job-deploy-linux.yml

name: Deploy Steps - Linux

on:
  workflow_call:
    inputs:
      ENV_NAME:
        required: true
        type: string
      AZURE_ENV_OPENAI_LOCATION:
        required: true
        type: string
      AZURE_LOCATION:
        required: true
        type: string
      RESOURCE_GROUP_NAME:
        required: true
        type: string
      IMAGE_TAG:
        required: true
        type: string
      BUILD_DOCKER_IMAGE:
        required: true
        type: string
      EXP:
        required: true
        type: string
      WAF_ENABLED:
        required: false
        type: string
        default: "false"
      AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID:
        required: false
        type: string
      AZURE_EXISTING_AI_PROJECT_RESOURCE_ID:
        required: false
        type: string
    outputs:
      CONTAINER_WEB_APPURL:
        description: "Container Web App URL"
        value: ${{ jobs.deploy-linux.outputs.CONTAINER_WEB_APPURL }}

jobs:
  deploy-linux:
    runs-on: ubuntu-latest
    environment: production
    env:
      AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }}
    outputs:
      CONTAINER_WEB_APPURL: ${{ steps.get_output_linux.outputs.CONTAINER_WEB_APPURL }}
    steps:
      - name: Validate Workflow Input Parameters
        shell: bash
        env:
          INPUT_ENV_NAME: ${{ inputs.ENV_NAME }}
          INPUT_AZURE_ENV_OPENAI_LOCATION: ${{ inputs.AZURE_ENV_OPENAI_LOCATION }}
          INPUT_AZURE_LOCATION: ${{ inputs.AZURE_LOCATION }}
          INPUT_RESOURCE_GROUP_NAME: ${{ inputs.RESOURCE_GROUP_NAME }}
          INPUT_IMAGE_TAG: ${{ inputs.IMAGE_TAG }}
          INPUT_BUILD_DOCKER_IMAGE: ${{ inputs.BUILD_DOCKER_IMAGE }}
          INPUT_EXP: ${{ inputs.EXP }}
          INPUT_WAF_ENABLED: ${{ inputs.WAF_ENABLED }}
          INPUT_AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID: ${{ inputs.AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID }}
          INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: ${{ inputs.AZURE_EXISTING_AI_PROJECT_RESOURCE_ID }}
        run: |
          echo "🔍 Validating workflow input parameters..."
          VALIDATION_FAILED=false

          # Validate ENV_NAME (required, alphanumeric and hyphens)
          if [[ -z "$INPUT_ENV_NAME" ]]; then
            echo "❌ ERROR: ENV_NAME is required but not provided"
            VALIDATION_FAILED=true
          elif [[ ! "$INPUT_ENV_NAME" =~ ^[a-zA-Z0-9-]+$ ]]; then
            echo "❌ ERROR: ENV_NAME '$INPUT_ENV_NAME' is invalid. Must contain only alphanumerics and hyphens"
            VALIDATION_FAILED=true
          else
            echo "✅ ENV_NAME: '$INPUT_ENV_NAME' is valid"
          fi

          # Validate AZURE_ENV_OPENAI_LOCATION (required, Azure region format)
          if [[ -z "$INPUT_AZURE_ENV_OPENAI_LOCATION" ]]; then
            echo "❌ ERROR: AZURE_ENV_OPENAI_LOCATION is required but not provided"
            VALIDATION_FAILED=true
          elif [[ ! "$INPUT_AZURE_ENV_OPENAI_LOCATION" =~ ^[a-z0-9]+$ ]]; then
            echo "❌ ERROR: AZURE_ENV_OPENAI_LOCATION '$INPUT_AZURE_ENV_OPENAI_LOCATION' is invalid. Must contain only lowercase letters and numbers"
            VALIDATION_FAILED=true
          else
            echo "✅ AZURE_ENV_OPENAI_LOCATION: '$INPUT_AZURE_ENV_OPENAI_LOCATION' is valid"
          fi

          # Validate AZURE_LOCATION (required, Azure region format)
          if [[ -z "$INPUT_AZURE_LOCATION" ]]; then
            echo "❌ ERROR: AZURE_LOCATION is required but not provided"
            VALIDATION_FAILED=true
          elif [[ ! "$INPUT_AZURE_LOCATION" =~ ^[a-z0-9]+$ ]]; then
            echo "❌ ERROR: AZURE_LOCATION '$INPUT_AZURE_LOCATION' is invalid. Must contain only lowercase letters and numbers"
            VALIDATION_FAILED=true
          else
            echo "✅ AZURE_LOCATION: '$INPUT_AZURE_LOCATION' is valid"
          fi

          # Validate RESOURCE_GROUP_NAME (required, Azure naming convention)
          if [[ -z "$INPUT_RESOURCE_GROUP_NAME" ]]; then
            echo "❌ ERROR: RESOURCE_GROUP_NAME is required but not provided"
            VALIDATION_FAILED=true
          elif [[ ! "$INPUT_RESOURCE_GROUP_NAME" =~ ^[a-zA-Z0-9._\(\)-]+$ ]] || [[ "$INPUT_RESOURCE_GROUP_NAME" =~ \.$ ]]; then
            echo "❌ ERROR: RESOURCE_GROUP_NAME '$INPUT_RESOURCE_GROUP_NAME' is invalid. Must contain only alphanumerics, periods, underscores, hyphens, and parentheses. Cannot end with period."
            VALIDATION_FAILED=true
          elif [[ ${#INPUT_RESOURCE_GROUP_NAME} -gt 90 ]]; then
            echo "❌ ERROR: RESOURCE_GROUP_NAME '$INPUT_RESOURCE_GROUP_NAME' exceeds 90 characters"
            VALIDATION_FAILED=true
          else
            echo "✅ RESOURCE_GROUP_NAME: '$INPUT_RESOURCE_GROUP_NAME' is valid"
          fi

          # Validate IMAGE_TAG (required, Docker tag pattern)
          if [[ -z "$INPUT_IMAGE_TAG" ]]; then
            echo "❌ ERROR: IMAGE_TAG is required but not provided"
            VALIDATION_FAILED=true
          elif [[ ! "$INPUT_IMAGE_TAG" =~ ^[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}$ ]]; then
            echo "❌ ERROR: IMAGE_TAG '$INPUT_IMAGE_TAG' is invalid. Must start with alphanumeric or underscore, max 128 characters"
            VALIDATION_FAILED=true
          else
            echo "✅ IMAGE_TAG: '$INPUT_IMAGE_TAG' is valid"
          fi

          # Validate BUILD_DOCKER_IMAGE (required, must be 'true' or 'false')
          if [[ "$INPUT_BUILD_DOCKER_IMAGE" != "true" && "$INPUT_BUILD_DOCKER_IMAGE" != "false" ]]; then
            echo "❌ ERROR: BUILD_DOCKER_IMAGE must be 'true' or 'false', got: '$INPUT_BUILD_DOCKER_IMAGE'"
            VALIDATION_FAILED=true
          else
            echo "✅ BUILD_DOCKER_IMAGE: '$INPUT_BUILD_DOCKER_IMAGE' is valid"
          fi

          # Validate EXP (required, must be 'true' or 'false')
          if [[ "$INPUT_EXP" != "true" && "$INPUT_EXP" != "false" ]]; then
            echo "❌ ERROR: EXP must be 'true' or 'false', got: '$INPUT_EXP'"
            VALIDATION_FAILED=true
          else
            echo "✅ EXP: '$INPUT_EXP' is valid"
          fi

          # Validate WAF_ENABLED (must be 'true' or 'false')
          if [[ "$INPUT_WAF_ENABLED" != "true" && "$INPUT_WAF_ENABLED" != "false" ]]; then
            echo "❌ ERROR: WAF_ENABLED must be 'true' or 'false', got: '$INPUT_WAF_ENABLED'"
            VALIDATION_FAILED=true
          else
            echo "✅ WAF_ENABLED: '$INPUT_WAF_ENABLED' is valid"
          fi

          # Validate AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID (optional, if provided must be valid Resource ID)
          if [[ -n "$INPUT_AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID" ]]; then
            if [[ ! "$INPUT_AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID" =~ ^/subscriptions/[a-fA-F0-9-]+/[Rr]esource[Gg]roups/[^/]+/providers/[Mm]icrosoft\.[Oo]perational[Ii]nsights/[Ww]orkspaces/[^/]+$ ]]; then
              echo "❌ ERROR: AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID is invalid. Must be a valid Azure Resource ID format:"
              echo "   /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}"
              echo "   Got: '$INPUT_AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID'"
              VALIDATION_FAILED=true
            else
              echo "✅ AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID: Valid Resource ID format"
            fi
          fi

          # Validate AZURE_EXISTING_AI_PROJECT_RESOURCE_ID (optional, if provided must be valid Resource ID)
          if [[ -n "$INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID" ]]; then
            if [[ ! "$INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID" =~ ^/subscriptions/[a-fA-F0-9-]+/[Rr]esource[Gg]roups/[^/]+/providers/([Mm]icrosoft\.[Mm]achine[Ll]earning[Ss]ervices/([Ww]orkspaces|[Pp]rojects)/[^/]+|[Mm]icrosoft\.[Cc]ognitive[Ss]ervices/[Aa]ccounts/[^/]+/[Pp]rojects/[^/]+)$ ]]; then
              echo "❌ ERROR: AZURE_EXISTING_AI_PROJECT_RESOURCE_ID is invalid. Must be a valid Azure Resource ID format:"
              echo "   /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CognitiveServices/accounts/{accountName}/projects/{projectName}"
              echo "   Got: '$INPUT_AZURE_EXISTING_AI_PROJECT_RESOURCE_ID'"
              VALIDATION_FAILED=true
            else
              echo "✅ AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: Valid Resource ID format"
            fi
          fi

          # Fail workflow if any validation failed
          if [[ "$VALIDATION_FAILED" == "true" ]]; then
            echo ""
            echo "❌ Parameter validation failed. Please correct the errors above and try again."
            exit 1
          fi

          echo ""
          echo "✅ All input parameters validated successfully!"

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Configure Parameters Based on WAF Setting
        shell: bash
        env:
          WAF_ENABLED: ${{ inputs.WAF_ENABLED }}
        run: |
          if [[ "$WAF_ENABLED" == "true" ]]; then
            cp infra/main.waf.parameters.json infra/main.parameters.json
            echo "✅ Successfully copied WAF parameters to main parameters file"
          else
            echo "🔧 Configuring Non-WAF deployment - using default main.parameters.json..."
          fi

      - name: Install azd
        uses: Azure/setup-azd@v2

      - name: Login to Azure
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Login to AZD
        id: login-azure
        shell: bash
        run: |
          azd auth login --client-id ${{ secrets.AZURE_CLIENT_ID }} --federated-credential-provider "github" --tenant-id ${{ secrets.AZURE_TENANT_ID }}

      - name: Deploy using azd up and extract values (Linux)
        id: get_output_linux
        shell: bash
        env:
          ENV_NAME: ${{ inputs.ENV_NAME }}
          AZURE_ENV_OPENAI_LOCATION: ${{ inputs.AZURE_ENV_OPENAI_LOCATION }}
          AZURE_LOCATION: ${{ inputs.AZURE_LOCATION }}
          RESOURCE_GROUP_NAME: ${{ inputs.RESOURCE_GROUP_NAME }}
          IMAGE_TAG: ${{ inputs.IMAGE_TAG }}
          BUILD_DOCKER_IMAGE: ${{ inputs.BUILD_DOCKER_IMAGE }}
          EXP: ${{ inputs.EXP }}
          AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID: ${{ inputs.AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID }}
          AZURE_EXISTING_AI_PROJECT_RESOURCE_ID: ${{ inputs.AZURE_EXISTING_AI_PROJECT_RESOURCE_ID }}
        run: |
          set -e          
          echo "Starting azd deployment..."
          echo "EXP: $EXP"
          echo "Using Docker Image Tag: $IMAGE_TAG"

          # Generate current timestamp in desired format: YYYY-MM-DDTHH:MM:SS.SSSSSSSZ
          current_date=$(date -u +"%Y-%m-%dT%H:%M:%S.%7NZ")

          echo "Creating environment..."
          azd env new $ENV_NAME --no-prompt
          echo "Environment created: $ENV_NAME"

          echo "Setting default subscription..."
          azd config set defaults.subscription ${{ secrets.AZURE_SUBSCRIPTION_ID }}

          # Set additional parameters
          azd env set AZURE_SUBSCRIPTION_ID="${{ secrets.AZURE_SUBSCRIPTION_ID }}"
          azd env set AZURE_ENV_AI_SERVICE_LOCATION="$AZURE_ENV_OPENAI_LOCATION"
          azd env set AZURE_LOCATION="$AZURE_LOCATION"
          azd env set AZURE_RESOURCE_GROUP="$RESOURCE_GROUP_NAME"
          azd env set AZURE_ENV_IMAGETAG="$IMAGE_TAG"

          if [[ "$BUILD_DOCKER_IMAGE" == "true" ]]; then
            ACR_NAME=$(echo "${{ secrets.ACR_TEST_LOGIN_SERVER }}")
            azd env set AZURE_ENV_CONTAINER_REGISTRY_ENDPOINT="$ACR_NAME"
            echo "Set ACR name to: $ACR_NAME"
          else
            echo "Skipping ACR name configuration (using existing image)"
          fi

          if [[ "$EXP" == "true" ]]; then
            echo "✅ EXP ENABLED - Setting EXP parameters..."
            
            if [[ -n "$AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID" ]]; then
              EXP_LOG_ANALYTICS_ID="$AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID"
            else
              EXP_LOG_ANALYTICS_ID="${{ secrets.AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID }}"
            fi
            
            if [[ -n "$AZURE_EXISTING_AI_PROJECT_RESOURCE_ID" ]]; then
              EXP_AI_PROJECT_ID="$AZURE_EXISTING_AI_PROJECT_RESOURCE_ID"
            else
              EXP_AI_PROJECT_ID="${{ secrets.AZURE_ENV_FOUNDRY_PROJECT_ID }}"
            fi
            
            echo "AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID: $EXP_LOG_ANALYTICS_ID"
            echo "AZURE_EXISTING_AIPROJECT_RESOURCE_ID: $EXP_AI_PROJECT_ID"
            azd env set AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID="$EXP_LOG_ANALYTICS_ID"
            azd env set AZURE_EXISTING_AIPROJECT_RESOURCE_ID="$EXP_AI_PROJECT_ID"
          else
            echo "❌ EXP DISABLED - Skipping EXP parameters"
          fi

          azd up --no-prompt

          echo "✅ Deployment succeeded."
          echo "$DEPLOY_OUTPUT"

          echo "Extracting deployment outputs..."
          DEPLOY_OUTPUT=$(azd env get-values --output json)
          echo "Deployment output: $DEPLOY_OUTPUT"

          if [[ -z "$DEPLOY_OUTPUT" ]]; then
            echo "Error: Deployment output is empty. Please check the deployment logs."
            exit 1
          fi

          CONTAINER_API_APPURL="https://$(echo "$DEPLOY_OUTPUT" | jq -r '.CONTAINER_API_APP_FQDN // empty')"
          echo "CONTAINER_API_APPURL=$CONTAINER_API_APPURL" >> $GITHUB_ENV

          CONTAINER_API_APPNAME=$(echo "$DEPLOY_OUTPUT" | jq -r '.CONTAINER_API_APP_NAME // empty')
          echo "CONTAINER_API_APPNAME=$CONTAINER_API_APPNAME" >> $GITHUB_ENV

          CONTAINER_WEB_APPURL="https://$(echo "$DEPLOY_OUTPUT" | jq -r '.CONTAINER_WEB_APP_FQDN // empty')"
          echo "CONTAINER_WEB_APPURL=$CONTAINER_WEB_APPURL" >> $GITHUB_ENV
          echo "CONTAINER_WEB_APPURL=$CONTAINER_WEB_APPURL" >> $GITHUB_OUTPUT

          CONTAINER_WEB_APPNAME=$(echo "$DEPLOY_OUTPUT" | jq -r '.CONTAINER_WEB_APP_NAME // empty')
          echo "CONTAINER_WEB_APPNAME=$CONTAINER_WEB_APPNAME" >> $GITHUB_ENV

      - name: Disable Auth in Web App
        shell: bash
        env:
          RESOURCE_GROUP_NAME: ${{ inputs.RESOURCE_GROUP_NAME }}
        run: |
          az containerapp update --name ${{ env.CONTAINER_WEB_APPNAME }} \
            --resource-group $RESOURCE_GROUP_NAME \
            --set-env-vars APP_AUTH_ENABLED=false

      - name: Disable Auth in API App
        shell: bash
        env:
          RESOURCE_GROUP_NAME: ${{ inputs.RESOURCE_GROUP_NAME }}
        run: |
          sleep 30
          az containerapp update --name ${{ env.CONTAINER_API_APPNAME }} \
            --resource-group $RESOURCE_GROUP_NAME \
            --set-env-vars APP_AUTH_ENABLED=false

      - name: Generate Deployment Summary
        if: always()
        shell: bash
        env:
          RESOURCE_GROUP_NAME: ${{ inputs.RESOURCE_GROUP_NAME }}
          WAF_ENABLED: ${{ inputs.WAF_ENABLED }}
          EXP: ${{ inputs.EXP }}
          AZURE_LOCATION: ${{ inputs.AZURE_LOCATION }}
          AZURE_ENV_OPENAI_LOCATION: ${{ inputs.AZURE_ENV_OPENAI_LOCATION }}
          IMAGE_TAG: ${{ inputs.IMAGE_TAG }}
          CONFIG_TYPE: ${{ inputs.WAF_ENABLED == 'true' && inputs.EXP == 'true' && 'WAF + EXP' || inputs.WAF_ENABLED == 'true' && inputs.EXP != 'true' && 'WAF + Non-EXP' || inputs.WAF_ENABLED != 'true' && inputs.EXP == 'true' && 'Non-WAF + EXP' || 'Non-WAF + Non-EXP' }}
        run: |
          echo "## 🚀 Deploy Job Summary (Linux)" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| **Job Status** | ${{ job.status == 'success' && '✅ Success' || '❌ Failed' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| **Resource Group** | \`$RESOURCE_GROUP_NAME\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Configuration Type** | \`$CONFIG_TYPE\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Azure Region (Infrastructure)** | \`$AZURE_LOCATION\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Azure OpenAI Region** | \`$AZURE_ENV_OPENAI_LOCATION\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Docker Image Tag** | \`$IMAGE_TAG\` |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          if [[ "${{ job.status }}" == "success" ]]; then
            echo "### ✅ Deployment Details" >> $GITHUB_STEP_SUMMARY
            echo "- **Container Web App URL**: [${{ env.CONTAINER_WEB_APPURL }}](${{ env.CONTAINER_WEB_APPURL }})" >> $GITHUB_STEP_SUMMARY
            echo "- **Container API App URL**: [${{ env.CONTAINER_API_APPURL }}](${{ env.CONTAINER_API_APPURL }})" >> $GITHUB_STEP_SUMMARY
            echo "- Successfully deployed to Azure with all resources configured" >> $GITHUB_STEP_SUMMARY
            echo "- Schemas registered and sample data uploaded successfully" >> $GITHUB_STEP_SUMMARY
          else
            echo "### ❌ Deployment Failed" >> $GITHUB_STEP_SUMMARY
            echo "- Deployment process encountered an error" >> $GITHUB_STEP_SUMMARY
            echo "- Check the deployment steps above for detailed error information" >> $GITHUB_STEP_SUMMARY
          fi

      - name: Logout from Azure
        if: always()
        shell: bash
        run: |
          az logout || true
          echo "Logged out from Azure."