plan-forge deploy.instructions.md

Azure IaC Pipeline Patterns

Authentication — Workload Identity Federation (OIDC)

Use OIDC/Workload Identity Federation everywhere — no stored client secrets.

GitHub Actions Setup

# One-time setup: configure the federated credential
azd pipeline config   # automatically configures OIDC for GitHub Actions

Required secrets in GitHub:

• AZURE_CLIENT_ID — App Registration client ID
• AZURE_TENANT_ID — Azure AD tenant ID
• AZURE_SUBSCRIPTION_ID — target subscription

Azure DevOps Setup

Use a service connection with Workload Identity Federation:

Project Settings → Service connections → New → Azure Resource Manager → Workload Identity Federation

GitHub Actions — Bicep Deployment Pipeline

# .github/workflows/infra-deploy.yml
name: Infrastructure Deploy

on:
  push:
    branches: [main]
    paths: ['infra/**']
  pull_request:
    branches: [main]
    paths: ['infra/**']
  workflow_dispatch:

permissions:
  id-token: write      # required for OIDC
  contents: read

jobs:
  validate:
    name: Validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Azure Login (OIDC)
        uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Install Bicep CLI
        run: az bicep install

      - name: Lint Bicep
        run: az bicep lint --file infra/main.bicep

      - name: Bicep Build (validate ARM output)
        run: az bicep build --file infra/main.bicep

      - name: What-If Analysis
        run: |
          az deployment group what-if \
            --resource-group ${{ vars.RESOURCE_GROUP }} \
            --template-file infra/main.bicep \
            --parameters infra/main.parameters.json \
            --no-pretty-print

  deploy-dev:
    name: Deploy Dev
    needs: validate
    runs-on: ubuntu-latest
    environment: dev
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v7
      - uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Deploy Bicep
        uses: azure/arm-deploy@v2
        with:
          resourceGroupName: ${{ vars.DEV_RESOURCE_GROUP }}
          template: infra/main.bicep
          parameters: infra/main.parameters.json environmentName=dev
          failOnStdErr: true

      - name: Smoke Test
        shell: pwsh
        run: ./scripts/Invoke-SmokeTest.ps1 -EnvironmentName dev

  deploy-prod:
    name: Deploy Production
    needs: deploy-dev
    runs-on: ubuntu-latest
    environment: prod           # requires manual approval gate in GitHub
    steps:
      - uses: actions/checkout@v7
      - uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Deploy Bicep
        uses: azure/arm-deploy@v2
        with:
          resourceGroupName: ${{ vars.PROD_RESOURCE_GROUP }}
          template: infra/main.bicep
          parameters: infra/main.parameters.json environmentName=prod
          failOnStdErr: true