Skip to content

feat: updates to fix Region name now being appended to azFw policy name #914 #1584

feat: updates to fix Region name now being appended to azFw policy name #914

feat: updates to fix Region name now being appended to azFw policy name #914 #1584

name: Unit Tests - Bicep Files and Modules
on:
pull_request:
branches:
- main
paths:
- "**.bicep"
- "ps-rule.yaml"
- ".ps-rule/*"
- "**/bicepconfig.json"
workflow_dispatch: {}
permissions:
contents: read
jobs:
bicep_unit_tests:
name: Bicep Build & Lint All Modules
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit
- name: Checkout Repo
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
- name: List Currently Installed Bicep Version
shell: pwsh
run: |
$bicepVersion = bicep --version
Write-Information "=====> Currently installed Bicep version is: $bicepVersion <=====" -InformationAction Continue
- name: Install latest version of Bicep
shell: sh
run: |
# From https://docs.microsoft.com/en-us/azure/azure-resource-manager/bicep/install#linux
# Fetch the latest Bicep CLI binary
curl -Lo bicep https://github.com/Azure/bicep/releases/latest/download/bicep-linux-x64
# Mark it as executable
chmod +x ./bicep
# Add bicep to your PATH (requires admin)
sudo mv ./bicep /usr/local/bin/bicep
# Verify you can now access the 'bicep' command
bicep --help
# Done!
- name: List Now Installed Bicep Version
shell: pwsh
run: |
$bicepVersion = bicep --version
Write-Information "=====> Now installed Bicep version is: $bicepVersion <=====" -InformationAction Continue
- name: Bicep Build & Lint All Modules
shell: pwsh
run: |
$output = @()
Get-ChildItem -Recurse -Filter '*.bicep' -Exclude 'callModuleFromACR.example.bicep','orchHubSpoke.bicep' | ForEach-Object {
Write-Information "==> Attempting Bicep Build For File: $_" -InformationAction Continue
$bicepOutput = bicep build $_.FullName 2>&1
if ($LastExitCode -ne 0)
{
foreach ($item in $bicepOutput) {
$output += "$($item) `r`n"
}
}
Else
{
echo "Bicep Build Successful for File: $_"
}
}
if ($output.length -gt 0) {
throw $output
}
- name: List Azure Resource Types
shell: pwsh
run: |
function Add-ToResourceTypesList {
param (
[Parameter(Mandatory = $true)]
[string] $Type
)
if (!$resourceTypesFullList.ContainsKey($Type)) {
$resourceTypesFullList.Add($Type, 1)
}
else {
$resourceTypesFullList[$Type] += 1
}
}
$resourceTypesFullList = @{}
Get-ChildItem -Path '.\infra-as-code\bicep\modules' -Recurse -Filter '*.json' -Exclude 'callModuleFromACR.example.json', 'orchHubSpoke.json', '*parameters*.json', 'bicepconfig.json', '*policy_*.json' | ForEach-Object {
Write-Information "==> Reading Built ARM Template JSON File: $_" -InformationAction Continue
$armTemplate = Get-Content $_.FullName | ConvertFrom-Json -Depth 100
$armResourceTypes = $armTemplate.Resources
$armResourceTypes | ForEach-Object {
if ($null -eq $_.Type) {
$_.PSObject.Properties | ForEach-Object {
Add-ToResourceTypesList -Type $_.Value.Type
}
}
else {
Add-ToResourceTypesList -Type $_.Type
}
}
}
Write-Information "==> Remove nested deployments resource type" -InformationAction Continue
$resourceTypesFullList.Remove('Microsoft.Resources/Deployments')
Write-Information "***** List of resource types in ALZ-Bicep modules *****" -InformationAction Continue
$resourceTypesFullList.Keys | Sort-Object
azure_waf:
name: Test Azure Well-Architected Framework (PSRule)
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit
- name: Checkout Repo
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
# Add pipeline tests for Azure Well-Architected Framework.
# See https://aka.ms/ps-rule-action for configuration options.
- name: Run PSRule analysis
uses: Microsoft/ps-rule@46451b8f5258c41beb5ae69ed7190ccbba84112c # v2.9.0
with:
modules: PSRule.Rules.Azure
baseline: Azure.Preview
continue-on-error: true