Silent Auth0 token refresh: sessions outlive the 24h access token #69
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: deploy-main | |
| cancel-in-progress: false | |
| permissions: | |
| id-token: write # Azure OIDC login | |
| contents: read | |
| env: | |
| ACR: acrnornis | |
| RESOURCE_GROUP: rg-nornis | |
| jobs: | |
| # Tests and image builds run in parallel; only the rollout below is gated on tests. | |
| # Images pushed for a failing commit are tagged but never deployed. | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: 10.0.x | |
| - run: dotnet restore Nornis.sln | |
| - run: dotnet build Nornis.sln --no-restore | |
| - run: dotnet test Nornis.sln --no-build | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Azure login (OIDC) | |
| uses: azure/login@v2 | |
| with: | |
| client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| - name: ACR login | |
| run: az acr login --name "$ACR" | |
| - uses: docker/setup-buildx-action@v3 | |
| # One shared build stage compiles the solution once; the second and third | |
| # targets reuse it from the builder's local cache. The GHA cache keeps the | |
| # NuGet-restore and publish layers warm between pushes. | |
| - name: Build and push images | |
| run: | | |
| for svc in api web worker; do | |
| docker buildx build \ | |
| --target "$svc" \ | |
| --tag "$ACR.azurecr.io/nornis-$svc:${{ github.sha }}" \ | |
| --tag "$ACR.azurecr.io/nornis-$svc:main-latest" \ | |
| --build-arg IMAGE_SOURCE="${{ github.server_url }}/${{ github.repository }}" \ | |
| --build-arg IMAGE_REVISION="${{ github.sha }}" \ | |
| --cache-from type=gha \ | |
| --cache-to type=gha,mode=max \ | |
| --push \ | |
| . | |
| done | |
| deploy: | |
| runs-on: ubuntu-latest | |
| needs: [test, build] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Azure login (OIDC) | |
| uses: azure/login@v2 | |
| with: | |
| client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| # Migrations run before the new images go live. They must stay additive — | |
| # the old revision keeps serving until the containerapp update below. | |
| - uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: 10.0.x | |
| - name: Apply EF migrations | |
| # The connection string must reach the shell as an env var, not inline | |
| # ${{ }} substitution — the password contains characters bash re-expands. | |
| env: | |
| SQL_CONNECTION_STRING: ${{ secrets.SQL_CONNECTION_STRING }} | |
| run: | | |
| dotnet tool install --global dotnet-ef --version 10.* | |
| dotnet restore Nornis.sln | |
| dotnet ef database update \ | |
| --project src/Nornis.Infrastructure \ | |
| --startup-project src/Nornis.Api \ | |
| --connection "$SQL_CONNECTION_STRING" | |
| - name: Deploy container apps | |
| run: | | |
| for svc in api web worker; do | |
| az containerapp update \ | |
| --name "ca-nornis-$svc" \ | |
| --resource-group "$RESOURCE_GROUP" \ | |
| --image "$ACR.azurecr.io/nornis-$svc:${{ github.sha }}" \ | |
| -o none | |
| done | |
| - name: Report endpoints | |
| run: | | |
| echo "web: https://$(az containerapp show -g $RESOURCE_GROUP -n ca-nornis-web --query properties.configuration.ingress.fqdn -o tsv)" >> $GITHUB_STEP_SUMMARY | |
| echo "api: https://$(az containerapp show -g $RESOURCE_GROUP -n ca-nornis-api --query properties.configuration.ingress.fqdn -o tsv)" >> $GITHUB_STEP_SUMMARY |