feat: Implemented post-deployment validation

.github/actions/templates/avm-publishModule/action.yml

@@ -46,6 +46,7 @@ runs:
         bicep --version
 
     - name: "Publish module to public bicep registry"
+      id: publish_step
       uses: azure/powershell@v1
       with:
         azPSVersion: "latest"
@@ -68,8 +69,33 @@ runs:
           Write-Verbose ($functionInput | ConvertTo-Json | Out-String) -Verbose
 
           # Get the modified child resources
-          Publish-ModuleFromPathToPBR @functionInput -Verbose
+          if($publishOutputs = Publish-ModuleFromPathToPBR @functionInput -Verbose) {
+            Write-Output ('{0}={1}' -f 'version', $publishOutputs.version) >> $env:GITHUB_OUTPUT
+            Write-Output ('{0}={1}' -f 'publishedModuleName', $publishOutputs.publishedModuleName) >> $env:GITHUB_OUTPUT
+          }
 
           Write-Output '::endgroup::'
 
-        # TODO Add publish validation (as per PBR pipeline template 'publish-module.yml')
+    - name: "Validate publish"
+      uses: azure/powershell@v1
+      if: ${{ steps.publish_step.outputs.version != '' && steps.publish_step.outputs.publishedModuleName != '' }}
+      with:
+        azPSVersion: "latest"
+        inlineScript: |
+          # Grouping task logs
+          Write-Output '::group::Validate publish'
+
+          # Load used functions
+          . (Join-Path $env:GITHUB_WORKSPACE 'avm' 'utilities' 'pipelines'  'publish' 'Confirm-ModuleIsPublished.ps1')
+
+          $functionInput = @{
+            Version             = "${{ steps.publish_step.outputs.version }}"
+            PublishedModuleName = "${{ steps.publish_step.outputs.publishedModuleName }}"
+          }
+
+          Write-Verbose "Invoke function with" -Verbose
+          Write-Verbose ($functionInput | ConvertTo-Json | Out-String) -Verbose
+
+          Confirm-ModuleIsPublished @functionInput -Verbose
+
+          Write-Output '::endgroup::'

avm/utilities/pipelines/publish/Confirm-ModuleIsPublished.ps1

@@ -0,0 +1,81 @@
+<#
+.SYNOPSIS
+Check if a module in a given path is published in a given version
+
+.DESCRIPTION
+Check if a module in a given path is published in a given version. Tries to find the module & version for a maximum of 60 minutes.
+
+.PARAMETER Version
+Mandatory. The version of the module to check for. For example: '0.2.0'
+
+.PARAMETER PublishedModuleName
+Mandatory. The path of the module to check for. For example: 'avm/res/key-vault/vault'
+
+.EXAMPLE
+Confirm-ModuleIsPublished -Version '0.2.0' -PublishedModuleName 'avm/res/key-vault/vault' -Verbose
+
+Check if module 'key-vault/vault' has been published with version '0.2.0
+#>
+function Confirm-ModuleIsPublished {
+
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory)]
+        [string] $Version,
+
+        [Parameter(Mandatory)]
+        [string] $PublishedModuleName
+    )
+
+    $baseUrl = 'https://mcr.microsoft.com/v2'
+    $catalogUrl = "$baseUrl/_catalog"
+    $moduleVersionsUrl = "$baseUrl/bicep/$PublishedModuleName/tags/list"
+
+    $time_limit_seconds = 3600 # 1h
+    $end_time = (Get-Date).AddSeconds($time_limit_seconds)
+    $retry_seconds = 5
+
+    #####################################
+    ##   Confirm module is published   ##
+    #####################################
+    while ($true) {
+        $catalogContentRaw = (Invoke-WebRequest -Uri $catalogUrl -UseBasicParsing).Content
+        $bicepCatalogContent = ($catalogContentRaw | ConvertFrom-Json).repositories | Select-String 'bicep/'
+        Write-Verbose ("Bicep modules found in MCR catalog:`n{0}" -f ($bicepCatalogContent | Out-String))
+
+        if ($bicepCatalogContent -match "bicep/$PublishedModuleName") {
+            Write-Verbose "Passed: Found module [$PublishedModuleName] in the MCR catalog" -Verbose
+            break
+        } else {
+            Write-Error "Error: Module [$PublishedModuleName] is not in the MCR catalog. Retrying in [$retry_seconds] seconds"
+            Start-Sleep -Seconds $retry_seconds
+        }
+
+        if ((Get-Date) -ge $end_time) {
+            throw "Time limit reached. Failed to validate publish of module in path [$PublishedModuleName] within the specified time."
+        }
+    }
+
+    #############################################
+    ##   Confirm module version is published   ##
+    #############################################
+    while ($true) {
+        $tagsContentRaw = (Invoke-WebRequest -Uri $moduleVersionsUrl -UseBasicParsing).Content
+        $tagsContent = ($tagsContentRaw | ConvertFrom-Json).tags
+
+        Write-Verbose ("Tags for module in path [$PublishedModuleName] found in MCR catalog:`n{0}" -f ($tagsContent | Out-String))
+
+        if ($tagsContent -match $Version) {
+            Write-Host "Passed: Found new tag [$Version] for published module"
+            break
+        } else {
+            Write-Host "Error: Could not find new tag [$Version] for published module. Retrying in [$retry_seconds] seconds"
+            Start-Sleep -Seconds $retry_seconds
+        }
+
+        if ((Get-Date) -ge $end_time) {
+            Write-Host 'Time limit reached. Failed to validate publish within the specified time.'
+            exit 1
+        }
+    }
+}

avm/utilities/pipelines/publish/Publish-ModuleFromPathToPBR.ps1

@@ -96,4 +96,9 @@ function Publish-ModuleFromPathToPBR {
   Write-Verbose "Publish Input:`n $($publishInput | ConvertTo-Json -Depth 10)" -Verbose
 
   bicep publish @publishInput
+
+  return @{
+    version             = $targetVersion
+    publishedModuleName = $publishedModuleName
+  }
 }

avm/utilities/pipelines/publish/helper/Get-ModulesToPublish.ps1

@@ -21,7 +21,7 @@ function Get-ModifiedFileList {
     Write-Verbose 'Gathering modified files from the previous head' -Verbose
     $Diff = git diff --name-only --diff-filter=AM HEAD^ HEAD
   }
-  $ModifiedFiles = $Diff | Get-Item -Force
+  $ModifiedFiles = $Diff ? ($Diff | Get-Item -Force) : @()
 
   return $ModifiedFiles
 }