name: Bicep
on:
  pull_request:
  push:
    branches: ["main"]

env:
  CLASS_RG: rg-hyf-students

jobs:
  what-if:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
      - name: Preview deployment
        run: |
          az deployment group what-if \
            --resource-group "$CLASS_RG" \
            --template-file main.bicep \
            --parameters \
              storageName=sthyfyourname \
              dbAdminPassword=not-a-real-secret | tee whatif.txt

      - name: Post the preview on the pull request
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          {
            echo '### Bicep `what-if` preview'
            echo '```'
            cat whatif.txt
            echo '```'
          } > comment.md
          gh pr comment ${{ github.event.pull_request.number }} --body-file comment.md

  deploy:
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
      - name: Apply deployment
        run: |
          az deployment group create \
            --resource-group "$CLASS_RG" \
            --template-file main.bicep \
            --parameters \
              storageName=sthyfyourname \
              dbAdminPassword=not-a-real-secret