.azure/applications/graphql/main.bicep

@@ -0,0 +1,83 @@
+targetScope = 'resourceGroup'
+
+@minLength(3)
+param imageTag string
+@minLength(3)
+param environment string
+@minLength(3)
+param location string
+
+@minLength(3)
+@secure()
+param containerAppEnvironmentName string
+@minLength(3)
+@secure()
+param appInsightConnectionString string
+@minLength(5)
+@secure()
+param appConfigurationName string
+@minLength(3)
+@secure()
+param environmentKeyVaultName string
+
+var namePrefix = 'dp-be-${environment}'
+var baseImageUrl = 'ghcr.io/digdir/dialogporten-'
+
+resource appConfiguration 'Microsoft.AppConfiguration/configurationStores@2023-03-01' existing = {
+  name: appConfigurationName
+}
+
+resource containerAppEnvironment 'Microsoft.App/managedEnvironments@2023-05-01' existing = {
+  name: containerAppEnvironmentName
+}
+
+var containerAppEnvVars = [
+  {
+    name: 'ASPNETCORE_ENVIRONMENT'
+    value: environment
+  }
+  {
+    name: 'APPLICATIONINSIGHTS_CONNECTION_STRING'
+    value: appInsightConnectionString
+  }
+  {
+    name: 'AZURE_APPCONFIG_URI'
+    value: appConfiguration.properties.endpoint
+  }
+]
+
+resource environmentKeyVaultResource 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
+  name: environmentKeyVaultName
+}
+
+var containerAppName = '${namePrefix}-graphql-ca'
+
+module containerApp '../../modules/containerApp/main.bicep' = {
+  name: containerAppName
+  params: {
+    name: containerAppName
+    image: '${baseImageUrl}graphql:${imageTag}'
+    location: location
+    envVariables: containerAppEnvVars
+    containerAppEnvId: containerAppEnvironment.id
+  }
+}
+
+module keyVaultReaderAccessPolicy '../../modules/keyvault/addReaderRoles.bicep' = {
+  name: 'keyVaultReaderAccessPolicy-${containerAppName}'
+  params: {
+    keyvaultName: environmentKeyVaultResource.name
+    principalIds: [containerApp.outputs.identityPrincipalId]
+  }
+}
+
+module appConfigReaderAccessPolicy '../../modules/appConfiguration/addReaderRoles.bicep' = {
+  name: 'appConfigReaderAccessPolicy-${containerAppName}'
+  params: {
+    appConfigurationName: appConfigurationName
+    principalIds: [containerApp.outputs.identityPrincipalId]
+  }
+}
+
+output name string = containerApp.outputs.name
+output revisionName string = containerApp.outputs.revisionName

.azure/applications/graphql/staging.bicepparam

@@ -0,0 +1,11 @@
+using './main.bicep'
+
+param environment = 'staging'
+param location = 'norwayeast'
+param imageTag = readEnvironmentVariable('IMAGE_TAG')
+
+// secrets
+param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_NAME')
+param containerAppEnvironmentName = readEnvironmentVariable('CONTAINER_APP_ENVIRONMENT_NAME')
+param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING')
+param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME')

.azure/applications/graphql/test.bicepparam

@@ -0,0 +1,11 @@
+using './main.bicep'
+
+param environment = 'test'
+param location = 'norwayeast'
+param imageTag = readEnvironmentVariable('IMAGE_TAG')
+
+// secrets
+param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_NAME')
+param containerAppEnvironmentName = readEnvironmentVariable('CONTAINER_APP_ENVIRONMENT_NAME')
+param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING')
+param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME')

.azure/modules/applicationInsights/create.bicep

@@ -7,7 +7,7 @@ type Sku = {
 }
 param sku Sku
 
-resource appInsightsWorkspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
+resource appInsightsWorkspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
     name: '${namePrefix}-insightsWorkspace'
     location: location
     properties: {

.azure/modules/containerApp/main.bicep

@@ -3,7 +3,7 @@ param envVariables array = []
 param port int = 8080
 param name string
 param image string
-param apimIp string
+param apimIp string?
 
 param containerAppEnvId string
 
@@ -28,16 +28,20 @@ var probes = [
   }
 ]
 
+var ipSecurityRestrictions = empty(apimIp)
+  ? []
+  : [
+      {
+        name: 'apim'
+        action: 'Allow'
+        ipAddressRange: apimIp!
+      }
+    ]
+
 var ingress = {
   targetPort: port
   external: true
-  ipSecurityRestrictions: [
-    {
-      name: 'apim'
-      action: 'Allow'
-      ipAddressRange: apimIp
-    }
-  ]
+  ipSecurityRestrictions: ipSecurityRestrictions
 }
 
 resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {

.azure/modules/containerAppEnv/main.bicep

@@ -3,7 +3,7 @@ param namePrefix string
 
 param appInsightWorkspaceName string
 
-resource appInsightsWorkspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' existing = {
+resource appInsightsWorkspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' existing = {
   name: appInsightWorkspaceName
 }
 

.github/ISSUE_TEMPLATE/bug.md

@@ -1,22 +1,22 @@
 ---
 name: Bug
-about: Hvis du finner noe som ikke fungerer som det skal.
+about: If you find something that is not working as it should.
 title: ''
 labels: bug
 assignees: ''
 ---
 
-### Beskrivelse
-En kort og konsis beskrivelse av feilen
+### Description
+A short and concise description of the error
 
-### Reproduksjon
-Punktvise steg for å reprodusere feilen, med informasjon om hvilke requests som ble foretatt (URL-er med parametre, metoder, headers (ikke tokens!), inklusive evt DTO-er som ble brukt hvis POST/PUT/PATCH)
+### Reproduction
+Step-by-step instructions to reproduce the error, with information about the requests that were made (URLs with parameters, methods, headers (no tokens!), including any DTOs used if POST/PUT/PATCH)
 
-### Forventet oppførsel
-En kort og konsis beskrivelse av hva du forventet skulle skje
+### Expected behavior
+A short and concise description of what you expected to happen
 
-### Faktisk oppførsel
-En kort og konsis beskrivelse av hva som faktisk skjedde
+### Actual behavior
+A short and concise description of what actually happened
 
-### Ytterligere informasjon
-Hvis det er ytterligere kontekst som er relevant å ta med.
+### Additional information
+If there is additional context that is relevant to include.

.github/ISSUE_TEMPLATE/new-change-in-functionality.md

@@ -0,0 +1,35 @@
+---
+name: New/change of functionality
+about: New or changed functionality
+title: ''
+labels: ''
+assignees: ''
+projects: ['digdir/7']
+---
+
+### Introduction
+A short and concise description of the functionality this issue addresses.
+
+### Description
+A longer description that accounts for the need, and describes how the functionality should work in detail (in prose form, see also acceptance criteria).
+
+If this is functionality that does not have a clear solution, tag the issue with `analysis`. The task list then consists of clarification questions.
+
+### Implementation
+If there are guidelines on architecture or other implementation choices, they are added here. Different approaches can also be discussed here.
+
+```[tasklist]
+### Tasks
+- [ ] Implementation tasks are added here
+- [ ] Prepare documentation (if relevant - either update working document, or add a new file in `docs`)
+- [ ] Add e2e-test (if relevant)
+```
+
+### Acceptance criteria
+_GIVEN_ ...
+_WHEN_ ....
+_THEN_ ...
+
+_GIVEN_ ...
+_WHEN_ ....
+_THEN_ ...

.github/workflows/action-check-for-changes.yml

@@ -12,6 +12,9 @@ on:
       hasSlackNotifierChanges:
         description: "Slack Notifier function related files changed"
         value: ${{ jobs.check-for-changes.outputs.hasSlackNotifierChanges }}
+      hasMigrationChanges:
+        description: "Migration related files changed"
+        value: ${{ jobs.check-for-changes.outputs.hasMigrationChanges }}
 jobs:
   check-for-changes:
     name: Filter
@@ -20,7 +23,7 @@ jobs:
       hasBackendChanges: ${{ steps.filter.outputs.backend_any_changed == 'true' }}
       hasAzureChanges: ${{ steps.filter.outputs.azure_any_changed == 'true' }}
       hasSlackNotifierChanges: ${{ steps.filter.outputs.slackNotifier_any_changed == 'true'}}
-
+      hasMigrationChanges: ${{ steps.filter.outputs.migration_any_changed == 'true'}}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -43,3 +46,5 @@ jobs:
             slackNotifier:
               - '.github/**/*'
               - 'src/Digdir.Tool.Dialogporten.SlackNotifier/**/*'
+            migration: 
+              - 'src/Digdir.Domain.Dialogporten.Infrastructure/Persistence/Migrations/**/*'

.github/workflows/action-deploy-apps.yml

@@ -37,6 +37,11 @@ on:
         description: "Current version to use as tag"
         required: true
         type: string
+      runMigration:
+        description: "If true, the migration job will be run."
+        required: false
+        type: boolean
+        default: false
 concurrency:
   # Existing runs are cancelled if someone repeatedly commits to their own Pull Request (PR). However, it does not stop others' dry runs or actual deployments from the main branch.
   # Also, the cancellation does not occur on merges to the main branch. Therefore, if multiple merges to main are performed simultaneously, they will just be queued up.
@@ -47,6 +52,7 @@ jobs:
   deploy-migration-job:
     name: Deploy migration job to ${{ inputs.environment }}
     runs-on: ubuntu-latest
+    if: ${{ inputs.runMigration }}
     environment: ${{inputs.environment}}
     permissions:
       id-token: write
@@ -56,7 +62,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: OIDC Login to Azure Public Cloud
-        uses: azure/login@v1
+        uses: azure/login@v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -108,13 +114,16 @@ jobs:
   deploy-apps:
     name: Deploy ${{ matrix.name }} to ${{ inputs.environment }}
     runs-on: ubuntu-latest
+    # Should run even though the migration job was skipped
+    if: ${{ always() && !failure() && !cancelled() }}
     needs: deploy-migration-job
     strategy:
       fail-fast: true
       matrix:
         include:
           - name: web-api-eu
           - name: web-api-so
+          - name: graphql
     environment: ${{ inputs.environment }}
     permissions:
       id-token: write

.github/workflows/action-publish.yml

@@ -27,6 +27,8 @@ jobs:
         include:
           - dockerfile: ./src/Digdir.Domain.Dialogporten.WebApi/Dockerfile
             imageName: webapi
+          - dockerfile: ./src/Digdir.Domain.Dialogporten.GraphQL/Dockerfile
+            imageName: graphql
           - dockerfile: ./src/Digdir.Domain.Dialogporten.Service/Dockerfile
             imageName: service
           - dockerfile: ./src/Digdir.Domain.Dialogporten.ChangeDataCapture/Dockerfile