pr-close-delete-env.yml

name: PR - Delete Environment when PR is closed

on:
  pull_request:
    types: [closed]
  workflow_dispatch:
    inputs:
      environment:
        description: "Pull request number"
        required: true
        default: ""

defaults:
  run:
    shell: pwsh

env:
  SLOT_NAME: pr-${{ github.event.number }}

permissions:
  id-token: write
  contents: read

jobs:
  delete-slot:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3

      - name: Load .env file
        uses: xom9ikk/dotenv@v2
        with:
          path: ./.github
          load-mode: strict

      - name: Azure CLI - Login
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID  }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID  }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Cleanup ACRPull & KeyVault permission
        run: |
          $acrId = az acr show `
            --resource-group ${{ env.AZURE_RESOURCE_GROUP }} `
            --name ${{ env.ACR_LOGIN_SERVER }} `
            --query id `
            --output tsv
          Write-Host '✅ acr found'

          # get slot identity
          $identityId = az webapp identity show `
            --resource-group ${{ env.AZURE_RESOURCE_GROUP }} `
            --name ${{ env.APP_SERVICE_NAME }} `
            --slot ${{ env.SLOT_NAME }} `
            --query principalId `
            --output tsv
          Write-Host '✅ slot identity found'

          # grant access to the identity on ACR
          az role assignment delete `
            --assignee $identityId `
            --scope $acrId `
            --role acrpull `
            --output none
          Write-Host '✅ acrpull role deleted'

          $kvId = az keyvault show `
            --resource-group ${{ env.AZURE_RESOURCE_GROUP }} `
            --name ${{ env.KEY_VAULT }} `
            --query id `
            --output tsv

          if($kvId) {
          Write-Host '✅ KeyVault found'

          # grant access to the identity on KeyVault
          az role assignment delete `
            --assignee $identityId `
            --scope $kvId `
            --role "Key Vault Secrets User" `
            -o none
          Write-Host '✅ Key Vault Secrets User role deleted'
          } else {
            Write-Host '❌ Key Vault not found'
          }

      - name: Delete slot on staging site
        run: |
          az webapp deployment slot delete `
            --resource-group ${{ env.AZURE_RESOURCE_GROUP }} `
            --name ${{ env.APP_SERVICE_NAME }} `
            --slot ${{ env.SLOT_NAME }} `
            --output none