gui-deploy.yml

# CI/CD pipeline for the CoPyRIT GUI.
#
# App-only test deployment is the default. Infrastructure reconciliation is
# explicit and leaves the running app unchanged before deploying new code.

trigger:
  branches:
    include:
      - main
  paths:
    include:
      - pyrit/backend/**
      - pyrit/memory/**
      - pyrit/cli/pyrit_migrate.py
      - frontend/**
      - docker/**
      - infra/**

pr: none

parameters:
  - name: deployInfra
    displayName: 'Deploy Infrastructure'
    type: boolean
    default: false
  - name: deployToProd
    displayName: 'Deploy to production'
    type: boolean
    default: false

variables:
  azureServiceConnection: 'copyrit-gui-azure'

stages:
  - stage: ValidateInputs
    displayName: 'Validate Inputs'
    pool:
      vmImage: 'ubuntu-latest'
    jobs:
      - job: ValidateProdSource
        displayName: 'Validate production source'
        steps:
          - checkout: none
          - bash: |
              set -euo pipefail
              if [[ '${{ parameters.deployToProd }}' == 'true' \
                && "$BUILD_SOURCEBRANCH" != refs/heads/main ]]; then
                echo "##vso[task.logissue type=error]Production deployment requires a commit merged to refs/heads/main"
                exit 1
              fi
            displayName: 'Validate production source'

  - stage: Build
    displayName: 'Build and Push Image'
    dependsOn: ValidateInputs
    variables:
      - group: copyrit-gui-common
    pool:
      vmImage: 'ubuntu-latest'
    jobs:
      - job: BuildAndPush
        displayName: 'Build and push immutable source image'
        steps:
          - checkout: self
            fetchDepth: 1

          - bash: |
              set -euo pipefail
              df -h /
              docker system df
              docker system prune --all --force
              df -h /
            displayName: 'Reclaim Docker disk space before build'

          - task: AzureCLI@2
            name: BuildImage
            displayName: 'Build and push Docker image'
            env:
              PYRIT_ACR_NAME: $(acrName)
              PYRIT_ACR_LOGIN_SERVER: $(acrLoginServer)
              PYRIT_IMAGE_NAME: $(imageName)
              PYRIT_SOURCE_VERSION: $(Build.SourceVersion)
            inputs:
              azureSubscription: '$(azureServiceConnection)'
              scriptType: 'bash'
              scriptLocation: 'inlineScript'
              inlineScript: |
                set -euo pipefail

                required_variables=(
                  PYRIT_ACR_NAME
                  PYRIT_ACR_LOGIN_SERVER
                  PYRIT_IMAGE_NAME
                  PYRIT_SOURCE_VERSION
                )
                for variable_name in "${required_variables[@]}"; do
                  if [[ -z "${!variable_name:-}" || "${!variable_name}" == '$('* ]]; then
                    echo "##vso[task.logissue type=error]Required build value is missing: $variable_name"
                    exit 1
                  fi
                done

                repository_pattern='^[a-z0-9]+([._-][a-z0-9]+)*(/[a-z0-9]+([._-][a-z0-9]+)*)*$'
                if [[ ! "$PYRIT_ACR_NAME" =~ ^[a-z0-9]{5,50}$ \
                  || "$PYRIT_ACR_LOGIN_SERVER" != "$PYRIT_ACR_NAME.azurecr.io" \
                  || ! "$PYRIT_IMAGE_NAME" =~ $repository_pattern \
                  || ! "$PYRIT_SOURCE_VERSION" =~ ^[0-9a-fA-F]{40}$ ]]; then
                  echo "##vso[task.logissue type=error]Invalid registry, repository, or source version"
                  exit 1
                fi

                source_commit=$(git rev-parse HEAD)
                if [[ "$source_commit" != "$PYRIT_SOURCE_VERSION" || -n "$(git status --porcelain)" ]]; then
                  echo "##vso[task.logissue type=error]Published images require a clean checkout at the source commit"
                  exit 1
                fi

                docker build \
                  -f .devcontainer/Dockerfile \
                  -t pyrit-devcontainer \
                  .devcontainer/

                image="$PYRIT_ACR_LOGIN_SERVER/$PYRIT_IMAGE_NAME:$PYRIT_SOURCE_VERSION"
                docker build --no-cache \
                  -f docker/Dockerfile \
                  -t "$image" \
                  --build-arg BASE_IMAGE=pyrit-devcontainer \
                  --build-arg PYRIT_SOURCE=local \
                  --build-arg GIT_COMMIT="$source_commit" \
                  --build-arg GIT_MODIFIED=false \
                  .

                az acr login --name "$PYRIT_ACR_NAME"
                push_output=$(docker push "$image")
                printf '%s\n' "$push_output"
                digest=$(sed -nE 's/.*digest: (sha256:[0-9a-fA-F]{64}).*/\1/p' <<< "$push_output" | tail -n 1)
                if [[ ! "$digest" =~ ^sha256:[0-9a-fA-F]{64}$ ]]; then
                  echo "##vso[task.logissue type=error]Docker push did not return an immutable digest"
                  exit 1
                fi
                immutable_image="$PYRIT_ACR_LOGIN_SERVER/$PYRIT_IMAGE_NAME@$digest"
                echo "##vso[task.setvariable variable=immutableImage;isOutput=true]$immutable_image"

          # The hosted agent is disposable; deployment pulls the pushed digest from ACR.
          # Release local images and build cache before injected post-job scanners run.
          - bash: |
              set -euo pipefail
              df -h /
              docker system df
              docker system prune --all --force
              df -h /
            displayName: 'Reclaim Docker disk space after build'
            condition: always()

  - template: infra/pipelines/deploy-stage.yml
    parameters:
      stageName: DeployTestInfra
      displayName: 'Deploy test infrastructure'
      deploymentName: DeployInfrastructure
      dependsOn:
        - Build
      slot: test
      phase: infra
      condition: and(succeeded(), eq('${{ parameters.deployInfra }}', 'true'))

  - template: infra/pipelines/deploy-stage.yml
    parameters:
      stageName: DeployTest
      displayName: 'Deploy app to Test'
      deploymentName: DeployToTest
      dependsOn:
        - Build
        - DeployTestInfra
      slot: test
      phase: app
      condition: >-
        and(not(canceled()),
            in(dependencies.Build.result, 'Succeeded', 'SucceededWithIssues'),
            or(in(dependencies.DeployTestInfra.result, 'Succeeded', 'SucceededWithIssues'),
               and(eq('${{ parameters.deployInfra }}', 'false'),
                   eq(dependencies.DeployTestInfra.result, 'Skipped'))))

  - stage: ApproveProd
    displayName: 'Approve Production Deployment'
    dependsOn: DeployTest
    condition: and(succeeded('DeployTest'), eq('${{ parameters.deployToProd }}', 'true'), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    variables:
      - group: copyrit-gui-prod
    jobs:
      - job: ValidateProdConfiguration
        displayName: 'Validate production authorization configuration'
        pool:
          vmImage: 'ubuntu-latest'
        steps:
          - checkout: none
          - bash: |
              set -euo pipefail
              if [[ -z "${PROD_APPROVERS:-}" || "$PROD_APPROVERS" == '$('* ]]; then
                echo "##vso[task.logissue type=error]copyrit-gui-prod must define prodApprovers before production deployment"
                exit 1
              fi
            displayName: 'Validate production approvers'
            env:
              PROD_APPROVERS: $(prodApprovers)

      - job: WaitForProdApproval
        displayName: 'Validate production readiness'
        dependsOn: ValidateProdConfiguration
        pool: server
        timeoutInMinutes: 1440
        steps:
          - task: ManualValidation@1
            timeoutInMinutes: 1440
            inputs:
              notifyUsers: '$(prodApprovers)'
              approvers: '$(prodApprovers)'
              allowApproversToApproveTheirOwnRuns: false
              instructions: |
                Confirm test is healthy, Entra and backend group authorization work,
                and the static test egress IP is allow-listed.
                Approval stops the production app, runs the production database migration, and then deploys the production app.
                Infrastructure deployment requested: ${{ parameters.deployInfra }}.
                App deployment reconciles application configuration and preserves
                the existing public/private access mode.
                If infrastructure is requested, approve the production Private Link
                cutover and configuration changes before the new code is deployed.
              onTimeout: reject

  - template: infra/pipelines/deploy-stage.yml
    parameters:
      stageName: DeployProdInfra
      displayName: 'Deploy prod infrastructure'
      deploymentName: DeployInfrastructure
      dependsOn:
        - ApproveProd
      slot: prod
      phase: infra
      condition: and(succeeded(), eq('${{ parameters.deployInfra }}', 'true'))

  - template: infra/pipelines/deploy-stage.yml
    parameters:
      stageName: DeployProd
      displayName: 'Deploy app to Production'
      deploymentName: DeployToProd
      dependsOn:
        - ApproveProd
        - Build
        - DeployProdInfra
      slot: prod
      phase: app
      condition: >-
        and(not(canceled()),
            in(dependencies.Build.result, 'Succeeded', 'SucceededWithIssues'),
            in(dependencies.ApproveProd.result, 'Succeeded', 'SucceededWithIssues'),
            or(in(dependencies.DeployProdInfra.result, 'Succeeded', 'SucceededWithIssues'),
               and(eq('${{ parameters.deployInfra }}', 'false'),
                   eq(dependencies.DeployProdInfra.result, 'Skipped'))))