CI/CD Integration

GitHub Actions — Documentation Site

The documentation site is deployed automatically via GitHub Actions:

Workflow: .github/workflows/deploy-docs.yml

Setting	Value
Trigger	Push to `main` (paths: `site/`, `docs/`, workflow file) + `workflow_dispatch`
Runner	`ubuntu-latest`
Node version	24
Build command	`npm ci --prefix site && npm run build --prefix site`
Deploy target	GitHub Pages via `actions/deploy-pages@v4`

GitHub Actions — Infrastructure (Planned)

Key requirements for an infrastructure deployment workflow:

Use federated identity credentials (OIDC) — no stored secrets
Run azd auth login with service principal
Set environment variables via azd env set
Run azd up --no-prompt
Require manual approval for production deployments
Pin azd version once Terraform alpha support reaches GA

Recommended Workflow Structure

# .github/workflows/deploy-infra.yml (planned)
on:
  workflow_dispatch:
    inputs:
      scenario:
        type: choice
        options: [baseline, firewall, vpn, full]
      environment:
        type: choice
        options: [dev, staging, prod]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - uses: actions/checkout@v4
      - name: Azure Login (OIDC)
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - name: Deploy
        run: |
          azd env set SCENARIO ${{ inputs.scenario }}
          azd up --no-prompt

Azure DevOps (Planned)

Key requirements for an Azure DevOps pipeline:

Use Workload Identity Federation service connection
Stage-gated deployment (dev → staging → prod)
Run azd up --no-prompt in each stage
Artifact publishing for deployment logs

Manual Deployment (Current)

Until infrastructure pipelines are available, deploy manually:

cd infra/bicep/smb-ready-foundation   # or infra/terraform/smb-ready-foundation
azd env select my-environment
azd up

See the Step-by-Step Walkthrough for the full deployment guide.

Validation in CI

All pull requests should run these checks:

# Markdown linting
npm run lint:md

# Bicep validation
bicep build infra/bicep/smb-ready-foundation/main.bicep
bicep lint infra/bicep/smb-ready-foundation/main.bicep

# Terraform validation
cd infra/terraform/smb-ready-foundation
terraform fmt -check -recursive
terraform init -backend=false && terraform validate

# Full validation suite
npm run validate:all

Contributing Branch naming, commit conventions, and PR process