job-deploy.yml

name: Deploy Job 

on:
  workflow_call:
    inputs:
      trigger_type:
        description: 'Trigger type (workflow_dispatch, pull_request, schedule)'
        required: true
        type: string
      runner_os:
        description: 'Runner OS (ubuntu-latest or windows-latest)'
        required: true
        type: string
      azure_location:
        description: 'Azure Location For Deployment'
        required: false
        default: 'australiaeast'
        type: string
      resource_group_name:
        description: 'Resource Group Name (Optional)'
        required: false
        default: ''
        type: string
      waf_enabled:
        description: 'Enable WAF'
        required: false
        default: false
        type: boolean
      EXP:
        description: 'Enable EXP'
        required: false
        default: false
        type: boolean
      build_docker_image:
        description: 'Build And Push Docker Image (Optional)'
        required: false
        default: false
        type: boolean
      cleanup_resources:
        description: 'Cleanup Deployed Resources'
        required: false
        default: false
        type: boolean
      run_e2e_tests:
        description: 'Run End-to-End Tests'
        required: false
        default: 'GoldenPath-Testing'
        type: string
      existing_webapp_url:
        description: 'Existing Container WebApp URL (Skips Deployment)'
        required: false
        default: ''
        type: string
      AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID:
        description: 'Log Analytics Workspace ID (Optional)'
        required: false
        default: ''
        type: string
      AZURE_EXISTING_AI_PROJECT_RESOURCE_ID:
        description: 'AI Project Resource ID (Optional)'
        required: false
        default: ''
        type: string
      docker_image_tag:
        description: 'Docker Image Tag from build job'
        required: false
        default: ''
        type: string
    outputs:
      RESOURCE_GROUP_NAME:
        description: "Resource Group Name"
        value: ${{ jobs.azure-setup.outputs.RESOURCE_GROUP_NAME }}
      CONTAINER_WEB_APPURL:
        description: "Container Web App URL"
        value: ${{ jobs.deploy-linux.outputs.CONTAINER_WEB_APPURL || jobs.deploy-windows.outputs.CONTAINER_WEB_APPURL }}
      ENV_NAME:
        description: "Environment Name"
        value: ${{ jobs.azure-setup.outputs.ENV_NAME }}
      AZURE_LOCATION:
        description: "Azure Location"
        value: ${{ jobs.azure-setup.outputs.AZURE_LOCATION }}
      AZURE_ENV_OPENAI_LOCATION:
        description: "Azure OpenAI Location"
        value: ${{ jobs.azure-setup.outputs.AZURE_ENV_OPENAI_LOCATION }}
      IMAGE_TAG:
        description: "Docker Image Tag Used"
        value: ${{ jobs.azure-setup.outputs.IMAGE_TAG }}
      QUOTA_FAILED:
        description: "Quota Check Failed Flag"
        value: ${{ jobs.azure-setup.outputs.QUOTA_FAILED }}

env:
  GPT_MIN_CAPACITY: 100
  BRANCH_NAME: ${{ github.event.workflow_run.head_branch || github.head_ref || github.ref_name }}
  WAF_ENABLED: ${{ inputs.trigger_type == 'workflow_dispatch' && (inputs.waf_enabled || false) || false }}
  EXP: ${{ inputs.trigger_type == 'workflow_dispatch' && (inputs.EXP || false) || false }}
  CLEANUP_RESOURCES: ${{ inputs.trigger_type != 'workflow_dispatch' || inputs.cleanup_resources }}
  RUN_E2E_TESTS: ${{ inputs.trigger_type == 'workflow_dispatch' && (inputs.run_e2e_tests || 'GoldenPath-Testing') || 'GoldenPath-Testing' }}
  BUILD_DOCKER_IMAGE: ${{ inputs.trigger_type == 'workflow_dispatch' && (inputs.build_docker_image || false) || false }}
jobs:
  azure-setup:
    name: Azure Setup
    if: inputs.trigger_type != 'workflow_dispatch' || inputs.existing_webapp_url == '' || inputs.existing_webapp_url == null
    runs-on: ubuntu-latest
    environment: production
    outputs:
      RESOURCE_GROUP_NAME: ${{ steps.check_create_rg.outputs.RESOURCE_GROUP_NAME }}
      ENV_NAME: ${{ steps.generate_env_name.outputs.ENV_NAME }}
      AZURE_LOCATION: ${{ steps.set_region.outputs.AZURE_LOCATION }}
      AZURE_ENV_OPENAI_LOCATION: ${{ steps.set_region.outputs.AZURE_ENV_OPENAI_LOCATION }}
      IMAGE_TAG: ${{ steps.determine_image_tag.outputs.IMAGE_TAG }}
      QUOTA_FAILED: ${{ steps.quota_failure_output.outputs.QUOTA_FAILED }}
      EXP_ENABLED: ${{ steps.configure_exp.outputs.EXP_ENABLED }}
    steps:

      - name: Validate Workflow Input Parameters
        shell: bash
        env:
          INPUT_TRIGGER_TYPE: ${{ inputs.trigger_type }}
          INPUT_RUNNER_OS: ${{ inputs.runner_os }}
          INPUT_BUILD_DOCKER_IMAGE: ${{ inputs.build_docker_image }}
          INPUT_AZURE_LOCATION: ${{ inputs.azure_location }}
          INPUT_RESOURCE_GROUP_NAME: ${{ inputs.resource_group_name }}
          INPUT_WAF_ENABLED: ${{ inputs.waf_enabled }}
          INPUT_EXP: ${{ inputs.EXP }}
          INPUT_CLEANUP_RESOURCES: ${{ inputs.cleanup_resources }}
          INPUT_RUN_E2E_TESTS: ${{ inputs.run_e2e_tests }}
          INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID: ${{ inputs.AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID }}
          INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: ${{ inputs.AZURE_EXISTING_AI_PROJECT_RESOURCE_ID }}
          INPUT_EXISTING_WEBAPP_URL: ${{ inputs.existing_webapp_url }}
          INPUT_DOCKER_IMAGE_TAG: ${{ inputs.docker_image_tag }}
        run: |
          echo "🔍 Validating workflow input parameters..."
          VALIDATION_FAILED=false
          
          # Validate trigger_type (required - alphanumeric with underscores)
          if [[ -z "$INPUT_TRIGGER_TYPE" ]]; then
            echo "❌ ERROR: trigger_type is required but was not provided"
            VALIDATION_FAILED=true
          elif [[ ! "$INPUT_TRIGGER_TYPE" =~ ^[a-zA-Z0-9_]+$ ]]; then
            echo "❌ ERROR: trigger_type '$INPUT_TRIGGER_TYPE' is invalid. Must contain only alphanumeric characters and underscores"
            VALIDATION_FAILED=true
          else
            echo "✅ trigger_type: '$INPUT_TRIGGER_TYPE' is valid"
          fi
          
          # Validate runner_os (required - must be specific values)
          ALLOWED_RUNNER_OS=("ubuntu-latest" "windows-latest")
          if [[ -z "$INPUT_RUNNER_OS" ]]; then
            echo "❌ ERROR: runner_os is required but was not provided"
            VALIDATION_FAILED=true
          elif [[ ! " ${ALLOWED_RUNNER_OS[@]} " =~ " ${INPUT_RUNNER_OS} " ]]; then
            echo "❌ ERROR: runner_os '$INPUT_RUNNER_OS' is invalid. Allowed values: ${ALLOWED_RUNNER_OS[*]}"
            VALIDATION_FAILED=true
          else
            echo "✅ runner_os: '$INPUT_RUNNER_OS' is valid"
          fi
          
          # Validate build_docker_image (boolean)
          if [[ "$INPUT_BUILD_DOCKER_IMAGE" != "true" && "$INPUT_BUILD_DOCKER_IMAGE" != "false" ]]; then
            echo "❌ ERROR: build_docker_image must be 'true' or 'false', got: '$INPUT_BUILD_DOCKER_IMAGE'"
            VALIDATION_FAILED=true
          else
            echo "✅ build_docker_image: '$INPUT_BUILD_DOCKER_IMAGE' is valid"
          fi
          
          # Validate azure_location (Azure region format)
          if [[ -n "$INPUT_AZURE_LOCATION" ]]; then
            if [[ ! "$INPUT_AZURE_LOCATION" =~ ^[a-z0-9]+$ ]]; then
              echo "❌ ERROR: azure_location '$INPUT_AZURE_LOCATION' is invalid. Must contain only lowercase letters and numbers (e.g., 'australiaeast', 'westus2')"
              VALIDATION_FAILED=true
            else
              echo "✅ azure_location: '$INPUT_AZURE_LOCATION' is valid"
            fi
          fi
          
          # Validate resource_group_name (Azure resource group naming convention)
          if [[ -n "$INPUT_RESOURCE_GROUP_NAME" ]]; then
            if [[ ! "$INPUT_RESOURCE_GROUP_NAME" =~ ^[a-zA-Z0-9._\(\)-]+$ ]] || [[ "$INPUT_RESOURCE_GROUP_NAME" =~ \.$ ]]; then
              echo "❌ ERROR: resource_group_name '$INPUT_RESOURCE_GROUP_NAME' is invalid. Must contain only alphanumerics, periods, underscores, hyphens, and parentheses. Cannot end with period."
              VALIDATION_FAILED=true
            elif [[ ${#INPUT_RESOURCE_GROUP_NAME} -gt 90 ]]; then
              echo "❌ ERROR: resource_group_name '$INPUT_RESOURCE_GROUP_NAME' exceeds 90 characters"
              VALIDATION_FAILED=true
            else
              echo "✅ resource_group_name: '$INPUT_RESOURCE_GROUP_NAME' is valid"
            fi
          fi
          
          # Validate waf_enabled (boolean)
          if [[ "$INPUT_WAF_ENABLED" != "true" && "$INPUT_WAF_ENABLED" != "false" ]]; then
            echo "❌ ERROR: waf_enabled must be 'true' or 'false', got: '$INPUT_WAF_ENABLED'"
            VALIDATION_FAILED=true
          else
            echo "✅ waf_enabled: '$INPUT_WAF_ENABLED' is valid"
          fi
          
          # Validate EXP (boolean)
          if [[ "$INPUT_EXP" != "true" && "$INPUT_EXP" != "false" ]]; then
            echo "❌ ERROR: EXP must be 'true' or 'false', got: '$INPUT_EXP'"
            VALIDATION_FAILED=true
          else
            echo "✅ EXP: '$INPUT_EXP' is valid"
          fi
          
          # Validate cleanup_resources (boolean)
          if [[ "$INPUT_CLEANUP_RESOURCES" != "true" && "$INPUT_CLEANUP_RESOURCES" != "false" ]]; then
            echo "❌ ERROR: cleanup_resources must be 'true' or 'false', got: '$INPUT_CLEANUP_RESOURCES'"
            VALIDATION_FAILED=true
          else
            echo "✅ cleanup_resources: '$INPUT_CLEANUP_RESOURCES' is valid"
          fi
          
          # Validate run_e2e_tests (specific allowed values)
          if [[ -n "$INPUT_RUN_E2E_TESTS" ]]; then
            ALLOWED_VALUES=("None" "GoldenPath-Testing" "Smoke-Testing")
            if [[ ! " ${ALLOWED_VALUES[@]} " =~ " ${INPUT_RUN_E2E_TESTS} " ]]; then
              echo "❌ ERROR: run_e2e_tests '$INPUT_RUN_E2E_TESTS' is invalid. Allowed values: ${ALLOWED_VALUES[*]}"
              VALIDATION_FAILED=true
            else
              echo "✅ run_e2e_tests: '$INPUT_RUN_E2E_TESTS' is valid"
            fi
          fi
          
          # Validate AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID (Azure Resource ID format)
          if [[ -n "$INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID" ]]; then
            if [[ ! "$INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID" =~ ^/subscriptions/[a-fA-F0-9-]+/[Rr]esource[Gg]roups/[^/]+/providers/[Mm]icrosoft\.[Oo]perational[Ii]nsights/[Ww]orkspaces/[^/]+$ ]]; then
              echo "❌ ERROR: AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID is invalid. Must be a valid Azure Resource ID format:"
              echo "   /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}"
              echo "   Got: '$INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID'"
              VALIDATION_FAILED=true
            else
              echo "✅ AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID: Valid Resource ID format"
            fi
          fi
          
          # Validate AZURE_EXISTING_AI_PROJECT_RESOURCE_ID (Azure Resource ID format)
          if [[ -n "$INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID" ]]; then
            if [[ ! "$INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID" =~ ^/subscriptions/[a-fA-F0-9-]+/[Rr]esource[Gg]roups/[^/]+/providers/([Mm]icrosoft\.[Mm]achine[Ll]earning[Ss]ervices/([Ww]orkspaces|[Pp]rojects)/[^/]+|[Mm]icrosoft\.[Cc]ognitive[Ss]ervices/[Aa]ccounts/[^/]+/[Pp]rojects/[^/]+)$ ]]; then
              echo "❌ ERROR: AZURE_EXISTING_AI_PROJECT_RESOURCE_ID is invalid. Must be a valid Azure Resource ID format:"
              echo "   /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CognitiveServices/accounts/{accountName}/projects/{projectName}"
              echo "   Got: '$INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID'"
              VALIDATION_FAILED=true
            else
              echo "✅ AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: Valid Resource ID format"
            fi
          fi
          
          # Validate existing_webapp_url (must start with https)
          if [[ -n "$INPUT_EXISTING_WEBAPP_URL" ]]; then
            if [[ ! "$INPUT_EXISTING_WEBAPP_URL" =~ ^https:// ]]; then
              echo "❌ ERROR: existing_webapp_url must start with 'https://', got: '$INPUT_EXISTING_WEBAPP_URL'"
              VALIDATION_FAILED=true
            else
              echo "✅ existing_webapp_url: '$INPUT_EXISTING_WEBAPP_URL' is valid"
            fi
          fi
          
          # Validate docker_image_tag (Docker tag pattern)
          if [[ -n "$INPUT_DOCKER_IMAGE_TAG" ]]; then
            # Docker tags: lowercase and uppercase letters, digits, underscores, periods, and hyphens
            # Cannot start with period or hyphen, max 128 characters
            if [[ ! "$INPUT_DOCKER_IMAGE_TAG" =~ ^[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}$ ]]; then
              echo "❌ ERROR: docker_image_tag '$INPUT_DOCKER_IMAGE_TAG' is invalid. Must:"
              echo "   - Start with alphanumeric or underscore"
              echo "   - Contain only alphanumerics, underscores, periods, hyphens"
              echo "   - Be max 128 characters"
              VALIDATION_FAILED=true
            else
              echo "✅ docker_image_tag: '$INPUT_DOCKER_IMAGE_TAG' is valid"
            fi
          fi
          
          # Fail workflow if any validation failed
          if [[ "$VALIDATION_FAILED" == "true" ]]; then
            echo ""
            echo "❌ Parameter validation failed. Please correct the errors above and try again."
            exit 1
          fi
          
          echo ""
          echo "✅ All input parameters validated successfully!"

      - name: Validate and Auto-Configure EXP
        id: configure_exp
        shell: bash
        env:
          INPUT_EXP: ${{ inputs.EXP }}
          INPUT_LOG_ANALYTICS_WORKSPACE_ID: ${{ inputs.AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID }}
          INPUT_AI_PROJECT_RESOURCE_ID: ${{ inputs.AZURE_EXISTING_AI_PROJECT_RESOURCE_ID }}
        run: |
          echo "🔍 Validating EXP configuration..."
          
          EXP_ENABLED="false"
          
          if [[ "$INPUT_EXP" == "true" ]]; then
            EXP_ENABLED="true"
            echo "✅ EXP explicitly enabled by user input"
          elif [[ -n "$INPUT_LOG_ANALYTICS_WORKSPACE_ID" ]] || [[ -n "$INPUT_AI_PROJECT_RESOURCE_ID" ]]; then
            echo "🔧 AUTO-ENABLING EXP: EXP parameter values were provided but EXP was not explicitly enabled."
            echo ""
            echo "You provided values for:"
            [[ -n "$INPUT_LOG_ANALYTICS_WORKSPACE_ID" ]] && echo "  - Azure Log Analytics Workspace ID: '$INPUT_LOG_ANALYTICS_WORKSPACE_ID'"
            [[ -n "$INPUT_AI_PROJECT_RESOURCE_ID" ]] && echo "  - Azure AI Project Resource ID: '$INPUT_AI_PROJECT_RESOURCE_ID'"
            echo ""
            echo "✅ Automatically enabling EXP to use these values."
            EXP_ENABLED="true"
          fi
          
          echo "EXP_ENABLED=$EXP_ENABLED" >> $GITHUB_ENV
          echo "EXP_ENABLED=$EXP_ENABLED" >> $GITHUB_OUTPUT
          echo "Final EXP status: $EXP_ENABLED"

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Login to Azure
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      
      - name: Run Quota Check
        id: quota-check
        env:
          AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          GPT_MIN_CAPACITY: ${{ env.GPT_MIN_CAPACITY }}
          AZURE_REGIONS: ${{ vars.AZURE_REGIONS }}
        run: |
          chmod +x infra/scripts/checkquota.sh
          if ! infra/scripts/checkquota.sh; then
            if grep -q "No region with sufficient quota found" infra/scripts/checkquota.sh; then
              echo "QUOTA_FAILED=true" >> $GITHUB_ENV
            fi
            exit 1
          fi

      - name: Set Quota Failure Output
        id: quota_failure_output
        if: env.QUOTA_FAILED == 'true'
        shell: bash
        run: |
          echo "QUOTA_FAILED=true" >> $GITHUB_OUTPUT
          echo "Quota check failed - will notify via separate notification job"
      
      - name: Fail Pipeline if Quota Check Fails
        if: env.QUOTA_FAILED == 'true'
        shell: bash
        run: exit 1
      
      - name: Set Deployment Region
        id: set_region
        shell: bash
        env:
          INPUT_TRIGGER_TYPE: ${{ inputs.trigger_type }}
          INPUT_AZURE_LOCATION: ${{ inputs.azure_location }}
        run: |
          echo "Selected Region from Quota Check: $VALID_REGION"
          echo "AZURE_ENV_OPENAI_LOCATION=$VALID_REGION" >> $GITHUB_ENV
          echo "AZURE_ENV_OPENAI_LOCATION=$VALID_REGION" >> $GITHUB_OUTPUT
          
          if [[ "$INPUT_TRIGGER_TYPE" == "workflow_dispatch" && -n "$INPUT_AZURE_LOCATION" ]]; then
            USER_SELECTED_LOCATION="$INPUT_AZURE_LOCATION"
            echo "Using user-selected Azure location: $USER_SELECTED_LOCATION"
            echo "AZURE_LOCATION=$USER_SELECTED_LOCATION" >> $GITHUB_ENV
            echo "AZURE_LOCATION=$USER_SELECTED_LOCATION" >> $GITHUB_OUTPUT
          else
            echo "Using location from quota check for automatic triggers: $VALID_REGION"
            echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
            echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_OUTPUT
          fi

      - name: Generate Resource Group Name
        id: generate_rg_name
        shell: bash
        env:
          INPUT_RESOURCE_GROUP_NAME: ${{ inputs.resource_group_name }}
        run: |
          # Check if a resource group name was provided as input
          if [[ -n "$INPUT_RESOURCE_GROUP_NAME" ]]; then
            echo "Using provided Resource Group name: $INPUT_RESOURCE_GROUP_NAME"
            echo "RESOURCE_GROUP_NAME=$INPUT_RESOURCE_GROUP_NAME" >> $GITHUB_ENV
          else
            echo "Generating a unique resource group name..."
            ACCL_NAME="cp"  # Account name as specified
            SHORT_UUID=$(uuidgen | cut -d'-' -f1)
            UNIQUE_RG_NAME="arg-${ACCL_NAME}-${SHORT_UUID}"
            echo "RESOURCE_GROUP_NAME=${UNIQUE_RG_NAME}" >> $GITHUB_ENV
            echo "Generated RESOURCE_GROUP_NAME: ${UNIQUE_RG_NAME}"
          fi

      - name: Install Bicep CLI
        shell: bash
        run: az bicep install

      - name: Check and Create Resource Group
        id: check_create_rg
        shell: bash
        run: |
          set -e  
          echo "🔍 Checking if resource group '$RESOURCE_GROUP_NAME' exists..."
          rg_exists=$(az group exists --name $RESOURCE_GROUP_NAME)
          if [ "$rg_exists" = "false" ]; then
            echo "📦 Resource group does not exist. Creating new resource group '$RESOURCE_GROUP_NAME' in location '$AZURE_LOCATION'..."
            az group create --name $RESOURCE_GROUP_NAME --location $AZURE_LOCATION || { echo "❌ Error creating resource group"; exit 1; }
            echo "✅ Resource group '$RESOURCE_GROUP_NAME' created successfully."
          else
            echo "✅ Resource group '$RESOURCE_GROUP_NAME' already exists. Deploying to existing resource group."
          fi
          echo "RESOURCE_GROUP_NAME=$RESOURCE_GROUP_NAME" >> $GITHUB_OUTPUT
          echo "RESOURCE_GROUP_NAME=$RESOURCE_GROUP_NAME" >> $GITHUB_ENV

      - name: Generate Unique Solution Prefix
        id: generate_solution_prefix
        shell: bash
        run: |
          set -e
          COMMON_PART="psldg"
          TIMESTAMP=$(date +%s)  
          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6) 
          UNIQUE_SOLUTION_PREFIX="${COMMON_PART}${UPDATED_TIMESTAMP}"
          echo "SOLUTION_PREFIX=${UNIQUE_SOLUTION_PREFIX}" >> $GITHUB_ENV
          echo "Generated SOLUTION_PREFIX: ${UNIQUE_SOLUTION_PREFIX}" 

      - name: Determine Docker Image Tag
        id: determine_image_tag
        shell: bash
        run: |
          if [[ "${{ env.BUILD_DOCKER_IMAGE }}" == "true" ]]; then
            if [[ -n "${{ inputs.docker_image_tag }}" ]]; then
              IMAGE_TAG="${{ inputs.docker_image_tag }}"
              echo "🔗 Using Docker image tag from build job: $IMAGE_TAG"
            else
              echo "❌ Docker build job failed or was skipped, but BUILD_DOCKER_IMAGE is true"
              exit 1
            fi
          else
            echo "🏷️ Using existing Docker image based on branch..."
            BRANCH_NAME="${{ env.BRANCH_NAME }}"
            echo "Current branch: $BRANCH_NAME"
            
            if [[ "$BRANCH_NAME" == "main" ]]; then
              IMAGE_TAG="latest"
              echo "Using main branch - image tag: latest"
            elif [[ "$BRANCH_NAME" == "dev" ]]; then
              IMAGE_TAG="dev"
              echo "Using dev branch - image tag: dev"
            elif [[ "$BRANCH_NAME" == "demo" ]]; then
              IMAGE_TAG="demo"
              echo "Using demo branch - image tag: demo"
            elif [[ "$BRANCH_NAME" == "hotfix" ]]; then
              IMAGE_TAG="hotfix"
            elif [[ "$BRANCH_NAME" == "dependabotchanges" ]]; then
              IMAGE_TAG="dependabotchanges"
            else
              IMAGE_TAG="latest"
              echo "Using default for branch '$BRANCH_NAME' - image tag: latest"
            fi
            
            echo "Using existing Docker image tag: $IMAGE_TAG"
          fi
          
          echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_ENV
          echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_OUTPUT

      - name: Generate Unique Environment Name
        id: generate_env_name
        shell: bash
        run: |
          COMMON_PART="pslc"
          TIMESTAMP=$(date +%s)
          UPDATED_TIMESTAMP=$(echo $TIMESTAMP | tail -c 6)
          UNIQUE_ENV_NAME="${COMMON_PART}${UPDATED_TIMESTAMP}"
          echo "ENV_NAME=${UNIQUE_ENV_NAME}" >> $GITHUB_ENV
          echo "Generated Environment Name: ${UNIQUE_ENV_NAME}"
          echo "ENV_NAME=${UNIQUE_ENV_NAME}" >> $GITHUB_OUTPUT

      - name: Display Workflow Configuration to GitHub Summary
        shell: bash
        env:
          INPUT_TRIGGER_TYPE: ${{ inputs.trigger_type }}
          INPUT_RUNNER_OS: ${{ inputs.runner_os }}
          INPUT_AZURE_LOCATION: ${{ inputs.azure_location }}
          INPUT_RESOURCE_GROUP_NAME: ${{ inputs.resource_group_name }}
          EVENT_NAME: ${{ github.event_name }}
          WAF_STATUS: ${{ env.WAF_ENABLED == 'true' && '✅ Yes' || '❌ No' }}
          EXP_STATUS: ${{ steps.configure_exp.outputs.EXP_ENABLED == 'true' && '✅ Yes' || '❌ No' }}
          CLEANUP_STATUS: ${{ env.CLEANUP_RESOURCES == 'true' && '✅ Yes' || '❌ No' }}
          BUILD_DOCKER_STATUS: ${{ env.BUILD_DOCKER_IMAGE == 'true' && '✅ Yes' || '❌ No' }}
        run: |
          echo "## 📋 Workflow Configuration Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Configuration | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|---------------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| **Trigger Type** | \`$EVENT_NAME\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Branch** | \`$BRANCH_NAME\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Runner OS** | \`$INPUT_RUNNER_OS\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **WAF Enabled** | $WAF_STATUS |" >> $GITHUB_STEP_SUMMARY
          echo "| **EXP Enabled** | $EXP_STATUS |" >> $GITHUB_STEP_SUMMARY
          echo "| **Run E2E Tests** | \`$RUN_E2E_TESTS\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Cleanup Resources** | $CLEANUP_STATUS |" >> $GITHUB_STEP_SUMMARY
          echo "| **Build Docker Image** | $BUILD_DOCKER_STATUS |" >> $GITHUB_STEP_SUMMARY
          
          if [[ "$INPUT_TRIGGER_TYPE" == "workflow_dispatch" && -n "$INPUT_AZURE_LOCATION" ]]; then
            echo "| **Azure Location** | \`$INPUT_AZURE_LOCATION\` (User Selected) |" >> $GITHUB_STEP_SUMMARY
          fi
          
          if [[ -n "$INPUT_RESOURCE_GROUP_NAME" ]]; then
            echo "| **Resource Group** | \`$INPUT_RESOURCE_GROUP_NAME\` (Pre-specified) |" >> $GITHUB_STEP_SUMMARY
          else
            echo "| **Resource Group** | \`$RESOURCE_GROUP_NAME\` (Auto-generated) |" >> $GITHUB_STEP_SUMMARY
          fi
          
          echo "" >> $GITHUB_STEP_SUMMARY
          
          if [[ "$INPUT_TRIGGER_TYPE" != "workflow_dispatch" ]]; then
            echo "ℹ️ **Note:** Automatic Trigger - Using Non-WAF + Non-EXP configuration" >> $GITHUB_STEP_SUMMARY
          else
            echo "ℹ️ **Note:** Manual Trigger - Using user-specified configuration" >> $GITHUB_STEP_SUMMARY
          fi

  deploy-linux:
    name: Deploy on Linux
    needs: azure-setup
    if: inputs.runner_os == 'ubuntu-latest' && !cancelled() && needs.azure-setup.result == 'success'
    uses: ./.github/workflows/job-deploy-linux.yml
    with:
      ENV_NAME: ${{ needs.azure-setup.outputs.ENV_NAME }}
      AZURE_ENV_OPENAI_LOCATION: ${{ needs.azure-setup.outputs.AZURE_ENV_OPENAI_LOCATION }}
      AZURE_LOCATION: ${{ needs.azure-setup.outputs.AZURE_LOCATION }}
      RESOURCE_GROUP_NAME: ${{ needs.azure-setup.outputs.RESOURCE_GROUP_NAME }}
      IMAGE_TAG: ${{ needs.azure-setup.outputs.IMAGE_TAG }}
      BUILD_DOCKER_IMAGE: ${{ inputs.build_docker_image || 'false' }}
      EXP: ${{ needs.azure-setup.outputs.EXP_ENABLED }}
      WAF_ENABLED: ${{ inputs.waf_enabled == true && 'true' || 'false' }}
      AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID: ${{ inputs.AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID }}
      AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: ${{ inputs.AZURE_EXISTING_AI_PROJECT_RESOURCE_ID }}
    secrets: inherit

  deploy-windows:
    name: Deploy on Windows
    needs: azure-setup
    if: inputs.runner_os == 'windows-latest' && !cancelled() && needs.azure-setup.result == 'success'
    uses: ./.github/workflows/job-deploy-windows.yml
    with:
      ENV_NAME: ${{ needs.azure-setup.outputs.ENV_NAME }}
      AZURE_ENV_OPENAI_LOCATION: ${{ needs.azure-setup.outputs.AZURE_ENV_OPENAI_LOCATION }}
      AZURE_LOCATION: ${{ needs.azure-setup.outputs.AZURE_LOCATION }}
      RESOURCE_GROUP_NAME: ${{ needs.azure-setup.outputs.RESOURCE_GROUP_NAME }}
      IMAGE_TAG: ${{ needs.azure-setup.outputs.IMAGE_TAG }}
      BUILD_DOCKER_IMAGE: ${{ inputs.build_docker_image || 'false' }}
      EXP: ${{ needs.azure-setup.outputs.EXP_ENABLED }}
      WAF_ENABLED: ${{ inputs.waf_enabled == true && 'true' || 'false' }}
      AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID: ${{ inputs.AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID }}
      AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: ${{ inputs.AZURE_EXISTING_AI_PROJECT_RESOURCE_ID }}
    secrets: inherit