azure-ipam-testing.yml

name: Azure IPAM Testing

run-name: Azure IPAM Deployment & Testing

on:
  pull_request:
    branches: [ main ]

env:
  ACR_NAME: ${{ vars.IPAM_TEST_ACR }}
  IPAM_UI_NAME: ipam-ui-${{ github.run_id }}-${{ github.run_attempt }}
  IPAM_ENGINE_NAME: ipam-engine-${{ github.run_id }}-${{ github.run_attempt }}

jobs:
  deploy:
    name: Deploy Azure IPAM
    runs-on: ubuntu-latest
    outputs:
      ipamURL: ${{ steps.deployScript.outputs.ipamURL }}
      ipamUIAppId: ${{ steps.deployScript.outputs.ipamUIAppId }}
      ipamEngineAppId: ${{ steps.deployScript.outputs.ipamEngineAppId }}
      ipamSuffix: ${{ steps.deployScript.outputs.ipamSuffix }}
      ipamResourceGroup: ${{ steps.deployScript.outputs.ipamResourceGroup }}
    steps:
      - name: Install Deployment Prerequisites
        shell: pwsh
        run: |
          Set-PSRepository PSGallery -InstallationPolicy Trusted
          Install-Module Az, Microsoft.Graph -AllowClobber -Force

      - name: Azure Login
        uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          enable-AzPSSession: true

      - name: Checkout Azure IPAM Code
        uses: actions/checkout@v4
        with:
          sparse-checkout: |
            deploy
            engine
            ui

      - name: Build Azure IPAM Container
        run: |
          az acr build -r $ACR_NAME -t ipam:${{ github.run_id }}-${{ github.run_attempt }} -f ./Dockerfile.deb .

      - name: Update Bicep File
        working-directory: deploy
        shell: pwsh
        run: |
          $acrName = "$env:ACR_NAME.azurecr.io"
          $containerName = "ipam:${{ github.run_id }}-${{ github.run_attempt }}"

          $bicepFile = Get-Content -Path ./modules/appService.bicep

          $bicepFile = $bicepFile -replace "azureipam.azurecr.io", $acrName
          $bicepFile = $bicepFile -replace "ipam:latest", $containerName

          $bicepFile | Out-File -FilePath ./modules/appService.bicep -Force

      - name: Deploy Azure IPAM
        working-directory: deploy
        id: deployScript
        shell: pwsh
        run: ./deploy.ps1 -Location "westus3" -UIAppName $env:IPAM_UI_NAME -EngineAppName $env:IPAM_ENGINE_NAME

      - name: "Upload Logs"
        working-directory: logs
        id: uploadLogs
        env:
          AZURE_IPAM_SUFFIX: ${{ steps.deployScript.outputs.ipamSuffix }}
          STORAGE_ACCT_RG: ${{ vars.LOGGING_STORAGE_RG }}
          STORAGE_ACCT_NAME: ${{ vars.LOGGING_STORAGE_NAME }}
          STORAGE_ACCT_CTR: ${{ vars.LOGGING_STORAGE_CTR }}
        shell: pwsh
        run: |
          $archiveName = "IPAM-RUN(${{ github.run_id }})-ATTEMPT(${{ github.run_attempt }})-SUFFIX($env:AZURE_IPAM_SUFFIX).zip"

          Compress-Archive -Path ./* -DestinationPath /tmp/$archiveName

          $storage = Get-AzStorageAccount -Name $env:STORAGE_ACCT_NAME -ResourceGroupName $env:STORAGE_ACCT_RG
          $context = $storage.Context

          $uploadDetails = @{
            File = "/tmp/$archiveName"
            Container = $env:STORAGE_ACCT_CTR
            Blob = $archiveName
            Context = $context
            StandardBlobTier = "Hot"
          }

          Set-AzStorageBlobContent @uploadDetails

          Write-Output "logFile=$archiveName" >> $Env:GITHUB_OUTPUT

      - name: "Output Azure IPAM Deployment Details"
        env:
          DEPLOYMENT_DETAILS: ${{ steps.uploadLogs.outputs.deployDetails }}
        shell: pwsh
        run: |
          $deployDetails = @{
            GITHUB_RUN_ID = "${{ github.run_id }}(${{ github.run_attempt }})"
            IPAM_SUFFIX = "${{ steps.deployScript.outputs.ipamSuffix }}"
            IPAM_UI_APP_ID = "${{ steps.deployScript.outputs.ipamUIAppId }}"
            IPAM_ENGINE_APP_ID = "${{ steps.deployScript.outputs.ipamEngineAppId }}"
            IPAM_URL = "${{ steps.deployScript.outputs.ipamURL }}"
            IPAM_LOG_FILE = "${{ steps.uploadLogs.outputs.logFile }}"
          }

          Write-Host "-------------------"
          Write-Host "Deployment Details:"
          Write-Host "-------------------"
          Write-Host ($deployDetails | Format-Table | Out-String) -NoNewline
          Write-Host "-------------------"

  test:
    name: Test Azure IPAM
    runs-on: ubuntu-latest
    needs: [ deploy ]
    steps:
      - name: Install Testing Prerequisites
        shell: pwsh
        run: |
          Set-PSRepository PSGallery -InstallationPolicy Trusted
          Install-Module Az, Pester -AllowClobber -Force

      - name: Azure Login
        uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          enable-AzPSSession: true

      - name: Checkout Azure IPAM Code
        uses: actions/checkout@v4
        with:
          sparse-checkout: |
            tests

      - name: Test Azure IPAM w/ Pester
        working-directory: tests
        env:
          IPAM_RESOURCE_GROUP: ${{ needs.deploy.outputs.ipamResourceGroup }}
          IPAM_URL: ${{ needs.deploy.outputs.ipamURL }}
          IPAM_ENGINE_APP_ID: ${{ needs.deploy.outputs.ipamEngineAppId }}
        shell: pwsh
        run: |
          Import-Module Pester -PassThru

          $pesterSettings = @{
            Run = @{
              Path = "./azureipam.tests.ps1"
              PassThru = $true
              SkipRemainingOnFailure = "Run"
            }
            Output = @{
              Verbosity = "Detailed"
            }
          }

          $pesterConfig = New-PesterConfiguration -Hashtable $pesterSettings

          Invoke-Pester -Configuration $pesterConfig

  cleanup:
    name: Cleanup Azure IPAM
    runs-on: ubuntu-latest
    needs: [ deploy, test ]
    steps:
      - name: Install Cleanup Prerequisites
        shell: pwsh
        run: |
          Set-PSRepository PSGallery -InstallationPolicy Trusted
          Install-Module Az -AllowClobber -Force

      - name: Azure Login
        uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          enable-AzPSSession: true

      - name : Remove Azure IPAM Resources
        shell: pwsh
        run: |
          Remove-AzResourceGroup -Name ${{ needs.deploy.outputs.ipamResourceGroup }} -Force

      - name : Remove Azure IPAM Identities
        shell: pwsh
        run: |
          $tenantId = (Get-AzContext).Tenant.Id
          $scope = "/providers/Microsoft.Management/managementGroups/$tenantId"

          $uiApp = Get-AzADApplication -ApplicationId ${{ needs.deploy.outputs.ipamUIAppId }}
          $engineApp = Get-AzADApplication -ApplicationId ${{ needs.deploy.outputs.ipamEngineAppId }}
          $engineSpn = Get-AzADServicePrincipal -ApplicationId ${{ needs.deploy.outputs.ipamEngineAppId }}

          Remove-AzRoleAssignment -ObjectId $engineSpn.Id -Scope $scope -RoleDefinitionName Reader

          $engineSpn | Remove-AzADServicePrincipal
          $uiApp | Remove-AzADApplication
          $engineApp | Remove-AzADApplication

      - name: "Remove Azure IPAM Container"
        run: |
          az acr repository delete --name $ACR_NAME --repository ipam --yes