cd.yaml

name: CD

on:
  pull_request:
    branches: [ main ]
    paths-ignore:
      - 'docs/**'

# Grant permissions to obtain federated identity credentials
# see https://docs.github.com/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-azure
permissions:
  id-token: write
  contents: read

# Update this value with a unique name to guarantee uniqueness of resource names and avoid conflicts between fork repositories when running CD workflow.
# CD workflow creates resources with this prefix and destroy them.
env:
  CD_RESOURCES_PREFIX: mvd

jobs:
  # The purpose of this job is only to set up resources_prefix as an output, because env context is not available in arguments to a called workflow
  # See this discussion for more context: https://github.community/t/reusable-workflow-env-context-not-available-in-jobs-job-id-with/206111/13
  SetResourcesPrefix:
    name: 'Set Resources Prefix'
    runs-on: ubuntu-latest
    # Added a step doing nothing, because a job needs to have at least one step.
    steps:
      - name: 'Empty step.'
        run: exit 0
    outputs:
      resources_prefix: ${{ env.CD_RESOURCES_PREFIX }}${{ github.run_number }}

  Deploy:
    uses: ./.github/workflows/deploy.yaml
    secrets: inherit
    needs: SetResourcesPrefix
    with:
      resources_prefix: ${{ needs.SetResourcesPrefix.outputs.resources_prefix }}

  Destroy:
    # Always run Destroy workflow unless SetResourcesPrefix workflow fails.
    if: ${{ always() && needs.SetResourcesPrefix.result == 'success'}}
    uses: ./.github/workflows/destroy.yaml
    needs:
      - SetResourcesPrefix
      - Deploy
    secrets: inherit
    with:
      resources_prefix: ${{ needs.SetResourcesPrefix.outputs.resources_prefix }}