deploy.yml

# Builds the app and deploys it to Azure App Service (see infra/main.bicep).
# Authentication uses OpenID Connect: GitHub issues a short-lived token that Azure
# trusts through a federated credential on a managed identity. No secret is stored.
#
# Required repository settings:
#   secrets:   AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID
#   variables: AZURE_WEBAPP_NAME
#
# Docs: https://github.com/Azure/webapps-deploy

name: Build and deploy Node.js app to Azure Web App

on:
  push:
    branches:
      - master
  workflow_dispatch:

concurrency:
  group: deploy-production
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read # required for actions/checkout

    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24.x' # matches the App Service runtime NODE|24-lts

      - name: Install, build, and test
        run: |
          npm ci
          npm run build --if-present
          npm run test --if-present

      - name: Upload artifact for deployment job
        uses: actions/upload-artifact@v4
        with:
          name: node-app
          path: .

  deploy:
    runs-on: ubuntu-latest
    needs: build
    permissions:
      id-token: write # required to request the OIDC token
      contents: read

    steps:
      - name: Download artifact from build job
        uses: actions/download-artifact@v4
        with:
          name: node-app

      - name: Login to Azure
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Deploy to Azure Web App
        id: deploy-to-webapp
        uses: azure/webapps-deploy@v3
        with:
          app-name: ${{ vars.AZURE_WEBAPP_NAME }}
          package: .

      - name: Show deployed URL
        run: echo "Deployed to ${{ steps.deploy-to-webapp.outputs.webapp-url }}"