name: Tests

permissions:
  id-token: write
  contents: write

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  bicep:
    name: Deploy Azure resources
    environment: bicep
    runs-on: ubuntu-latest
    concurrency:
      group: bicep
    env:
      LOCATION: eastus
      DEPLOYMENT_NAME: keyweave-${{ github.run_id }}
    steps:
      - uses: actions/checkout@v3
      - name: Fetch complete history
        run: git fetch --prune --unshallow
      - name: Check for deployed tag
        id: check_tag
        run: |
          if git rev-parse --verify deployed >/dev/null 2>&1; then
            echo "DEPLOYED_TAG_EXISTS=true" >> $GITHUB_ENV
            echo "LAST_DEPLOYED_COMMIT=$(git rev-list -n 1 deployed)" >> $GITHUB_ENV
          else
            echo "DEPLOYED_TAG_EXISTS=false" >> $GITHUB_ENV
          fi
      - name: Check for changes in bicep folder
        if: env.DEPLOYED_TAG_EXISTS == 'true'
        run: |
          if git diff --quiet $LAST_DEPLOYED_COMMIT HEAD -- bicep/ ; then
            echo "NO_CHANGES=true" >> $GITHUB_ENV
          else
            echo "NO_CHANGES=false" >> $GITHUB_ENV
          fi
      - if: env.DEPLOYED_TAG_EXISTS == 'false' || env.NO_CHANGES == 'false'
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - if: env.DEPLOYED_TAG_EXISTS == 'false' || env.NO_CHANGES == 'false'
        name: Deploy Bicep template
        uses: azure/arm-deploy@v1
        with:
          scope: subscription
          region: ${{ env.LOCATION }}
          template: bicep/main.bicep
          deploymentName: ${{ env.DEPLOYMENT_NAME }}
      - if: env.DEPLOYED_TAG_EXISTS == 'false' || env.NO_CHANGES == 'false'
        name: Tag Deployment
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          git tag -fa deployed -m "Deployed to Azure"
          git push origin --tags --force

  tests-no-access:
    name: Tests with No Access
    needs: bicep
    runs-on: ubuntu-latest
    environment: test
    steps:
    - uses: actions/checkout@v4
    - uses: dtolnay/rust-toolchain@stable
    - name: 'Az CLI login'
      uses: azure/login@v1
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID_NO_ACCESS }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
    - name: Run all tests
      run: cargo test no_access
  tests-get:
    name: Tests with Get
    needs: bicep
    runs-on: ubuntu-latest
    environment: test
    steps:
    - uses: actions/checkout@v4
    - uses: dtolnay/rust-toolchain@stable
    - name: 'Az CLI login'
      uses: azure/login@v1
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID_GET }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
    - name: Run all tests
      run: cargo test only_get
  tests-list:
    name: Tests with List
    needs: bicep
    runs-on: ubuntu-latest
    environment: test
    steps:
    - uses: actions/checkout@v4
    - uses: dtolnay/rust-toolchain@stable
    - name: 'Az CLI login'
      uses: azure/login@v1
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID_LIST }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
    - name: Run all tests
      run: cargo test only_list
  tests-get-list:
    name: Tests with Get and List
    needs: bicep
    runs-on: ubuntu-latest
    environment: test
    steps:
    - uses: actions/checkout@v4
    - uses: dtolnay/rust-toolchain@stable
    - name: 'Az CLI login'
      uses: azure/login@v1
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID_GET_LIST }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
    - name: Run all tests
      run: cargo test get_and_list_access