Enhance PR verification workflow: update job conditions and add terraform plan and deploy steps for Development environment

Author: frasermolyneux

.github/workflows/pr-verify.yml

@@ -1,17 +1,15 @@
 name: PR Verify
 
 # Label-based workflow control:
-# - 'run-dev-plan': Enables dev Terraform plan for copilot/* branches (always runs for other branches)
-# - 'run-prd-plan': Enables prd Terraform plan for any branch
-# - copilot/* branches: Require 'run-dev-plan' label to run dev plan, and both 'run-dev-plan' + 'run-prd-plan' labels to run prd plan
-# - Non-copilot branches: Dev plan runs automatically, prd plan requires 'run-prd-plan' label
-# - dependabot PRs: Terraform plans are always skipped
+# - Always run Terraform plan against Development when Terraform exists (skips drafts/dependabot)
+# - 'deploy-dev': Runs Terraform plan+apply and deploys the app to Development (skips drafts/dependabot)
+# - 'run-prd-plan': Runs Terraform plan against Production (skips drafts/dependabot)
 
 on:
   pull_request:
     branches:
       - main
-    types: [opened, synchronize, reopened, ready_for_review]
+    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
 
 permissions: {}
 
@@ -29,15 +27,11 @@ jobs:
           dotnet-version: 9.0.x
           src-folder: "src"
 
-  # Dev Terraform Plan:
-  # - Runs automatically for feature/bugfix/hotfix branches (non-copilot, non-dependabot)
-  # - Skipped for copilot/* branches unless 'run-dev-plan' label is added
-  # - Always skipped for dependabot PRs
   terraform-plan-dev:
     permissions:
       contents: read
       id-token: write
-    if: github.event.pull_request.draft == false && github.actor != 'dependabot[bot]' && (!startsWith(github.head_ref, 'copilot/') || contains(github.event.pull_request.labels.*.name, 'run-dev-plan'))
+    if: github.event.pull_request.draft == false && github.event.pull_request.user.login != 'dependabot[bot]' && !contains(github.event.pull_request.labels.*.name, 'deploy-dev')
     needs: build-and-test
     environment: Development
     runs-on: ubuntu-latest
@@ -53,17 +47,69 @@ jobs:
           AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
           AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
 
-  # Prd Terraform Plan:
-  # Label requirements for this job:
-  # - Non-copilot branches: require 'run-prd-plan' label only
-  # - copilot/* branches: require both 'run-dev-plan' and 'run-prd-plan' labels
-  # - Always skipped for dependabot PRs
+  terraform-plan-and-apply-dev:
+    permissions:
+      contents: read
+      id-token: write
+    if: github.event.pull_request.draft == false && github.event.pull_request.user.login != 'dependabot[bot]' && contains(github.event.pull_request.labels.*.name, 'deploy-dev')
+    needs: build-and-test
+    environment: Development
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.repository }}-dev
+    steps:
+      - uses: frasermolyneux/actions/terraform-plan-and-apply@main
+        with:
+          terraform-folder: "terraform"
+          terraform-var-file: "tfvars/dev.tfvars"
+          terraform-backend-file: "backends/dev.backend.hcl"
+          AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
+          AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
+          AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - id: terraform-output
+        shell: bash
+        run: |
+          cd terraform
+          echo "function_app_name=$(terraform output -raw function_app_name)" >> $GITHUB_OUTPUT
+          echo "resource_group_name=$(terraform output -raw resource_group_name)" >> $GITHUB_OUTPUT
+        env:
+          ARM_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
+          ARM_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+          ARM_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
+          ARM_USE_AZUREAD: true
+          ARM_USE_OIDC: true
+
+    outputs:
+      function_app_name: ${{ steps.terraform-output.outputs.function_app_name }}
+      resource_group_name: ${{ steps.terraform-output.outputs.resource_group_name }}
+
+  function-app-deploy-dev:
+    permissions:
+      contents: read
+      id-token: write
+    if: github.event.pull_request.draft == false && github.event.pull_request.user.login != 'dependabot[bot]' && contains(github.event.pull_request.labels.*.name, 'deploy-dev')
+    environment: Development
+    needs: [build-and-test, terraform-plan-and-apply-dev]
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.repository }}-dev
+    steps:
+      - uses: frasermolyneux/actions/deploy-function-app@main
+        with:
+          function-app-artifact-name: "XtremeIdiots.Portal.Repository.App"
+          function-app-name: ${{ needs.terraform-plan-and-apply-dev.outputs.function_app_name }}
+          function-app-resource-group: ${{ needs.terraform-plan-and-apply-dev.outputs.resource_group_name }}
+          AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
+          AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
+          AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
   terraform-plan-prd:
     permissions:
       contents: read
       id-token: write
-    if: github.event.pull_request.draft == false && github.actor != 'dependabot[bot]' && contains(github.event.pull_request.labels.*.name, 'run-prd-plan') && (!startsWith(github.head_ref, 'copilot/') || contains(github.event.pull_request.labels.*.name, 'run-dev-plan'))
-    needs: terraform-plan-dev
+    if: github.event.pull_request.draft == false && github.event.pull_request.user.login != 'dependabot[bot]' && contains(github.event.pull_request.labels.*.name, 'run-prd-plan')
+    needs: build-and-test
     environment: Production
     runs-on: ubuntu-latest
     concurrency: