build.yml

name: Build

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  id-token: write
  contents: read
  actions: read
  security-events: write

env:
  CI: true
  # don't print dotnet logo
  DOTNET_NOLOGO: true
  # disable telemetry (reduces dotnet tool output in logs)
  DOTNET_CLI_TELEMETRY_OPTOUT: true

jobs:
  build-cli:
    name: Build CLI (${{ matrix.rid }})
    runs-on: ubuntu-latest

    strategy:
      # let us get failures from other jobs even if one fails
      fail-fast: false
      # should be the full list of supported RIDs with customizations expressed via the parameters under each item
      matrix:
        rid:
          - win-x64
          - linux-x64
          - linux-musl-x64
          - osx-x64
          - linux-arm64
          - win-arm64
          - osx-arm64

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4

      - name: Publish Bicep
        run: dotnet publish --configuration release --self-contained true -r ${{ matrix.rid }} ./src/Bicep.Cli/Bicep.Cli.csproj

      - name: Upload Bicep
        uses: actions/upload-artifact@v4
        with:
          name: bicep-release-${{ matrix.rid }}
          path: ./src/Bicep.Cli/bin/release/net8.0/${{ matrix.rid }}/publish/*
          if-no-files-found: error

      - name: Upload Bicep project assets file
        uses: actions/upload-artifact@v4
        with:
          name: bicep-project-assets-${{ matrix.rid }}
          path: ./src/Bicep.Cli/obj/project.assets.json
          if-no-files-found: error

  build-nugets:
    name: Build NuGet Packages
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4

      - name: Pack
        run: dotnet pack --configuration release

      - name: Upload Packages
        uses: actions/upload-artifact@v4
        with:
          name: bicep-nupkg-any
          path: out/*
          if-no-files-found: error

  build-vscode-ext:
    name: "Build: VSCode Extension"
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4

      - name: Publish Language Server
        run: |
          dotnet publish --configuration release ./src/Bicep.LangServer/Bicep.LangServer.csproj
          cp -R src/Bicep.LangServer/bin/release/net8.0/publish ./src/vscode-bicep/bicepLanguageServer

      - name: Check npm version
        run: npm -v

      - name: npm ci (vscode-bicep-ui)
        run: npm ci
        working-directory: ./src/vscode-bicep-ui

      - name: Build vscode-bicep-ui
        run: npm run build
        working-directory: ./src/vscode-bicep-ui

      - name: npm ci (vscode-bicep)
        run: npm ci --install-links
        working-directory: ./src/vscode-bicep

      - name: Generate VSIX notice
        run: |
          mkdir -p ./src/vscode-bicep-notice/inputs
          npm --prefix ./src/vscode-bicep list -a --install-links --json > ./src/vscode-bicep-notice/inputs/npm-list.json
          cp ./src/Bicep.LangServer/obj/project.assets.json ./src/vscode-bicep-notice/inputs/project.assets.json
          dotnet build --configuration Release ./src/vscode-bicep-notice/vscode-bicep-notice.proj

      - name: Create VSIX
        run: npm run package
        working-directory: ./src/vscode-bicep

      - name: Upload VSIX
        uses: actions/upload-artifact@v4
        with:
          name: vscode-bicep.vsix
          path: ./src/vscode-bicep/vscode-bicep.vsix
          if-no-files-found: error

  test-vscode-bicep-ui:
    name: "Test: VSCode Bicep UI"
    runs-on: ${{ matrix.os }}
    needs: build-vscode-ext
    strategy:
      fail-fast: false
      matrix:
        os:
          - windows-latest
          - ubuntu-latest
          - macos-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Check npm version
        run: npm -v

      - name: npm ci
        run: npm ci
        working-directory: ./src/vscode-bicep-ui

      - name: Run lint
        run: npm run lint
        working-directory: ./src/vscode-bicep-ui

      - name: Run tests
        run: npm run test
        working-directory: ./src/vscode-bicep-ui

  test-vscode-ext:
    name: "Test: VSCode Extension"
    runs-on: ${{ matrix.os }}
    needs: build-vscode-ext
    strategy:
      fail-fast: false
      matrix:
        os:
          - windows-latest
          - ubuntu-latest
          - macos-latest
        # OSX runner performance is slow (https://github.com/actions/runner-images/issues/1336).
        # We can get away with skipping it for PRs, and instead triggering on merges to main.
        skipOsx:
          - ${{ github.event_name == 'pull_request' }}
        exclude:
          - skipOsx: true
            os: macos-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4

      - name: Publish Language Server
        run: |
          dotnet publish --configuration release ./src/Bicep.LangServer/Bicep.LangServer.csproj
          cp -R src/Bicep.LangServer/bin/release/net8.0/publish ./src/vscode-bicep/bicepLanguageServer

      - name: Check npm version
        run: npm -v

      - name: npm ci (vscode-bicep-ui)
        run: npm ci
        working-directory: ./src/vscode-bicep-ui

      - name: Build vscode-bicep-ui)
        run: npm run build
        working-directory: ./src/vscode-bicep-ui

      - name: npm ci (vscode-bicep)
        run: npm ci --install-links
        working-directory: ./src/vscode-bicep

      - name: Run lint
        run: npm run lint
        working-directory: ./src/vscode-bicep

      - name: Run unit tests
        run: npm run test:unit
        working-directory: ./src/vscode-bicep

      - name: Run snapshot tests
        run: npm run test:snapshot
        working-directory: ./src/vscode-bicep

      - name: Build prod
        run: npm run build:prod
        working-directory: ./src/vscode-bicep

      - name: Build E2E tests
        run: npm run build:e2e
        working-directory: ./src/vscode-bicep

      - name: Run E2E tests
        run: npm run test:e2e
        if: runner.os != 'Linux'
        working-directory: ./src/vscode-bicep

      # In headless Linux CI machines xvfb is required to run VS Code, so need a separate path for Linux.
      - name: Run E2E tests (Linux)
        run: xvfb-run -a npm run test:e2e
        if: runner.os == 'Linux'
        working-directory: ./src/vscode-bicep

      - name: Show extension logs of E2E tests
        run: cat ./bicep-e2e.log
        if: always()
        working-directory: ./src/vscode-bicep

      - name: Upload Code Coverage
        uses: codecov/codecov-action@v4
        with:
          flags: typescript
          directory: ./src/vscode-bicep/coverage

  build-vs-ext:
    name: Build Visual Studio Extension
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      # needed by the GenerateNotice package
      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4

      - name: Add msbuild to PATH
        uses: microsoft/setup-msbuild@v2

      - name: Build Bicep.sln
        run: dotnet build --configuration release

      - name: Build BicepInVisualStudio.sln
        run: msbuild src/vs-bicep/BicepInVisualStudio.sln /restore /p:Configuration=Release /v:m /bl:./src/binlog/bicep_in_visual_studio_build.binlog

      - name: Upload BicepInVisualStudio.sln build binlog
        uses: actions/upload-artifact@v4
        with:
          name: build-binlog-files
          path: ./src/binlog/bicep_in_visual_studio_build.binlog
          if-no-files-found: error

      - name: Upload BicepLanguageServerClient VSIX
        uses: actions/upload-artifact@v4
        with:
          name: Bicep.VSLanguageServerClient.Vsix.vsix
          path: ./src/vs-bicep/Bicep.VSLanguageServerClient.Vsix/bin/Release/vs-bicep.vsix
          if-no-files-found: error

      - name: Run bicep in visual studio unit tests
        run: |
          $vswhere = (Invoke-WebRequest -Uri "https://github.com/microsoft/vswhere/releases/latest/download/vswhere.exe" -OutFile "vswhere.exe")
          $vstest = & .\vswhere.exe -latest -products * -requires Microsoft.VisualStudio.PackageGroup.TestTools.Core -find **\TestPlatform\vstest.console.exe
          . $vstest .\src\vs-bicep\Bicep.VSLanguageServerClient.UnitTests\bin\release\net472\Bicep.VSLanguageServerClient.UnitTests.dll

      # Temporarily disable VS Bicep integration tests, they're flaky
      # Proper fix tracked under https://github.com/Azure/bicep/issues/8078
      #
      # - name: Install bicep in Visual Studio
      #   run: ./src/vs-bicep/Install.cmd
      #
      # - name: Run bicep in visual studio integration tests
      #   uses: microsoft/vstest-action@v1.0.0
      #   with:
      #     testAssembly: Bicep.VSLanguageServerClient.IntegrationTests.dll
      #     runInParallel: false
      #     searchFolder: ./src/vs-bicep/Bicep.VSLanguageServerClient.IntegrationTests/bin/Release/net472/
      #     ifNoFilesFound: error

  build-windows-setup:
    name: Build Windows Setup
    runs-on: windows-latest
    needs: build-cli

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4

      - name: Download Bicep CLI
        uses: actions/download-artifact@v4
        with:
          name: bicep-release-win-x64
          path: ./src/installer-win/bicep

      - name: Download Bicep CLI project assets file
        uses: actions/download-artifact@v4
        with:
          name: bicep-project-assets-win-x64
          path: ./src/installer-win/bicep

      - name: Build Windows Installer
        run: dotnet build --configuration release ./src/installer-win/installer.proj

      - name: Upload Windows Installer
        uses: actions/upload-artifact@v4
        with:
          name: bicep-setup-win-x64
          path: ./src/installer-win/bin/release/net8.0/bicep-setup-win-x64.exe
          if-no-files-found: error

  build-cli-nugets:
    name: Build CLI NuGet Packages (${{ matrix.rid }})
    runs-on: ${{ matrix.os }}
    needs:
      - build-cli
      - build-nugets
    env:
      RuntimeSuffix: ${{ matrix.rid }}
    strategy:
      fail-fast: false
      # should be the full list of RIDs that we support in the CLI
      matrix:
        include:
          - os: windows-latest
            rid: win-x64
            runTests: true
          - os: ubuntu-latest
            rid: linux-x64
            runTests: true
          - os: macos-latest
            rid: osx-x64
            runTests: true
          - os: ubuntu-latest
            rid: win-arm64
            runTests: false
          - os: ubuntu-latest
            rid: linux-arm64
            runTests: false
          - os: ubuntu-latest
            rid: osx-arm64
            runTests: false

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Check npm version
        run: npm -v

      - name: npm ci
        if: matrix.runTests
        run: npm ci
        working-directory: ./src/Bicep.MSBuild.E2eTests

      - name: Run lint
        if: matrix.runTests
        run: npm run lint
        working-directory: ./src/Bicep.MSBuild.E2eTests

      - name: Download Bicep CLI
        uses: actions/download-artifact@v4
        with:
          name: bicep-release-${{ matrix.rid }}
          path: ./src/Bicep.Cli.Nuget/tools

      - name: Download Bicep CLI project assets file
        uses: actions/download-artifact@v4
        with:
          name: bicep-project-assets-${{ matrix.rid }}
          path: ./src/Bicep.Cli.Nuget/tools

      - name: Download .Net Packages
        uses: actions/download-artifact@v4
        with:
          name: bicep-nupkg-any
          path: ./src/Bicep.MSBuild.E2eTests/examples/local-packages

      - name: Build CLI Package
        run: dotnet build --configuration Release /p:RuntimeSuffix=${{ matrix.rid }} ./src/Bicep.Cli.Nuget/nuget.proj

      - name: Upload CLI Package
        uses: actions/upload-artifact@v4
        with:
          name: bicep-nupkg-${{ matrix.rid }}
          path: ./src/Bicep.Cli.Nuget/*.nupkg
          if-no-files-found: error

      - name: Download CLI Package
        if: matrix.runTests
        uses: actions/download-artifact@v4
        with:
          name: bicep-nupkg-${{ matrix.rid }}
          path: ./src/Bicep.MSBuild.E2eTests/examples/local-packages

      - name: Run E2E tests
        if: matrix.runTests
        run: npm run test
        working-directory: ./src/Bicep.MSBuild.E2eTests

  build-playground:
    name: Build Playground
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Check npm version
        run: npm -v

      - name: npm ci
        run: npm ci
        working-directory: ./src/playground

      - name: Run lint
        run: npm run lint
        working-directory: ./src/playground

      - name: Build
        run: npm run package
        working-directory: ./src/playground

      - name: Upload
        uses: actions/upload-artifact@v4
        with:
          name: playground
          path: ./src/playground/dist/*
          if-no-files-found: error

  build-highlight-libs:
    name: Build Highlight Libraries
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Check npm version
        run: npm -v

      - name: TextMate Grammar
        run: |
          npm ci
          npm run lint
          npm test
        working-directory: ./src/textmate

      - name: HighlightJs Grammar
        run: |
          npm ci
          npm run lint
          npm test
        working-directory: ./src/highlightjs

      - name: Monarch Grammar
        run: |
          npm ci
          npm run lint
          npm test
        working-directory: ./src/monarch

  test-cli-e2e:
    name: 'Test CLI (e2e) (${{ matrix.runtime.rid }})'
    runs-on: ${{ matrix.runtime.os }}
    needs: build-cli
    strategy:
      # let us get failures from other jobs even if one fails
      fail-fast: false
      # should be the full list of supported RIDs with customizations expressed via the parameters under each item
      matrix:
        runtime:
          - os: windows-latest
            rid: win-x64
          - os: ubuntu-latest
            rid: linux-x64
          - os: ubuntu-latest
            rid: linux-musl-x64
          - os: macos-latest
            rid: osx-x64
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Download Bicep CLI
        uses: actions/download-artifact@v4
        with:
          name: bicep-release-${{ matrix.runtime.rid }}
          path: ./src/Bicep.Cli.E2eTests/src/temp/bicep-cli

      - name: Make Bicep CLI executable
        if: runner.os != 'Windows'
        run: chmod +x ./src/Bicep.Cli.E2eTests/src/temp/bicep-cli/bicep

      - name: Run Bicep E2E Tests
        if: matrix.runtime.rid != 'linux-musl-x64'
        run: npm ci && npm test
        env:
          BICEP_CLI_EXECUTABLE: ../../../Bicep.Cli.E2eTests/src/temp/bicep-cli/bicep
        working-directory: ./src/Bicep.Cli.E2eTests

      - name: Run Bicep E2E Tests (linux-musl-x64)
        if: matrix.runtime.rid == 'linux-musl-x64'
        uses: docker://mcr.microsoft.com/azure-cli:2.63.0
        with:
          entrypoint: sh
          args: -c "apk add --update nodejs npm && npm ci --prefix ./src/Bicep.Cli.E2eTests && npm test --prefix ./src/Bicep.Cli.E2eTests"
        env:
          BICEP_CLI_DOTNET_RID: ${{ matrix.runtime.rid }}
          BICEP_CLI_EXECUTABLE: ../../../Bicep.Cli.E2eTests/src/temp/bicep-cli/bicep

  test-dotnet:
    name: 'Test Dotnet (${{ matrix.os }}) (${{matrix.config.name}})'
    runs-on: ${{ matrix.os }}
    strategy:
      # let us get failures from other jobs even if one fails
      fail-fast: false
      matrix:
        config:
          - name: Core
            filter: FullyQualifiedName~Bicep.Core.IntegrationTests
          - name: LangServer
            filter: FullyQualifiedName~Bicep.LangServer.IntegrationTests
          - name: Others
            filter: FullyQualifiedName!~Bicep.Core.IntegrationTests&FullyQualifiedName!~Bicep.LangServer.IntegrationTests
        os:
          - windows-latest
          - ubuntu-latest
          - macos-latest
        # OSX runner performance is slow (https://github.com/actions/runner-images/issues/1336).
        # We can get away with skipping it for PRs, and instead triggering on merges to main.
        skipOsx:
          - ${{ github.event_name == 'pull_request' }}
        exclude:
          - skipOsx: true
            os: macos-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4

      - name: Run Tests
        run: dotnet test --filter '${{ matrix.config.filter}}' --configuration release --settings ./.github/workflows/ci.runsettings --results-directory ./TestResults

      - name: Upload Test Results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: TestResults-${{ matrix.config.name }}-${{ matrix.os }}
          path: ./TestResults/*.trx
          if-no-files-found: error

      - name: Upload Code Coverage
        uses: codecov/codecov-action@v4
        with:
          flags: dotnet

  comment-test-summary:
    name: "PR Comment: Dotnet Tests Summary"
    needs: test-dotnet
    runs-on: ubuntu-latest
    permissions:
      checks: write
      pull-requests: write
    if: always()

    steps:
      - name: Merge Test Results into Single Artifact (fewer artifacts to deal with in build)
        uses: actions/upload-artifact/merge@v4
        with:
          name: TestResults
          pattern: TestResults-*
          delete-merged: true

      - name: Download Test Results Artifact
        uses: actions/download-artifact@v4
        with:
          pattern: TestResults
          path: TestResults
          merge-multiple: true

      - name: Publish Dotnet Test Results
        uses: EnricoMi/publish-unit-test-result-action@v2
        with:
          check_name: Dotnet Test Results
          files: "TestResults/**/*.trx"

  comment-preview-links:
    name: "PR Comment: Preview Links"
    needs: [build-vscode-ext, build-cli]
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    if: always() && !github.event.pull_request.head.repo.fork

    steps:
      - uses: mshick/add-pr-comment@v2
        with:
          message: |
            Test this change out locally with the following install scripts (Action run [${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}))
            <details>
              <summary>VSCode</summary>

              - Mac/Linux
                  ```sh
                  bash <(curl -Ls https://aka.ms/bicep/nightly-vsix.sh) --run-id ${{ github.run_id }}
                  ```
              - Windows
                  ```powershell
                  iex "& { $(irm https://aka.ms/bicep/nightly-vsix.ps1) } -RunId ${{ github.run_id }}"
                  ```
            </details>
            <details>
              <summary>Azure CLI</summary>

              - Mac/Linux
                  ```sh
                  bash <(curl -Ls https://aka.ms/bicep/nightly-cli.sh) --run-id ${{ github.run_id }}
                  ```
              - Windows
                  ```powershell
                  iex "& { $(irm https://aka.ms/bicep/nightly-cli.ps1) } -RunId ${{ github.run_id }}"
                  ```
            </details>

  can-run-live-tests:
    name: Check secret access
    runs-on: ubuntu-latest
    outputs:
      access_verified: ${{ steps.check-access.outputs.verified && !(github.event_name == 'workflow_dispatch' && github.ref != 'refs/head/main') }}

    steps:
      - id: check-access
        env:
          SECRET_TO_CHECK: ${{ secrets.SECRET_TO_CHECK }}
        if: env.SECRET_TO_CHECK != ''
        run: echo 'verified=true' >> $GITHUB_OUTPUT

  test-cli-live:
    name: Test CLI (live) (${{ matrix.runtime.rid }}) (${{ matrix.environment }})
    strategy:
      fail-fast: false
      matrix:
        environment: [prod, ff]
        runtime:
          # should be the list of RIDs that correspond to OSs supported by GitHub hosted runners
          - os: windows-latest
            rid: win-x64
          - os: ubuntu-latest
            rid: linux-x64
          - os: macos-latest
            rid: osx-x64
    runs-on: ${{ matrix.runtime.os }}
    needs:
      - build-cli
      - can-run-live-tests
    if: needs.can-run-live-tests.outputs.access_verified == 'true'

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
          submodules: true

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v4

      - name: Download Bicep CLI
        uses: actions/download-artifact@v4
        with:
          name: bicep-release-${{ matrix.runtime.rid }}
          path: ./src/Bicep.Cli.E2eTests/src/temp/bicep-cli

      - name: Make Bicep CLI executable
        if: runner.os != 'Windows'
        run: chmod +x ./src/Bicep.Cli.E2eTests/src/temp/bicep-cli/bicep

      - name: Az CLI login
        uses: azure/login@v2
        with:
          environment: ${{ (matrix.environment == 'prod' && 'AzureCloud') || 'AzureUSGovernment' }}
          client-id: ${{ (matrix.environment == 'prod' && secrets.LIVE_TEST_CLIENT_ID_PROD) || secrets.LIVE_TEST_CLIENT_ID_FF }}
          tenant-id: ${{ (matrix.environment == 'prod' && secrets.LIVE_TEST_TENANT_ID_PROD) || secrets.LIVE_TEST_TENANT_ID_FF }}
          subscription-id: ${{ (matrix.environment == 'prod' && secrets.LIVE_TEST_SUBSCRIPTION_ID_PROD) || secrets.LIVE_TEST_SUBSCRIPTION_ID_FF }}

      - name: Run Bicep Live E2E Tests (${{ matrix.environment }})
        run: npm ci && npm run test:live:${{ matrix.environment }}
        env:
          BICEP_CLI_EXECUTABLE: ../../../Bicep.Cli.E2eTests/src/temp/bicep-cli/bicep
        working-directory: ./src/Bicep.Cli.E2eTests

  test-cli-live-linux-musl-x64:
    name: Test CLI (live) (linux-musl-x64) (${{ matrix.environment }})
    strategy:
      matrix:
        environment:
          - prod
          - ff
    runs-on: ubuntu-latest
    container:
      # The azure-cli image is based on Alpine linux which uses musl libc.
      image: mcr.microsoft.com/azure-cli:2.63.0
    needs:
      - build-cli
      - can-run-live-tests
    if: needs.can-run-live-tests.outputs.access_verified == 'true'

    steps:
      - uses: actions/checkout@v4

      # Cannot use actions/setup-node@v4 for linux-musl-x64
      - name: Setup Node.js
        run: apk add --update nodejs npm

      - name: Download Bicep CLI
        uses: actions/download-artifact@v4
        with:
          name: bicep-release-linux-musl-x64
          path: ./src/Bicep.Cli.E2eTests/src/temp/bicep-cli

      - name: Make Bicep CLI executable
        run: chmod +x ./src/Bicep.Cli.E2eTests/src/temp/bicep-cli/bicep

      - name: Az CLI login
        uses: azure/login@v2
        with:
          environment: ${{ (matrix.environment == 'prod' && 'AzureCloud') || 'AzureUSGovernment' }}
          client-id: ${{ (matrix.environment == 'prod' && secrets.LIVE_TEST_CLIENT_ID_PROD) || secrets.LIVE_TEST_CLIENT_ID_FF }}
          tenant-id: ${{ (matrix.environment == 'prod' && secrets.LIVE_TEST_TENANT_ID_PROD) || secrets.LIVE_TEST_TENANT_ID_FF }}
          subscription-id: ${{ (matrix.environment == 'prod' && secrets.LIVE_TEST_SUBSCRIPTION_ID_PROD) || secrets.LIVE_TEST_SUBSCRIPTION_ID_FF }}

      - name: Run Bicep Live E2E Tests (${{ matrix.environment }})
        run: npm ci && npm run test:live:${{ matrix.environment }}
        env:
          BICEP_CLI_DOTNET_RID: linux-musl-x64
          BICEP_CLI_EXECUTABLE: ../../../Bicep.Cli.E2eTests/src/temp/bicep-cli/bicep
        working-directory: ./src/Bicep.Cli.E2eTests