feat: add support for tag-based trigger

terraform/pipeline/azure-pipelines.yml

@@ -6,10 +6,15 @@ trigger:
       - dev
       - test
       - prod
+  tags:
+    include:
+      - 20??.??.?*-rc?*
+      - 20??.??.?*
   # only run for changes to Terraform files
   paths:
     include:
       - terraform/*
+
 pool:
   vmImage: ubuntu-latest
 
@@ -22,6 +27,8 @@ stages:
             value: $[variables['System.PullRequest.SourceBranch']]
           - name: INDIVIDUAL_SOURCE
             value: $[variables['Build.SourceBranchName']]
+          - name: IS_TAG
+            value: $[startsWith(variables['Build.SourceBranch'], 'refs/tags/')]
           - name: TARGET
             value: $[variables['System.PullRequest.TargetBranch']]
         steps:
@@ -30,6 +37,9 @@ stages:
           - bash: |
               WORKSPACE=$(python terraform/pipeline/workspace.py)
               echo "##vso[task.setvariable variable=workspace;isOutput=true]$WORKSPACE"
+
+              TAG_TYPE=$(python terraform/pipeline/tag.py)
+              echo "##vso[task.setvariable variable=tag_type;isOutput=true]$TAG_TYPE"
             name: setvars
             displayName: Determine deployment environment
             env:
@@ -82,34 +92,52 @@ stages:
           - publish: "$(Build.ArtifactStagingDirectory)"
             displayName: "Publish tfplan for use in TerraformApply"
             artifact: savedPlan
-            condition: in(variables['Build.SourceBranchName'], 'dev', 'test', 'prod')
+            condition: |
+                or(
+                  in(variables['Build.SourceBranchName'], 'dev', 'test', 'prod'),
+                  or(
+                    eq(variables['setvars.tag_type'], 'test'),
+                    eq(variables['setvars.tag_type'], 'prod')
+                  )
+                )
   - stage: TerraformApply
     dependsOn: TerraformPlan
     variables:
       - name: workspace
         value: $[ dependencies.TerraformPlan.outputs['Plan.setvars.workspace'] ]
-    # only run on dev, test, or prod branches
-    condition: in(variables['Build.SourceBranchName'], 'dev', 'test', 'prod')
+      - name: tag_type
+        value: $[ dependencies.TerraformPlan.outputs['Plan.setvars.tag_type'] ]
+    # only run on dev, test, or prod branches OR if it's a tag for test or prod
+    condition: |
+      or(
+        in(variables['Build.SourceBranchName'], 'dev', 'test', 'prod'),
+        or(
+          eq(variables['tag_type'], 'test'),
+          eq(variables['tag_type'], 'prod')
+        )
+      )
     jobs:
       - deployment: Apply
         condition: succeeded()
         environment: Approval
         variables:
           - name: workspace
             value: $[ stageDependencies.TerraformPlan.Plan.outputs['setvars.workspace'] ]
+          - name: tag_type
+            value: $[ stageDependencies.TerraformPlan.Plan.outputs['setvars.tag_type'] ]
         strategy:
           runOnce:
             deploy:
               steps:
                 - checkout: self
-                # https://github.com/microsoft/azure-pipelines-terraform/tree/main/Tasks/TerraformTask/TerraformTaskV3#readme
                 - download: current
                   displayName: "Download plan file published from TerraformPlan"
                   artifact: savedPlan
                 - task: TerraformInstaller@0
                   displayName: Install Terraform
                   inputs:
                     terraformVersion: 1.3.1
+                # https://github.com/microsoft/azure-pipelines-terraform/tree/main/Tasks/TerraformTask/TerraformTaskV3#readme
                 - task: TerraformTaskV3@3
                   displayName: Terraform init
                   inputs:

terraform/pipeline/tag.py

@@ -0,0 +1,19 @@
+import os
+import re
+
+REASON = os.environ["REASON"]
+# use variable corresponding to tag triggers
+SOURCE = os.environ["INDIVIDUAL_SOURCE"]
+IS_TAG = os.environ["IS_TAG"].lower() == "true"
+
+if REASON == "IndividualCI" and IS_TAG:
+    if re.fullmatch(r"20\d\d.\d\d.\d+-rc\d+", SOURCE):
+        tag_type = "test"
+    elif re.fullmatch(r"20\d\d.\d\d.\d+", SOURCE):
+        tag_type = "prod"
+    else:
+        tag_type = None
+else:
+    tag_type = None
+
+print(tag_type)

terraform/pipeline/workspace.py

@@ -1,10 +1,12 @@
 import os
+import re
 import sys
 
 REASON = os.environ["REASON"]
 # the name of the variable that Azure Pipelines uses for the source branch depends on the type of run, so need to check both
 SOURCE = os.environ.get("OTHER_SOURCE") or os.environ["INDIVIDUAL_SOURCE"]
 TARGET = os.environ["TARGET"]
+IS_TAG = os.environ["IS_TAG"].lower() == "true"
 
 # the branches that correspond to environments
 ENV_BRANCHES = ["dev", "test", "prod"]
@@ -15,6 +17,10 @@
 elif REASON in ["IndividualCI", "Manual"] and SOURCE in ENV_BRANCHES:
     # it's being run on one of the environment branches, so use that
     environment = SOURCE
+elif REASON in ["IndividualCI"] and IS_TAG and re.fullmatch(r"20\d\d.\d\d.\d+-rc\d+", SOURCE):
+    environment = "test"
+elif REASON in ["IndividualCI"] and IS_TAG and re.fullmatch(r"20\d\d.\d\d.\d+", SOURCE):
+    environment = "prod"
 else:
     # default to running against dev
     environment = "dev"