mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 20:53:06 +00:00
Oliver Kieselbach
f795fbcb4e
True parallel operation, no forced re-consent: existing tenants keep signing in via the legacy app (1a400946), new tenants land on the C4A8 app (886ab5e2). Model "default legacy, funnel primary, learn in the background": - Web: am_auth_app flag -> NEXT_PUBLIC_ENTRA_DEFAULT_APP -> primary; get-started CTA hands over with ?authapp=primary; auth/me homedApp updates the flag so an operator tenant flip takes effect on each user's NEXT login; AADSTS90094/65001 one-shot cross-app retry, AADSTS65004 -> failed screen with previous-app link; am_login_attempt pins redirect returns to the app that started them. - Backend: TenantConfiguration.HomedAppClientId (null = legacy, GA-only flip via PUT config) + LastAuthClientId/Since observability; EntraAppRegistry resolves the acting app per tenant (no-op until the legacy config pair is set); Graph client-credentials, admin-consent URLs and the surfaced client id follow the homed app (app-scoped cache keys); JwtBearer [Authorize] pipeline now shares the middleware audience builders (was single-audience - would 401 legacy tokens after the swap); middleware trusts EntraId:LegacyClientId implicitly. - well-known association file now lists both app ids (publisher domain); deploy-web passes NEXT_PUBLIC_ENTRA_LEGACY_CLIENT_ID / _DEFAULT_APP; mcp-server.bicep default client id -> C4A8 app. Backend xUnit 3730/3730, vitest 625/625 (13 new), tsc/ESLint clean, next build ok. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
85 lines
3.8 KiB
YAML
85 lines
3.8 KiB
YAML
name: Deploy Web (Static Web App)
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- 'src/Web/autopilot-monitor-web/**'
|
|
- '.github/workflows/deploy-web.yml'
|
|
workflow_dispatch:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, closed]
|
|
branches:
|
|
- main
|
|
paths:
|
|
- 'src/Web/autopilot-monitor-web/**'
|
|
- '.github/workflows/deploy-web.yml'
|
|
|
|
jobs:
|
|
build_and_deploy_job:
|
|
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.action != 'closed')
|
|
runs-on: ubuntu-latest
|
|
name: Build and Deploy Job
|
|
# Dependabot PRs run without repo secrets, so the deploy token is absent.
|
|
# Surface it as an env var so the deploy step can gate on it — secrets
|
|
# cannot be referenced directly in an `if:` expression.
|
|
env:
|
|
DEPLOY_TOKEN: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
lfs: false
|
|
fetch-depth: 0 # Full history needed for git-based sitemap lastmod dates
|
|
- name: Build And Deploy
|
|
id: builddeploy
|
|
# Skip (green) instead of failing when the token is missing (Dependabot
|
|
# PRs); real deploys on main and internal PRs still have it.
|
|
if: env.DEPLOY_TOKEN != ''
|
|
uses: Azure/static-web-apps-deploy@v1
|
|
env:
|
|
NEXT_PUBLIC_ENTRA_CLIENT_ID: ${{ vars.NEXT_PUBLIC_ENTRA_CLIENT_ID }}
|
|
# Dual app-reg window: previous app registration (unset = single-app behaviour)
|
|
# and the default app for browsers without a stored selection (legacy|primary).
|
|
NEXT_PUBLIC_ENTRA_LEGACY_CLIENT_ID: ${{ vars.NEXT_PUBLIC_ENTRA_LEGACY_CLIENT_ID }}
|
|
NEXT_PUBLIC_ENTRA_DEFAULT_APP: ${{ vars.NEXT_PUBLIC_ENTRA_DEFAULT_APP }}
|
|
NEXT_PUBLIC_ENTRA_REDIRECT_URI: ${{ vars.NEXT_PUBLIC_ENTRA_REDIRECT_URI }}
|
|
NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI: ${{ vars.NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI }}
|
|
NEXT_PUBLIC_API_BASE_URL: ${{ vars.NEXT_PUBLIC_API_BASE_URL }}
|
|
NEXT_PUBLIC_PLATFORM_STATS_MANIFEST_URL: ${{ vars.NEXT_PUBLIC_PLATFORM_STATS_MANIFEST_URL }}
|
|
NEXT_PUBLIC_APPINSIGHTS_CONNECTION_STRING: ${{ secrets.NEXT_PUBLIC_APPINSIGHTS_CONNECTION_STRING }}
|
|
with:
|
|
azure_static_web_apps_api_token: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
|
|
repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
|
|
action: "upload"
|
|
###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
|
|
# For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig
|
|
app_location: "src/Web/autopilot-monitor-web" # App source code path
|
|
api_location: "" # Api source code path - optional
|
|
# Static export (next.config output:'export'): Oryx runs `npm run build`
|
|
# and uploads the exported out/ directory as plain static files — no
|
|
# managed SSR runtime is provisioned anymore. (No is_static_export
|
|
# input on this action version; Oryx detects the export from
|
|
# next.config + output_location.)
|
|
output_location: "out" # Built app content directory - optional
|
|
###### End of Repository/Build Configurations ######
|
|
|
|
close_pull_request_job:
|
|
if: github.event_name == 'pull_request' && github.event.action == 'closed'
|
|
runs-on: ubuntu-latest
|
|
name: Close Pull Request Job
|
|
env:
|
|
DEPLOY_TOKEN: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
|
|
steps:
|
|
- name: Close Pull Request
|
|
id: closepullrequest
|
|
if: env.DEPLOY_TOKEN != ''
|
|
uses: Azure/static-web-apps-deploy@v1
|
|
with:
|
|
azure_static_web_apps_api_token: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
|
|
action: "close"
|
|
|
|
|
|
|
|
|