azure-deploy-dev.yml

name: 'App Deploy [Azure - DEV]'

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths-ignore:
      - '**/*.md'
      - .docker*
      - .env.example
      - .github
      - .gitignore
      - .pa11yci
      - .tool-versions
      - .yardopts
      - bin/*
      - docker-compose.*
      - terraform-azure/**
      - uml/*

# Permissions for OIDC authentication
permissions:
  id-token: write
  contents: write
  packages: write

env:
  ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
  ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
  ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
  DOCKER_IMAGE: ghcr.io/dfe-digital/early-years-foundation-recovery

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    environment: development

    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout Code
        uses: actions/checkout@v4

      # Create and boot Docker image builder
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: v0.9.1

      # Login to the container registry
      - name: Login to Github Container Registry
        uses: docker/#-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Build and push image
      - name: Build and push Docker Image
        uses: docker/build-push-action@v6
        with:
          target: app
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          outputs: type=image,name=target,annotation-index.org.opencontainers.image.description=Early Years Recovery Rails Application
          build-args: |
            BUILDKIT_INLINE_CACHE=1
            SHA=${{ github.sha }}
          cache-from: |
            ${{ env.DOCKER_IMAGE }}:${{ github.sha }}
          tags: |
            ${{ env.DOCKER_IMAGE }}:${{ github.sha }}
            ${{ env.DOCKER_IMAGE }}:latest

      # Login to Azure using OIDC
      - name: Login to Azure CLI
        uses: azure/#@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      # Deploy Web Application
      - name: Deploy to Azure App Services
        uses: azure/webapps-deploy@v2
        with:
          app-name: ${{ vars.WEBAPP_NAME }}
          images: ${{ env.DOCKER_IMAGE }}:${{ github.sha }}

      # Destroy Background Worker
      - name: Destroy existing Azure Container Instances
        uses: azure/CLI@v2
        with:
          azcliversion: 2.50.0
          inlineScript: |
            az container delete --resource-group ${{ secrets.AZURE_RESOURCE_GROUP }} \
              --name ${{ vars.WORKERAPP_NAME }} \
              --yes

      # Deploy Background Worker
      - name: Deploy to Azure Container Instances
        uses: azure/CLI@v2
        with:
          azcliversion: 2.50.0
          inlineScript: |
            az container create --resource-group ${{ secrets.AZURE_RESOURCE_GROUP }} \
              --name ${{ vars.WORKERAPP_NAME }} \
              --image ${{ env.DOCKER_IMAGE }}:${{ github.sha }} \
              --cpu 1 \
              --memory 2 \
              --command-line "que" \
              --restart-policy OnFailure \
              --log-analytics-workspace ${{ secrets.AZURE_LOG_ANALYTICS_WORKSPACE }} \
              --vnet ${{ secrets.AZURE_VNET }} \
              --subnet ${{ secrets.AZURE_WORKER_APP_SUBNET }} \
              --ip-address Private \
              --output none \
              --environment-variables \
                EDITOR=vi \
                RAILS_ENV=production \
                RAILS_LOG_TO_STDOUT=true \
                CONTENTFUL_ENVIRONMENT=test \
                ENVIRONMENT=${{ vars.ENVIRONMENT }} \
                DOMAIN=${{ vars.WEBAPP_CONFIG_DOMAIN }} \
                GOOGLE_CLOUD_BUCKET=${{ vars.WEBAPP_CONFIG_GOOGLE_CLOUD_BUCKET }} \
                RAILS_MASTER_KEY=${{ secrets.WEBAPP_CONFIG_RAILS_MASTER_KEY }} \
                DATABASE_URL=${{ secrets.WEBAPP_DATABASE_URL }} \
                GCS_CREDENTIALS=${{ secrets.GCS_CREDENTIALS }} \
                SENTRY_TOKEN=${{ secrets.SENTRY_TOKEN }}