gui-deploy.yml

# CI/CD pipeline for CoPyRIT GUI deployment.
#
# Triggers on changes to GUI-relevant paths on the main branch.
# Builds Docker image, pushes to ACR, deploys to test ACA environment.
# Production deployment is opt-in via the deployToProd parameter.
#
# All infrastructure details (IDs, connection strings, resource names) are
# stored in ADO variable groups — nothing sensitive appears in this file.
# Required variable groups:
#   - copyrit-gui-common  (azureServiceConnection, acrName, acrLoginServer, imageName)
#   - copyrit-gui-test    (resourceGroup, appName, entraTenantId, entraClientId,
#                           allowedGroupObjectIds, sqlServerFqdn, sqlDatabaseName,
#                           keyVaultResourceId, acrResourceId, enablePrivateEndpoint, enableOtel)
#   - copyrit-gui-prod    (same keys as test, with production values)

trigger:
  branches:
    include:
      - main
  paths:
    include:
      - pyrit/backend/**
      - frontend/**
      - docker/**
      - infra/**

pr: none

parameters:
  - name: deployToProd
    displayName: 'Deploy to production'
    type: boolean
    default: false

# Service connection must be a compile-time variable (not from a variable group)
# because azureSubscription is validated during YAML parsing.
variables:
  azureServiceConnection: 'copyrit-gui-azure'

stages:
  # ──────────────────────────────────────────────
  # Stage 0: Validate runtime inputs
  # ──────────────────────────────────────────────
  - stage: ValidateInputs
    displayName: 'Validate Inputs'
    pool:
      vmImage: 'ubuntu-latest'
    jobs:
      - job: ValidateProdBranchGate
        displayName: 'Validate production branch gate'
        steps:
          - checkout: none
          - task: Bash@3
            displayName: 'Fail if prod deploy requested from non-release branch'
            inputs:
              targetType: 'inline'
              script: |
                set -euo pipefail

                DEPLOY_TO_PROD='${{ parameters.deployToProd }}'
                DEPLOY_TO_PROD_LOWER=$(echo "$DEPLOY_TO_PROD" | tr '[:upper:]' '[:lower:]')

                echo "Build.SourceBranch=$BUILD_SOURCEBRANCH"
                echo "deployToProd=$DEPLOY_TO_PROD"

                if [[ "$DEPLOY_TO_PROD_LOWER" == "true" && "$BUILD_SOURCEBRANCH" != refs/heads/releases/* ]]; then
                  echo "##vso[task.logissue type=error]deployToProd can only be used from refs/heads/releases/* branches. Current branch: $BUILD_SOURCEBRANCH"
                  exit 1
                fi

                echo "Validation passed"

  # ──────────────────────────────────────────────
  # Stage 1: Build Docker image and push to ACR
  # ──────────────────────────────────────────────
  - stage: Build
    displayName: 'Build and Push Image'
    dependsOn: ValidateInputs
    variables:
      - group: copyrit-gui-common
    pool:
      vmImage: 'ubuntu-latest'
    jobs:
      - job: BuildAndPush
        displayName: 'Build Docker image and push to ACR'
        steps:
          - checkout: self
            fetchDepth: 1

          - task: AzureCLI@2
            displayName: 'Build and push Docker image'
            inputs:
              azureSubscription: '$(azureServiceConnection)'
              scriptType: 'bash'
              scriptLocation: 'inlineScript'
              inlineScript: |
                set -euo pipefail

                echo "=== Building devcontainer base image ==="
                docker build \
                  -f .devcontainer/Dockerfile \
                  -t pyrit-devcontainer \
                  .devcontainer/

                echo "=== Building production image ==="
                docker build --no-cache \
                  -f docker/Dockerfile \
                  -t $(acrLoginServer)/$(imageName):$(Build.SourceVersion) \
                  -t $(acrLoginServer)/$(imageName):latest \
                  --build-arg BASE_IMAGE=pyrit-devcontainer \
                  --build-arg PYRIT_SOURCE=local \
                  --build-arg GIT_COMMIT=$(Build.SourceVersion) \
                  --build-arg GIT_MODIFIED=false \
                  .

                echo "=== Pushing to ACR ==="
                az acr login --name $(acrName)
                docker push $(acrLoginServer)/$(imageName):$(Build.SourceVersion)
                docker push $(acrLoginServer)/$(imageName):latest

                echo "✅ Image pushed: $(acrLoginServer)/$(imageName):$(Build.SourceVersion)"

  # ──────────────────────────────────────────────
  # Stage 2: Deploy to test environment
  # ──────────────────────────────────────────────
  - stage: DeployTest
    displayName: 'Deploy to Test'
    dependsOn: Build
    variables:
      - group: copyrit-gui-common
      - group: copyrit-gui-test
    pool:
      vmImage: 'ubuntu-latest'
    jobs:
      - deployment: DeployToTest
        displayName: 'Deploy to test environment'
        environment: 'copyrit-test'
        strategy:
          runOnce:
            deploy:
              steps:
                - checkout: self
                  fetchDepth: 1

                - task: AzureCLI@2
                  displayName: 'Deploy Bicep to test'
                  inputs:
                    azureSubscription: '$(azureServiceConnection)'
                    scriptType: 'bash'
                    scriptLocation: 'inlineScript'
                    inlineScript: |
                      set -euo pipefail

                      az deployment group create \
                        --resource-group $(resourceGroup) \
                        --template-file $(Build.SourcesDirectory)/infra/main.bicep \
                        --parameters appName=$(appName) \
                        --parameters containerImage=$(acrLoginServer)/$(imageName):$(Build.SourceVersion) \
                        --parameters entraTenantId=$(entraTenantId) \
                        --parameters entraClientId=$(entraClientId) \
                        --parameters allowedGroupObjectIds="$(allowedGroupObjectIds)" \
                        --parameters sqlServerFqdn=$(sqlServerFqdn) \
                        --parameters sqlDatabaseName=$(sqlDatabaseName) \
                        --parameters keyVaultResourceId=$(keyVaultResourceId) \
                        --parameters acrResourceId=$(acrResourceId) \
                        --parameters enablePrivateEndpoint=$(enablePrivateEndpoint) \
                        --parameters enableOtel=$(enableOtel) \
                        --parameters envSecretName=$(envSecretName)

                - task: AzureCLI@2
                  displayName: 'Health check'
                  inputs:
                    azureSubscription: '$(azureServiceConnection)'
                    scriptType: 'bash'
                    scriptLocation: 'inlineScript'
                    inlineScript: |
                      set -euo pipefail

                      IMAGE="$(acrLoginServer)/$(imageName):$(Build.SourceVersion)"
                      HEALTH=""

                      for i in {1..5}; do
                        HEALTH="$(az containerapp revision list \
                          --resource-group "$(resourceGroup)" \
                          --name "$(appName)" \
                          --query "[?properties.template.containers[0].image=='$IMAGE'] | sort_by(@,&properties.createdTime)[-1].properties.healthState" \
                          -o tsv)"

                        echo "Attempt $i/5 - Image: $IMAGE - Health: ${HEALTH:-<not-found>}"

                        if [[ "$HEALTH" == "Healthy" ]]; then
                          echo "✅ Test environment health check passed"
                          exit 0
                        fi

                        if [[ "$i" -lt 5 ]]; then
                          echo "Revision is not healthy yet. Waiting 2 minutes before retry..."
                          sleep 120
                        fi
                      done

                      echo "❌ Test environment health check failed after 5 attempts"
                      exit 1

  # ──────────────────────────────────────────────
  # Stage 3: Deploy to production (manual trigger)
  # ──────────────────────────────────────────────
  - stage: DeployProd
    displayName: 'Deploy to Production'
    dependsOn: DeployTest
    condition: and(succeeded('DeployTest'), eq('${{ parameters.deployToProd }}', 'true'), startsWith(variables['Build.SourceBranch'], 'refs/heads/releases/'))
    variables:
      - group: copyrit-gui-common
      - group: copyrit-gui-prod
    pool:
      vmImage: 'ubuntu-latest'
    jobs:
      - deployment: DeployToProd
        displayName: 'Deploy to production environment'
        environment: 'copyrit-prod'
        strategy:
          runOnce:
            deploy:
              steps:
                - checkout: self
                  fetchDepth: 1

                - task: AzureCLI@2
                  displayName: 'Deploy Bicep to prod'
                  inputs:
                    azureSubscription: '$(azureServiceConnection)'
                    scriptType: 'bash'
                    scriptLocation: 'inlineScript'
                    inlineScript: |
                      set -euo pipefail

                      az deployment group create \
                        --resource-group $(resourceGroup) \
                        --template-file $(Build.SourcesDirectory)/infra/main.bicep \
                        --parameters appName=$(appName) \
                        --parameters containerImage=$(acrLoginServer)/$(imageName):$(Build.SourceVersion) \
                        --parameters entraTenantId=$(entraTenantId) \
                        --parameters entraClientId=$(entraClientId) \
                        --parameters allowedGroupObjectIds="$(allowedGroupObjectIds)" \
                        --parameters sqlServerFqdn=$(sqlServerFqdn) \
                        --parameters sqlDatabaseName=$(sqlDatabaseName) \
                        --parameters keyVaultResourceId=$(keyVaultResourceId) \
                        --parameters acrResourceId=$(acrResourceId) \
                        --parameters enablePrivateEndpoint=$(enablePrivateEndpoint) \
                        --parameters enableOtel=$(enableOtel) \
                        --parameters envSecretName=$(envSecretName)

                - task: AzureCLI@2
                  displayName: 'Health check'
                  inputs:
                    azureSubscription: '$(azureServiceConnection)'
                    scriptType: 'bash'
                    scriptLocation: 'inlineScript'
                    inlineScript: |
                      set -euo pipefail

                      IMAGE="$(acrLoginServer)/$(imageName):$(Build.SourceVersion)"
                      HEALTH=""

                      for i in {1..5}; do
                        HEALTH="$(az containerapp revision list \
                          --resource-group "$(resourceGroup)" \
                          --name "$(appName)" \
                          --query "[?properties.template.containers[0].image=='$IMAGE'] | sort_by(@,&properties.createdTime)[-1].properties.healthState" \
                          -o tsv)"

                        echo "Attempt $i/5 - Image: $IMAGE - Health: ${HEALTH:-<not-found>}"

                        if [[ "$HEALTH" == "Healthy" ]]; then
                          echo "✅ Production health check passed"
                          exit 0
                        fi

                        if [[ "$i" -lt 5 ]]; then
                          echo "Revision is not healthy yet. Waiting 2 minutes before retry..."
                          sleep 120
                        fi
                      done

                      echo "❌ Production health check failed after 5 attempts"
                      exit 1