deploy-azure.yml

name: Deploy · Azure

# Phase 0 of docs/28-Azure-Hosting.md §7. Manual only, and that is not timidity: this
# workflow creates a PostgreSQL server and a Container Apps environment, both of which cost
# money and neither of which anybody wants created by a push to a branch.
#
# THERE IS NO PASSWORD IN THIS FILE OR IN THE SECRETS IT READS. `AZURE_CLIENT_ID`,
# `AZURE_TENANT_ID` and `AZURE_SUBSCRIPTION_ID` are identifiers, not credentials: GitHub
# proves the workflow's identity to Entra over OIDC and Entra hands back a short-lived token.
# The application then reaches PostgreSQL by managed identity, so no database password exists
# anywhere in the system — see docs/29-From-Zero-To-Production.md §2.2.

on:
  workflow_dispatch:
    inputs:
      name:
        description: 'Short deployment name, lower-case letters and digits'
        required: true
        default: 'flowx'
      resourceGroup:
        description: 'Resource group to deploy into. Must already exist'
        required: true
      location:
        description: 'Azure region'
        required: false
        default: 'westeurope'
      whatIf:
        description: 'Preview the changes without applying them'
        type: boolean
        required: false
        default: true

permissions:
  contents: read
  # Required for OIDC. Without it `azure/login` has nothing to present and no fallback,
  # which is the point.
  id-token: write

env:
  DOTNET_NOLOGO: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true

jobs:
  template:
    name: The template compiles
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Build the Bicep
        # Runs before anything is deployed and before anything is built, because a template
        # that does not compile should cost seconds rather than a container build. The same
        # command runs locally: `bicep build deploy/azure/main.bicep`.
        run: |
          az bicep install
          az bicep build --file deploy/azure/main.bicep --outfile /tmp/main.json
          test -s /tmp/main.json || { echo "::error::The template produced no ARM output."; exit 1; }
          echo "Template compiles."

  deploy:
    name: Deploy Phase 0
    needs: template
    runs-on: ubuntu-latest
    environment: azure
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - uses: azure/login@a65d910e8af852a8061c627c456678983e180302  # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Build and push the host image
        # Built by ACR rather than here: the runner has no registry credentials to hold, and
        # the image never crosses the public internet twice.
        env:
          REGISTRY: ${{ secrets.AZURE_REGISTRY }}
        run: |
          set -euo pipefail
          tag="${GITHUB_SHA::12}"
          echo "TAG=$tag" >> "$GITHUB_ENV"
          az acr build \
            --registry "$REGISTRY" \
            --image "flowx/crm:$tag" \
            --file samples/crm/Dockerfile .

      - name: Deploy the template
        env:
          REGISTRY: ${{ secrets.AZURE_REGISTRY }}
          ADMIN_OBJECT_ID: ${{ secrets.AZURE_DB_ADMIN_OBJECT_ID }}
          ADMIN_NAME: ${{ secrets.AZURE_DB_ADMIN_NAME }}
        run: |
          set -euo pipefail

          # `--what-if` by default. A first run should show what it would create and stop,
          # because "it deployed something unexpected into a subscription" is not a mistake
          # anybody enjoys explaining.
          mode="--what-if"
          if [ "${{ inputs.whatIf }}" = "false" ]; then mode=""; fi

          az deployment group create $mode \
            --resource-group "${{ inputs.resourceGroup }}" \
            --template-file deploy/azure/main.bicep \
            --parameters \
              name='${{ inputs.name }}' \
              location='${{ inputs.location }}' \
              image="$REGISTRY.azurecr.io/flowx/crm:$TAG" \
              databaseAdministratorObjectId="$ADMIN_OBJECT_ID" \
              databaseAdministratorName="$ADMIN_NAME"

      - name: What was deployed
        if: ${{ inputs.whatIf == false }}
        run: |
          set -euo pipefail
          az deployment group show \
            --resource-group "${{ inputs.resourceGroup }}" \
            --name main \
            --query properties.outputs \
            --output table

          echo "::notice::The database role is not created by the template. Run the statement in deploy/azure/README.md §3 once, as the administrator, before the app can reach PostgreSQL."