build.yml

name: Build

on:
  push:
    branches:
    - main
    tags:
    - '*'
    paths-ignore:
    - .vscode/**
    - docs/**
    - README.md
    - LICENSE
    - CHANGELOG.md
    - .github/**
    - '!.github/workflows/build.yml'
    - '**/README.md'
  pull_request:
    branches:
    - main
    paths-ignore:
    - .vscode/**
    - docs/**
    - README.md
    - LICENSE
    - CHANGELOG.md
    - .github/**
    - '!.github/workflows/build.yml'
    - '**/README.md'
  workflow_dispatch:

env:
  DOCKER_BUILDKIT: 1
  AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
  REVIEW_APP_NAME_SUFFIX: ${{ (github.event_name == 'pull_request' && format('-ra{0}', github.event.number)) || '' }}
  HOSTNAME_SUFFIX_FOR_PR: ${{ (github.event_name == 'pull_request' && format('-ra{0}.hst-smpls.falu.io', github.event.number)) || '' }}

jobs:
  Build:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    concurrency:
      group: ${{ github.workflow }}-${{ github.ref }}
      cancel-in-progress: true

    outputs:
      version: ${{ steps.gitversion.outputs.nuGetVersionV2 }}

    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        fetch-depth: 0 # Required for GitVersion

    - name: Install GitVersion
      uses: gittools/actions/gitversion/setup@v2
      with:
        versionSpec: '5.x'

    - name: Determine Version
      uses: gittools/actions/gitversion/execute@v2
      id: gitversion
      with:
        useConfigFile: true

    - name: Replace tokens in deploy folder
      if: ${{ github.actor != 'dependabot[bot]' }}
      uses: qetza/replacetokens-action@v1.2.0
      with:
        sources: |
          deploy/**/*.bicep
          deploy/**/*.parameters.json
        variables: '[${{ toJSON(env) }},${{ toJSON(secrets) }}]' # use env & secrets
        log-level: 'debug'
        if-no-files-found: 'error'
        missing-var-log: 'error'
      env:
        DOCKER_IMAGE_TAG: ${{ steps.gitversion.outputs.nuGetVersionV2 }}

    - name: Publish deploy artifact
      if: ${{ github.actor != 'dependabot[bot]' }}
      uses: actions/upload-artifact@v4
      with:
        path: deploy
        name: deploy
        retention-days: 1

    - name: Pull Docker base images to warm cache
      run: docker compose --file ${{ github.workspace }}/docker-compose.yml pull
      env:
        DOCKER_IMAGE_TAG: 'latest'
      continue-on-error: true # Ignore errors if the image is not found

    - name: Build docker images
      run: >
        docker compose
        --file ${{ github.workspace }}/docker-compose.yml
        build
        --parallel
        --build-arg BUILDKIT_INLINE_CACHE=1
      env:
        DOCKER_IMAGE_TAG: ${{ steps.gitversion.outputs.nuGetVersionV2 }}

    - name: Log into registry
      if: ${{ github.actor != 'dependabot[bot]' }}
      run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login https://ghcr.io -u ${{ github.actor }} --password-stdin

    - name: Push docker images (NuGetVersionV2)
      if: ${{ github.actor != 'dependabot[bot]' }}
      run: docker compose --file ${{ github.workspace }}/docker-compose.yml push
      env:
        DOCKER_IMAGE_TAG: ${{ steps.gitversion.outputs.nuGetVersionV2 }}

    - name: Push docker images (ShortSha)
      if: ${{ github.actor != 'dependabot[bot]' && github.ref == 'refs/heads/main' }}
      run: docker compose --file ${{ github.workspace }}/docker-compose.yml build --push
      env:
        DOCKER_IMAGE_TAG: ${{ steps.gitversion.outputs.shortSha }}

    - name: Push docker images (latest)
      if: ${{ github.actor != 'dependabot[bot]' && github.ref == 'refs/heads/main' }}
      run: docker compose --file ${{ github.workspace }}/docker-compose.yml build --push
      env:
        DOCKER_IMAGE_TAG: 'latest'

  Deploy:
    if: ${{ github.actor != 'dependabot[bot]' }}
    runs-on: ubuntu-latest
    needs: Build
    timeout-minutes: 5

    concurrency:
      group: ${{ github.workflow }}-${{ github.ref }}
      cancel-in-progress: false # cancelling will not stop ARM deployment

    env:
      version: ${{ needs.Build.outputs.version }}

    steps:
    - name: Download Artifact (deploy)
      uses: actions/download-artifact@v4
      with:
        name: deploy
        path: ${{ github.workspace }}/deploy

    - name: Azure Login
      uses: azure/login@v2
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}

    - name: Deploy
      uses: azure/arm-deploy@v2
      with:
        subscriptionId: ${{ env.AZURE_SUBSCRIPTION_ID }}
        resourceGroupName: 'FALU-SAMPLES'
        template: '${{ github.workspace }}/deploy/main.bicep'
        parameters: reviewAppNameSuffix=${{ env.REVIEW_APP_NAME_SUFFIX }}
        deploymentName: ${{ env.version}}
        scope: 'resourcegroup'

    - name: Publish review app URLs
      uses: thollander/actions-comment-pull-request@v2
      if: ${{ github.event_name == 'pull_request' }}
      with:
        message: |
          Deployment of your Review Apps succeeded.

          You can check them out below
          |Application|Url|
          |--|--|
          |Identity (Python)|https://identity-verification${{ env.HOSTNAME_SUFFIX_FOR_PR }}/ping|
        comment_tag: samples