publish-module.yml

name: Publish module

on:
  workflow_call:
    inputs:
      tag:
        description: "The git tag of the module to publish."
        required: true
        type: string
    secrets:
      # Secrets must be passed from the caller workflow explicitly.
      PUBLISH_CLIENT_ID:
        required: true
      PUBLISH_TENANT_ID:
        required: true
      PUBLISH_SUBSCRIPTION_ID:
        required: true
      PUBLISH_REGISTRY_SERVER:
        required: true
  workflow_dispatch:
    inputs:
      tag:
        description: "The git tag of the module to publish."
        required: true
        type: string

permissions:
  id-token: write
  contents: read

jobs:
  main:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      - name: Parse tag
        id: parse-tag
        uses: actions/github-script@v6
        with:
          result-encoding: string
          script: |
            const script = require("./scripts/github-actions/parse-tag.js")
            const tag = "${{ github.event.inputs.tag || inputs.tag }}"
            script({ core, tag })

      - name: Checkout tag
        uses: actions/checkout@v2
        with:
          # Input contexts for workflow_dispatch and workflow_call are inconsistent.
          # For workflow_dispatch, use ${{ github.event.inputs.<variable_name> }}
          # For workflow_call, use ${{ inputs.<variable_name> }}
          ref: ${{ github.event.inputs.tag || inputs.tag }}

      - name: Log in to Azure
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.PUBLISH_CLIENT_ID }}
          tenant-id: ${{ secrets.PUBLISH_TENANT_ID }}
          subscription-id: ${{ secrets.PUBLISH_SUBSCRIPTION_ID }}

      # Adding a step to explicitly install the latest Bicep CLI because there is
      # always a delay in updating Bicep CLI in the job runner environments.
      - name: Install the latest Bicep CLI
        run: |
          curl -Lo bicep https://github.com/Azure/bicep/releases/latest/download/bicep-linux-x64
          chmod +x ./bicep
          sudo mv ./bicep /usr/local/bin/bicep
          bicep --version

      - name: Publish module
        run: bicep publish "modules/${{ steps.parse-tag.outputs.module_path }}/main.json" --target "br:${{ secrets.PUBLISH_REGISTRY_SERVER }}/public/bicep/${{ steps.parse-tag.outputs.module_path }}:${{ steps.parse-tag.outputs.version }}"