azure-deploy-prod.yml

name: 'App Deploy [Azure - PROD]'

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Create release version ("vx.x.x")'
        type: string
        required: true
      ref:
        description: 'Release candidate to deploy ("rcx.x.x")'
        type: string
        required: true

# Permissions for OIDC authentication
permissions:
  id-token: write
  contents: write
  packages: write

env:
  ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
  ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
  ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
  DOCKER_IMAGE: ghcr.io/dfe-digital/early-years-foundation-recovery

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    environment: production

    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref || github.ref_name }}

      # Tag the branch with the release version
      - name: Tag Version
        if: ${{ inputs.version }}
        run: |
          git tag --force ${{ inputs.version }}
          git push --force origin refs/tags/${{ inputs.version }}
          echo "HEAD=$(git rev-parse ${{ inputs.version }})" >> $GITHUB_ENV

      # Create and boot Docker image builder
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: v0.9.1

      # Login to the container registry
      - name: Login to Github Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Build and push image
      - name: Build and push Docker Image
        uses: docker/build-push-action@v6
        with:
          target: app
          context: .
          push: true
          build-args: |
            BUILDKIT_INLINE_CACHE=1
            SHA=${{ github.sha }}
          cache-from: |
            ${{ env.DOCKER_IMAGE }}:${{ github.sha }}
            ${{ env.DOCKER_IMAGE }}:${{ inputs.ref || github.ref_name }}
          tags: |
            ${{ env.DOCKER_IMAGE }}:${{ github.sha }}
            ${{ env.DOCKER_IMAGE }}:${{ inputs.version || github.ref_name }}

      # Login to Azure using OIDC
      - name: Login to Azure CLI
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      # Deploy Web Application
      - name: Deploy to Azure App Services
        uses: azure/webapps-deploy@v2
        with:
          app-name: ${{ vars.WEBAPP_NAME }}
          images: ${{ env.DOCKER_IMAGE }}:${{ inputs.version || github.ref_name }}
          slot-name: ${{ vars.WEBAPP_DEPLOY_SLOT }}

      # Destroy Background Worker
      - name: Destroy existing Azure Container Instances
        uses: azure/CLI@v2
        with:
          azcliversion: 2.50.0
          inlineScript: |
            az container delete --resource-group ${{ secrets.AZURE_RESOURCE_GROUP }} \
              --name ${{ vars.WORKERAPP_NAME }} \
              --yes

      # Deploy Background Worker
      - name: Deploy to Azure Container Instances
        uses: azure/CLI@v2
        with:
          azcliversion: 2.50.0
          inlineScript: |
            az container create --resource-group ${{ secrets.AZURE_RESOURCE_GROUP }} \
              --name ${{ vars.WORKERAPP_NAME }} \
              --image ${{ env.DOCKER_IMAGE }}:${{ inputs.version || github.ref_name }} \
              --cpu 2 \
              --memory 2 \
              --command-line "que" \
              --restart-policy OnFailure \
              --log-analytics-workspace ${{ secrets.AZURE_LOG_ANALYTICS_WORKSPACE }} \
              --vnet ${{ secrets.AZURE_VNET }} \
              --subnet ${{ secrets.AZURE_WORKER_APP_SUBNET }} \
              --ip-address Private \
              --output none \
              --environment-variables \
                EDITOR=vi \
                RAILS_ENV=production \
                RAILS_LOG_TO_STDOUT=true \
                ENVIRONMENT=${{ vars.ENVIRONMENT }} \
                DOMAIN=${{ vars.WEBAPP_CONFIG_DOMAIN }} \
                GOOGLE_CLOUD_BUCKET=${{ vars.WEBAPP_CONFIG_GOOGLE_CLOUD_BUCKET }} \
                RAILS_MASTER_KEY=${{ secrets.WEBAPP_CONFIG_RAILS_MASTER_KEY }} \
                DATABASE_URL=${{ secrets.WEBAPP_DATABASE_URL }} \
                GCS_CREDENTIALS=${{ secrets.GCS_CREDENTIALS }} \
                SENTRY_TOKEN=${{ secrets.SENTRY_TOKEN }}