job-deploy-devcontainer.yml

name: Deploy Steps - DevContainer

# The devcontainer (Dockerfile + features + post-create script) installs everything:
#   Python 3.11, Azure CLI + Bicep, azd, Node.js, Poetry, pip dependencies
# So the workflow simply: builds the container → logs in → runs azd up.

on:
  workflow_call:
    inputs:
      ENV_NAME:
        required: true
        type: string
      AZURE_ENV_OPENAI_LOCATION:
        required: true
        type: string
      AZURE_LOCATION:
        required: true
        type: string
      RESOURCE_GROUP_NAME:
        required: true
        type: string
      IMAGE_TAG:
        required: true
        type: string
      BUILD_DOCKER_IMAGE:
        required: true
        type: string
      EXP:
        required: true
        type: string
      WAF_ENABLED:
        required: false
        type: string
        default: 'false'
      AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID:
        required: false
        type: string
      AZURE_EXISTING_AI_PROJECT_RESOURCE_ID:
        required: false
        type: string
    outputs:
      WEB_APPURL:
        description: "Container Web App URL"
        value: ${{ jobs.deploy-devcontainer.outputs.WEB_APPURL }}

permissions:
  contents: read
  packages: write  # Required to push devcontainer image to GHCR (optional caching)

jobs:
  deploy-devcontainer:
    runs-on: ubuntu-latest
    env:
      AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }}
    outputs:
      WEB_APPURL: ${{ steps.load_azd_outputs.outputs.WEB_APP_URL }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Validate Workflow Input Parameters
        shell: bash
        env:
          INPUT_ENV_NAME: ${{ inputs.ENV_NAME }}
          INPUT_AZURE_ENV_OPENAI_LOCATION: ${{ inputs.AZURE_ENV_OPENAI_LOCATION }}
          INPUT_AZURE_LOCATION: ${{ inputs.AZURE_LOCATION }}
          INPUT_RESOURCE_GROUP_NAME: ${{ inputs.RESOURCE_GROUP_NAME }}
          INPUT_IMAGE_TAG: ${{ inputs.IMAGE_TAG }}
          INPUT_EXP: ${{ inputs.EXP }}
          INPUT_WAF_ENABLED: ${{ inputs.WAF_ENABLED }}
          INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID: ${{ inputs.AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID }}
          INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: ${{ inputs.AZURE_EXISTING_AI_PROJECT_RESOURCE_ID }}
        run: |
          echo "🔍 Validating workflow input parameters..."
          VALIDATION_FAILED=false

          # Validate ENV_NAME (required, alphanumeric and hyphens)
          if [[ -z "$INPUT_ENV_NAME" ]]; then
            echo "❌ ERROR: ENV_NAME is required but not provided"
            VALIDATION_FAILED=true
          elif [[ ! "$INPUT_ENV_NAME" =~ ^[a-zA-Z0-9_-]+$ ]]; then
            echo "❌ ERROR: ENV_NAME '$INPUT_ENV_NAME' is invalid. Must contain only alphanumerics, underscores, and hyphens"
            VALIDATION_FAILED=true
          else
            echo "✅ ENV_NAME: '$INPUT_ENV_NAME' is valid"
          fi

          # Validate AZURE_ENV_OPENAI_LOCATION (required, Azure region format)
          if [[ -z "$INPUT_AZURE_ENV_OPENAI_LOCATION" ]]; then
            echo "❌ ERROR: AZURE_ENV_OPENAI_LOCATION is required but not provided"
            VALIDATION_FAILED=true
          elif [[ ! "$INPUT_AZURE_ENV_OPENAI_LOCATION" =~ ^[a-z0-9]+$ ]]; then
            echo "❌ ERROR: AZURE_ENV_OPENAI_LOCATION '$INPUT_AZURE_ENV_OPENAI_LOCATION' is invalid. Must contain only lowercase letters and numbers"
            VALIDATION_FAILED=true
          else
            echo "✅ AZURE_ENV_OPENAI_LOCATION: '$INPUT_AZURE_ENV_OPENAI_LOCATION' is valid"
          fi

          # Validate AZURE_LOCATION (required, Azure region format)
          if [[ -z "$INPUT_AZURE_LOCATION" ]]; then
            echo "❌ ERROR: AZURE_LOCATION is required but not provided"
            VALIDATION_FAILED=true
          elif [[ ! "$INPUT_AZURE_LOCATION" =~ ^[a-z0-9]+$ ]]; then
            echo "❌ ERROR: AZURE_LOCATION '$INPUT_AZURE_LOCATION' is invalid. Must contain only lowercase letters and numbers"
            VALIDATION_FAILED=true
          else
            echo "✅ AZURE_LOCATION: '$INPUT_AZURE_LOCATION' is valid"
          fi

          # Validate RESOURCE_GROUP_NAME (required, Azure naming convention)
          if [[ -z "$INPUT_RESOURCE_GROUP_NAME" ]]; then
            echo "❌ ERROR: RESOURCE_GROUP_NAME is required but not provided"
            VALIDATION_FAILED=true
          elif [[ ! "$INPUT_RESOURCE_GROUP_NAME" =~ ^[a-zA-Z0-9._\(\)-]+$ ]] || [[ "$INPUT_RESOURCE_GROUP_NAME" =~ \.$ ]]; then
            echo "❌ ERROR: RESOURCE_GROUP_NAME '$INPUT_RESOURCE_GROUP_NAME' is invalid. Must contain only alphanumerics, periods, underscores, hyphens, and parentheses. Cannot end with period."
            VALIDATION_FAILED=true
          elif [[ ${#INPUT_RESOURCE_GROUP_NAME} -gt 90 ]]; then
            echo "❌ ERROR: RESOURCE_GROUP_NAME '$INPUT_RESOURCE_GROUP_NAME' exceeds 90 characters"
            VALIDATION_FAILED=true
          else
            echo "✅ RESOURCE_GROUP_NAME: '$INPUT_RESOURCE_GROUP_NAME' is valid"
          fi

          # Validate IMAGE_TAG (required, Docker tag pattern)
          if [[ -z "$INPUT_IMAGE_TAG" ]]; then
            echo "❌ ERROR: IMAGE_TAG is required but not provided"
            VALIDATION_FAILED=true
          elif [[ ! "$INPUT_IMAGE_TAG" =~ ^[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}$ ]]; then
            echo "❌ ERROR: IMAGE_TAG '$INPUT_IMAGE_TAG' is invalid. Must start with alphanumeric or underscore, contain only alphanumerics, underscores, periods, hyphens, max 128 characters"
            VALIDATION_FAILED=true
          else
            echo "✅ IMAGE_TAG: '$INPUT_IMAGE_TAG' is valid"
          fi

          # Validate EXP (required, boolean string)
          if [[ "$INPUT_EXP" != "true" && "$INPUT_EXP" != "false" ]]; then
            echo "❌ ERROR: EXP must be 'true' or 'false', got: '$INPUT_EXP'"
            VALIDATION_FAILED=true
          else
            echo "✅ EXP: '$INPUT_EXP' is valid"
          fi

          # Validate WAF_ENABLED (boolean string)
          if [[ "$INPUT_WAF_ENABLED" != "true" && "$INPUT_WAF_ENABLED" != "false" ]]; then
            echo "❌ ERROR: WAF_ENABLED must be 'true' or 'false', got: '$INPUT_WAF_ENABLED'"
            VALIDATION_FAILED=true
          else
            echo "✅ WAF_ENABLED: '$INPUT_WAF_ENABLED' is valid"
          fi

          # Validate AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID (optional, Azure Resource ID format)
          if [[ -n "$INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID" ]]; then
            if [[ ! "$INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID" =~ ^/subscriptions/[a-fA-F0-9-]+/[Rr]esource[Gg]roups/[^/]+/providers/[Mm]icrosoft\.[Oo]perational[Ii]nsights/[Ww]orkspaces/[^/]+$ ]]; then
              echo "❌ ERROR: AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID is invalid. Must be a valid Azure Resource ID format:"
              echo "   /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}"
              echo "   Got: '$INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID'"
              VALIDATION_FAILED=true
            else
              echo "✅ AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID: Valid Resource ID format"
            fi
          else
            echo "✅ AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID: Not provided (optional)"
          fi

          # Validate AZURE_EXISTING_AI_PROJECT_RESOURCE_ID (optional, if provided must be valid Resource ID)
          if [[ -n "$INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID" ]]; then
            if [[ ! "$INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID" =~ ^/subscriptions/[a-fA-F0-9-]+/[Rr]esource[Gg]roups/[^/]+/providers/([Mm]icrosoft\.[Mm]achine[Ll]earning[Ss]ervices/([Ww]orkspaces|[Pp]rojects)/[^/]+|[Mm]icrosoft\.[Cc]ognitive[Ss]ervices/[Aa]ccounts/[^/]+/[Pp]rojects/[^/]+)$ ]]; then
              echo "❌ ERROR: AZURE_EXISTING_AI_PROJECT_RESOURCE_ID is invalid. Must be a valid Azure Resource ID format:"
              echo "   /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CognitiveServices/accounts/{accountName}/projects/{projectName}"
              echo "   Got: '$INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID'"
              VALIDATION_FAILED=true
            else
              echo "✅ AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: Valid Resource ID format"
            fi
          else
            echo "✅ AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: Not provided (optional)"
          fi

          # Fail workflow if any validation failed
          if [[ "$VALIDATION_FAILED" == "true" ]]; then
            echo ""
            echo "❌ Parameter validation failed. Please correct the errors above and try again."
            exit 1
          fi

          echo ""
          echo "✅ All input parameters validated successfully!"

      - name: Configure Parameters Based on WAF Setting
        shell: bash
        env:
          WAF_ENABLED: ${{ inputs.WAF_ENABLED }}
        run: |
          if [[ "$WAF_ENABLED" == "true" ]]; then
            cp content-gen/infra/main.waf.parameters.json content-gen/infra/main.parameters.json
            echo "✅ Successfully copied WAF parameters to main parameters file"
          else
            echo "🔧 Configuring Non-WAF deployment - using default main.parameters.json..."
          fi

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set Lowercase Image Name
        id: image_name
        shell: bash
        run: echo "IMAGE_NAME=ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')/devcontainer" >> $GITHUB_ENV

      # Build devcontainer and run azd up inside it
      - name: Deploy with azd up in DevContainer
        uses: devcontainers/ci@v0.3
        env:
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          INPUT_ENV_NAME: ${{ inputs.ENV_NAME }}
          INPUT_AZURE_ENV_OPENAI_LOCATION: ${{ inputs.AZURE_ENV_OPENAI_LOCATION }}
          INPUT_AZURE_LOCATION: ${{ inputs.AZURE_LOCATION }}
          INPUT_RESOURCE_GROUP_NAME: ${{ inputs.RESOURCE_GROUP_NAME }}
          INPUT_IMAGE_TAG: ${{ inputs.IMAGE_TAG }}
          INPUT_BUILD_DOCKER_IMAGE: ${{ inputs.BUILD_DOCKER_IMAGE }}
          INPUT_EXP: ${{ inputs.EXP }}
          INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID: ${{ inputs.AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID }}
          INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: ${{ inputs.AZURE_EXISTING_AI_PROJECT_RESOURCE_ID }}
          SECRET_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID: ${{ secrets.AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID }}
          SECRET_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: ${{ secrets.AZURE_EXISTING_AI_PROJECT_RESOURCE_ID }}
          SECRET_ACR_TEST_USERNAME: ${{ secrets.ACR_TEST_USERNAME }}
        with:
          # Cache the built devcontainer image to GHCR to reuse across runs
          imageName: ${{ env.IMAGE_NAME }}
          cacheFrom: ${{ env.IMAGE_NAME }}
          push: always

          # Explicitly forward env vars into the devcontainer
          env: |
            AZURE_CLIENT_ID
            AZURE_CLIENT_SECRET
            AZURE_TENANT_ID
            AZURE_SUBSCRIPTION_ID
            INPUT_ENV_NAME
            INPUT_AZURE_ENV_OPENAI_LOCATION
            INPUT_AZURE_LOCATION
            INPUT_RESOURCE_GROUP_NAME
            INPUT_IMAGE_TAG
            INPUT_BUILD_DOCKER_IMAGE
            INPUT_EXP
            INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID
            INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID
            SECRET_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID
            SECRET_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID
            SECRET_ACR_TEST_USERNAME

          runCmd: |
            echo "🐳 Running inside devcontainer — same environment as Codespaces"
            echo "Python:     $(python3 --version)"
            echo "Azure CLI:  $(az version --query '"azure-cli"' -o tsv)"
            echo "azd:        $(azd version)"
            echo ""

            set -e

            # 1. Authenticate Azure CLI and azd using client secret
            echo "🔐 Logging in with Azure CLI (client secret)..."
            az login --service-principal -u "$AZURE_CLIENT_ID" -p "$AZURE_CLIENT_SECRET" --tenant "$AZURE_TENANT_ID"
            az account set --subscription "$AZURE_SUBSCRIPTION_ID"

            echo "🔐 Logging in with azd (client secret)..."
            azd auth login \
              --client-id "$AZURE_CLIENT_ID" \
              --client-secret "$AZURE_CLIENT_SECRET" \
              --tenant-id "$AZURE_TENANT_ID"

            # 2. Change to content-gen directory where azure.yaml lives
            cd content-gen

            # Initialize azd environment
            echo "⚙️ Creating azd environment: $INPUT_ENV_NAME"
            azd env new "$INPUT_ENV_NAME" --no-prompt

            echo "Setting default subscription..."
            azd config set defaults.subscription "$AZURE_SUBSCRIPTION_ID"

            # Set core parameters
            azd env set AZURE_SUBSCRIPTION_ID="$AZURE_SUBSCRIPTION_ID"
            azd env set AZURE_ENV_OPENAI_LOCATION="$INPUT_AZURE_ENV_OPENAI_LOCATION"
            azd env set AZURE_LOCATION="$INPUT_AZURE_LOCATION"
            azd env set AZURE_RESOURCE_GROUP="$INPUT_RESOURCE_GROUP_NAME"

            # Set ACR endpoint based on BUILD_DOCKER_IMAGE flag
            if [[ "$INPUT_BUILD_DOCKER_IMAGE" == "true" ]]; then
              ACR_NAME=$(echo "$SECRET_ACR_TEST_USERNAME")
              azd env set ACR_NAME="$ACR_NAME"
              echo "Set ACR name to: $ACR_NAME"
            else
              echo "Skipping ACR name configuration (using existing image)"
            fi

            # Set EXP parameters if enabled
            if [[ "$INPUT_EXP" == "true" ]]; then
              echo "✅ EXP ENABLED - Setting EXP parameters..."

              if [[ -n "$INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID" ]]; then
                EXP_LOG_ANALYTICS_ID="$INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID"
              else
                EXP_LOG_ANALYTICS_ID="$SECRET_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID"
              fi

              if [[ -n "$INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID" ]]; then
                EXP_AI_PROJECT_ID="$INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID"
              else
                EXP_AI_PROJECT_ID="$SECRET_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID"
              fi

              echo "AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID: $EXP_LOG_ANALYTICS_ID"
              echo "AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: $EXP_AI_PROJECT_ID"
              azd env set AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID="$EXP_LOG_ANALYTICS_ID"
              azd env set AZURE_EXISTING_AI_PROJECT_RESOURCE_ID="$EXP_AI_PROJECT_ID"
            else
              echo "❌ EXP DISABLED - Skipping EXP parameters"
              if [[ -n "$INPUT_AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID" ]] || [[ -n "$INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID" ]]; then
                echo "⚠️  Warning: EXP parameter values provided but EXP is disabled. These values will be ignored."
              fi
            fi

            # 3. Deploy using azd up
            echo "🚀 Running azd up..."
            azd up --no-prompt

            # 4. Export azd env values to a file so the host can read them
            echo "📝 Exporting azd environment values..."
            azd env get-values > /tmp/azd-env-values.txt 2>/dev/null || true
            cp /tmp/azd-env-values.txt "$PWD/.azd-env-output" || true

            # Also copy to the workspace root for the host step
            cp /tmp/azd-env-values.txt "$GITHUB_WORKSPACE/.azd-env-output" || true

            echo ""
            echo "✅ Deployment complete!"

      - name: Load azd Environment Outputs
        id: load_azd_outputs
        if: always()
        shell: bash
        run: |
          # Read the azd env values exported from the devcontainer
          AZD_OUTPUT_FILE=""
          if [ -f .azd-env-output ]; then
            AZD_OUTPUT_FILE=".azd-env-output"
          elif [ -f content-gen/.azd-env-output ]; then
            AZD_OUTPUT_FILE="content-gen/.azd-env-output"
          fi

          if [ -n "$AZD_OUTPUT_FILE" ]; then
            echo "📝 Loading azd environment values from $AZD_OUTPUT_FILE..."

            # Parse azd env output (format: KEY="value")
            while IFS= read -r line; do
              key=$(echo "$line" | cut -d'=' -f1)
              value=$(echo "$line" | cut -d'=' -f2- | sed 's/^"//' | sed 's/"$//')
              if [ -n "$key" ] && [ -n "$value" ]; then
                echo "${key}=${value}" >> $GITHUB_ENV
              fi
            done < "$AZD_OUTPUT_FILE"

            echo "✅ Loaded azd environment values"

            # Extract Web App URL for downstream jobs
            WEB_APP_URL=$(grep '^WEB_APP_URL=' "$AZD_OUTPUT_FILE" | cut -d'=' -f2- | sed 's/^"//' | sed 's/"$//')
            echo "WEB_APP_URL=$WEB_APP_URL" >> $GITHUB_OUTPUT
          else
            echo "⚠️ No azd env output file found (.azd-env-output)"
          fi

      - name: Generate Deploy Job Summary
        if: always()
        env:
          RESOURCE_GROUP_NAME: ${{ inputs.RESOURCE_GROUP_NAME }}
          WAF_ENABLED: ${{ inputs.WAF_ENABLED }}
          EXP: ${{ inputs.EXP }}
          AZURE_LOCATION: ${{ inputs.AZURE_LOCATION }}
          AZURE_ENV_OPENAI_LOCATION: ${{ inputs.AZURE_ENV_OPENAI_LOCATION }}
          IMAGE_TAG: ${{ inputs.IMAGE_TAG }}
          JOB_STATUS: ${{ job.status }}
          WEB_APP_URL: ${{ steps.load_azd_outputs.outputs.WEB_APP_URL }}
        run: |
          echo "## 🐳 Deploy Job Summary (DevContainer)" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
          
          if [[ "$JOB_STATUS" == "success" ]]; then
            echo "| **Job Status** | ✅ Success |" >> $GITHUB_STEP_SUMMARY
          else
            echo "| **Job Status** | ❌ Failed |" >> $GITHUB_STEP_SUMMARY
          fi
          
          echo "| **Resource Group** | \`$RESOURCE_GROUP_NAME\` |" >> $GITHUB_STEP_SUMMARY
          
          # Determine configuration type
          if [[ "$WAF_ENABLED" == "true" && "$EXP" == "true" ]]; then
            CONFIG_TYPE="WAF + EXP"
          elif [[ "$WAF_ENABLED" == "true" && "$EXP" != "true" ]]; then
            CONFIG_TYPE="WAF + Non-EXP"
          elif [[ "$WAF_ENABLED" != "true" && "$EXP" == "true" ]]; then
            CONFIG_TYPE="Non-WAF + EXP"
          else
            CONFIG_TYPE="Non-WAF + Non-EXP"
          fi
          echo "| **Configuration Type** | \`$CONFIG_TYPE\` |" >> $GITHUB_STEP_SUMMARY
          
          echo "| **Azure Region (Infrastructure)** | \`$AZURE_LOCATION\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Azure OpenAI Region** | \`$AZURE_ENV_OPENAI_LOCATION\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Docker Image Tag** | \`$IMAGE_TAG\` |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          
          if [[ "$JOB_STATUS" == "success" ]]; then
            echo "### ✅ Deployment Details" >> $GITHUB_STEP_SUMMARY
            echo "- **Web App URL**: [$WEB_APP_URL]($WEB_APP_URL)" >> $GITHUB_STEP_SUMMARY
            echo "- Successfully deployed to Azure using devcontainer with all resources configured" >> $GITHUB_STEP_SUMMARY
          else
            echo "### ❌ Deployment Failed" >> $GITHUB_STEP_SUMMARY
            echo "- Deployment process encountered an error" >> $GITHUB_STEP_SUMMARY
            echo "- Check the deploy job for detailed error information" >> $GITHUB_STEP_SUMMARY
          fi

      - name: Logout from Azure
        if: always()
        shell: bash
        run: |
          az logout || true
          echo "Logged out from Azure."