template-build-deploy.yml

name: Reusable Build and Deploy

on:
  workflow_call:
    inputs:
      # The environment to deploy to (Staging or Production)
      githubEnvironment:
        required: true
        type: string
      deployEnvironment:
        required: true
        type: string
        
      AppName:
        required: true
        type: string
        
    secrets:
      AZURE_CREDENTIALS:
        required: true
      AZURE_SUBSCRIPTION:
        required: true
      AZURE_RG:
        required: true
      CLIENT_ID:
        required: true
        
      ConnectionString:
        required: true
      OpenAiApiKey:
        required: true

      GH_PAT:
        required: true
      
      GithubRepoToken:
        required: true

jobs:
  build:
    runs-on: ubuntu-latest
    environment: ${{ inputs.githubEnvironment }}
    
    steps:
      - uses: actions/checkout@v4

      # Log in to Azure
      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          
      # Run Bicep
      - name: Deploy Bicep
        uses: azure/arm-deploy@v2
        with:
          subscriptionId: ${{ secrets.AZURE_SUBSCRIPTION }}
          resourceGroupName: ${{ secrets.AZURE_RG }}
          template: ./.github/bicep/main.bicep
          parameters: 'appName=${{ inputs.appName }} environment=${{ inputs.deployEnvironment }} hostingPlanName=${{ vars.HOSTING_PLAN_NAME }} hostingPlanRgName=${{ vars.HOSTING_PLAN_RG_NAME }} connectionString=${{ secrets.ConnectionString }} openAiApiKey=${{ secrets.OpenAiApiKey }} GH_PAT=${{ secrets.GH_PAT }} allowedCors=${{ vars.ALLOWED_CORS }} maxRequests=${{ vars.MAX_REQUESTS }} signingAuthority=${{ vars.SIGNING_AUTHORITY }} rulesTableName=${{ vars.RULES_TABLE_NAME }}'
          failOnStdErr: false

      # TODO: Persist Bicep outputs to GH step outputs
      
      # https://stackoverflow.com/questions/60521929/change-variables-in-appsettings-when-deploying-with-github-actions
      # This will fail if done before the build step
      - name: App Settings Variable Substitution
        uses: microsoft/variable-substitution@v1
        with:
          files: './src/WebUI/wwwroot/appsettings.json'
        env:
          ApiBaseUrl: ${{ vars.API_BASE_URL }}
          SigningAuthority: ${{ vars.SIGNING_AUTHORITY }}

      - name: Set up .NET Core
        uses: actions/setup-dotnet@v4
        with:
          global-json-file: global.json

      - name: Build with dotnet
        run: dotnet build --configuration Release

      - name: dotnet publish WebAPI
        if: ${{ vars.TAKE_APP_OFFLINE != 'TRUE' }}
        run: dotnet publish ./src/WebAPI -c Release --no-build --no-restore -o ./publish/api

      - name: dotnet publish WebUI
        run: dotnet publish ./src/WebUI -c Release --no-build --no-restore -o ./publish/ui

      - name: Upload API artifact for deployment job
        if: ${{ vars.TAKE_APP_OFFLINE != 'TRUE' }}
        uses: actions/upload-artifact@v4
        with:
          name: .net-app-api
          path: ./publish/api

      - name: Upload WebUI artifact for deployment job
        uses: actions/upload-artifact@v4
        with:
          name: .net-app-webui
          path: ./publish/ui

  deploy-api:
    runs-on: ubuntu-latest
    needs: build
    
    environment:
      name: ${{ inputs.githubEnvironment }}
      url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}

    steps:
      - name: Download artifact from build job
        if: ${{ vars.TAKE_APP_OFFLINE != 'TRUE' }}
        uses: actions/download-artifact@v4
        with:
          name: .net-app-api

      # Log in to Azure
      - name: Azure Login
        if: ${{ vars.TAKE_APP_OFFLINE != 'TRUE' }}
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Deploy to Azure Web App
        if: ${{ vars.TAKE_APP_OFFLINE != 'TRUE' }}
        id: deploy-to-webapp
        uses: azure/webapps-deploy@v3
        with:
          app-name: "${{ vars.AZURE_WEB_APP_NAME }}"
          package: .

  deploy-webui:
    runs-on: ubuntu-latest
    needs: build
    
    environment:
      name: ${{ inputs.githubEnvironment }}
      url: ${{ steps.deploy-to-staticwebapp.outputs.static_web_app_url }}
      
    steps:
      - name: Download artifact from build job
        uses: actions/download-artifact@v4
        with:
          name: .net-app-webui
    
      - name: Check for App Offline
        id: app_offline
        shell: pwsh
        run: |
            Set-Location "wwwroot"
            if ($env:TAKE_APP_OFFLINE -eq "TRUE")
            {
              Remove-Item -Path "index.html" -Force
              Move-Item -Path "app_offline-template.htm" -Destination "index.html"
            }
            else
            {
              Remove-Item -Path "app_offline-template.htm" -Force
            }
        #working-directory: .net-app-webui
        env:
          TAKE_APP_OFFLINE: ${{ vars.TAKE_APP_OFFLINE }}

      # Log in to Azure
      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          
      # TODO: Move to federated auth
          
      - name: Mask Deployment Token
        uses: azure/CLI@v2
        with:
          azcliversion: latest
          inlineScript: |
            echo "::add-mask::$(az staticwebapp secrets list -n ${{ vars.AZURE_STATIC_WEB_APP_NAME }} | jq -r '.properties.apiKey')"  

      - name: Retrieve Deployment Token
        uses: azure/CLI@v2
        with:
          azcliversion: latest
          inlineScript: |
            echo "SWA_TOKEN=$(az staticwebapp secrets list -n ${{ vars.AZURE_STATIC_WEB_APP_NAME }} | jq -r '.properties.apiKey')" >> $GITHUB_ENV            

      - name: Deploy Static Web App
        id: deploy-to-staticwebapp
        uses: Azure/static-web-apps-deploy@v1
        with:
          azure_static_web_apps_api_token: ${{ env.SWA_TOKEN }}
          repo_token: ${{ secrets.GithubRepoToken }} # Used for Github integrations (i.e. PR comments)
          skip_app_build: true
          action: "upload"
          ###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
          # For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig
          app_location: "./wwwroot" # App source code path
          config_file_location: "./"
          #api_location: '' # Api source code path - optional
          #output_location: '' # Built app content directory - optional
          ###### End of Repository/Build Configurations ######