deploy.yml

name: Build & Deploy

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment'
        type: choice
        options:
          - dev
          - test1
          - prod
        default: dev
      deploy:
        description: 'Deploy after build'
        type: boolean
        default: true

env:
  ACR_NAME: azopscrewacr2dovm8
  ACR_SERVER: azopscrewacr2dovm8.azurecr.io
  KEYCLOAK_BASE_URL: https://auth.aoc-app.com
  KEYCLOAK_CLIENT_ID: azureopscrew-frontend

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    outputs:
      env_name: ${{ steps.env.outputs.name }}
      resource_group: ${{ steps.env.outputs.rg }}
      frontend_public_url: ${{ steps.env.outputs.frontend_public_url }}
      keycloak_realm: ${{ steps.env.outputs.keycloak_realm }}
      keycloak_authority: ${{ steps.env.outputs.keycloak_authority }}
      keycloak_local_login_enabled: ${{ steps.env.outputs.keycloak_local_login_enabled }}
      keycloak_local_signup_enabled: ${{ steps.env.outputs.keycloak_local_signup_enabled }}
      keycloak_entra_sso_enabled: ${{ steps.env.outputs.keycloak_entra_sso_enabled }}
      image_tag: ${{ github.sha }}
    
    steps:
      - uses: actions/checkout@v4

      - name: Set environment
        id: env
        run: |
          ENV_NAME="${{ github.event.inputs.environment }}"
          case "$ENV_NAME" in
            test*)
              RESOURCE_GROUP="AzureOpsCrew-dev"
              ;;
            *)
              RESOURCE_GROUP="AzureOpsCrew-${ENV_NAME}"
              ;;
          esac

          case "$ENV_NAME" in
            prod)
              FRONTEND_PUBLIC_URL="https://aoc-app.com"
              ;;
            *)
              FRONTEND_PUBLIC_URL="https://${ENV_NAME}.aoc-app.com"
              ;;
          esac

          case "$ENV_NAME" in
            dev)
              KEYCLOAK_REALM="azureopscrew-dev"
              ;;
            test1)
              KEYCLOAK_REALM="azureopscrew-test1"
              ;;
            prod)
              KEYCLOAK_REALM="azureopscrew-prod"
              ;;
            *)
              echo "Unsupported environment for Keycloak realm mapping: $ENV_NAME" >&2
              exit 1
              ;;
          esac

          KEYCLOAK_AUTHORITY="${{ env.KEYCLOAK_BASE_URL }}/realms/${KEYCLOAK_REALM}"

          case "$ENV_NAME" in
            test1)
              KEYCLOAK_LOCAL_LOGIN_ENABLED="false"
              KEYCLOAK_LOCAL_SIGNUP_ENABLED="false"
              KEYCLOAK_ENTRA_SSO_ENABLED="true"
              ;;
            dev|prod)
              KEYCLOAK_LOCAL_LOGIN_ENABLED="false"
              KEYCLOAK_LOCAL_SIGNUP_ENABLED="false"
              KEYCLOAK_ENTRA_SSO_ENABLED="true"
              ;;
            *)
              KEYCLOAK_LOCAL_LOGIN_ENABLED="true"
              KEYCLOAK_LOCAL_SIGNUP_ENABLED="true"
              KEYCLOAK_ENTRA_SSO_ENABLED="false"
              ;;
          esac

          echo "name=${ENV_NAME}" >> $GITHUB_OUTPUT
          echo "rg=${RESOURCE_GROUP}" >> $GITHUB_OUTPUT
          echo "frontend_public_url=${FRONTEND_PUBLIC_URL}" >> $GITHUB_OUTPUT
          echo "keycloak_realm=${KEYCLOAK_REALM}" >> $GITHUB_OUTPUT
          echo "keycloak_authority=${KEYCLOAK_AUTHORITY}" >> $GITHUB_OUTPUT
          echo "keycloak_local_login_enabled=${KEYCLOAK_LOCAL_LOGIN_ENABLED}" >> $GITHUB_OUTPUT
          echo "keycloak_local_signup_enabled=${KEYCLOAK_LOCAL_SIGNUP_ENABLED}" >> $GITHUB_OUTPUT
          echo "keycloak_entra_sso_enabled=${KEYCLOAK_ENTRA_SSO_ENABLED}" >> $GITHUB_OUTPUT
          echo "🎯 Environment: ${ENV_NAME}"
          echo "🎯 Resource Group: ${RESOURCE_GROUP}"
          echo "🎯 Frontend Public URL: ${FRONTEND_PUBLIC_URL}"
          echo "🎯 Keycloak Realm: ${KEYCLOAK_REALM}"
          echo "🚀 Deploy enabled: ${{ github.event.inputs.deploy }}"

      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: '{"clientId":"${{ secrets.AZ_CLIENT_ID }}","clientSecret":"${{ secrets.AZ_SECRET }}","subscriptionId":"${{ secrets.AZ_SUBSCRIPTION_ID }}","tenantId":"${{ secrets.AZ_TENANT_ID }}"}'

      - name: ACR Login
        run: az acr login --name ${{ env.ACR_NAME }}

      - name: Build & Push Backend
        run: |
          echo "📦 Building Backend..."
          docker build \
            -t ${{ env.ACR_SERVER }}/backend:${{ github.sha }} \
            -t ${{ env.ACR_SERVER }}/backend:${{ steps.env.outputs.name }}-latest \
            -f backend/src/Api/Dockerfile \
            backend/
          docker push ${{ env.ACR_SERVER }}/backend:${{ github.sha }}
          docker push ${{ env.ACR_SERVER }}/backend:${{ steps.env.outputs.name }}-latest
          echo "✅ Backend pushed"

      - name: Build & Push Frontend
        run: |
          echo "📦 Building Frontend..."
          docker build \
            -t ${{ env.ACR_SERVER }}/frontend:${{ github.sha }} \
            -t ${{ env.ACR_SERVER }}/frontend:${{ steps.env.outputs.name }}-latest \
            frontend/
          docker push ${{ env.ACR_SERVER }}/frontend:${{ github.sha }}
          docker push ${{ env.ACR_SERVER }}/frontend:${{ steps.env.outputs.name }}-latest
          echo "✅ Frontend pushed"

      - name: Build Summary
        run: |
          echo "## 📦 Build Complete" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Environment:** ${{ steps.env.outputs.name }}" >> $GITHUB_STEP_SUMMARY
          echo "**Frontend Public URL:** ${{ steps.env.outputs.frontend_public_url }}" >> $GITHUB_STEP_SUMMARY
          echo "**Backend Image:** \`${{ env.ACR_SERVER }}/backend:${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
          echo "**Frontend Image:** \`${{ env.ACR_SERVER }}/frontend:${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY

  deploy:
    name: Deploy
    needs: build
    runs-on: ubuntu-latest
    if: ${{ github.event.inputs.deploy == 'true' }}
    
    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: '{"clientId":"${{ secrets.AZ_CLIENT_ID }}","clientSecret":"${{ secrets.AZ_SECRET }}","subscriptionId":"${{ secrets.AZ_SUBSCRIPTION_ID }}","tenantId":"${{ secrets.AZ_TENANT_ID }}"}'

      - name: Deploy Backend
        run: |
          echo "🚀 Deploying Backend to ${{ needs.build.outputs.env_name }}..."
          az containerapp update \
            --name ca-azopscrew-backend-${{ needs.build.outputs.env_name }} \
            --resource-group ${{ needs.build.outputs.resource_group }} \
            --image ${{ env.ACR_SERVER }}/backend:${{ needs.build.outputs.image_tag }} \
            --set-env-vars \
              KeycloakOidc__Enabled=true \
              KeycloakOidc__Authority=${{ needs.build.outputs.keycloak_authority }} \
              KeycloakOidc__ClientId=${{ env.KEYCLOAK_CLIENT_ID }} \
              KeycloakOidc__RequireVerifiedEmail=true
          echo "✅ Backend deployed"

      - name: Deploy Frontend
        run: |
          echo "🚀 Deploying Frontend to ${{ needs.build.outputs.env_name }}..."
          az containerapp update \
            --name ca-azopscrew-frontend-${{ needs.build.outputs.env_name }} \
            --resource-group ${{ needs.build.outputs.resource_group }} \
            --image ${{ env.ACR_SERVER }}/frontend:${{ needs.build.outputs.image_tag }} \
            --set-env-vars \
              KEYCLOAK_AUTHORITY=${{ needs.build.outputs.keycloak_authority }} \
              KEYCLOAK_CLIENT_ID=${{ env.KEYCLOAK_CLIENT_ID }} \
              PUBLIC_APP_URL=${{ needs.build.outputs.frontend_public_url }} \
              KEYCLOAK_CALLBACK_URL=${{ needs.build.outputs.frontend_public_url }}/api/auth/keycloak/callback \
              KEYCLOAK_LOCAL_LOGIN_ENABLED=${{ needs.build.outputs.keycloak_local_login_enabled }} \
              KEYCLOAK_LOCAL_SIGNUP_ENABLED=${{ needs.build.outputs.keycloak_local_signup_enabled }} \
              KEYCLOAK_ENTRA_SSO_ENABLED=${{ needs.build.outputs.keycloak_entra_sso_enabled }} \
              KEYCLOAK_ENTRA_IDP_HINT=entra
          echo "✅ Frontend deployed"

      - name: Deploy Summary
        run: |
          echo "## 🚀 Deployment Complete" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          BACKEND_URL=$(az containerapp show -n ca-azopscrew-backend-${{ needs.build.outputs.env_name }} -g ${{ needs.build.outputs.resource_group }} --query properties.configuration.ingress.fqdn -o tsv)
          FRONTEND_URL=$(az containerapp show -n ca-azopscrew-frontend-${{ needs.build.outputs.env_name }} -g ${{ needs.build.outputs.resource_group }} --query properties.configuration.ingress.fqdn -o tsv)
          echo "**Backend:** https://$BACKEND_URL" >> $GITHUB_STEP_SUMMARY
          echo "**Frontend:** https://$FRONTEND_URL" >> $GITHUB_STEP_SUMMARY