-
Notifications
You must be signed in to change notification settings - Fork 2
140 lines (120 loc) · 3.72 KB
/
infrastructure.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
---
name: Infrastructure
on:
push:
branches:
- main
paths:
- .github/workflows/infrastructure.yml
- infrastructure/**
pull_request:
branches:
- main
paths:
- .github/workflows/infrastructure.yml
- infrastructure/**
workflow_dispatch: {}
permissions: {}
jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Lint Bicep Files
uses: azure/cli@v2
with:
azcliversion: latest
inlineScript: |
az bicep lint --file infrastructure/main.bicep
az bicep lint --file infrastructure/main.bicepparam
- name: Build Bicep Files
uses: azure/cli@v2
with:
azcliversion: latest
inlineScript: |
az bicep build --file infrastructure/main.bicep --outfile infrastructure/main.json
az bicep build-params --file infrastructure/main.bicepparam --outfile infrastructure/main.parameters.json
- name: Upload Bicep Files
uses: actions/upload-artifact@v4
with:
name: infrastructure
path: infrastructure/
test:
name: Test
runs-on: ubuntu-latest
needs: build
if: github.ref == 'refs/heads/main' || github.event_name == 'pull_request'
environment: Staging
permissions:
id-token: write
steps:
- name: Download Bicep Files
uses: actions/download-artifact@v4
with:
name: infrastructure
path: infrastructure/
- name: Azure Login
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- name: Create Resource Group
uses: azure/cli@v2
with:
azcliversion: latest
inlineScript: |
az group create --name ${{ vars.RESOURCE_GROUP }} --location ${{ vars.LOCATION }}
- name: Validate ARM Deployment
uses: azure/arm-deploy@v2
with:
scope: resourcegroup
resourceGroupName: ${{ vars.RESOURCE_GROUP }}
template: infrastructure/main.bicep
parameters: infrastructure/main.bicepparam
deploymentMode: Validate
- name: What-if ARM Deployment
uses: azure/arm-deploy@v2
with:
scope: resourcegroup
resourceGroupName: ${{ vars.RESOURCE_GROUP }}
template: infrastructure/main.bicep
parameters: infrastructure/main.bicepparam
deploymentMode: Incremental
additionalArguments: --what-if
deploy:
name: Deploy
runs-on: ubuntu-latest
needs: test
if: github.ref == 'refs/heads/main'
environment: Production
permissions:
id-token: write
steps:
- name: Download Bicep Files
uses: actions/download-artifact@v4
with:
name: infrastructure
path: infrastructure/
- name: Azure Login
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- name: Create Resource Group
uses: azure/cli@v2
with:
azcliversion: latest
inlineScript: |
az group create --name ${{ vars.RESOURCE_GROUP }} --location ${{ vars.LOCATION }}
- name: Deploy Resources
uses: azure/arm-deploy@v2
with:
scope: resourcegroup
resourceGroupName: ${{ vars.RESOURCE_GROUP }}
template: infrastructure/main.bicep
parameters: infrastructure/main.bicepparam
deploymentMode: Incremental