name: Deploy Azure Applications

on:
  workflow_dispatch:
    inputs:
      environment:
        description: "Deployment environment (must match a configured GitHub Environment)"
        required: true
        type: string
      component:
        description: "Which component to deploy"
        required: true
        default: "all"
        type: choice
        options:
          - all
          - funcapi
          - funcqueue
          - titiler
          - swa
      training_image_tag:
        description: "Training image tag (blank = resolved hastegeo version)"
        required: false
        default: ""
        type: string
      imageprep_image_tag:
        description: "Imageryprep image tag (blank = resolved hastegeo version)"
        required: false
        default: ""
        type: string
      app_tag:
        description: "Application version tag"
        required: true
        type: string
      hastegeo_version:
        description: "hastegeo wheel version to deploy (blank = latest stable release)"
        required: false
        default: ""
        type: string

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    permissions:
      id-token: write
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "24"
      - name: Install tools
        run: |
          curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg
          sudo mv microsoft.gpg /etc/apt/trusted.gpg.d/microsoft.gpg
          sudo sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/repos/microsoft-ubuntu-$(lsb_release -cs)-prod $(lsb_release -cs) main" > /etc/apt/sources.list.d/dotnetdev.list'
          sudo apt-get update
          sudo apt-get install git-lfs -y
          git lfs env
          sudo apt-get install azure-functions-core-tools-4 jq git-lfs -y
          npm install -g @azure/static-web-apps-cli@2.0.9

      - name: Resolve hastegeo wheel URL
        id: hastegeo
        if: >-
          inputs.component == 'all' ||
          inputs.component == 'funcapi' ||
          inputs.component == 'funcqueue'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          python .github/scripts/resolve_hastegeo_deploy.py \
            --version "${{ inputs.hastegeo_version }}"

      - name: Resolve matching image tags
        id: artifacts
        env:
          VERSION: ${{ steps.hastegeo.outputs.version }}
          TRAINING_INPUT: ${{ inputs.training_image_tag }}
          IMAGEPREP_INPUT: ${{ inputs.imageprep_image_tag }}
        run: |
          TRAINING_TAG="${TRAINING_INPUT:-$VERSION}"
          IMAGEPREP_TAG="${IMAGEPREP_INPUT:-$VERSION}"
          if [[ "$VERSION" == *rc* ]]; then
            if [[ "$TRAINING_TAG" != "$VERSION" || \
                  "$IMAGEPREP_TAG" != "$VERSION" ]]; then
              echo "::error::RC deployments require matching wheel and image tags"
              exit 1
            fi
          fi
          echo "training_tag=$TRAINING_TAG" >> "$GITHUB_OUTPUT"
          echo "imageprep_tag=$IMAGEPREP_TAG" >> "$GITHUB_OUTPUT"

      - name: Azure Login
        uses: azure/login@1384c340ab2dda50fed2bee3041d1d87018aa5e8 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Git LFS Pull
        run: git lfs pull
      - name: Deploy
        env:
          # Non-sensitive UI feature flag, baked into the Vite bundle at build time.
          # Set as a GitHub Environment variable; defaults to false when unset.
          VITE_SHOW_FOOTER: ${{ vars.VITE_SHOW_FOOTER }}
          # hastegeo wheel pinned into the function-app requirements before
          # `func publish` (deploy_apps.sh); the editable default can't resolve
          # on Azure's remote build.
          HASTEGEO_WHEEL_URL: ${{ steps.hastegeo.outputs.url }}
          # Batch pool wiring. All optional: unset reproduces the legacy
          # single-pool behavior. Stored as environment *secrets* (not
          # variables) so the values are masked in this repo's public
          # Actions logs, matching the other infra-naming config.
          BATCH_TRAINING_POOL_ID: ${{ secrets.BATCH_TRAINING_POOL_ID }}
          BATCH_IMAGERYPREP_POOL_ID: ${{ secrets.BATCH_IMAGERYPREP_POOL_ID }}
          BATCH_TRAINING_POOL_IDS: ${{ secrets.BATCH_TRAINING_POOL_IDS }}
          BATCH_INFERENCE_POOL_IDS: ${{ secrets.BATCH_INFERENCE_POOL_IDS }}
          BATCH_IMAGERYPREP_POOL_IDS: ${{ secrets.BATCH_IMAGERYPREP_POOL_IDS }}
          BATCH_USE_SAS: ${{ secrets.BATCH_USE_SAS }}
          BATCH_MANAGE_POOLS: ${{ secrets.BATCH_MANAGE_POOLS }}
        run: |
          chmod +x .github/scripts/deploy_apps.sh
          .github/scripts/deploy_apps.sh \
            "${{ secrets.AZURE_TENANT_ID }}" \
            "${{ secrets.AZURE_SUBSCRIPTION_ID }}" \
            "${{ secrets.RESOURCE_PREFIX }}" \
            "${{ secrets.LOCATION }}" \
            "${{ secrets.RESOURCE_SUFFIX }}" \
            "${{ secrets.ACR_NAME }}" \
            "${{ steps.artifacts.outputs.training_tag }}" \
            "${{ steps.artifacts.outputs.imageprep_tag }}" \
            "${{ secrets.ENVIRONMENT_TYPE }}" \
            "${{ inputs.app_tag }}" \
            "${{ secrets.BATCH_ACCOUNT }}" \
            "${{ secrets.SHARED_RESOURCE_GROUP }}" \
            "${{ secrets.STATIC_APP_DOMAIN }}" \
            "${{ secrets.EMAIL_CONNECTION_STRING }}" \
            "${{ inputs.component }}"