feat: Updated Git tag handling to be more robust (#1399)

## Description

- Made sure pipeline fails if git tag is not correcly published
- Added post-publishing test that fails if the git tag is not found
- Tested fail state locally as having a git tag rejected isn't exactly
easy to provoke

## Pipeline Reference

<!-- Insert your Pipeline Status Badge below -->

| Pipeline |
| -------- |
| [working
run](https://github.com/AlexanderSehr/bicep-registry-modules/actions/runs/8401389568/job/23009717955)
|

## Type of Change

<!-- Use the check-boxes [x] on the options that are relevant. -->

- [x] Update to CI Environment or utlities (Non-module effecting
changes)
- [ ] Azure Verified Module updates:
- [ ] Bugfix containing backwards compatible bug fixes, and I have NOT
bumped the MAJOR or MINOR version in `version.json`:
- [ ] Someone has opened a bug report issue, and I have included "Closes
#{bug_report_issue_number}" in the PR description.
- [ ] The bug was found by the module author, and no one has opened an
issue to report it yet.
- [ ] Feature update backwards compatible feature updates, and I have
bumped the MINOR version in `version.json`.
- [ ] Breaking changes and I have bumped the MAJOR version in
`version.json`.
  - [ ] Update to documentation

---------

Co-authored-by: Erika Gressi <[email protected]>

.github/actions/templates/avm-publishModule/action.yml

@@ -67,8 +67,10 @@ runs:
           Write-Verbose ($functionInput | ConvertTo-Json | Out-String) -Verbose
 
           if($publishOutputs = Publish-ModuleFromPathToPBR @functionInput -Verbose) {
-            Write-Output ('{0}={1}' -f 'version', $publishOutputs.version) >> $env:GITHUB_OUTPUT
-            Write-Output ('{0}={1}' -f 'publishedModuleName', $publishOutputs.publishedModuleName) >> $env:GITHUB_OUTPUT
+            $publishOutputs.Keys | Foreach-Object {
+              Write-Verbose ('Passing pipeline variable [{0}] with value [{1}]' -f $_, $publishOutputs.$_) -Verbose
+              Write-Output ('{0}={1}' -f $_, $publishOutputs.$_) >> $env:GITHUB_OUTPUT
+            }
           }
 
           Write-Output '::endgroup::'
@@ -88,6 +90,7 @@ runs:
           $functionInput = @{
             Version             = "${{ steps.publish_step.outputs.version }}"
             PublishedModuleName = "${{ steps.publish_step.outputs.publishedModuleName }}"
+            GitTagName          = "${{ steps.publish_step.outputs.gitTagName }}"
           }
 
           Write-Verbose "Invoke function with" -Verbose

avm/utilities/pipelines/publish/Confirm-ModuleIsPublished.ps1

@@ -11,6 +11,9 @@ Mandatory. The version of the module to check for. For example: '0.2.0'
 .PARAMETER PublishedModuleName
 Mandatory. The path of the module to check for. For example: 'avm/res/key-vault/vault'
 
+.PARAMETER GitTagName
+Mandatory. The tag name of the module's git tag to check for. For example: 'avm/res/event-hub/namespace/0.2.0'
+
 .EXAMPLE
 Confirm-ModuleIsPublished -Version '0.2.0' -PublishedModuleName 'avm/res/key-vault/vault' -Verbose
 
@@ -24,7 +27,10 @@ function Confirm-ModuleIsPublished {
         [string] $Version,
 
         [Parameter(Mandatory)]
-        [string] $PublishedModuleName
+        [string] $PublishedModuleName,
+
+        [Parameter(Mandatory)]
+        [string] $GitTagName
     )
 
     $baseUrl = 'https://mcr.microsoft.com/v2'
@@ -36,6 +42,16 @@ function Confirm-ModuleIsPublished {
     $retry_seconds = 60
     $index = 0
 
+    #######################################
+    ##   Confirm module tag is created   ##
+    #######################################
+    $existingTag = git ls-remote --tags origin $GitTagName
+    if (-not $existingTag) {
+        throw "Tag [$GitTagName] was not successfully created. Please review."
+    } else {
+        Write-Verbose "Passed: Found Git tag [$GitTagName]" -Verbose
+    }
+
     #####################################
     ##   Confirm module is published   ##
     #####################################

avm/utilities/pipelines/publish/Publish-ModuleFromPathToPBR.ps1

@@ -61,10 +61,10 @@ function Publish-ModuleFromPathToPBR {
   $publishedModuleName = Get-BRMRepositoryName -TemplateFilePath $TemplateFilePath
 
   # 4.Create release tag
-  $tagName = New-ModuleReleaseTag -ModuleFolderPath $moduleFolderPath -TargetVersion $targetVersion
+  $gitTagName = New-ModuleReleaseTag -ModuleFolderPath $moduleFolderPath -TargetVersion $targetVersion
 
   # 5. Get the documentation link
-  $documentationUri = Get-ModuleReadmeLink -TagName $tagName -ModuleFolderPath $moduleFolderPath
+  $documentationUri = Get-ModuleReadmeLink -TagName $gitTagName -ModuleFolderPath $moduleFolderPath
 
   # 6. Replace telemetry version value (in Bicep)
   $tokenConfiguration = @{
@@ -108,5 +108,6 @@ function Publish-ModuleFromPathToPBR {
   return @{
     version             = $targetVersion
     publishedModuleName = $publishedModuleName
+    gitTagName          = $gitTagName
   }
 }

avm/utilities/pipelines/publish/helper/New-ModuleReleaseTag.ps1

@@ -38,16 +38,16 @@ function New-ModuleReleaseTag {
   $wellFormattedTag = git check-ref-format --normalize $tagName
   if (-not $wellFormattedTag) {
     throw "Tag [$tagName] is not well formatted."
-    # TODO: Handle exception if tag not formatted correctly
   }
 
   # 3 Check tag not already existing
   $existingTag = git ls-remote --tags origin $tagName
   if ($existingTag) {
-    throw "Tag [$tagName] already exists"
-    # TODO: Handle exception if tag already existing
+    Write-Verbose "Tag [$tagName] already exists" -Verbose
+    return $tagName
   }
 
+
   # 3 Create local tag
   Write-Verbose "Creating release tag: [$tagName]" -Verbose
   git tag $tagName
@@ -56,6 +56,10 @@ function New-ModuleReleaseTag {
   Write-Verbose "Publishing release tag: [$tagName]" -Verbose
   git push origin $tagName
 
+  if ($LASTEXITCODE -ne 0) {
+    throw 'Git Tag creation failed. Please review error log.'
+  }
+
   # 5 Return tag
   return $tagName
 }