azure-deploy-themebuilder.yml

name: azure deploy themebuilder
run-name: Deploy to themebuilder to ${{ inputs.environment }} by @${{ github.actor }}
on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
        description: 'Deployment environment (production, preview)'
      pr_number:
        required: false
        type: string
        description: 'PR number for preview deployments'
      update_comment:
        required: false
        type: boolean
        default: false
        description: 'Whether to update PR comment with deployment URL'
    secrets:
      AZURE_CLIENT_ID:
        required: true
      AZURE_TENANT_ID:
        required: true
      AZURE_SUBSCRIPTION_ID:
        required: true

permissions:
  id-token: write
  contents: read
  pull-requests: write

concurrency:
  group: azure-themebuilder-prod-deploy-${{ inputs.environment == 'production' && 'production' || inputs.pr_number || 'preview' }}
  cancel-in-progress: true

env:
  RESOURCE_GROUP: ${{ inputs.environment == 'production' && 'rg-designsystemet-prod' || 'rg-designsystemet-test' }}
  CONTAINERAPPS_ENV: ${{ inputs.environment == 'production' && 'themebuilder-prod-ca' || 'themebuilder-test-ca' }}
  ACR_NAME: designsystemetacr
  APP_NAME: ${{ inputs.environment == 'production' && 'themebuilder-prod' || format('themebuilder-pr-{0}', inputs.pr_number) }}
  IMAGE: ${{ inputs.pr_number && format('{0}-{1}', inputs.pr_number, github.sha) || format('{0}-{1}', github.run_id, github.sha) }}
  PORT: 8000

jobs:
  deploy:
    runs-on: ubuntu-latest
    outputs:
      fqdn: ${{ steps.fqdn.outputs.fqdn }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: az login (oidc)
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: acr login (for docker push)
        run: az acr login --name ${{ env.ACR_NAME }}

      - name: build & push image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
        with:
          context: .
          file: ./Dockerfile
          target: themebuilder
          platforms: linux/amd64
          push: true
          tags: ${{ env.ACR_NAME }}.azurecr.io/themebuilder:${{ env.IMAGE }}
          build-args: |
            PORT=${{ env.PORT }}
            HOST=0.0.0.0
            APP_ENV=${{ inputs.environment }}

      - name: get acr creds (masked)
        id: acr
        shell: bash
        run: |
          set -euo pipefail
          az acr update -n "${ACR_NAME}" --admin-enabled true >/dev/null
          USER=$(az acr credential show -n "${ACR_NAME}" --query username -o tsv)
          PASS=$(az acr credential show -n "${ACR_NAME}" --query 'passwords[0].value' -o tsv)
          echo "::add-mask::${USER}"
          echo "::add-mask::${PASS}"
          echo "user=${USER}" >> "$GITHUB_OUTPUT"
          echo "pass=${PASS}" >> "$GITHUB_OUTPUT"

      - name: deploy (no mi; use registry creds)
        uses: azure/container-apps-deploy-action@8dff69dac3367c32ceb2690d8f13adbeab462703 # v2
        with:
          resourceGroup: ${{ env.RESOURCE_GROUP }}
          containerAppEnvironment: ${{ env.CONTAINERAPPS_ENV }}
          containerAppName: ${{ env.APP_NAME }}
          imageToDeploy: ${{ env.ACR_NAME }}.azurecr.io/themebuilder:${{ env.IMAGE }}
          registryUrl: ${{ env.ACR_NAME }}.azurecr.io
          registryUsername: ${{ steps.acr.outputs.user }}
          registryPassword: ${{ steps.acr.outputs.pass }}
          targetPort: ${{ env.PORT }}
          ingress: external
          environmentVariables: "PORT=${{ env.PORT }} HOST=0.0.0.0 APP_ENV=${{ inputs.environment }}"
          location: "norwayeast"

      - name: fetch fqdn
        id: fqdn
        run: |
          FQDN=$(az containerapp show -n "${APP_NAME}" -g "${RESOURCE_GROUP}" --query properties.configuration.ingress.fqdn -o tsv)
          echo "fqdn=${FQDN}" >> "$GITHUB_OUTPUT"

  update-comment:
    if: ${{ inputs.update_comment }}
    needs: deploy
    uses: ./.github/workflows/preview-comment.yml
    with:
      pr_number: ${{ github.event.number }}
      deployment_type: theme
      deployment_url: https://${{ needs.deploy.outputs.fqdn }}