main.yml

name: Build and Deploy

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  AZURE_API_NAME: XenobiasoftSudokuApi-prod
  AZURE_MCP_NAME: XenobiasoftSudokuMcp-prod
  AZURE_FUNCTIONS_NAME: XenobiasoftSudokuFunctions-prod
  AZURE_SWA_NAME: swa-sudoku-xenobiasoft-prod
  DOTNET_VERSION: "10.x"

permissions:
  contents: read
  id-token: write
  checks: write
  pull-requests: write

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      code: ${{ steps.filter.outputs.code }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            code:
              - 'src/**'
              - 'infra/**'
              - 'Tests/**'
              - '**/*.csproj'
              - '**/*.sln'
              - 'package*.json'
              - '.github/workflows/**'

  build:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}
          dotnet-quality: "ga"

      - name: Cache .NET packages
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Restore dependencies
        run: dotnet restore

      - name: Build
        run: dotnet build --configuration Release --no-restore --verbosity normal

      - name: Publish API
        run: dotnet publish src/backend/Sudoku.Api/Sudoku.Api.csproj --configuration Release --output ${{ github.workspace }}/publish-api --no-restore --no-build

      - name: Publish MCP Server
        run: dotnet publish src/backend/Sudoku.McpServer/Sudoku.McpServer.csproj --configuration Release --output ${{ github.workspace }}/publish-mcp --no-restore --no-build

      - name: Publish Functions
        run: dotnet publish src/backend/Sudoku.Functions/Sudoku.Functions.csproj --configuration Release --output ${{ github.workspace }}/publish-functions --no-restore --no-build

      - name: Upload publish-api artifact
        uses: actions/upload-artifact@v4
        with:
          name: publish-api
          path: ${{ github.workspace }}/publish-api

      - name: Upload publish-mcp artifact
        uses: actions/upload-artifact@v4
        with:
          name: publish-mcp
          path: ${{ github.workspace }}/publish-mcp

      - name: Upload publish-functions artifact
        uses: actions/upload-artifact@v4
        with:
          name: publish-functions
          path: ${{ github.workspace }}/publish-functions
          # The .NET isolated publish output includes a hidden `.azurefunctions`
          # directory with the worker metadata. upload-artifact@v4 excludes
          # hidden files by default, which drops it from the package and makes
          # Flex Consumption reject the deploy ("Cannot find required
          # .azurefunctions directory at root level in the .zip package").
          include-hidden-files: true

  build-frontend:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: src/frontend/Sudoku.React/package-lock.json

      - name: Install dependencies
        run: npm ci
        working-directory: src/frontend/Sudoku.React

      - name: Run frontend tests
        run: npm run test
        working-directory: src/frontend/Sudoku.React

      - name: Build frontend
        run: npm run build
        working-directory: src/frontend/Sudoku.React

      - name: Upload frontend artifact
        uses: actions/upload-artifact@v4
        with:
          name: frontend-dist
          path: src/frontend/Sudoku.React/dist

  test:
    needs: build
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}
          dotnet-quality: "ga"

      - name: Cache .NET packages
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Restore dependencies
        run: dotnet restore

      - name: Run tests with coverage
        run: dotnet test --configuration Release --no-restore --verbosity normal --logger trx --results-directory TestResults --collect:"XPlat Code Coverage" --settings coverlet.runsettings

      - name: Generate coverage report
        uses: danielpalme/ReportGenerator-GitHub-Action@5
        with:
          reports: TestResults/**/coverage.cobertura.xml
          targetdir: CoverageReport
          reporttypes: HtmlInline;Cobertura;MarkdownSummaryGithub
          verbosity: Warning

      - name: Enforce 80% line coverage threshold
        run: |
          PERCENT=$(awk 'NR==2 && /line-rate/ { match($0, /line-rate="([0-9.]+)"/, a); printf "%.2f", a[1] * 100 }' CoverageReport/Cobertura.xml)
          echo "Line coverage: ${PERCENT}%"
          echo "### Coverage Summary" >> $GITHUB_STEP_SUMMARY
          echo "Line coverage: **${PERCENT}%**" >> $GITHUB_STEP_SUMMARY
          if awk "BEGIN { exit !($PERCENT < 80) }"; then
            echo "❌ Coverage ${PERCENT}% is below the required 80% threshold." | tee -a $GITHUB_STEP_SUMMARY
            exit 1
          else
            echo "✅ Coverage ${PERCENT}% meets the required 80% threshold." | tee -a $GITHUB_STEP_SUMMARY
          fi

      - name: Publish test results as PR annotations
        uses: dorny/test-reporter@v1
        if: always()
        with:
          name: .NET Tests
          path: TestResults/*.trx
          reporter: dotnet-trx
          fail-on-error: false

      - name: Upload test-results artifact
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-results
          path: TestResults

  deploy-infra:
    needs: [test, changes]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.changes.outputs.code == 'true'
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Debug Azure context
        run: |
          az account show --output table
          az account list --output table
          az group show -n rg-xenobiasoft-sudoku-prod-westus2 --output table

      # Flex Consumption does not support in-place migration of an existing
      # Function App from another plan (Azure returns Conflict 59602). If the
      # app currently lives on a non-Flex plan, delete it so the Bicep deploy
      # can recreate it fresh on the FC1 plan. Idempotent: once the app is on
      # FlexConsumption this is a no-op. Does not touch the shared B1 plan that
      # hosts the API and MCP apps.
      - name: Recreate Functions app on Flex (delete if on a non-Flex plan)
        shell: bash
        run: |
          set -euo pipefail
          RG="rg-xenobiasoft-sudoku-prod-westus2"
          APP="${AZURE_FUNCTIONS_NAME}"
          FLEX_PLAN="XenobiasoftFunctionsPlan-prod"
          COSMOS="cosmos-sudoku-prod"

          # Existence via an RG-scoped list + client-side filter (returns an
          # empty string / exit 0 when absent, so `set -e` only trips on a real
          # CLI/auth failure). The plan is then read from properties.serverFarmId
          # via `az resource show`: `az functionapp [show|list] --query
          # appServicePlanId` returns null for Flex Consumption apps (and was
          # empty in CI for the B1 app too), which previously mis-routed an
          # existing app down the delete-or-create-fresh paths.
          APP_ID=$(az functionapp list -g "$RG" --query "[?name=='$APP'].id | [0]" -o tsv)

          if [ -z "$APP_ID" ]; then
            echo "No existing Functions app; Bicep will create it fresh on FC1."
          else
            PLAN_ID=$(az resource show --ids "$APP_ID" --query "properties.serverFarmId" -o tsv)
            if [[ "$PLAN_ID" == */"$FLEX_PLAN" ]]; then
              echo "App already on Flex plan ($FLEX_PLAN); no recreate needed."
            else
              echo "Existing app is on a non-Flex plan ($PLAN_ID); deleting so Bicep can recreate it on FC1."
              # The recreated app gets a NEW system-assigned principal. Azure
              # forbids updating an existing role assignment's principalId, so the
              # assignments tied to the old principal must be removed first or
              # Bicep fails with RoleAssignmentUpdateNotPermitted. Capture the old
              # principal's assignment ids while it still resolves, then delete.
              OLD_PRINCIPAL=$(az functionapp show --ids "$APP_ID" --query identity.principalId -o tsv 2>/dev/null || true)
              STALE_RBAC=""
              STALE_COSMOS=""
              if [ -n "$OLD_PRINCIPAL" ] && [ "$OLD_PRINCIPAL" != "null" ]; then
                STALE_RBAC=$(az role assignment list --all --assignee "$OLD_PRINCIPAL" --query "[].id" -o tsv 2>/dev/null || true)
                STALE_COSMOS=$(az cosmosdb sql role assignment list --account-name "$COSMOS" -g "$RG" --query "[?principalId=='$OLD_PRINCIPAL'].id" -o tsv 2>/dev/null || true)
              fi
              az functionapp delete --ids "$APP_ID"
              for id in $STALE_RBAC; do
                echo "Removing stale Azure RBAC assignment $id"
                az role assignment delete --ids "$id" 2>/dev/null || true
              done
              for raid in $STALE_COSMOS; do
                echo "Removing stale Cosmos SQL role assignment $raid"
                az cosmosdb sql role assignment delete --account-name "$COSMOS" -g "$RG" --role-assignment-id "$raid" --yes 2>/dev/null || true
              done
            fi
          fi

      - name: Deploy Bicep template
        id: deploy
        uses: azure/arm-deploy@v2
        with:
          resourceGroupName: rg-xenobiasoft-sudoku-prod-westus2
          template: ./infra/main.bicep
          parameters: ./infra/params/prod.bicepparam
          scope: resourcegroup
          failOnStdErr: false

      # Role assignments are not declared in Bicep (they go stale on resource
      # recreate). They live in scripts/assign-roles.sh — the single source of
      # truth — and are applied here, after Bicep has (re)created the managed
      # identities. The script is idempotent and exits non-zero on real failure.
      # See .claude/rules/rbac-role-assignments.md.
      - name: Assign managed identity roles
        shell: bash
        run: bash scripts/assign-roles.sh

      - name: DNS check (scm endpoint)
        shell: bash
        run: |
          sudo apt-get update && sudo apt-get install -y dnsutils

          for host in "${AZURE_API_NAME}.azurewebsites.net"; do
            echo "Checking DNS for $host"
            for i in {1..10}; do
              if nslookup "$host"; then
                echo "OK: $host"
                break
              fi
              echo "Waiting for DNS to propagate ($i/10)..."
              sleep 15
            done
            # Do not fail the job just because DNS isn't ready yet
            nslookup "$host" || echo "WARNING: $host not resolvable yet; continuing to deploy."
          done

      - name: Dump deployment error details (if failed)
        if: failure()
        run: |
          echo "Showing deployment operations for 'main'..."
          az deployment operation group list \
            --resource-group rg-xenobiasoft-sudoku-prod-westus2 \
            --name main \
            --output jsonc

          echo "Showing deployment details for 'main'..."
          az deployment group show \
            --resource-group rg-xenobiasoft-sudoku-prod-westus2 \
            --name main \
            --output jsonc

  deploy-apps:
    needs: deploy-infra
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Download publish-api artifact
        uses: actions/download-artifact@v4
        with:
          name: publish-api
          path: ${{ github.workspace }}/publish-api

      - name: Deploy API
        uses: azure/webapps-deploy@v3
        with:
          app-name: ${{ env.AZURE_API_NAME }}
          package: ${{ github.workspace }}/publish-api

      - name: Download publish-mcp artifact
        uses: actions/download-artifact@v4
        with:
          name: publish-mcp
          path: ${{ github.workspace }}/publish-mcp

      - name: Deploy MCP Server
        uses: azure/webapps-deploy@v3
        with:
          app-name: ${{ env.AZURE_MCP_NAME }}
          package: ${{ github.workspace }}/publish-mcp

      - name: Download publish-functions artifact
        uses: actions/download-artifact@v4
        with:
          name: publish-functions
          path: ${{ github.workspace }}/publish-functions

      - name: Deploy Functions
        shell: bash
        run: |
          set -euo pipefail
          cd "${{ github.workspace }}/publish-functions"
          zip -r ../functions.zip .
          # Flex Consumption deploys the package to its configured deployment
          # blob container via `az functionapp deployment source config-zip`
          # (the documented Flex method). `az functionapp deploy --type zip`
          # targets the OneDeploy endpoint and returns HTTP 415 on Flex apps.
          # No --build-remote: the .NET isolated publish output is pre-built.
          az functionapp deployment source config-zip \
            --name "${{ env.AZURE_FUNCTIONS_NAME }}" \
            --resource-group "rg-xenobiasoft-sudoku-prod-westus2" \
            --src "${{ github.workspace }}/functions.zip"

  deploy-event-grid:
    needs: deploy-apps
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      # Created here (not in Bicep) because the subscription must point at a live
      # function. We use the WebHook destination against the Functions Event Grid
      # extension URL rather than the AzureFunction destination: the latter
      # resolves the function through the ARM "list functions" API, which is not
      # reliably populated for dotnet-isolated apps on a Linux plan and returns
      # NotFound. The WebHook path uses the eventgrid_extension system key, and
      # the Functions runtime auto-answers Event Grid's validation handshake.
      # The command is an upsert, so it is safe to re-run on every deploy.
      - name: Create Event Grid subscription (BlobDeleted -> PuzzleReplenishFunction)
        shell: bash
        run: |
          set -euo pipefail
          RG="rg-xenobiasoft-sudoku-prod-westus2"
          TOPIC="sudoku-puzzle-pool-prod"
          FUNC_APP="${AZURE_FUNCTIONS_NAME}"
          FUNC_NAME="PuzzleReplenishFunction"

          # The eventgrid_extension system key only exists once the host has
          # loaded the Event Grid-triggered function, so polling for it also
          # gates on the function being indexed and running.
          SYSKEY=""
          for i in {1..15}; do
            SYSKEY=$(az functionapp keys list \
              --name "$FUNC_APP" --resource-group "$RG" \
              --query "systemKeys.eventgrid_extension" -o tsv 2>/dev/null || true)
            if [ -n "$SYSKEY" ] && [ "$SYSKEY" != "null" ]; then
              echo "eventgrid_extension system key is available."
              break
            fi
            echo "Waiting for function to index / system key to appear ($i/15)..."
            sleep 20
          done
          if [ -z "$SYSKEY" ] || [ "$SYSKEY" = "null" ]; then
            echo "ERROR: eventgrid_extension system key never appeared; the function did not index." >&2
            exit 1
          fi
          echo "::add-mask::$SYSKEY"

          ENDPOINT="https://${FUNC_APP}.azurewebsites.net/runtime/webhooks/eventgrid?functionName=${FUNC_NAME}&code=${SYSKEY}"

          # The system key persists in Azure Storage across deployments, so its
          # presence doesn't mean the newly-deployed app is ready. Poll the
          # webhook endpoint directly until the runtime answers (non-404/non-000).
          for i in {1..10}; do
            HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$ENDPOINT" || echo "000")
            if [ "$HTTP_STATUS" != "404" ] && [ "$HTTP_STATUS" != "000" ]; then
              echo "Webhook endpoint is responding (HTTP $HTTP_STATUS)."
              break
            fi
            echo "Waiting for webhook endpoint to be ready ($i/10)..."
            sleep 15
          done

          az eventgrid system-topic event-subscription create \
            --name puzzle-replenish-sub \
            --system-topic-name "$TOPIC" \
            --resource-group "$RG" \
            --endpoint-type webhook \
            --endpoint "$ENDPOINT" \
            --included-event-types Microsoft.Storage.BlobDeleted \
            --subject-begins-with "/blobServices/default/containers/sudoku-puzzles/" \
            --max-delivery-attempts 30 \
            --event-ttl 1440
          echo "Event Grid subscription created/updated."

  deploy-swa:
    needs: [deploy-infra, build-frontend, changes]
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Get SWA deployment token
        id: swa-token
        run: |
          TOKEN=$(az staticwebapp secrets list \
            --name ${{ env.AZURE_SWA_NAME }} \
            --query "properties.apiKey" \
            --output tsv)
          if [ -z "$TOKEN" ]; then
            echo "ERROR: Failed to retrieve SWA deployment token for ${{ env.AZURE_SWA_NAME }}" >&2
            exit 1
          fi
          echo "::add-mask::$TOKEN"
          echo "token=$TOKEN" >> $GITHUB_OUTPUT

      - name: Download frontend artifact
        uses: actions/download-artifact@v4
        with:
          name: frontend-dist
          path: frontend-dist

      - name: Deploy to Static Web App
        uses: Azure/static-web-apps-deploy@v1
        with:
          azure_static_web_apps_api_token: ${{ steps.swa-token.outputs.token }}
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          action: "upload"
          app_location: "frontend-dist"
          output_location: ""
          skip_app_build: true