OSOE-861: Add Git tags for Azure deployments and swaps

.github/actions/add-azure-application-insights-release-annotation/Add-ReleaseAnnotation.ps1

@@ -1,6 +1,7 @@
 param(
     [parameter(Mandatory = $true)][string]$ApplicationInsightsResourceId,
     [parameter(Mandatory = $true)][string]$ReleaseName,
+    [parameter(Mandatory = $false)][string]$Timestamp = '',
     [parameter(Mandatory = $false)]$ReleaseProperties = @()
 )
 
@@ -9,7 +10,7 @@ Write-Output "Adding release annotation with the release name `"$ReleaseName`"."
 $annotation = @{
     Id = [Guid]::NewGuid()
     AnnotationName = $ReleaseName
-    EventTime = (Get-Date).ToUniversalTime().GetDateTimeFormats('s')[0]
+    EventTime = if ($Timestamp) { $Timestamp } else { (Get-Date).ToUniversalTime().GetDateTimeFormats('s')[0] }
     # AI only displays annotations from the "Deployment" category so this must be this string.
     Category = 'Deployment'
     Properties = ConvertTo-Json $ReleaseProperties -Compress

.github/actions/add-azure-application-insights-release-annotation/action.yml

@@ -13,6 +13,11 @@ inputs:
     required: false
     description: >
       The name to give the created release annotation. This will be visible on the Azure Portal when viewing it.
+  timestamp:
+    required: false
+    description: >
+      The timestamp to use for the release annotation. If not set then the current time will be used. This can be useful
+      when using a single timestamp for multiple actions in a workflow.
 
 runs:
   using: composite
@@ -28,10 +33,12 @@ runs:
         # Might contain user input so should go via an env var for security.
         RELEASE_NAME: ${{ inputs.release-name }}
         AI_RESOURCE_ID: ${{ inputs.application-insights-resource-id }}
+        TIMESTAMP: ${{ inputs.timestamp }}
       run: |
         $params = @{
             ApplicationInsightsResourceId = $Env:AI_RESOURCE_ID
             ReleaseName = $Env:RELEASE_NAME ? $Env:RELEASE_NAME : 'Run #${{ github.run_number }} (GitHub Actions)'
+            Timestamp = $Env:TIMESTAMP
             ReleaseProperties = @{
               'Commit branch' = '${{ github.head_ref }}'
               'Commit SHA' = '${{ github.sha }}'

.github/actions/create-timestamp/action.yml

@@ -0,0 +1,22 @@
+name: Create Timestamp
+description: Create a timestamp in ISO 8601 format for use in tags (replaces ":" with "." for use in git tags).
+runs:
+  using: composite
+  steps:
+    - name: Get Timestamp
+      id: get-timestamp
+      shell: pwsh
+      run: |
+        # Get the current timestamp in the ISO 8601 format but replace ":" with "." because we can't use ":" in tags.
+        $timestamp = ((Get-Date).ToUniversalTime().GetDateTimeFormats('s')[0])
+        $timestampTag = $timestamp -replace ":", "-"
+        echo "timestamp=$timestamp" >> $env:GITHUB_OUTPUT
+        echo "timestamp-tag=$timestampTag" >> $env:GITHUB_OUTPUT
+
+outputs:
+  timestamp:
+    description: The generated timestamp
+    value: ${{ steps.get-timestamp.outputs.timestamp }}
+  timestamp-tag:
+    description: The generated timestamp parsed as a usable git tag
+    value: ${{ steps.get-timestamp.outputs.timestamp-tag }}

.github/actions/publish-nuget/action.yml

@@ -221,7 +221,7 @@ runs:
         retention-days: ${{ inputs.nuget-artifact-retention-days }}
 
     - name: Create Release
-      uses: Lombiq/GitHub-Actions/.github/actions/release-action@dev
+      uses: Lombiq/GitHub-Actions/.github/actions/release-action@issue/OSOE-861
       # This is to prevent creating releases when pushing tags for issue-specific pre-releases like
       # v4.3.1-alpha.osoe-86.
       if: "!contains(steps.setup.outputs.publish-version, '-')"

.github/actions/release-action/action.yml

@@ -25,6 +25,14 @@ inputs:
     description: An optional tag for the release. If this is omitted the git ref will be used (if it is a tag).
     required: false
     default: ''
+  repo:
+    description: Optionally specify the repo where the release should be generated. Defaults to current repo.
+    required: false
+    default: ''
+  token:
+    description: The GitHub token.
+    required: false
+    default: ${{ github.token }}
 
 outputs:
   id:
@@ -49,3 +57,5 @@ runs:
         artifacts: ${{ inputs.artifacts }}
         generateReleaseNotes: ${{ inputs.generateReleaseNotes }}
         tag: ${{ inputs.tag }}
+        repo: ${{ inputs.repo }}
+        token: ${{ inputs.token }}

.github/actions/remove-old-tags/action.yml

@@ -0,0 +1,24 @@
+name: Remove Old Tags
+description: >
+    Removes the old prefix/latest tag so that a new one can be set.
+
+inputs:
+  tag-prefix:
+    description: The prefix for the tag we are removing.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Delete Latest Tag
+      shell: pwsh
+      run: |
+        git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+        git config user.name 'github-actions[bot]'
+        git fetch --tags
+        $latestTag = (git tag --list '${{ inputs.tag-prefix }}/latest')
+        if ($latestTag)
+        {
+            git tag --delete '${{ inputs.tag-prefix }}/latest'
+            git push origin ':refs/tags/${{ inputs.tag-prefix }}/latest'
+        }

.github/workflows/build-and-test-dotnet.yml

@@ -246,7 +246,7 @@ jobs:
 
       - name: Tests
         if: inputs.test-disable == 'false'
-        uses: Lombiq/GitHub-Actions/.github/actions/test-dotnet@dev
+        uses: Lombiq/GitHub-Actions/.github/actions/test-dotnet@issue/OSOE-861
         with:
           blame-hang-timeout: ${{ inputs.blame-hang-timeout }}
           build-directory: ${{ inputs.build-directory }}

.github/workflows/build-and-test-orchard-core.yml

@@ -300,7 +300,7 @@ jobs:
 
       - name: Tests
         if: inputs.test-disable == 'false'
-        uses: Lombiq/GitHub-Actions/.github/actions/test-dotnet@dev
+        uses: Lombiq/GitHub-Actions/.github/actions/test-dotnet@issue/OSOE-861
         with:
           blame-hang-timeout: ${{ inputs.blame-hang-timeout }}
           build-directory: ${{ inputs.build-directory }}

.github/workflows/deploy-orchard1-to-azure-app-service.yml

@@ -183,7 +183,7 @@ jobs:
 
       - name: Add Azure Application Insights Release Annotation
         if: ${{ inputs.application-insights-resource-id != '' }}
-        uses: Lombiq/GitHub-Actions/.github/actions/add-azure-application-insights-release-annotation@dev
+        uses: Lombiq/GitHub-Actions/.github/actions/add-azure-application-insights-release-annotation@issue/OSOE-861
         with:
           release-name: 'Deploy #${{ github.run_number }} to ${{ inputs.slot-name }}'
           application-insights-resource-id: ${{ inputs.application-insights-resource-id }}

.github/workflows/deploy-to-azure-app-service.yml

@@ -132,6 +132,14 @@ on:
         description: >
           Compiles application assemblies as ReadyToRun (R2R) format. R2R is a form of ahead-of-time (AOT) compilation.
           If ready to run is set to `true` the `runtime` input is needed.
+      tag-prefix:
+        type: string
+        default: staging
+        required: false
+        description: >
+          The prefix to use for the tag. If not set, 'staging' will be used as the prefix. The tag will be in the
+          format of "<prefix>/latest" and "<prefix>/<timestamp>". This is used for tracking what's deployed, where and
+          when by tagging the deployed commit.
 
 jobs:
   deploy:
@@ -227,11 +235,37 @@ jobs:
           restart: false
           clean: false
 
+      - name: Create Timestamp
+        id: create-timestamp
+        uses: Lombiq/GitHub-Actions/.github/actions/create-timestamp@issue/OSOE-861
+
       - name: Add Azure Application Insights Release Annotation
-        uses: Lombiq/GitHub-Actions/.github/actions/add-azure-application-insights-release-annotation@dev
+        uses: Lombiq/GitHub-Actions/.github/actions/add-azure-application-insights-release-annotation@issue/OSOE-861
         with:
           release-name: 'Deploy #${{ github.run_number }} to ${{ inputs.slot-name }}'
           application-insights-resource-id: ${{ inputs.application-insights-resource-id }}
+          timestamp: ${{ steps.create-timestamp.outputs.timestamp }}
+
+      - name: Remove Old Tags
+        uses: Lombiq/GitHub-Actions/.github/actions/remove-old-tags@issue/OSOE-861
+        with:
+          tag-prefix: ${{ inputs.tag-prefix }}
+
+      - name: Delete Old prefix/latest Tag
+        run: |
+          $latestTag = (git tag --list '${{ inputs.tag-prefix }}/latest')
+          if ($latestTag)
+          {
+            git tag -d '${{ inputs.tag-prefix }}/latest'
+            git push origin ':refs/tags/${{ inputs.tag-prefix }}/latest'
+          }
+
+      - name: Tag Latest and Add Timestamp Tag
+        run: |
+          git tag '${{ inputs.tag-prefix }}/latest'
+          git push origin 'refs/tags/${{ inputs.tag-prefix }}/latest'
+          git tag '${{ inputs.tag-prefix }}/${{ steps.create-timestamp.outputs.timestamp-tag }}'
+          git push origin 'refs/tags/${{ inputs.tag-prefix }}/${{ steps.create-timestamp.outputs.timestamp-tag }}'
 
       - name: Start Web App Slot
         run: |

.github/workflows/msbuild-and-test.yml

@@ -138,7 +138,7 @@ jobs:
 
       - name: Tests
         if: inputs.test-disable == 'false'
-        uses: Lombiq/GitHub-Actions/.github/actions/test-dotnet@dev
+        uses: Lombiq/GitHub-Actions/.github/actions/test-dotnet@issue/OSOE-861
         with:
           build-directory: ${{ inputs.build-directory }}
           dotnet-test-process-timeout: ${{ inputs.dotnet-test-process-timeout }}

.github/workflows/publish-nuget.yml

@@ -75,7 +75,7 @@ jobs:
           dotnet-version: ${{ inputs.dotnet-version }}
 
       - name: Publish to NuGet
-        uses: Lombiq/GitHub-Actions/.github/actions/publish-nuget@dev
+        uses: Lombiq/GitHub-Actions/.github/actions/publish-nuget@issue/OSOE-861
         with:
           source: ${{ inputs.source }}
           verbosity: ${{ inputs.verbosity }}

.github/workflows/reset-azure-environment.yml

@@ -193,7 +193,7 @@ jobs:
 
       - name: Add Azure Application Insights Release Annotation
         if: ${{ inputs.application-insights-resource-id != '' }}
-        uses: Lombiq/GitHub-Actions/.github/actions/add-azure-application-insights-release-annotation@dev
+        uses: Lombiq/GitHub-Actions/.github/actions/add-azure-application-insights-release-annotation@issue/OSOE-861
         with:
           release-name: 'Reset #${{ github.run_number }} from ${{ inputs.source-slot-name }} to ${{ inputs.destination-slot-name }}'
           application-insights-resource-id: ${{ inputs.application-insights-resource-id }}

.github/workflows/swap-azure-web-app-slots.yml

@@ -29,6 +29,12 @@ on:
           The ID of the Azure Subscription the resources are under, which will be mapped to the subscription-id
           parameter when calling azure/login. You can look this up e.g. in the Azure Portal under any resource or the
           subscription itself.
+      CODE_REPOSITORY_WRITE_TOKEN:
+        required: false
+        description: >
+          An authentication token, like a personal access token (PAT) that gives access to the other repository.
+          This is necessary because the repository that triggered the workflow and the repository that the workflow is
+          running on are different in this case.
 
     inputs:
       cancel-workflow-on-failure:
@@ -69,6 +75,38 @@ on:
         description: >
           ID of the Application Insights resource that the release annotation for the swap should be added to.
           This can e.g. be looked up on the Azure Portal under the given AI resource's Overview page -> JSON View.
+      app-code-repository:
+        type: string
+        default: ''
+        required: false
+        description: >
+          The repository that hosts the code that will be swapped during the Azure Web App slot swap process. This is
+          necessary for adding tags to the repository to track the deployment status and history. If not specified,
+          tagging steps will be skipped. Example input: 'organization/repository-name'
+      app-code-repository-ref:
+        type: string
+        required: false
+        description: >
+          The branch, tag, or SHA to checkout from the specified app-code-repository. When checking out the repository
+          that triggered this workflow, this defaults to the reference or SHA for that event. Otherwise, it uses the
+          default branch of the app-code-repository. This is used to ensure the correct version of the code is used
+          during the tagging process.
+      tag-prefix:
+        type: string
+        default: production
+        required: false
+        description: >
+          The prefix for the tags that will be added to the app-code-repository. If not set, 'production' will be used
+          as the prefix. The tag will be in the format of "<prefix>/latest" and "<prefix>/<timestamp>". This is used for
+          tracking what's deployed, where and when by tagging the deployed commit.
+      swap-prefix:
+        type: string
+        default: staging
+        required: false
+        description: >
+          The prefix of the deployment tag that we will be looking for in the app-code-repository. If not set, 'staging'
+          will be used as the prefix. This is used to find the currently deployed commit by its tag in the
+          app-code-repository.
 
 jobs:
   swap-azure-web-app-slots:
@@ -105,11 +143,16 @@ jobs:
             -SourceSlotName ${{ inputs.source-slot-name }} `
             -DestinationSlotName ${{ inputs.destination-slot-name }}
 
+      - name: Create timestamp
+        id: create-timestamp
+        uses: Lombiq/GitHub-Actions/.github/actions/create-timestamp@issue/OSOE-861
+
       - name: Add Azure Application Insights Release Annotation
-        uses: Lombiq/GitHub-Actions/.github/actions/add-azure-application-insights-release-annotation@dev
+        uses: Lombiq/GitHub-Actions/.github/actions/add-azure-application-insights-release-annotation@issue/OSOE-861
         with:
           release-name: 'Swap #${{ github.run_number }} from ${{ inputs.source-slot-name }} to ${{ inputs.destination-slot-name }}'
           application-insights-resource-id: ${{ inputs.application-insights-resource-id }}
+          timestamp: ${{ steps.create-timestamp.outputs.timestamp }}
 
       - name: Test Destination Web App Slot
         run: |
@@ -118,6 +161,66 @@ jobs:
             -WebAppName ${{ inputs.app-name }} `
             -SlotName ${{ inputs.destination-slot-name }}
 
+      - name: Checkout Code Repository
+        if: inputs.app-code-repository != ''
+        uses: Lombiq/GitHub-Actions/.github/actions/checkout@dev
+        with:
+          repository: ${{ inputs.app-code-repository }}
+          ref: ${{ inputs.app-code-repository-ref }}
+          token: ${{ secrets.CODE_REPOSITORY_WRITE_TOKEN }}
+
+      - name: Remove Old Tags
+        uses: Lombiq/GitHub-Actions/.github/actions/remove-old-tags@issue/OSOE-861
+        with:
+          tag-prefix: ${{ inputs.tag-prefix }}
+
+      - name: Delete Old prefix/latest Tag
+        run: |
+            $latestTag = (git tag --list '${{ inputs.tag-prefix }}/latest')
+            if ($latestTag)
+            {
+                git tag -d '${{ inputs.tag-prefix }}/latest'
+                git push origin ':refs/tags/${{ inputs.tag-prefix }}/latest'
+            }
+
+      - name: Move Latest Tag (Swap) and Add Timestamp Tag
+        if: inputs.app-code-repository != ''
+        run: |
+            if([string]::IsNullOrEmpty('${{ inputs.tag-prefix }}'))
+            {
+                throw 'Tag prefix not set, exiting'
+            }
+
+            $tagExists = (git tag --list '${{ inputs.swap-prefix }}/latest')
+            if ([string]::IsNullOrEmpty($tagExists))
+            {
+                throw 'No latest tag found for swap prefix'
+            }
+
+            $latest = (git rev-list -n 1 '${{ inputs.swap-prefix }}/latest')
+            if ($latest)
+            {
+                git tag --annotate '${{ inputs.tag-prefix }}/latest' $latest --message 'Latest tag for ${{ inputs.tag-prefix }}'
+                git push origin 'refs/tags/${{ inputs.tag-prefix }}/latest'
+                $gitMessage = 'Swap tagged at ${{ steps.create-timestamp.outputs.timestamp-tag }}'
+                git tag --annotate '${{ inputs.tag-prefix }}/${{ steps.create-timestamp.outputs.timestamp-tag }}' $latest --message $gitMessage
+                git push origin 'refs/tags/${{ inputs.tag-prefix }}/${{ steps.create-timestamp.outputs.timestamp-tag }}'
+            }
+            else
+            {
+                throw "No latest tag found for swap prefix"
+            }
+
+      - name: Create Release
+        uses: Lombiq/GitHub-Actions/.github/actions/release-action@issue/OSOE-861
+        if: inputs.app-code-repository != ''
+        with:
+          repo: ${{ inputs.app-code-repository }}
+          token: ${{ secrets.CODE_REPOSITORY_WRITE_TOKEN }}
+          tag: ${{ inputs.tag-prefix }}/latest
+          allowUpdates: true
+          generateReleaseNotes: true
+
       - name: Cancel Workflow on Failure
         if: failure() && inputs.cancel-workflow-on-failure == 'true'
         uses: Lombiq/GitHub-Actions/.github/actions/cancel-workflow@dev

.github/workflows/swap-orchard1-azure-web-app-slots.yml

@@ -111,7 +111,7 @@ jobs:
 
       - name: Add Azure Application Insights Release Annotation
         if: ${{ inputs.application-insights-resource-id != '' }}
-        uses: Lombiq/GitHub-Actions/.github/actions/add-azure-application-insights-release-annotation@dev
+        uses: Lombiq/GitHub-Actions/.github/actions/add-azure-application-insights-release-annotation@issue/OSOE-861
         with:
           release-name: 'Swap #${{ github.run_number }} from ${{ inputs.source-slot-name }} to ${{ inputs.destination-slot-name }}'
           application-insights-resource-id: ${{ inputs.application-insights-resource-id }}

.github/workflows/tag-version-this-repo.yml

@@ -9,7 +9,7 @@ jobs:
   run:
     name: Tag Version Automation
     if: github.event.pusher.name != 'LombiqBot'
-    uses: Lombiq/GitHub-Actions/.github/workflows/tag-version.yml@dev
+    uses: Lombiq/GitHub-Actions/.github/workflows/tag-version.yml@issue/OSOE-861
     with:
       additional-pattern-include-list: '@("https://raw.githubusercontent.com/Lombiq/GitHub-Actions/(?<ref>[\w\./-]*)/.github")'
     secrets:

.github/workflows/tag-version.yml

@@ -106,7 +106,7 @@ jobs:
         run: git push --tags --force
 
       - name: Create Release
-        uses: Lombiq/GitHub-Actions/.github/actions/release-action@dev
+        uses: Lombiq/GitHub-Actions/.github/actions/release-action@issue/OSOE-861
         # This is to prevent creating releases when pushing tags for issue-specific pre-releases like
         # v4.3.1-alpha.osoe-86.
         if: "!contains(steps.determine-tag.outputs.tagname, '-')"

.github/workflows/validate-pull-request.yml

@@ -28,6 +28,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Check for Merge Conflict in PR
-        uses: Lombiq/GitHub-Actions/.github/actions/check-merge-conflict@dev
+        uses: Lombiq/GitHub-Actions/.github/actions/check-merge-conflict@issue/OSOE-861
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}