gui-deploy.yml

# CI/CD pipeline for the CoPyRIT GUI.
#
# Every deployment uses the single topology defined by infra/main.bicep:
# public ACA-managed HTTPS ingress plus VNet-integrated fixed NAT egress.

trigger:
  branches:
    include:
      - main
  paths:
    include:
      - pyrit/backend/**
      - frontend/**
      - docker/**
      - infra/**

pr: none

parameters:
  - name: deployToProd
    displayName: 'Deploy to production'
    type: boolean
    default: false

variables:
  azureServiceConnection: 'copyrit-gui-azure'

stages:
  - stage: ValidateInputs
    displayName: 'Validate Inputs'
    pool:
      vmImage: 'ubuntu-latest'
    jobs:
      - job: ValidateProdSource
        displayName: 'Validate production source'
        steps:
          - checkout: none
          - bash: |
              set -euo pipefail
              if [[ '${{ parameters.deployToProd }}' == 'true' \
                && "$BUILD_SOURCEBRANCH" != refs/heads/main ]]; then
                echo "##vso[task.logissue type=error]Production deployment requires a commit merged to refs/heads/main"
                exit 1
              fi
            displayName: 'Validate production source'

  - stage: Build
    displayName: 'Build and Push Image'
    dependsOn: ValidateInputs
    variables:
      - group: copyrit-gui-common
    pool:
      vmImage: 'ubuntu-latest'
    jobs:
      - job: BuildAndPush
        displayName: 'Build and push immutable source image'
        steps:
          - checkout: self
            fetchDepth: 1

          - task: AzureCLI@2
            name: BuildImage
            displayName: 'Build and push Docker image'
            env:
              PYRIT_ACR_NAME: $(acrName)
              PYRIT_ACR_LOGIN_SERVER: $(acrLoginServer)
              PYRIT_IMAGE_NAME: $(imageName)
              PYRIT_SOURCE_VERSION: $(Build.SourceVersion)
            inputs:
              azureSubscription: '$(azureServiceConnection)'
              scriptType: 'bash'
              scriptLocation: 'inlineScript'
              inlineScript: |
                set -euo pipefail

                required_variables=(
                  PYRIT_ACR_NAME
                  PYRIT_ACR_LOGIN_SERVER
                  PYRIT_IMAGE_NAME
                  PYRIT_SOURCE_VERSION
                )
                for variable_name in "${required_variables[@]}"; do
                  if [[ -z "${!variable_name:-}" || "${!variable_name}" == '$('* ]]; then
                    echo "##vso[task.logissue type=error]Required build value is missing: $variable_name"
                    exit 1
                  fi
                done

                repository_pattern='^[a-z0-9]+([._-][a-z0-9]+)*(/[a-z0-9]+([._-][a-z0-9]+)*)*$'
                if [[ ! "$PYRIT_ACR_NAME" =~ ^[a-z0-9]{5,50}$ \
                  || "$PYRIT_ACR_LOGIN_SERVER" != "$PYRIT_ACR_NAME.azurecr.io" \
                  || ! "$PYRIT_IMAGE_NAME" =~ $repository_pattern \
                  || ! "$PYRIT_SOURCE_VERSION" =~ ^[0-9a-fA-F]{40}$ ]]; then
                  echo "##vso[task.logissue type=error]Invalid registry, repository, or source version"
                  exit 1
                fi

                docker build \
                  -f .devcontainer/Dockerfile \
                  -t pyrit-devcontainer \
                  .devcontainer/

                image="$PYRIT_ACR_LOGIN_SERVER/$PYRIT_IMAGE_NAME:$PYRIT_SOURCE_VERSION"
                docker build --no-cache \
                  -f docker/Dockerfile \
                  -t "$image" \
                  --build-arg BASE_IMAGE=pyrit-devcontainer \
                  --build-arg PYRIT_SOURCE=local \
                  --build-arg GIT_COMMIT="$PYRIT_SOURCE_VERSION" \
                  --build-arg GIT_MODIFIED=false \
                  .

                az acr login --name "$PYRIT_ACR_NAME"
                push_output=$(docker push "$image")
                printf '%s\n' "$push_output"
                digest=$(sed -nE 's/.*digest: (sha256:[0-9a-fA-F]{64}).*/\1/p' <<< "$push_output" | tail -n 1)
                if [[ ! "$digest" =~ ^sha256:[0-9a-fA-F]{64}$ ]]; then
                  echo "##vso[task.logissue type=error]Docker push did not return an immutable digest"
                  exit 1
                fi
                immutable_image="$PYRIT_ACR_LOGIN_SERVER/$PYRIT_IMAGE_NAME@$digest"
                echo "##vso[task.setvariable variable=immutableImage;isOutput=true]$immutable_image"

  - stage: DeployTest
    displayName: 'Deploy to Test'
    dependsOn: Build
    variables:
      - group: copyrit-gui-common
      - group: copyrit-gui-test
      - name: immutableImage
        value: $[ stageDependencies.Build.BuildAndPush.outputs['BuildImage.immutableImage'] ]
    pool:
      vmImage: 'ubuntu-latest'
    jobs:
      - deployment: DeployToTest
        displayName: 'Deploy test environment'
        timeoutInMinutes: 120
        environment: 'copyrit-test'
        strategy:
          runOnce:
            deploy:
              steps:
                - checkout: self
                  fetchDepth: 1

                - task: AzureCLI@2
                  displayName: 'Preview, deploy, and verify test'
                  env:
                    PYRIT_SLOT: test
                    PYRIT_BUILD_ID: $(Build.BuildId)
                    PYRIT_SOURCE_DIRECTORY: $(Build.SourcesDirectory)
                    PYRIT_AGENT_TEMP_DIRECTORY: $(Agent.TempDirectory)
                    PYRIT_DEPLOYMENT_RESOURCE_GROUP: $(deploymentResourceGroup)
                    PYRIT_APP_NAME: $(deploymentAppName)
                    PYRIT_CONTAINER_IMAGE: $(immutableImage)
                    PYRIT_VNET_ADDRESS_PREFIX: $(deploymentVnetAddressPrefix)
                    PYRIT_INFRASTRUCTURE_SUBNET_ADDRESS_PREFIX: $(deploymentInfrastructureSubnetAddressPrefix)
                    PYRIT_ALLOWED_CLIENT_CIDR: $(deploymentAllowedClientCidr)
                    PYRIT_MANAGED_IDENTITY_RESOURCE_ID: $(managedIdentityResourceId)
                    PYRIT_ENTRA_TENANT_ID: $(entraTenantId)
                    PYRIT_ENTRA_CLIENT_ID: $(entraClientId)
                    PYRIT_ALLOWED_GROUP_OBJECT_IDS: $(allowedGroupObjectIds)
                    PYRIT_SQL_SERVER_FQDN: $(sqlServerFqdn)
                    PYRIT_SQL_DATABASE_NAME: $(sqlDatabaseName)
                    PYRIT_KEY_VAULT_RESOURCE_ID: $(keyVaultResourceId)
                    PYRIT_ACR_RESOURCE_ID: $(acrResourceId)
                    PYRIT_ENABLE_OTEL: $(enableOtel)
                    PYRIT_ENV_SECRET_NAME: $(envSecretName)
                  inputs:
                    azureSubscription: '$(azureServiceConnection)'
                    scriptType: 'bash'
                    scriptLocation: 'scriptPath'
                    scriptPath: '$(Build.SourcesDirectory)/infra/pipelines/deploy_public_nat.sh'

  - stage: ApproveProd
    displayName: 'Approve Production Deployment'
    dependsOn: DeployTest
    condition: and(succeeded('DeployTest'), eq('${{ parameters.deployToProd }}', 'true'), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    variables:
      - group: copyrit-gui-prod
    jobs:
      - job: ValidateProdConfiguration
        displayName: 'Validate production authorization configuration'
        pool:
          vmImage: 'ubuntu-latest'
        steps:
          - checkout: none
          - bash: |
              set -euo pipefail
              if [[ -z "${PROD_APPROVERS:-}" || "$PROD_APPROVERS" == '$('* ]]; then
                echo "##vso[task.logissue type=error]copyrit-gui-prod must define prodApprovers before production deployment"
                exit 1
              fi
            displayName: 'Validate production approvers'
            env:
              PROD_APPROVERS: $(prodApprovers)

      - job: WaitForProdApproval
        displayName: 'Validate production readiness'
        dependsOn: ValidateProdConfiguration
        pool: server
        timeoutInMinutes: 1440
        steps:
          - task: ManualValidation@1
            timeoutInMinutes: 1440
            inputs:
              notifyUsers: '$(prodApprovers)'
              approvers: '$(prodApprovers)'
              allowApproversToApproveTheirOwnRuns: false
              instructions: |
                Confirm test is healthy, Entra and backend group authorization work,
                the static test egress IP is allow-listed, and production variables
                describe the same public ACA plus fixed NAT topology.
              onTimeout: reject

  - stage: DeployProd
    displayName: 'Deploy to Production'
    dependsOn:
      - ApproveProd
      - Build
    condition: succeeded('ApproveProd')
    variables:
      - group: copyrit-gui-common
      - group: copyrit-gui-prod
      - name: immutableImage
        value: $[ stageDependencies.Build.BuildAndPush.outputs['BuildImage.immutableImage'] ]
    pool:
      vmImage: 'ubuntu-latest'
    jobs:
      - deployment: DeployToProd
        displayName: 'Deploy production environment'
        timeoutInMinutes: 120
        environment: 'copyrit-prod'
        strategy:
          runOnce:
            deploy:
              steps:
                - checkout: self
                  fetchDepth: 1

                - task: AzureCLI@2
                  displayName: 'Preview, deploy, and verify production'
                  env:
                    PYRIT_SLOT: prod
                    PYRIT_BUILD_ID: $(Build.BuildId)
                    PYRIT_SOURCE_DIRECTORY: $(Build.SourcesDirectory)
                    PYRIT_AGENT_TEMP_DIRECTORY: $(Agent.TempDirectory)
                    PYRIT_DEPLOYMENT_RESOURCE_GROUP: $(deploymentResourceGroup)
                    PYRIT_APP_NAME: $(deploymentAppName)
                    PYRIT_CONTAINER_IMAGE: $(immutableImage)
                    PYRIT_VNET_ADDRESS_PREFIX: $(deploymentVnetAddressPrefix)
                    PYRIT_INFRASTRUCTURE_SUBNET_ADDRESS_PREFIX: $(deploymentInfrastructureSubnetAddressPrefix)
                    PYRIT_ALLOWED_CLIENT_CIDR: $(deploymentAllowedClientCidr)
                    PYRIT_MANAGED_IDENTITY_RESOURCE_ID: $(managedIdentityResourceId)
                    PYRIT_ENTRA_TENANT_ID: $(entraTenantId)
                    PYRIT_ENTRA_CLIENT_ID: $(entraClientId)
                    PYRIT_ALLOWED_GROUP_OBJECT_IDS: $(allowedGroupObjectIds)
                    PYRIT_SQL_SERVER_FQDN: $(sqlServerFqdn)
                    PYRIT_SQL_DATABASE_NAME: $(sqlDatabaseName)
                    PYRIT_KEY_VAULT_RESOURCE_ID: $(keyVaultResourceId)
                    PYRIT_ACR_RESOURCE_ID: $(acrResourceId)
                    PYRIT_ENABLE_OTEL: $(enableOtel)
                    PYRIT_ENV_SECRET_NAME: $(envSecretName)
                  inputs:
                    azureSubscription: '$(azureServiceConnection)'
                    scriptType: 'bash'
                    scriptLocation: 'scriptPath'
                    scriptPath: '$(Build.SourcesDirectory)/infra/pipelines/deploy_public_nat.sh'