workflow.yml

name: Build and deploy

on:
  push:
    branches:
      - main

permissions:
  id-token: write

env:
  AZURE_CORE_OUTPUT: none

jobs:
  build:
    environment: production
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Log in to Azure
        uses: Azure/login@v2
        with:
          client-id: ${{ secrets.CLIENT_ID }}
          tenant-id: ${{ secrets.TENANT_ID }}
          allow-no-subscriptions: true

      - name: Docker login to ACR
        run: az acr login --name ${{ secrets.REGISTRY_NAME }}

      - uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            network=host

      - name: Build and push image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ secrets.REGISTRY_NAME }}.azurecr.io/gh-tg-bot/gh-tg-bot:${{ github.sha }}
          cache-from: type=gha,ref=${{ github.ref_name }}
          cache-to: type=gha,mode=max
          allow: |
            network.host
            security.insecure
          network: host
          
      - name: Azure logout
        run: |
          az logout

  deploy:
    runs-on: ubuntu-latest
    environment: production
    needs: build
    steps:
      - uses: actions/checkout@v2
      - name: Log in to Azure
        uses: Azure/login@v2
        with:
          client-id: ${{ secrets.CLIENT_ID }}
          tenant-id: ${{ secrets.TENANT_ID }}
          allow-no-subscriptions: true

      - name: Docker login to ACR
        run: az acr login --name ${{ secrets.REGISTRY_NAME }}

      # Would like to use azure/webapps-deploy but it doesn't seem to work with OIDC.
      - name: Deploy from ACR
        run: |
          az webapp config container set \
            --container-image-name ${{ secrets.REGISTRY_NAME }}.azurecr.io/gh-tg-bot/gh-tg-bot:${{ github.sha }} \
            --container-registry-url https://${{ secrets.REGISTRY_NAME }}.azurecr.io \
            --subscription ${{ secrets.SUBSCRIPTION }} \
            --resource-group prodeko-rg \
            --name gh-tg-bot

      - name: Azure logout
        run: |
          az logout