refactor: move development work into separate pipeline file

revert original pipeline back

experiment-pipeline.yml

@@ -0,0 +1,97 @@
+trigger:
+  # automatically runs on pull requests
+  # https://docs.microsoft.com/en-us/azure/devops/pipelines/repos/github?view=azure-devops&tabs=yaml#pr-triggers
+  branches:
+    include:
+      - dev
+      - test
+      - prod
+  tags:
+    include:
+      - 20??.??.?
+  # only run for changes to Terraform files
+  paths:
+    include:
+      - experiment-*
+stages:
+  - stage: terraform
+    pool:
+      vmImage: ubuntu-latest
+    jobs:
+      - job: terraform
+        variables:
+          - name: OTHER_SOURCE
+            value: $[variables['System.PullRequest.SourceBranch']]
+          - name: INDIVIDUAL_SOURCE
+            value: $[variables['Build.SourceBranchName']]
+          - name: IS_TAG
+            value: $[startsWith(variables['Build.SourceBranch'], 'refs/tags/')]
+          - name: TARGET
+            value: $[variables['System.PullRequest.TargetBranch']]
+        steps:
+          - bash: |
+              echo $(IS_TAG)
+          # set the workspace variable at runtime (rather than build time) so that all the necessary variables are available, and we can use Python
+          # https://learn.microsoft.com/en-us/azure/devops/pipelines/process/set-variables-scripts?view=azure-devops&tabs=bash#about-tasksetvariable
+          - bash: |
+              WORKSPACE=$(python experiment-workspace.py)
+              echo "##vso[task.setvariable variable=workspace]$WORKSPACE"
+            displayName: Determine deployment environment
+            env:
+              REASON: $(Build.Reason)
+          # https://github.com/microsoft/azure-pipelines-terraform/tree/main/Tasks/TerraformInstaller#readme
+          - task: TerraformInstaller@0
+            displayName: Install Terraform
+            inputs:
+              terraformVersion: 1.3.1
+          # https://github.com/microsoft/azure-pipelines-terraform/tree/main/Tasks/TerraformTask/TerraformTaskV3#readme
+          - task: TerraformTaskV3@3
+            displayName: Terraform init
+            inputs:
+              provider: azurerm
+              command: init
+              workingDirectory: "$(System.DefaultWorkingDirectory)/terraform"
+              # https://developer.hashicorp.com/terraform/tutorials/automation/automate-terraform#automated-terraform-cli-workflow
+              commandOptions: -input=false
+              # service connection
+              backendServiceArm: deployer
+              # needs to match main.tf
+              backendAzureRmResourceGroupName: courtesy-cards-eligibility-terraform
+              backendAzureRmStorageAccountName: courtesycardsterraform
+              backendAzureRmContainerName: tfstate
+              backendAzureRmKey: terraform.tfstate
+          - task: TerraformTaskV3@3
+            displayName: Select environment
+            inputs:
+              provider: azurerm
+              command: custom
+              customCommand: workspace
+              commandOptions: select $(workspace)
+              workingDirectory: "$(System.DefaultWorkingDirectory)/terraform"
+              # service connection
+              environmentServiceNameAzureRM: deployer
+          - task: TerraformTaskV3@3
+            displayName: Terraform plan
+            inputs:
+              provider: azurerm
+              command: plan
+              # wait for lock to be released, in case being used by another pipeline run
+              # https://discuss.hashicorp.com/t/terraform-plan-wait-for-lock-to-be-released/6870/2
+              commandOptions: -input=false -lock-timeout=5m
+              workingDirectory: "$(System.DefaultWorkingDirectory)/terraform"
+              # service connection
+              environmentServiceNameAzureRM: deployer
+            # the plan is done as part of the apply (below), so don't bother doing it twice
+            condition: notIn(variables['Build.SourceBranchName'], 'dev', 'test', 'prod')
+          - task: TerraformTaskV3@3
+            displayName: Terraform apply
+            inputs:
+              provider: azurerm
+              command: apply
+              # (ditto the lock comment above)
+              commandOptions: -input=false -lock-timeout=5m
+              workingDirectory: "$(System.DefaultWorkingDirectory)/terraform"
+              # service connection
+              environmentServiceNameAzureRM: deployer
+            # only run on certain branches
+            condition: in(variables['Build.SourceBranchName'], 'dev', 'test', 'prod')

experiment-workspace.py

@@ -0,0 +1,36 @@
+import os
+import re
+import sys
+
+REASON = os.environ["REASON"]
+# the name of the variable that Azure Pipelines uses for the source branch depends on the type of run, so need to check both
+SOURCE = os.environ.get("OTHER_SOURCE") or os.environ["INDIVIDUAL_SOURCE"]
+TARGET = os.environ["TARGET"]
+IS_TAG = os.environ["IS_TAG"]
+
+# the branches that correspond to environments
+ENV_BRANCHES = ["dev", "test", "prod"]
+
+if REASON == "PullRequest" and TARGET in ENV_BRANCHES:
+    # it's a pull request against one of the environment branches, so use the target branch
+    environment = TARGET
+elif REASON in ["IndividualCI", "Manual"] and SOURCE in ENV_BRANCHES:
+    # it's being run on one of the environment branches, so use that
+    environment = SOURCE
+elif REASON in ["IndividualCI"] and IS_TAG and re.fullmatch(r"20\d\d.\d\d.\d*", SOURCE):
+    environment = "test"
+else:
+    # default to running against dev
+    environment = "dev"
+
+# matching logic in ../init.sh
+workspace = "default" if environment == "prod" else environment
+
+# just for troubleshooting
+if TARGET is not None:
+    deployment_description = f"from {SOURCE} to {TARGET}"
+else:
+    deployment_description = f"for {SOURCE}"
+print(f"Deploying {deployment_description} as a result of {REASON} using workspace {workspace}", file=sys.stderr)
+
+print(workspace)

terraform/pipeline/azure-pipelines.yml

@@ -6,9 +6,6 @@ trigger:
       - dev
       - test
       - prod
-  tags:
-    include:
-      - 20??.??.?
   # only run for changes to Terraform files
   paths:
     include:
@@ -24,13 +21,9 @@ stages:
             value: $[variables['System.PullRequest.SourceBranch']]
           - name: INDIVIDUAL_SOURCE
             value: $[variables['Build.SourceBranchName']]
-          - name: IS_TAG
-            value: $[startsWith(variables['Build.SourceBranch'], 'refs/tags/')]
           - name: TARGET
             value: $[variables['System.PullRequest.TargetBranch']]
         steps:
-          - bash: |
-              echo $(IS_TAG)
           # set the workspace variable at runtime (rather than build time) so that all the necessary variables are available, and we can use Python
           # https://learn.microsoft.com/en-us/azure/devops/pipelines/process/set-variables-scripts?view=azure-devops&tabs=bash#about-tasksetvariable
           - bash: |

terraform/pipeline/workspace.py

@@ -1,12 +1,10 @@
 import os
-import re
 import sys
 
 REASON = os.environ["REASON"]
 # the name of the variable that Azure Pipelines uses for the source branch depends on the type of run, so need to check both
 SOURCE = os.environ.get("OTHER_SOURCE") or os.environ["INDIVIDUAL_SOURCE"]
 TARGET = os.environ["TARGET"]
-IS_TAG = os.environ["IS_TAG"]
 
 # the branches that correspond to environments
 ENV_BRANCHES = ["dev", "test", "prod"]
@@ -17,8 +15,6 @@
 elif REASON in ["IndividualCI", "Manual"] and SOURCE in ENV_BRANCHES:
     # it's being run on one of the environment branches, so use that
     environment = SOURCE
-elif REASON in ["IndividualCI"] and IS_TAG and re.fullmatch(r"20\d\d.\d\d.\d*", SOURCE):
-    environment = "test"
 else:
     # default to running against dev
     environment = "dev"