deployMcpServer.yml

name: Deploy AFL MCP Server

on:
    pull_request:
        branches:
            - main

permissions:
    contents: read
    id-token: write
    pull-requests: write

env:
  DOTNET_VERSION: 9.0.x
  COVERAGE_PATH: ${{ github.workspace }}/coverage

jobs:
    env-setup:
        name: Setup Environment
        runs-on: ubuntu-latest
        outputs:
          dotnet-version: ${{ steps.set-output-defaults.outputs.dotnet-version }}
          coverage-path: ${{ steps.set-output-defaults.outputs.coverage-path }}
        steps:
          - name: set outputs with default values
            id: set-output-defaults
            run: |
              echo "dotnet-version=${{ env.DOTNET_VERSION }}" >> "$GITHUB_OUTPUT"
              echo "coverage-path=${{ env.COVERAGE_PATH }}" >> "$GITHUB_OUTPUT"

    test-and-coverage:
      name: Run Tests and Generate Coverage
      needs: env-setup
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v4
          name: Checkout code

        - name: Setup .NET
          uses: actions/setup-dotnet@v5
          with:
            dotnet-version: ${{ needs.env-setup.outputs.dotnet-version }}

        - name: Restore dependencies
          run: dotnet restore src/mcp-afl-server.sln

        - name: Build solution
          run: dotnet build src/mcp-afl-server.sln --configuration Release --no-restore

        - name: Create coverage directory
          run: mkdir -p ${{ needs.env-setup.outputs.coverage-path }}

        - name: Run unit tests
          run: dotnet test ./test/mcp-afl-server.UnitTests/mcp-afl-server.UnitTests.csproj --configuration Release --verbosity normal --collect:"XPlat Code Coverage" --logger trx --results-directory ${{ needs.env-setup.outputs.coverage-path }}

        - name: Merge Code Coverage reports
          run: |
                dotnet tool install -g dotnet-reportgenerator-globaltool
                reportgenerator "-reports:${{ needs.env-setup.outputs.coverage-path }}/**/coverage.cobertura.xml" "-targetdir:${{ needs.env-setup.outputs.coverage-path }}" -reporttypes:Cobertura

        - name: Code Coverage Report
          uses: irongut/CodeCoverageSummary@v1.3.0
          with:
                filename: coverage/Cobertura.xml
                badge: true
                fail_below_min: false
                format: markdown
                hide_branch_rate: false
                hide_complexity: true
                indicators: true
                output: both
                thresholds: '60 80'
        
    build-container-image:
        name: Build Docker Image
        needs: test-and-coverage
        runs-on: ubuntu-latest
        outputs:
            loginServer: ${{ steps.getacrserver.outputs.loginServer }}
        defaults:
            run:
                working-directory: './src'
        steps:
            - uses: actions/checkout@v4
              name: Checkout code

            - uses: azure/login@v2
              name: Login to Azure
              with:
                client-id: ${{ secrets.AZURE_CLIENT_ID }}
                tenant-id: ${{ secrets.AZURE_TENANT_ID }}
                subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

            - name: Set up Docker buildx
              uses: docker/setup-buildx-action@v3

            - name: Get ACR name
              id: getacrname
              run: |
                acrName=$(az acr list --resource-group ${{ secrets.RG_NAME }} --query "[0].name" -o tsv)
                echo "acrName=$acrName" >> "$GITHUB_OUTPUT"

            - name: Get ACR Server
              id: getacrserver
              run: |
                loginServer=$(az acr list --resource-group ${{ secrets.RG_NAME }} --query "[0].loginServer" -o tsv)
                echo "loginServer=$loginServer" >> "$GITHUB_OUTPUT"
                
            - name: Login to Azure Container Registry
              run: az acr login --name ${{ steps.getacrname.outputs.acrName }}

            - name: Build Docker Image
              run: |
                docker build -t ${{ steps.getacrserver.outputs.loginServer }}/afl-mcp-server:${{ github.sha }} .

            - name: Push Docker Image
              run: |
                docker push ${{ steps.getacrserver.outputs.loginServer }}/afl-mcp-server:${{ github.sha }}

    lint-bicep:
        name: Run Bicep Linter
        needs: test-and-coverage
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v4
              name: Checkout code
            
            - name: Run Bicep Linter
              run: az bicep build --file './infra/deployMcpServer.bicep'

    validate-bicep:
        name: Validate Bicep Template
        needs: [lint-bicep, build-container-image]
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v4
              name: Checkout code

            - uses: azure/login@v2
              name: Login to Azure
              with:
                client-id: ${{ secrets.AZURE_CLIENT_ID }}
                tenant-id: ${{ secrets.AZURE_TENANT_ID }}
                subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

            - uses: azure/bicep-deploy@v2
              name: Run preflight validation
              with:
                type: deployment
                scope: subscription
                location: australiaeast
                subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
                name: ${{ github.run_number }}
                template-file: './infra/deployMcpServer.bicep'
                parameters-file: './infra/parameters.deployMcpServer.bicepparam'
                operation: validate

    preview-bicep:
        name: Preview Bicep Deployment
        needs: [lint-bicep, build-container-image, validate-bicep]
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v4
              name: Checkout code
            
            - uses: azure/login@v2
              name: Login to Azure
              with:
                client-id: ${{ secrets.AZURE_CLIENT_ID }}
                tenant-id: ${{ secrets.AZURE_TENANT_ID }}
                subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

            - uses: azure/bicep-deploy@v2
              name: Perform What-If
              with:
                type: deployment
                operation: whatIf
                scope: subscription
                validation-level: 'providerNoRbac'
                subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
                location: australiaeast
                name: ${{ github.run_number }}
                template-file: './infra/deployMcpServer.bicep'
                parameters-file: './infra/parameters.deployMcpServer.bicepparam'
                parameters: '{"imageName": "${{ needs.build-container-image.outputs.loginServer}}/afl-mcp-server:${{ github.sha }}", "emailAddress": "${{ secrets.EMAIL_ADDRESS }}"}'

    deploy-mcp-server:
        name: Deploy MCP Server
        needs: [lint-bicep, build-container-image, validate-bicep, preview-bicep]
        runs-on: ubuntu-latest
        environment: prod
        steps:
            - uses: actions/checkout@v4
              name: Checkout code
            
            - uses: azure/login@v2
              name: Login to Azure
              with:
                client-id: ${{ secrets.AZURE_CLIENT_ID }}
                tenant-id: ${{ secrets.AZURE_TENANT_ID }}
                subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

            - uses: azure/bicep-deploy@v2
              name: Deploy Bicep Template
              with:
                type: deployment
                operation: create
                scope: subscription
                subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
                location: australiaeast
                name: ${{ github.run_number }}
                template-file: './infra/deployMcpServer.bicep'
                parameters-file: './infra/parameters.deployMcpServer.bicepparam'
                parameters: '{"imageName": "${{ needs.build-container-image.outputs.loginServer}}/afl-mcp-server:${{ github.sha }}", "emailAddress": "${{ secrets.EMAIL_ADDRESS }}"}'