bicep-what-if.yml

---
name: Bicep What If

on:
  pull_request:
    branches:
      - main
    paths:
      - 'dev-infrastructure/**/*.bicep'
      - '.github/workflows/bicep-what-if.yml'

jobs:
  what-if:
    permissions:
      id-token: 'write'
      contents: 'read'
    runs-on: 'ubuntu-latest'
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          fetch-depth: 1

      - name: 'Az CLI login'
        uses: azure/login@v2
        with:
            client-id: ${{ secrets.AZURE_CLIENT_ID }}
            tenant-id: ${{ secrets.AZURE_TENANT_ID }}
            subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: 'Deployment What If'
        uses: azure/cli@v2
        with:
          azcliversion: latest
          inlineScript: |
            RESOURCEGROUP=${GITHUB_RUN_ID}
            cd dev-infrastructure/

            az group create -g "${RESOURCEGROUP}" -l eastus

            # service cluster
            az deployment group what-if \
              --name "${GITHUB_RUN_ID}" \
              --resource-group "${RESOURCEGROUP}" \
              --template-file templates/svc-cluster.bicep \
              --parameters configurations/svc-cluster.bicepparam \
              --parameters currentUserId="${GITHUB_ACTOR}"

            # management cluster
            az deployment group what-if \
              --name "${GITHUB_RUN_ID}" \
              --resource-group "${RESOURCEGROUP}" \
              --template-file templates/mgmt-cluster.bicep \
              --parameters configurations/mgmt-cluster.bicepparam \
              --parameters currentUserId="${GITHUB_ACTOR}"

      - name: 'Clean Up'
        uses: azure/cli@v2
        if: always()
        with:
          azcliversion: latest
          inlineScript: |
            RESOURCEGROUP=${GITHUB_RUN_ID}
            az group delete -g "${RESOURCEGROUP}" -y