update-portal.yml

---
name: Update Portal Experience

##########################################
# Start the job on push for all branches #
##########################################

# yamllint disable-line rule:truthy
on:
  pull_request_target:
    types:
      - opened
      - reopened
      - synchronize
      - ready_for_review
    paths:
      - "eslzArm/**.json"
      - "src/Alz.Tools/**"
      - "src/**.json"
      - "src/**.bicep"

env:
  github_user_name: "github-actions"
  github_email: "41898282+github-actions[bot]@users.noreply.github.com"
  github_commit_message: "Auto-update Portal experience"
  github_pr_number: ${{ github.event.number }}
  github_pr_repo: ${{ github.event.pull_request.head.repo.full_name }}

permissions:
  contents: write

###############
# Set the Job #
###############

jobs:
  update-portal:
    name: Update Portal Experience
    runs-on: ubuntu-latest
    if: |
      (
        github.event.pull_request.head.repo.full_name == 'Azure/Enterprise-Scale'
      )
      ||
      (
        github.event.pull_request.head.repo.full_name != 'Azure/Enterprise-Scale'
        &&
        contains(github.event.pull_request.labels.*.name, 'PR: Safe to test :test_tube:')
      )
      ||
      (
        github.event_name == 'workflow_dispatch'
      )
      ||
      (
        github.event_name == 'merge_group'
      )

    steps:
      - name: Check out repository
        uses: actions/checkout@v3

      - name: Show env
        run: env | sort

      - name: Check out PR
        run: |
          echo "==> Check out PR..."
          gh pr checkout "$github_pr_number"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure local git
        run: |
          echo "git user name  : $github_user_name"
          git config --global user.name "$github_user_name"
          echo "git user email : $github_email"
          git config --global user.email "$github_email"

      - name: Update policies
        run: bicep build ./src/templates/policies.bicep --outfile ./eslzArm/managementGroupTemplates/policyDefinitions/policies.json

      - name: Update policy set definitions (initiatives)
        run: bicep build ./src/templates/initiatives.bicep --outfile ./eslzArm/managementGroupTemplates/policyDefinitions/initiatives.json

      - name: Update roles
        run: bicep build ./src/templates/roles.bicep --outfile ./eslzArm/managementGroupTemplates/roleDefinitions/customRoleDefinitions.json

      - name: Check git status
        run: |
          echo "==> Check git status..."
          git status --short --branch

      - name: Stage changes
        run: |
          echo "==> Stage changes..."
          mapfile -t STATUS_LOG < <(git status --short | grep eslzArm/)
          if [ ${#STATUS_LOG[@]} -gt 0 ]; then
              echo "Found changes to the following files:"
              printf "%s\n" "${STATUS_LOG[@]}"
              git add --all ./eslzArm
          else
              echo "No changes to add."
          fi

      - name: Push changes
        run: |
          echo "==> Check git diff..."
          mapfile -t GIT_DIFF < <(git diff --cached)
          printf "%s\n" "${GIT_DIFF[@]}"

          if [ ${#GIT_DIFF[@]} -gt 0 ]; then

              echo "==> Commit changes..."
              git commit --message "$github_commit_message [$GITHUB_ACTOR/${GITHUB_SHA::8}]"

              echo "==> Push changes..."
              echo "Pushing changes to: $github_pr_repo"
              git push "https://$GITHUB_TOKEN@github.com/$github_pr_repo.git" "HEAD:$GITHUB_HEAD_REF"

          else
              echo "No changes found."
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}