# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

trigger:
  branches:
    include:
      - main
variables:
  - name: Azure.WorkloadIdentity.Connection
    # TODO: edit to match the name of the ro service connection
    value: az-test-0-ro
  - name: AZURE_TOKEN
    value: $(Pipeline.Workspace)/token.txt
  - name: FAST_SERVICE_ACCOUNT
    # TODO: edit to match the rw service account email
    value: az-test-0-ro@myprj.iam.gserviceaccount.com
  - name: FAST_WIF_PROVIDER
    # TODO: edit to match your WIF provider name
    value: projects/592545000114/locations/global/workloadIdentityPools/azd-0/providers/az-test-0-ro
  - name: GOOGLE_CREDENTIALS
    value: cicd-sa-credentials.json
pool:
  name: Azure Pipelines
  vmImage: 'ubuntu-latest'
jobs:
  - job: gcp
    displayName: Interact with GCP resources.
    steps:
      - task: TerraformInstaller@1
        displayName: Install Terraform 1.14.3
        inputs:
          terraformVersion: 1.14.3
      - task: AzureCLI@2
        inputs:
          connectedServiceNameARM: $(Azure.WorkloadIdentity.Connection)
          addSpnToEnvironment: true
          scriptType: 'bash'
          scriptLocation: 'inlineScript'
#       # failOnStandardError: true
          inlineScript: |
            sudo snap install google-cloud-sdk --classic
            echo $idToken > $AZURE_TOKEN
            gcloud iam workload-identity-pools create-cred-config \
              $FAST_WIF_PROVIDER \
              --service-account=$FAST_SERVICE_ACCOUNT \
              --service-account-token-lifetime-seconds=900 \
              --output-file=$GOOGLE_CREDENTIALS \
              --credential-source-file=$AZURE_TOKEN
            gcloud config set auth/credential_file_override $GOOGLE_CREDENTIALS
            # gcloud projects list
            terraform init
            terraform apply -auto-approve -no-color
