check_bicep_code.yml

on:
  pull_request:
    branches:
      - master
    paths:
      - 'shared/bicep/*.*'
      - 'app01/bicep/*.*'
      - 'app02/bicep/*.*'
      - 'app03/bicep/*.*'
      - 'app03/dev/bicep/*.*'
      - 'app03/qa/bicep/*.*'
      - 'app03/staging/bicep/*.*'
      - 'app03/prod/bicep/*.*'
name: Check correctness of bicep templates
jobs:
  lint:
    name: Check code syntax
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v3

      - name: Check ipgroups_max
        uses: ./.github/actions/ipgroups_max_bicep
        with:
          file_prefix: 'ipgroups'
          file_extension: 'bicep'
          max_ip_groups: '80'

      - name: Check CIDR prefix length
        uses: ./.github/actions/cidr_prefix_length_bicep
        with:
          file_prefixes: 'ipgroups rcg'
          file_extension: 'bicep'
          min_cidr_length: '24'
          base_dir: './'

      - name: Check Firewall rule priorities
        uses: ./.github/actions/fw_rule_prio_bicep
        with:
          file_prefixes: 'rcg'
          file_extension: 'bicep'
          min_prio: '10000'
          max_prio: '40000'
          base_dir: './'

      # Validate templates
      # Checkout remote repo for app04 (the path is important, the AzFW bicep template expects to find it there)
      - name: Checkout app04 repo
        uses: actions/checkout@v2
        with:
          repository: erjosito/segmentation-iac-app04
          ref: master
          path: './app04'
      # Expand app02's CSV file with NSG rules to JSON
      - name: Expand CSV file with NSG rules to JSON
        run: |
          python3 ./scripts/nsg_csv_to_json.py --csv-file ./app02/bicep/nsg-rules-app02.csv --output-file ./app02/bicep/nsg-rules-app02.json --verbose
      # Login
      - uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
      # Validate templates
      - uses: azure/arm-deploy@v1
        name: Run preflight validation for shared infra
        with:
          resourceGroupName: ${{ secrets.AZURE_RG }}
          template: ./shared/bicep/azfwpolicy.bicep
          deploymentMode: Validate
      - uses: azure/arm-deploy@v1
        name: Run preflight validation for app01 infra
        with:
          resourceGroupName: ${{ secrets.AZURE_RG }}
          template: ./app01/bicep/infra-app01.bicep
          deploymentMode: Validate
      - uses: azure/arm-deploy@v1
        name: Run preflight validation for app02 infra
        with:
          resourceGroupName: ${{ secrets.AZURE_RG }}
          template: ./app01/bicep/infra-app02.bicep
          deploymentMode: Validate
      - uses: azure/arm-deploy@v1
        name: Run preflight validation for app03 DEV infra
        with:
          resourceGroupName: ${{ secrets.AZURE_RG }}
          template: ./app03/dev/bicep/infra-app03-dev.bicep
          deploymentMode: Validate