simulator-deploy.yml

name: Build and Deploy Robot Simulator

on:
  push:
    branches: [main]
    paths:
      - "RobotSimulator/**"

# Required for OIDC federated identity authentication — no client secrets used
permissions:
  id-token: write
  contents: read

env:
  RESOURCE_GROUP: ewu-deliverybotsystem-rg

  # ACR — pre-created; admin credentials stored as Container App registry secret
  ACR_NAME: DeliverybotCR
  ACR_LOGIN_SERVER: deliverybotcr.azurecr.io

  # Container App — pre-created with system-assigned managed identity
  CONTAINER_APP_NAME: deliverybot-robot-simulator

  IMAGE_NAME: deliverybot-robot-simulator

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      # ── 1. Checkout source code ───────────────────────────────────────────────
      - name: Checkout repository
        uses: actions/checkout@v4

      # ── 2. Authenticate to Azure via OIDC federated identity ─────────────────
      - name: Azure Login (OIDC)
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      # ── 3. Build Docker image and push to ACR ────────────────────────────────
      # Build context is RobotSimulator/ to match the docker-compose convention.
      # The Dockerfile copies src projects relative to that context root.
      - name: Log in to Azure Container Registry
        run: az acr login --name "$ACR_NAME"

      - name: Build and push Docker image
        run: |
          IMAGE_TAG="${ACR_LOGIN_SERVER}/${IMAGE_NAME}:${{ github.sha }}"
          echo "Building: $IMAGE_TAG"
          docker build \
            -f RobotSimulator/src/DeliveryBot.RobotSimulator.Api/Dockerfile \
            -t "$IMAGE_TAG" \
            RobotSimulator/
          docker push "$IMAGE_TAG"
          echo "IMAGE_TAG=$IMAGE_TAG" >> "$GITHUB_ENV"

      # ── 4. Deploy updated image to Container App ─────────────────────────────
      # Image-only update — environment variables and secrets already configured
      # on the live Container App are intentionally left unchanged.
      # Do not add --set-env-vars here; Event Hub transport settings are managed
      # outside this workflow until they are brought under IaC.
      - name: Update Container App image
        run: |
          az containerapp update \
            --name "$CONTAINER_APP_NAME" \
            --resource-group "$RESOURCE_GROUP" \
            --image "$IMAGE_TAG"

      # ── 5. Output the live deployment URL ─────────────────────────────────────
      - name: Print deployment URL
        run: |
          FQDN=$(az containerapp show \
            --name "$CONTAINER_APP_NAME" \
            --resource-group "$RESOURCE_GROUP" \
            --query properties.configuration.ingress.fqdn -o tsv)
          echo "========================================"
          echo "  Deployment complete!"
          echo "  App URL   : https://${FQDN}"
          echo "  Health    : https://${FQDN}/health"
          echo "  Bots API  : https://${FQDN}/bots"
          echo "========================================"