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Rollback to previous revision
        run: |
          echo "Attempting to rollback to previous revision for $APP_NAME in $AZURE_RESOURCE_GROUP"
          if [ -z "$PREV_REVISION" ]; then
            echo "No previous revision to rollback to. Exiting."
            exit 0
          fi
          
          echo "Rolling back to revision: $PREV_REVISION"
          
          az containerapp revision activate \
            --name "$APP_NAME" \
            --resource-group "$AZURE_RESOURCE_GROUP" \
            --revision "$PREV_REVISION"
          
          echo "Rollback complete. Activated revision: $PREV_REVISION"

  # -----------------------------------------------
  # Update the private DNS zone for the deployed application (release/ci-test only)
  # -----------------------------------------------
  update-dns:
    needs: [deploy, resolve-params]
    if: ${{ needs.resolve-params.outputs.mode != 'dry-run' }}
    runs-on: ubuntu-latest
    outputs:
        internal_app_fqdn: ${{ steps.fqdn.outputs.internal_app_fqdn }}
    env:
      AZURE_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}
      APP_NAME: ${{ needs.deploy.outputs.app_name }}
      DNS_ZONE_NAME: ${{ vars.AZURE_PRIVATE_DNS_ZONE }}
      DNS_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}
      PRIVATE_APP_FQDN: "${{ needs.deploy.outputs.app_name }}.${{ vars.AZURE_PRIVATE_DNS_ZONE }}"
    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Get container app internal FQDN
        id: fqdn
        run: |
          fqdn=$(az containerapp show \
            --name "$APP_NAME" \
            --resource-group "$AZURE_RESOURCE_GROUP" \
            --query "properties.configuration.ingress.fqdn" \
            --output tsv)
          echo "Application FQDN: $fqdn"
          echo "internal_app_fqdn=$fqdn" >> $GITHUB_OUTPUT

      - name: Update private DNS zone
        env:
            INTERNAL_APP_FQDN: ${{ steps.fqdn.outputs.internal_app_fqdn }}
        run: |
          if [[ -z "INTERNAL_APP_FQDN" ]]; then
            echo "ERROR: No FQDN found for $APP_NAME"
            exit 1
          fi
          
          echo "Updating DNS: $PRIVATE_APP_FQDN -> $INTERNAL_APP_FQDN"
          
          az network private-dns record-set cname set-record \
            --zone-name "$DNS_ZONE_NAME" \
            --resource-group "$DNS_RESOURCE_GROUP" \
            --record-set-name "$APP_NAME" \
            --cname "$INTERNAL_APP_FQDN"

  # TODO:
  # For frontend applications we should also bind a custom acntech.no DNS record
  # and bind it to the internal FQDN with a valid SSL certificate.

  # -----------------------------------------------
  # Trigger the env-test workflow to run tests against the deployed environment
  # -----------------------------------------------
  trigger-env-test:
    needs: [deploy, resolve-params, update-dns]
    if: ${{ needs.resolve-params.outputs.mode != 'dry-run' }}
    runs-on: ubuntu-latest
    env:
      VERSION: ${{ needs.resolve-params.outputs.version }}
      REF: ${{ needs.resolve-params.outputs.ref }}
      MODE: ${{ needs.resolve-params.outputs.mode }}
      TARGET_ENV: ${{ needs.resolve-params.outputs.deploy_env }}
      PRIVATE_APP_FQDN: "${{ needs.deploy.outputs.app_name }}.${{ vars.AZURE_PRIVATE_DNS_ZONE }}"
      INTERNAL_APP_FQDN: "${{ needs.update-dns.outputs.internal_app_fqdn }}"
    steps:

      - name: Print params
        run: |
          echo "Triggering Environment Test workflow:"
          echo "version: $VERSION"
          echo "ref: $REF"
          echo "mode: $MODE"          
          echo "target_env: $TARGET_ENV"
          echo "private_app_fqdn: $PRIVATE_APP_FQDN"
          echo "internal_app_fqdn: $INTERNAL_APP_FQDN"

      - name: Trigger env-test workflow via repository_dispatch
        if: ${{ env.ACT != 'true' }}
        uses: peter-evans/repository-dispatch@v3
        with:
          token: ${{ secrets.GH_PAT }}
          event-type: trigger-env-test
          client-payload: >-
            {
              "version": "${{ env.VERSION }}",
              "ref": "${{ env.REF }}",              
              "mode": "${{ env.MODE }}",
              "target_env": "${{ env.TARGET_ENV }}",
              "private_app_fqdn": "${{ env.PRIVATE_APP_FQDN }}",
              "internal_app_fqdn": "${{ env.INTERNAL_APP_FQDN }}"
            }

      - name: Log dispatch if platform  is 'act'
        if: ${{ env.ACT == 'true' }}
        run: |
          echo "Running in 'act' mode, skipping repository dispatch."
          echo "Would trigger deploy workflow with:"
          echo "version: $VERSION"
          echo "ref: $REF"
          echo "mode: $MODE"
          echo "target_env: $TARGET_ENV"
          echo "private_app_fqdn: $PRIVATE_APP_FQDN"
          echo "internal_app_fqdn: $INTERNAL_APP_FQDN"

  # -----------------------------------------------
  # Tag the version with env/[deploy_env] after a successful deployment
  # -----------------------------------------------
  tag-current-env:
    needs: [deploy, resolve-params]
    uses: ./.github/workflows/tag-git.yml
    with:
      tag_name: env/${{ needs.resolve-params.outputs.deploy_env }}
      ref: ${{ needs.resolve-params.outputs.ref }}
      force: true
      dry_run: ${{ needs.resolve-params.outputs.mode == 'dry-run' }}

  # -----------------------------------------------
  # Tag PASS after successful deployment: [ver]/CD/[env]/deploy/PASS
  # -----------------------------------------------
  tag-deploy-pass:
    needs: [deploy, resolve-params]
    uses: ./.github/workflows/tag-git.yml
    with:
      tag_name: ${{ needs.resolve-params.outputs.version }}/CD/${{ needs.resolve-params.outputs.deploy_env }}/deploy/PASS
      ref: ${{ needs.resolve-params.outputs.ref }}
      dry_run: ${{ needs.resolve-params.outputs.mode == 'dry-run' }}

  # -----------------------------------------------
  # Tag FAIL after failed deployment: [ver]/CD/[env]/deploy/FAIL
  # -----------------------------------------------
  tag-deploy-fail:
    needs: [deploy, resolve-params]
    if: ${{ failure() || cancelled() }}
    uses: ./.github/workflows/tag-git.yml
    with:
      tag_name: ${{ needs.resolve-params.outputs.version }}/CD/${{ needs.resolve-params.outputs.deploy_env }}/deploy/FAIL
      ref: ${{ needs.resolve-params.outputs.ref }}
      dry_run: ${{ needs.resolve-params.outputs.mode == 'dry-run' }}

  # -----------------------------------------------
  # Tag failed CD for env: [ver]/CD/[env]/FAIL
  # -----------------------------------------------
  tag-cd-env-fail:
    needs: [deploy, resolve-params]
    if: ${{ failure() || cancelled() }}
    uses: ./.github/workflows/tag-git.yml
    with:
      tag_name: ${{ needs.resolve-params.outputs.version }}/CD/${{ needs.resolve-params.outputs.deploy_env }}/FAIL
      ref: ${{ needs.resolve-params.outputs.ref }}
      dry_run: ${{ needs.resolve-params.outputs.mode == 'dry-run' }}

  # -----------------------------------------------
  # Tag failed CD: [ver]/CD/FAIL
  # -----------------------------------------------
  tag-cd-fail:
    needs: [deploy, resolve-params]
    if: ${{ failure() || cancelled() }}
    uses: ./.github/workflows/tag-git.yml
    with:
      tag_name: ${{ needs.resolve-params.outputs.version }}/CD/FAIL
      ref: ${{ needs.resolve-params.outputs.ref }}
      dry_run: ${{ needs.resolve-params.outputs.mode == 'dry-run' }}