mult-env-workflow.yml

name: Multiple Environment Workflow

on: pull_request

env:
  # The name of the resource group to be created.
  DEV_RG_NAME: "RG-Dev-AppDeploy-Azure-${{ github.event.pull_request.number}}"

  # The location to store the meta data for the deployment.
  DEV_LOCATION: "westeurope"

  # The name of the WebApp
  DEV_WEBAPP_NAME: "DEV-AppDeploy-Azure-${{ github.event.pull_request.number}}"

jobs:
  buildImage:
    name: Build and Push Docker Image
    runs-on: ubuntu-latest

    steps:
    # checkout code
    - name: checkout branch
      uses: actions/checkout@v2

    # log into Azure
    - name: "Login via Azure CLI"
      uses: azure/login@v1
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}

    # authenticate into Docker
    - name: "docker login"
      uses: azure/docker-login@v1
      with:
        login-server: ${{ secrets.DOCKER_LOGIN_SERVER }}
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}

    # Build and push Docker image
    - name: Build and push
      id: docker_build
      uses: docker/build-push-action@v2
      with:
        push: true
        tags: ${{ secrets.DOCKER_LOGIN_SERVER }}/appdeployazure:${{ github.sha }}

    # Scanning Images using Microsoft Defender
    - uses: Azure/container-scan@v0 
      name: Scan image for vulnerabilities
      id: container-scan
      continue-on-error: true
      with:
        image-name: ${{ secrets.DOCKER_LOGIN_SERVER }}/appdeployazure:${{ github.sha }} 

    # Sending logs to AppInsights
    - name: Post logs to appinsights
      uses: Azure/publish-security-assessments@v0
      with: 
        scan-results-path: ${{ steps.container-scan.outputs.scan-report-path }}
        connection-string: ${{ secrets.AZ_APPINSIGHTS_CONNECTION_STRING }}
        subscription-token: ${{ secrets.AZ_SUBSCRIPTION_TOKEN }}

  deploy_container:

    runs-on: ubuntu-latest
    name: Create and Deploy Container to Azure
    needs: buildImage

    env:
      url: https://${{ secrets.DEV_WEBAPP_NAME}}.azurewebsites.net
    
    environment:
      name: Dev
      url: ${{ env.url }}

    steps:
    # checkout code
    - name: checkout branch
      uses: actions/checkout@v2

    # log into Azure
    - name: "Login via Azure CLI"
      uses: azure/login@v1
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}

    # deploy infrastructure with Azure Bicep
    - name: Deploy infrastructure
      id: azure-deployment
      shell: pwsh
      run: |
        $deployment = $(az deployment sub create --name ${{ secrets.DEV_RG_NAME }} `
          --location ${{ secrets.DEV_LOCATION }} `
          --template-file ./main.bicep `
          --parameters location=${{ secrets.DEV_LOCATION }} `
          --parameters rgName=${{ secrets.DEV_RG_NAME }} `
          --parameters webAppName=${{ secrets.DEV_WEBAPP_NAME}} `
          --parameters dockerRegistryHost=${{ secrets.DOCKER_LOGIN_SERVER }} `
          --parameters dockerRegistryServerUsername=${{ secrets.DOCKER_USERNAME }} `
          --parameters dockerRegistryServerPassword=${{ secrets.DOCKER_PASSWORD }} `
          --parameters dockerImage=appdeployazure:${{ github.sha }} `
          --output json) | ConvertFrom-Json
      working-directory: ./infra/bicep

    # Push container image to Azure WebApp
    - name: Setup Container
      id: container-set
      shell: pwsh
      run: |
        $deployment = $(az webapp config container set  --resource-group ${{ secrets.DEV_RG_NAME }} `
          --name ${{ secrets.DEV_WEBAPP_NAME}} `
          --docker-custom-image-name ${{ secrets.DOCKER_LOGIN_SERVER }}/appdeployazure:${{ github.sha }} `
          --docker-registry-server-url https://${{ secrets.DOCKER_LOGIN_SERVER }} `
          --docker-registry-server-user ${{ secrets.DOCKER_USERNAME }} `
          --docker-registry-server-password ${{ secrets.DOCKER_PASSWORD }} `
          --output json) | ConvertFrom-Json
      working-directory: ./infra/bicep
    
 
  deploy_test:
        
    runs-on: ubuntu-latest
    name: Deploy to Test
    needs: deploy_container

    # output URL from deployment
    environment:
      name: test
      url:  ${{ steps.get-webapp-url.outputs.webAppUrl }}
 
    steps:
    # checkout code
    - name: checkout branch
      uses: actions/checkout@v2
    
    # log into Azure
    - name: "Login via Azure CLI"
      uses: azure/login@v1
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}

    # deploy infrastructure with Azure Bicep
    - name: Deploy infrastructure
      id: azure-deployment
      shell: pwsh
      run: |
        $deployment = $(az deployment sub create --name ${{ secrets.TEST_RG_NAME }} `
          --location ${{ secrets.TEST_LOCATION }} `
          --template-file ./main.bicep `
          --parameters location=${{ secrets.TEST_LOCATION }} `
          --parameters rgName=${{ secrets.TEST_RG_NAME }} `
          --parameters webAppName=${{ secrets.TEST_WEBAPP_NAME}} `
          --parameters dockerRegistryHost=${{ secrets.DOCKER_LOGIN_SERVER }} `
          --parameters dockerRegistryServerUsername=${{ secrets.DOCKER_USERNAME }} `
          --parameters dockerRegistryServerPassword=${{ secrets.DOCKER_PASSWORD }} `
          --parameters dockerImage=${{ secrets.DOCKER_LOGIN_SERVER }}/appdeployazure:${{ github.sha }} `
          --output json) | ConvertFrom-Json
      working-directory: ./infra/bicep

    # Push container image to Azure WebApp
    - name: Setup Container
      id: container-set
      shell: pwsh
      run: |
        $deployment = $(az webapp config container set  --resource-group ${{ secrets.TEST_RG_NAME }} `
          --name ${{ secrets.TEST_WEBAPP_NAME}} `
          --docker-custom-image-name ${{ secrets.DOCKER_LOGIN_SERVER }}/appdeployazure:${{ github.sha }} `
          --docker-registry-server-url https://${{ secrets.DOCKER_LOGIN_SERVER }} `
          --docker-registry-server-user ${{ secrets.DOCKER_USERNAME }} `
          --docker-registry-server-password ${{ secrets.DOCKER_PASSWORD }} `
          --output json) | ConvertFrom-Json
      working-directory: ./infra/bicep

    # Get the URL for the Azure WebApp
    - name: Get the Webapp URL
      id: get-webapp-url
      shell: pwsh
      run: |
        $appurl = $(az webapp config hostname list `
          --resource-group ${{ secrets.TEST_RG_NAME }} `
          --webapp-name ${{ secrets.TEST_WEBAPP_NAME }} `
          --output json) | ConvertFrom-Json
        Write-Output "The webapp URL is https://$($appurl.name)"
        Write-Output "::set-output name=webAppUrl::https://$($appurl.name)"
      working-directory: ./infra/bicep


  deploy_staging:
        
    runs-on: ubuntu-latest
    name: Deploy to Staging
    needs: deploy_test

    # output URL from  deployment
    environment:
      name: staging
      url:  ${{ steps.get-webapp-url.outputs.webAppUrl }}
 
    steps:
    # checkout code
    - name: checkout branch
      uses: actions/checkout@v2
    
    # log into Azure
    - name: "Login via Azure CLI"
      uses: azure/login@v1
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}

    # deploy infrastructure with Azure Bicep
    - name: Deploy infrastructure
      id: azure-deployment
      shell: pwsh
      run: |
        $deployment = $(az deployment sub create --name ${{ secrets.STAGING_RG_NAME }} `
          --location ${{ secrets.STAGING_LOCATION }} `
          --template-file ./main.bicep `
          --parameters location=${{ secrets.STAGING_LOCATION }} `
          --parameters rgName=${{ secrets.STAGING_RG_NAME }} `
          --parameters webAppName=${{ secrets.STAGING_WEBAPP_NAME}} `
          --parameters dockerRegistryHost=${{ secrets.DOCKER_LOGIN_SERVER }} `
          --parameters dockerRegistryServerUsername=${{ secrets.DOCKER_USERNAME }} `
          --parameters dockerRegistryServerPassword=${{ secrets.DOCKER_PASSWORD }} `
          --parameters dockerImage=${{ secrets.DOCKER_LOGIN_SERVER }}/appdeployazure:${{ github.sha }} `
          --output json) | ConvertFrom-Json
      working-directory: ./infra/bicep

    # Push container image to Azure WebApp
    - name: Setup Container
      id: container-set
      shell: pwsh
      run: |
        $deployment = $(az webapp config container set  --resource-group ${{ secrets.STAGING_RG_NAME }} `
          --name ${{ secrets.STAGING_WEBAPP_NAME}} `
          --docker-custom-image-name ${{ secrets.DOCKER_LOGIN_SERVER }}/appdeployazure:${{ github.sha }} `
          --docker-registry-server-url https://${{ secrets.DOCKER_LOGIN_SERVER }} `
          --docker-registry-server-user ${{ secrets.DOCKER_USERNAME }} `
          --docker-registry-server-password ${{ secrets.DOCKER_PASSWORD }} `
          --output json) | ConvertFrom-Json
      working-directory: ./infra/bicep

    # Get the URL for the Azure WebApp
    - name: Get the Webapp URL
      id: get-webapp-url
      shell: pwsh
      run: |
        $appurl = $(az webapp config hostname list `
          --resource-group ${{ secrets.STAGING_RG_NAME }} `
          --webapp-name ${{ secrets.STAGING_WEBAPP_NAME }} `
          --output json) | ConvertFrom-Json
        Write-Output "The webapp URL is https://$($appurl.name)"
        Write-Output "::set-output name=webAppUrl::https://$($appurl.name)"
      working-directory: ./infra/bicep

    
  deploy_production:
        
    runs-on: ubuntu-latest
    name: Deploy to Production
    needs: deploy_staging

    # output URL from env deployment
    environment:
      name: Production
      url:  ${{ steps.get-webapp-url.outputs.webAppUrl }}
 
    steps:
    # checkout code
    - name: checkout branch
      uses: actions/checkout@v2
    
    # log into Azure
    - name: "Login via Azure CLI"
      uses: azure/login@v1
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}

    # deploy infrastructure with Azure Bicep
    - name: Deploy infrastructure
      id: azure-deployment
      shell: pwsh
      run: |
        $deployment = $(az deployment sub create --name ${{ secrets.PROD_RG_NAME }} `
          --location ${{ secrets.PROD_LOCATION }} `
          --template-file ./main.bicep `
          --parameters location=${{ secrets.PROD_LOCATION }} `
          --parameters rgName=${{ secrets.PROD_RG_NAME }} `
          --parameters webAppName=${{ secrets.PROD_WEBAPP_NAME}} `
          --parameters dockerRegistryHost=${{ secrets.DOCKER_LOGIN_SERVER }} `
          --parameters dockerRegistryServerUsername=${{ secrets.DOCKER_USERNAME }} `
          --parameters dockerRegistryServerPassword=${{ secrets.DOCKER_PASSWORD }} `
          --parameters dockerImage=${{ secrets.DOCKER_LOGIN_SERVER }}/appdeployazure:${{ github.sha }} `
          --output json) | ConvertFrom-Json
      working-directory: ./infra/bicep

    # Push container image to Azure WebApp
    - name: Setup Container
      id: container-set
      shell: pwsh
      run: |
        $deployment = $(az webapp config container set  --resource-group ${{ secrets.PROD_RG_NAME }} `
          --name ${{ secrets.PROD_WEBAPP_NAME}} `
          --docker-custom-image-name ${{ secrets.DOCKER_LOGIN_SERVER }}/appdeployazure:${{ github.sha }} `
          --docker-registry-server-url https://${{ secrets.DOCKER_LOGIN_SERVER }} `
          --docker-registry-server-user ${{ secrets.DOCKER_USERNAME }} `
          --docker-registry-server-password ${{ secrets.DOCKER_PASSWORD }} `
          --output json) | ConvertFrom-Json
      working-directory: ./infra/bicep

    # Get the URL for the Azure WebApp
    - name: Get the Webapp URL
      id: get-webapp-url
      shell: pwsh
      run: |
        $appurl = $(az webapp config hostname list `
          --resource-group ${{ secrets.PROD_RG_NAME }} `
          --webapp-name ${{ secrets.PROD_WEBAPP_NAME }} `
          --output json) | ConvertFrom-Json
        Write-Output "The webapp URL is https://$($appurl.name)"
        Write-Output "::set-output name=webAppUrl::https://$($appurl.name)"
      working-directory: ./infra/bicep