azure_cicd.yaml

trigger:
  branches:
    include:
      - main
  paths:
    include:
      - src/ContentProcessorWorkflow/**

  # When multiple commits land quickly on main, only run the latest.
  batch: true

pr: none

pool:
  vmImage: ubuntu-latest

variables:
  azureServiceConnection: 'ado-pipeline-fed'

  resourceGroup: 'rg-cps-v2'
  containerAppsEnv: 'cps-apps-env'
  containerAppName: 'containerapp-cpsworkflow'

  acrName: 'cpsv2'
  acrLoginServer: 'cpsv2.azurecr.io'
  imageRepository: 'contentprocessorworkflow'

  appConfigEndpoint: 'https://appconfig-cps.azconfig.io'

  dockerfilePath: 'Dockerfile'
  dockerContext: '.'

  imageTag: '$(Build.BuildId)'

steps:
  - checkout: self
    fetchDepth: 1

  # Build + push to ACR (main only). PRs will build only.
  - task: AzureCLI@2
    displayName: Build image (PR + main)
    inputs:
      azureSubscription: '$(azureServiceConnection)'
      scriptType: bash
      scriptLocation: inlineScript
      inlineScript: |
        set -euo pipefail

        IMAGE="$(acrLoginServer)/$(imageRepository):$(imageTag)"
        echo "Building $IMAGE"

        az acr login --name "$(acrName)"
        az acr show --name "$(acrName)"
        docker build -f "$(dockerfilePath)" -t "$IMAGE" "$(dockerContext)"

  - task: AzureCLI@2
    displayName: Push image to ACR (main only)
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    inputs:
      azureSubscription: '$(azureServiceConnection)'
      scriptType: bash
      scriptLocation: inlineScript
      inlineScript: |
        set -euo pipefail

        IMAGE="$(acrLoginServer)/$(imageRepository):$(imageTag)"
        echo "Pushing $IMAGE"

        az acr login --name "$(acrName)"
        docker push "$IMAGE"

  # Deploy (update container app to the new image) as a background worker (no ingress).
  - task: AzureCLI@2
    displayName: Deploy to Azure Container Apps (main only, queue worker)
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    inputs:
      azureSubscription: '$(azureServiceConnection)'
      scriptType: bash
      scriptLocation: inlineScript
      inlineScript: |
        set -euo pipefail

        wait_for_app_ready() {
          local name="$1"
          local rg="$2"
          local max_attempts="${3:-60}"
          local sleep_seconds="${4:-10}"

          for i in $(seq 1 "$max_attempts"); do
            state=$(az containerapp show --name "$name" --resource-group "$rg" --query properties.provisioningState -o tsv 2>/dev/null || true)
            if [ -z "$state" ]; then
              echo "Waiting for container app '$name' to exist... ($i/$max_attempts)"
            elif [ "$state" != "InProgress" ]; then
              echo "Container app provisioningState=$state"
              return 0
            else
              echo "Container app provisioningState=InProgress; waiting... ($i/$max_attempts)"
            fi
            sleep "$sleep_seconds"
          done

          echo "Timed out waiting for container app provisioning to complete."
          return 1
        }

        retry_on_inprogress() {
          local max_attempts="${1:-30}"
          shift
          for i in $(seq 1 "$max_attempts"); do
            set +e
            output=$("$@" 2>&1)
            code=$?
            set -e
            if [ $code -eq 0 ]; then
              return 0
            fi
            echo "$output"
            if echo "$output" | grep -q "ContainerAppOperationInProgress"; then
              echo "Container app busy; retrying... ($i/$max_attempts)"
              sleep 15
              continue
            fi
            return $code
          done
          echo "Timed out retrying operation due to ContainerAppOperationInProgress."
          return 1
        }

        disable_ingress() {
          local name="$1"
          local rg="$2"

          set +e
          output=$(az containerapp ingress disable --name "$name" --resource-group "$rg" --only-show-errors 2>&1)
          code=$?
          set -e

          if [ $code -eq 0 ]; then
            echo "Ingress disabled on '$name'."
            return 0
          fi

          echo "$output"
          if echo "$output" | grep -q "ContainerAppOperationInProgress"; then
            retry_on_inprogress 30 az containerapp ingress disable --name "$name" --resource-group "$rg" --only-show-errors 1>/dev/null
            echo "Ingress disabled on '$name' (after retry)."
            return 0
          fi

          # If ingress is already disabled, some CLI versions return a non-zero exit code.
          if echo "$output" | grep -qi "ingress.*not.*enabled"; then
            echo "Ingress already disabled on '$name'."
            return 0
          fi

          return $code
        }

        assert_worker_has_no_ingress_or_probes() {
          local name="$1"
          local rg="$2"

          INGRESS_JSON=$(az containerapp show --name "$name" --resource-group "$rg" --query "properties.configuration.ingress" -o json)
          PROBES_JSON=$(az containerapp show --name "$name" --resource-group "$rg" --query "properties.template.containers[0].probes" -o json)

          # Ingress should be null/absent for a worker. If it's an object, ingress is enabled.
          if [ "$INGRESS_JSON" != "null" ] && [ "$INGRESS_JSON" != "" ]; then
            echo "ERROR: Ingress is enabled for worker app '$name' (expected no ingress)."
            echo "Ingress config: $INGRESS_JSON"
            exit 1
          fi

          # Probes should be absent for this worker.
          if [ "$PROBES_JSON" != "null" ] && [ "$PROBES_JSON" != "[]" ] && [ "$PROBES_JSON" != "" ]; then
            echo "ERROR: Probes are configured for worker app '$name' (expected none)."
            echo "Probes: $PROBES_JSON"
            exit 1
          fi
        }

        IMAGE="$(acrLoginServer)/$(imageRepository):$(imageTag)"
        echo "Deploying $IMAGE to $(containerAppName)"

        # Ensure extension is available on the hosted agent.
        az extension add --name containerapp --upgrade

        # Create the Container App if it doesn't exist (worker: no ingress, no target port).
        if ! az containerapp show --name "$(containerAppName)" --resource-group "$(resourceGroup)" 1>/dev/null 2>&1; then
          az containerapp create \
            --name "$(containerAppName)" \
            --resource-group "$(resourceGroup)" \
            --environment "$(containerAppsEnv)" \
            --image "$IMAGE" \
            --env-vars "APP_CONFIG_ENDPOINT=$(appConfigEndpoint)" \
            --only-show-errors 1>/dev/null
        fi

        wait_for_app_ready "$(containerAppName)" "$(resourceGroup)" 60 10

        # Ensure this app stays a pure background worker.
        disable_ingress "$(containerAppName)" "$(resourceGroup)"
        assert_worker_has_no_ingress_or_probes "$(containerAppName)" "$(resourceGroup)"

        # Configure managed identity to pull from ACR.
        retry_on_inprogress 30 az containerapp identity assign \
          --name "$(containerAppName)" \
          --resource-group "$(resourceGroup)" \
          --system-assigned \
          --only-show-errors 1>/dev/null

        wait_for_app_ready "$(containerAppName)" "$(resourceGroup)" 60 10

        PRINCIPAL_ID=$(az containerapp show \
          --name "$(containerAppName)" \
          --resource-group "$(resourceGroup)" \
          --query identity.principalId \
          -o tsv)

        ACR_ID=$(az acr show \
          --name "$(acrName)" \
          --query id \
          -o tsv)

        # Validate that the container app identity already has AcrPull on the registry.
        # NOTE: Using --assignee can trigger a Graph API lookup and emit warnings in locked-down tenants.
        # Filtering by principalId avoids Graph entirely.
        if ! az role assignment list \
          --scope "$ACR_ID" \
          --query "[?principalId=='$PRINCIPAL_ID' && roleDefinitionName=='AcrPull'] | length(@)" \
          -o tsv | grep -q '^1$'; then
          echo "ERROR: Container App managed identity does not have 'AcrPull' on ACR scope: $ACR_ID"
          echo "Ask an Azure admin to run:"
          echo "  az role assignment create --assignee $PRINCIPAL_ID --role AcrPull --scope $ACR_ID"
          exit 1
        fi

        retry_on_inprogress 30 az containerapp registry set \
          --name "$(containerAppName)" \
          --resource-group "$(resourceGroup)" \
          --server "$(acrLoginServer)" \
          --identity system \
          --only-show-errors 1>/dev/null

        wait_for_app_ready "$(containerAppName)" "$(resourceGroup)" 60 10

        # Roll out the new image.
        retry_on_inprogress 40 az containerapp update \
          --name "$(containerAppName)" \
          --resource-group "$(resourceGroup)" \
          --image "$IMAGE" \
          --set-env-vars "APP_CONFIG_ENDPOINT=$(appConfigEndpoint)" \
          --only-show-errors

        # Re-assert worker invariants after update.
        disable_ingress "$(containerAppName)" "$(resourceGroup)"
        assert_worker_has_no_ingress_or_probes "$(containerAppName)" "$(resourceGroup)"

        wait_for_app_ready "$(containerAppName)" "$(resourceGroup)" 80 10

        echo "Container image configured on app:"
        az containerapp show \
          --name "$(containerAppName)" \
          --resource-group "$(resourceGroup)" \
          --query "properties.template.containers[0].{name:name,image:image}" \
          -o table

        READY_REV=$(az containerapp show \
          --name "$(containerAppName)" \
          --resource-group "$(resourceGroup)" \
          --query properties.latestReadyRevisionName \
          -o tsv)

        if [ -n "$READY_REV" ]; then
          echo "Latest ready revision: $READY_REV"
          az containerapp revision show \
            --name "$(containerAppName)" \
            --resource-group "$(resourceGroup)" \
            --revision "$READY_REV" \
            --query "properties.template.containers[0].image" \
            -o tsv
        fi