deploymentChecker-sing-nic.yml

name: Deployment Checker - Single Nic
# Prerequisites
# 1. Set up your AZURE CREDENTIALS SECRET as per : https://github.com/marketplace/actions/azure-login#configure-a-service-principal-with-a-secret
# 2. Make sure the Service Principal has IAM Owner on the Resource Group you're deploying into.

on:
  #Run on Manual execution
  workflow_dispatch:

  #Run when bicep code changes
  # push:
  #   branches:
  #    - 'master'
  #    - 'dev'
  #   paths:
  #     - "bicep/main-sing-nic.bicep"
  #     - "bicep/main-sing-nic.parameters.json"
  #     - ".github/workflows/deploymentChecker-sing-nic.yml"

  #Run when PR's are made to main, where the changes are in the bicep directory or this workflow file itself
  pull_request:
    branches:
     - 'master'
    paths:
      #- "bicep/main-active-active.parameters.json"
      - "bicep/*"
      - ".github/workflows/deploymentChecker-sing-nic.yml"

  #Run on a weekly schedule
  #schedule:
    # At 11:00pm, every Tuesday week
  #  - cron: "0 23 * * 2"
env:
  RG: "Automation-Actions-OPNAZURE-sing-nic-${{ github.run_number }}" #The resource group we're deploying to.
  Location: "eastus"
  ParamFilePath: "bicep/main.parameters.json" #Path to parameter file
  TemplateFilePath: "bicep/main.bicep"
  OPNsense-PIP: "OPNsense-PublicIP"
  VNET: "OPN-VNET"
  VNETAddress: "10.0.0.0/16"
  UntrustedSubnet: "Untrusted-Subnet"
  UntrustedSubnetAddress: "10.0.0.0/24"
  TrustedSubnet: "Trusted-Subnet"
  TrustedSubnetAddress: "10.0.1.0/24"
  scenarioOption: "SingleNic"
  existingvirtualNetwork: "existing"
  DeployWindows: false
  OpnScriptURI: "https://raw.githubusercontent.com/dmauser/opnazure/master/scripts/"
  DEPNAME: "Dep-OPNsense-sing-nic-${{ github.run_number }}" #Deployment Name
  AZCLIVERSION: 2.36.0 #Pinning to a specific AZ CLI version

jobs:
  Validation:
    runs-on: ubuntu-latest
    steps:
      #Get the code files from the repo
      - uses: actions/checkout@v3

      - name: Job parameter check
        run: |
          RG='${{ env.RG }}'
          echo "RG is: $RG"

          echo "Param file path is: ${{ env.ParamFilePath }}"
          echo "Template file path is: ${{ env.TemplateFilePath }}"
          echo "Deployment name is ${{ env.DEPNAME }}"
          echo "AZ cli version is ${{ env.AZCLIVERSION }}"

      - name: Arm Parameter file check exists
        shell: pwsh
        run: |
          Write-Output "Checking parameter file existance/contents"
          $paramFilePath="${{ env.ParamFilePath }}"
          Test-Path $paramFilePath

          if (Test-Path $paramFilePath) {
            $paramFileContent=Get-Content $paramFilePath
            Write-Output $paramFileContent
          }

      - name: Azure Login
        uses: Azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          enable-AzPSSession: false
          environment: azurecloud
          allow-no-subscriptions: false

      - name: Validate Infrastructure deployment
        uses: Azure/cli@v1
        with:
          azcliversion: ${{ env.AZCLIVERSION }}
          inlineScript: |
            az group create -l '${{ env.Location }}' -g '${{ env.RG }}'
            az network vnet create -g '${{ env.RG }}' -n '${{ env.VNET }}' --address-prefixes '${{ env.VNETAddress }}'
            az network vnet subnet create -g '${{ env.RG }}' --vnet-name '${{ env.VNET }}' -n '${{ env.UntrustedSubnet }}' --address-prefixes '${{ env.UntrustedSubnetAddress }}'

            [[ ! -z "${GITHUB_HEAD_REF}" ]] && OpnScriptURI=$(echo ${{ env.OpnScriptURI }} | sed -e "s_master_${GITHUB_HEAD_REF}_")
            az deployment group validate -g '${{ env.RG }}' -n '${{ env.DEPNAME }}' -f ${{ env.TemplateFilePath }} -p ${{ env.ParamFilePath }} -p scenarioOption=${{ env.scenarioOption }} -p existingvirtualNetwork=${{ env.existingvirtualNetwork }} -p existingUntrustedSubnetName=${{ env.UntrustedSubnet }} -p DeployWindows=${{ env.DeployWindows }} -p OpnScriptURI=$OpnScriptURI

  Deploy:
    runs-on: ubuntu-latest
    needs: [Validation]
    steps:
      - uses: actions/checkout@v3

      - name: Azure Login
        uses: Azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          enable-AzPSSession: false
          environment: azurecloud
          allow-no-subscriptions: false

      - name: Deploy Infrastructure
        id: deployAks
        uses: Azure/cli@v1
        with:
          azcliversion: ${{ env.AZCLIVERSION }}
          inlineScript: |
            [[ ! -z "${GITHUB_HEAD_REF}" ]] && OpnScriptURI=$(echo ${{ env.OpnScriptURI }} | sed -e "s_master_${GITHUB_HEAD_REF}_")
            echo Executing: az deployment group create -g ${{ env.RG }} -n ${{ env.DEPNAME }} -f ${{ env.TemplateFilePath }} -p ${{ env.ParamFilePath }} -p scenarioOption=${{ env.scenarioOption }} -p existingvirtualNetwork=${{ env.existingvirtualNetwork }} -p existingUntrustedSubnetName=${{ env.UntrustedSubnet }} -p DeployWindows=${{ env.DeployWindows }} -p OpnScriptURI=$OpnScriptURI --verbose
            az deployment group create -g ${{ env.RG }} -n ${{ env.DEPNAME }} -f ${{ env.TemplateFilePath }} -p ${{ env.ParamFilePath }} -p scenarioOption=${{ env.scenarioOption }} -p existingvirtualNetwork=${{ env.existingvirtualNetwork }} -p existingUntrustedSubnetName=${{ env.UntrustedSubnet }} -p DeployWindows=${{ env.DeployWindows }} -p OpnScriptURI=$OpnScriptURI --verbose

  CheckOPNsenseAvailability:
    runs-on: ubuntu-latest
    needs: [Deploy]
    steps:
      - uses: actions/checkout@v3

      - name: Azure Login
        uses: Azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          enable-AzPSSession: true
          environment: azurecloud
          allow-no-subscriptions: false

      - name: Test OPNsense Access
        run: |
          PIP=$(az network public-ip show -g '${{ env.RG }}' -n '${{ env.OPNsense-PIP }}' --query "ipAddress" -o tsv)
          #curl -k https://$PIP --verbose

  Cleanup:
    runs-on: ubuntu-latest
    needs: [Validation, Deploy, CheckOPNsenseAvailability]
    if: always()
    steps:
      - name: Azure Login
        uses: Azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          enable-AzPSSession: true
          environment: azurecloud
          allow-no-subscriptions: false

      - name: Cleanup
        uses: Azure/cli@v1
        with:
          azcliversion: ${{ env.AZCLIVERSION }}
          inlineScript: |
            az group delete -n '${{ env.RG }}' -y --verbose