detect-drift.yml

name: Detect Infrastructure Drift

permissions:
  id-token: write
  contents: read

on:
  pull_request:
    branches:
      - main
    paths:
      - '**.bicep'

env:
  RESOURCE_GROUP: ${{ vars.RESOURCE_GROUP }}
  STORAGE_ACCOUNT_NAME: ${{ vars.STORAGE_ACCOUNT_NAME }}
  APP_INSIGHTS_ACCOUNT_NAME: ${{ vars.APP_INSIGHTS_ACCOUNT_NAME }}

jobs:
  detect-drift-staging:
    name: Detect Drift - Staging
    runs-on: ubuntu-latest
    environment: staging-pr
    steps:
      - name: Checkout
        uses: actions/checkout@v1
      - uses: azure/login@v1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - name: Detect Drift
        uses: azure/CLI@v1
        with:
          inlineScript: |
            az deployment group create --name ftaaas --template-file infra/deploytostorageaccount.bicep --parameters accountName=$STORAGE_ACCOUNT_NAME appInsightsName=$APP_INSIGHTS_ACCOUNT_NAME skuName=Standard_LRS -g $RESOURCE_GROUP --what-if
      - name: logout
        run: |
          az logout
        if: always()
  detect-drift-production:
    name: Detect Drift - Production
    runs-on: ubuntu-latest
    needs: detect-drift-staging
    environment: production-pr
    steps:
      - name: Checkout
        uses: actions/checkout@v1
      - uses: azure/login@v1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} 
      - name: Detect Drift
        uses: azure/CLI@v1
        with:
          inlineScript: |
            az deployment group create --name ftaaas --template-file infra/deploytostorageaccount.bicep --parameters accountName=$STORAGE_ACCOUNT_NAME appInsightsName=$APP_INSIGHTS_ACCOUNT_NAME skuName=Standard_LRS -g $RESOURCE_GROUP --what-if
      - name: logout
        run: |
          az logout
        if: always()