cd.yml

name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

env:
  AZCLI_VERSION: 2.55.0
  BICEP_VERSION: 0.24.24
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  AKS_RG_NAME: 'bicepbuild'

jobs:
  push-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: ./src
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  deploy-k8s:
    runs-on: ubuntu-latest
    needs: push-image
    permissions:
      contents: read
      id-token: write

    concurrency:
      group: deploy
      cancel-in-progress: false

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: AzCLI login
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.ACR_CLIENT_ID }}
          tenant-id: ${{ secrets.ACR_TENANT_ID }}
          subscription-id: ${{ secrets.ACR_SUBSCRIPTION_ID }}

      - name: Deploy
        uses: azure/CLI@v2
        with:
          azcliversion: ${{ env.AZCLI_VERSION }}
          inlineScript: |
            az bicep install --version v${{ env.BICEP_VERSION }}
            az deployment group create \
              --resource-group ${{ env.AKS_RG_NAME }} \
              --parameters ./deploy/main.bicepparam \
              --query "properties.outputs"