devops-with-github-example/.github/workflows/deploy_infra.yaml at main · christosgalano/devops-with-github-example · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
name: deploy-infra
run-name: ${{ github.workflow }}
on:
  pull_request:
    branches:
      - main
    paths:
      - "bicep/**"
      - "ps-rule.yaml"
      - ".github/workflows/deploy_infra.yaml"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

env:
  BICEP_DIR: bicep

jobs:
  psrule-scan:
    name: psrule-scan
    runs-on: ubuntu-latest
    permissions:
      issues: read
      checks: write
      contents: read
      pull-requests: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Bicep build
        run: az bicep build --file ${{ env.BICEP_DIR }}/main.bicep --outfile ${{ env.BICEP_DIR }}/main.json

      - name: Run PSRule
        uses: microsoft/ps-rule@v2.9.0
        with:
          modules: "PSRule.Rules.Azure"
          inputPath: ${{ env.BICEP_DIR }}/main*.json
          outputFormat: NUnit3
          outputPath: psrule-results-${{ github.run_number }}.xml
          summary: true

      - name: Publish scan results
        uses: EnricoMi/publish-unit-test-result-action@v2.7.0
        if: always()
        with:
          check_name: PSRule Scan Results
          nunit_files: psrule-results-${{ github.run_number }}.xml
          comment_mode: always
          fail_on: test failures
          action_fail: false
          ignore_runs: false
          job_summary: false
          compare_to_earlier_commit: true
          check_run_annotations: all tests, skipped tests

  deploy-development:
    name: deploy-development
    needs: psrule-scan
    runs-on: ubuntu-latest
    environment: development-infrastructure
    permissions:
      contents: read
    defaults:
      run:
        shell: bash
        working-directory: ${{ env.BICEP_DIR }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Azure login
        uses: Azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Lint template
        run: az bicep build --file main.bicep

      - name: Validate template
        run: |
          az stack sub validate \
          --name "${{ vars.DEPLOYMENT_STACK_NAME }}" \
          --location "${{ vars.LOCATION }}"  \
          --template-file main.bicep \
          --parameters environments/development.bicepparam \
          --action-on-unmanage 'deleteAll' \
          --deny-settings-mode 'none'

      - name: Deploy template
        run: |
          az stack sub create \
          --name "${{ vars.DEPLOYMENT_STACK_NAME }}" \
          --location "${{ vars.LOCATION }}"  \
          --template-file main.bicep \
          --parameters environments/development.bicepparam \
          --action-on-unmanage 'deleteAll' \
          --deny-settings-mode 'none' \
          --yes

  deploy-production:
    name: deploy-production
    needs: deploy-development
    runs-on: ubuntu-latest
    environment: production-infrastructure
    permissions:
      contents: read
    defaults:
      run:
        shell: bash
        working-directory: ${{ env.BICEP_DIR }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Azure login
        uses: Azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Lint template
        run: az bicep build --file main.bicep

      - name: Validate template
        run: |
          az stack sub validate \
          --name "${{ vars.DEPLOYMENT_STACK_NAME }}" \
          --location "${{ vars.LOCATION }}"  \
          --template-file main.bicep \
          --parameters environments/production.bicepparam \
          --action-on-unmanage 'deleteAll' \
          --deny-settings-mode 'none'

      - name: Deploy template
        run: |
          az stack sub create \
          --name "${{ vars.DEPLOYMENT_STACK_NAME }}" \
          --location "${{ vars.LOCATION }}"  \
          --template-file main.bicep \
          --parameters environments/production.bicepparam \
          --action-on-unmanage 'deleteAll' \
          --deny-settings-mode 'none' \
          --yes