azure-pipelines.yml

# This pipeline is for CI/CD
name: $(Date:yyyyMMdd)$(Rev:.r)-$(Build.DefinitionVersion)-$(SourceBranchName)-$(Build.BuildId)

trigger: none

pr:
  autoCancel: false
  branches:
    include:
    - main
  drafts: false
  paths:
    exclude:
    - '.devcontainer/**'  
    - 'visuals/**'  
    - '*.md'  

schedules:
- cron: '0 0 * * Fr'
  displayName: 'Weekly build (UTC)'
  # Run if there are no changes
  always: 'true'
  branches:
    include:
    - main

resources:
  repositories:
  - repository: azure-identity-scripts
    type: github
    endpoint: github.com # Service Connection name
    name: geekzter/azure-identity-scripts

variables:
- group: terraform-service-connection

jobs:
- job: 'Provision'
  displayName: 'Provision & Destroy'
  timeoutInMinutes: 120

  pool:
    name: 'Azure Pipelines'
    vmImage: ubuntu-latest

  variables:
    AZURE_CORE_ONLY_SHOW_ERRORS: true
    AZURE_EXTENSION_USE_DYNAMIC_INSTALL: yes_without_prompt
    devRepository: $(Build.SourcesDirectory)/dev-center
    identityRepository: $(Build.SourcesDirectory)/azure-identity-scripts
    identityScriptDirectory: $(identityRepository)/scripts/azure-devops
    repository: dev-center
    # scriptDirectory: $(devRepository)/scripts
    terraformDirectory: $(devRepository)/terraform
    TF_IN_AUTOMATION: true
    TF_INPUT: 0
    TF_VAR_configure_rbac: false
    # TF_VAR_resource_group_name: ${{ split(variables['System.CollectionUri'],'/')[3] }}-dev-center-$(Build.BuildId)
    TF_VAR_resource_group_name: dev-center-$(Build.BuildId)
    TF_VAR_resource_suffix: $(Build.BuildId)
    TF_VAR_run_id: $(Build.BuildId)
    TF_WORKSPACE: ci

  steps:
  - checkout: self
  - checkout: azure-identity-scripts

  - pwsh: terraform init
    displayName: 'Terraform init'
    workingDirectory: '$(terraformDirectory)'

  - task: AzureCLI@2
    displayName: 'Terraform plan & apply'
    name: apply
    inputs:
      azureSubscription: '$(azureConnection)'
      scriptType: pscore
      scriptLocation: inlineScript
      inlineScript: |
        $(identityScriptDirectory)/set_terraform_azurerm_vars.ps1
        terraform apply -auto-approve
      addSpnToEnvironment: true
      failOnStandardError: true
      workingDirectory: '$(terraformDirectory)'
    env: # Maintain casing of Terraform variable names
      TF_VAR_application_name: $(TF_VAR_application_name)
      TF_VAR_application_owner: $(TF_VAR_application_owner)
      TF_VAR_configure_rbac: $(TF_VAR_configure_rbac)
      TF_VAR_resource_group_name: $(TF_VAR_resource_group_name)
      TF_VAR_tags: $(TF_VAR_tags)
      TF_VAR_run_id: $(TF_VAR_run_id)

  - pwsh: |
      Write-Host "##vso[task.setvariable variable=result;isOutput=true]success"
    name: provisioningResult
    displayName: 'Indicate provisioning success'
    condition: succeeded()

  - task: AzureCLI@2
    displayName: 'Terraform destroy'
    condition: succeededOrFailed()
    continueOnError: true # Treat failure as warning during destroy, we will clean up anyway
    inputs:
      azureSubscription: '$(azureConnection)'
      scriptType: pscore
      scriptLocation: inlineScript
      inlineScript: |
        $(identityScriptDirectory)/set_terraform_azurerm_vars.ps1
        terraform destroy -auto-approve
      addSpnToEnvironment: true
      failOnStandardError: true
      workingDirectory: '$(terraformDirectory)'
    env: # Maintain casing of Terraform variable names
      TF_VAR_application_name: $(TF_VAR_application_name)
      TF_VAR_application_owner: $(TF_VAR_application_owner)
      TF_VAR_configure_rbac: $(TF_VAR_configure_rbac)
      TF_VAR_resource_group_name: $(TF_VAR_resource_group_name)
      TF_VAR_tags: $(TF_VAR_tags)
      TF_VAR_run_id: $(TF_VAR_run_id)

  - task: AzureCLI@2
    name: teardown
    displayName: 'Tear down remaining resources'
    condition: or(always(),canceled())
    inputs:
      azureSubscription: '$(azureConnection)'
      scriptType: pscore
      scriptLocation: inlineScript
      inlineScript: |
        $ErrorActionPreference = "Continue" # Continue to remove resources if remove by resource group fails
        # Build JMESPath expression
        $tagQuery = "[?tags.repository == '$(repository)' && tags.workspace == '$(TF_WORKSPACE)' && tags.runid == '$(Build.BuildId)' && properties.provisioningState != 'Deleting'].id"
        Write-Host "Removing resources identified by `"$tagQuery`"..."

        # Remove resource groups
        $resourceGroupIDs = $(az group list --query "${tagQuery}" -o tsv)
        if ($resourceGroupIDs) {
          Write-Host "Removing resource group(s) `"${resourceGroupIDs}`"..."
          &{ # az writes information to stderr
            $ErrorActionPreference = 'SilentlyContinue'
            az resource delete --ids $resourceGroupIDs 2>&1
          }
        } else {
          Write-Host "No resource groups to remove"
        }

        # Remove (remaining) resources
        $resourceIDs = $(az resource list --query "${tagQuery}" -o tsv)
        if ($resourceIDs) {
          Write-Host "Removing resources `"${resourceIDs}`"..."
          &{ # az writes information to stderr
            $ErrorActionPreference = 'SilentlyContinue'
            az resource delete --ids $resourceIDs 2>&1
          }
        } else {
          Write-Host "No resources to remove"
        }
      failOnStandardError: true

  - task: AzureResourceGroupDeployment@2
    displayName: 'Delete $(TF_VAR_resource_group_name)'
    condition: or(failed(),canceled()) # Try this if the previous approach failed
    inputs:
      azureSubscription: '$(azureConnection)'
      action: 'deleteRG'
      resourceGroupName: '$(TF_VAR_resource_group_name)'