avm.template.module.yml

name: "avm.template.module"

on:
  workflow_call:
    inputs:
      workflowInput:
        type: string
        description: "Input from the workflow caller in JSON format"
        required: true
      moduleTestFilePaths:
        type: string
        description: "List of relative path to the module test files in JSON format"
        required: true
      psRuleModuleTestFilePaths:
        type: string
        description: "List of relative path to the PSRule module test files in JSON format"
        required: true
      modulePath:
        type: string
        description: "Relative path to the module folder"
        required: true

env:
  ARM_SUBSCRIPTION_ID: "${{ secrets.ARM_SUBSCRIPTION_ID }}"
  ARM_MGMTGROUP_ID: "${{ secrets.ARM_MGMTGROUP_ID }}"
  ARM_TENANT_ID: "${{ secrets.ARM_TENANT_ID }}"
  TOKEN_NAMEPREFIX: "${{ secrets.TOKEN_NAMEPREFIX }}"

jobs:
  #########################
  #   Static validation   #
  #########################
  job_module_static_validation: # Note: Please don't change this job name. It is used by the setEnvironment action to define which PS modules to install on runners.
    name: "Static validation"
    runs-on: ubuntu-latest
    if: (fromJson(inputs.workflowInput)).staticValidation == 'true'
    steps:
      - name: "Checkout"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set environment
        uses: ./.github/actions/templates/avm-setEnvironment
      - name: "Run tests"
        uses: ./.github/actions/templates/avm-validateModulePester
        with:
          modulePath: "${{ inputs.modulePath }}"

  #########################
  #   PSRule validation   #
  #########################
  job_psrule_test: # Note: Please don't change this job name. It is used by the setEnvironment action to define which PS modules to install on runners.
    name: "PSRule [${{ matrix.testCases.name }}]"
    runs-on: ubuntu-latest
    if: ${{ inputs.psRuleModuleTestFilePaths != '' && (fromJson(inputs.workflowInput)).staticValidation == 'true'  }}
    strategy:
      fail-fast: false
      matrix:
        testCases: ${{ fromJson(inputs.psRuleModuleTestFilePaths) }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set environment
        uses: ./.github/actions/templates/avm-setEnvironment
      - name: "Run PSRule validation with [${{ matrix.testCases.path }}]"
        uses: ./.github/actions/templates/avm-validateModulePSRule
        with:
          templateFilePath: "${{ inputs.modulePath }}/${{ matrix.testCases.path }}"
          subscriptionId: "${{ secrets.ARM_SUBSCRIPTION_ID }}"
          managementGroupId: "${{ secrets.ARM_MGMTGROUP_ID }}"
          psrulePath: "avm/utilities/pipelines/staticValidation/psrule" #'${{ github.workspace }}/avm'
          psruleBaseline: "Azure.Default"

  job_psrule_test_waf_reliability: # Note: Please don't change this job name. It is used by the setEnvironment action to define which PS modules to install on runners.
    name: "PSRule - WAF Reliability [${{ matrix.testCases.name }}]"
    runs-on: ubuntu-latest
    if: ${{ inputs.psRuleModuleTestFilePaths != '' && (fromJson(inputs.workflowInput)).staticValidation == 'true'  }}
    strategy:
      fail-fast: false
      matrix:
        testCases: ${{ fromJson(inputs.psRuleModuleTestFilePaths) }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set environment
        uses: ./.github/actions/templates/avm-setEnvironment
      - name: "Run PSRule validation with [${{ matrix.testCases.path }}]"
        uses: ./.github/actions/templates/avm-validateModulePSRule
        with:
          templateFilePath: "${{ inputs.modulePath }}/${{ matrix.testCases.path }}"
          subscriptionId: "${{ secrets.ARM_SUBSCRIPTION_ID }}"
          managementGroupId: "${{ secrets.ARM_MGMTGROUP_ID }}"
          psrulePath: "avm/utilities/pipelines/staticValidation/psrule" #'${{ github.workspace }}/avm'
          psruleBaseline: "Azure.Pillar.Reliability"

  #############################
  #   Deployment validation   #
  #############################
  job_module_deploy_validation: # Note: Please don't change this job name. It is used by the setEnvironment action to define which PS modules to install on runners.
    name: "Deploy [${{ matrix.testCases.name}}]"
    runs-on: ubuntu-latest
    if: |
      !cancelled() &&
      (fromJson(inputs.workflowInput)).deploymentValidation == 'true' &&
      needs.job_module_static_validation.result != 'failure' &&
      needs.job_psrule_test_waf_reliability.result != 'failure'
    needs:
      - job_module_static_validation
      - job_psrule_test_waf_reliability
    strategy:
      fail-fast: false
      matrix:
        testCases: ${{ fromJson(inputs.moduleTestFilePaths) }}
    steps:
      - name: "Checkout"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set environment
        uses: ./.github/actions/templates/avm-setEnvironment
        with:
          removeDeployment: "${{ fromJson(inputs.workflowInput).removeDeployment }}"
      - name: "Run deployment validation with test file [${{ matrix.testCases.path }}]"
        uses: ./.github/actions/templates/avm-validateModuleDeployment
        with:
          modulePath: "${{ inputs.modulePath }}"
          templateFilePath: "${{ inputs.modulePath }}/${{ matrix.testCases.path }}"
          deploymentMetadataLocation: "WestEurope"
          subscriptionId: "${{ secrets.ARM_SUBSCRIPTION_ID }}"
          managementGroupId: "${{ secrets.ARM_MGMTGROUP_ID }}"
          removeDeployment: "${{ fromJson(inputs.workflowInput).removeDeployment }}"
          customLocation: "${{ fromJson(inputs.workflowInput).customLocation }}"
        env:
          AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}

  ##################
  #   Publishing   #
  ##################
  job_publish_module: # Note: Please don't change this job name. It is used by the setEnvironment action to define which PS modules to install on runners.
    name: "Publishing"
    runs-on: ubuntu-latest
    # Note: Below always() required in condition due to psrule jobs being skipped for ptn modules not having defaults or waf-aligned folders
    if: github.ref == 'refs/heads/main' &&
      github.repository	 == 'Azure/bicep-registry-modules' &&
      always() &&
      needs.job_module_static_validation.result == 'success' &&
      needs.job_module_deploy_validation.result == 'success'
    needs:
      - job_module_static_validation
      - job_module_deploy_validation
    steps:
      - name: "Checkout"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set environment
        uses: ./.github/actions/templates/avm-setEnvironment
      - name: "Publishing"
        uses: ./.github/actions/templates/avm-publishModule
        with:
          templateFilePath: "${{ inputs.modulePath }}/main.bicep"
        env:
          PUBLISH_REGISTRY_SERVER: "${{ secrets.PUBLISH_REGISTRY_SERVER }}"
          PUBLISH_CLIENT_ID: "${{ secrets.PUBLISH_CLIENT_ID }}"
          PUBLISH_TENANT_ID: "${{ secrets.PUBLISH_TENANT_ID }}"
          PUBLISH_SUBSCRIPTION_ID: "${{ secrets.PUBLISH_SUBSCRIPTION_ID }}"