AzGovViz.pipeline.yml

# Azure Governance Visualizer v6_major_20230717_1
# First things first:
# 1. Mandatory: In the AzGovViz.variables.yml file set needed variables 'ServiceConnection' and 'ManagementGroupId
# 2. Mandatory: Check line 20
# Documentation: https://github.com/JulianHayward/Azure-MG-Sub-Governance-Reporting

trigger: none

pr: none

variables:
  - template: ./AzGovViz.variables.yml

schedules:
- cron: "0 0,12 * * *"
  displayName: every 12h
  always: true
  branches:
    include:
    - master #CHECK branch 'master' is applicable? - delete me :)

#Running AzOps? Run Azure Governance Visualizer after 'AzOps - Push' ..
#AzOps accelerator https://github.com/Azure/AzOps-Accelerator
#resources:
#  pipelines:
#    - pipeline: 'Push'
#      source: 'AzOps - Push'
#      trigger:
#        branches:
#          include:
#            - master #CHECK branch 'master' is applicable? - delete me :)

jobs:
- job: AzureGovernanceVisualizer
  timeoutInMinutes: 0

  pool:
    vmImage: 'ubuntu-22.04'

  steps:
  - checkout: self
    fetchDepth: 1

  - pwsh: |
      Write-Host 'Build Script Arguments String...'

      $argumentsString = ''
      $scriptPath = '$(System.DefaultWorkingDirectory)/$(ScriptDir)/$(Script)'

      $astTokens = $null
      $astErrors = $null
      $ast = [System.Management.Automation.Language.Parser]::ParseFile($scriptPath, [ref]$astTokens, [ref]$astErrors)

      $scriptParameters = $ast.FindAll( { $args[0] -is [System.Management.Automation.Language.ParameterAst] }, $false)

      foreach ($scriptParameter in $scriptParameters) {
        $scriptParameterName = $scriptParameter.Name.VariablePath.UserPath
        if ($scriptParameterName -ne 'ScriptDir' -and $scriptParameterName -ne 'Script') {
          $argument = Get-ChildItem -Path "Env:$( $scriptParameterName.ToUpper() )" -ErrorAction SilentlyContinue
          if ($argument.value) {
            if ($scriptParameterName -eq 'ManagementGroupId') {
              if ($argument.Value -match ' ') {
                Write-Host "##vso[task.logissue type=error]Management Group ID ($($argument.Value)) validation failed! Management Group ID may not contain spaces - provide the Management Group ID, not the displayName"
                exit 1
              }
            }
            if ($scriptParameter.StaticType.Name -eq 'SwitchParameter') {
              if ($argument.Value -eq 'True') {
                if ($scriptParameterName -eq 'WebAppPublish') {
                  #skipping
                }
                else {
                  $argumentsString += "-$( $scriptParameterName ) "
                }
              }
            } else {
              if ($scriptParameterName -eq 'CsvDelimiter') {
                $argumentsString += "-$( $scriptParameterName ) '$( $argument.Value )' "
              }
              elseif ($scriptParameterName -eq 'WebAppSubscriptionId' -or $scriptParameterName -eq 'WebAppResourceGroup' -or $scriptParameterName -eq 'WebAppName') {
                #skipping
              }
              else{
                $argumentsString += "-$( $scriptParameterName ) $( $argument.Value ) "
              }
            }
            if ($scriptParameterName -eq 'outputPath') {
              $outputPath = "$( $argument.Value )"
            }
            if ($scriptParameterName -eq 'NoDefinitionInsightsDedicatedHTML') {
              $NoDefinitionInsightsDedicatedHTML = "$( $argument.Value )"
            }
          }
        }
      }

      Write-Host "Arguments String: $( $argumentsString.Trim() )"
      Write-Host "##vso[task.setvariable variable=ScriptArguments]$( $argumentsString.Trim() )"
    displayName: 'Create Arguments String Variable'

  - task: PowerShell@2
    inputs:
      pwsh: true
      targetType: 'filePath'
      filePath: $(System.DefaultWorkingDirectory)/$(ScriptDir)/$(ScriptPrerequisites)
      arguments: '-OutputPath $(OutputPath)'
    displayName: 'Prerequisites check'
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)

  - task: AzurePowerShell@5
    inputs:
      azureSubscription: '$(ServiceConnection)'
      scriptType: filePath
      pwsh: true
      scriptPath: '$(System.DefaultWorkingDirectory)/$(ScriptDir)/$(Script)'
      scriptArguments: $(ScriptArguments) -ScriptPath $(ScriptDir)
      azurePowerShellVersion: latestVersion
    displayName: 'Run Azure Governance Visualizer'

  - pwsh: |
      write-host "#################################"
      write-host "Push Azure Governance Visualizer output to repository"
      write-host "#################################"
      $executionDateTimeInternationalReadable = get-date -format "dd-MMM-yyyy HH:mm:ss"
      $currentTimeZone = (Get-TimeZone).Id
      git config --global user.email "AzureGovernanceVisualizerPipeline@azdo.com"
      $PipelineInfo = "Pipeline: '$(Build.DefinitionName)' 'rev $(Build.BuildNumber)' (Project: $([uri]::EscapeDataString("$(System.TeamProject)")); Repository: $(Build.Repository.Name); Branch: $(Build.SourceBranchName) Commit: $(Build.SourceVersion))"
      git config --global user.name "$PipelineInfo"
      git config pull.rebase false
      git add --all
      git commit -m "wiki $executionDateTimeInternationalReadable ($currentTimeZone)"
      git -c http.extraheader="AUTHORIZATION: bearer $(System.AccessToken)" push origin HEAD:$(Build.SourceBranchName)
    displayName: 'Push Azure Governance Visualizer output to repository'

  - task: AzurePowerShell@5
    condition: and(succeeded(), eq(variables['WebAppPublish'], 'true'))
    inputs:
      azureSubscription: '$(ServiceConnection)'
      ScriptType: 'InlineScript'
      pwsh: true
      Inline: |
        $azAPICallConf = initAzAPICall -DebugAZAPICall $true
        $currentTask = "AzAPICall - Check if WebApp ($($env:WEBAPPNAME)) has Authentication enabled"
        $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/subscriptions/$($env:WEBAPPSUBSCRIPTIONID)/resourceGroups/$($env:WEBAPPRESOURCEGROUP)/providers/Microsoft.Web/sites/$($env:WEBAPPNAME)/config/authsettings/list?api-version=2021-02-01"
        $method = 'POST'
        $request = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask -listenOn 'Content'

        $authStatus = $request.properties.enabled
        Write-Host "WebApp ($($env:WEBAPPNAME)) has Authentication enabled: $authStatus"
        if ($authStatus) {
            try {
                Write-Host "NoDefinitionInsightsDedicatedHTML = $($env:NODEFINITIONINSIGHTSDEDICATEDHTML)"
                if ($($env:NODEFINITIONINSIGHTSDEDICATEDHTML)) {
                  try{
                    Compress-Archive -Path "$($env:SYSTEM_DEFAULTWORKINGDIRECTORY)/$($env:OUTPUTPATH)/AzGovViz_$($env:MANAGEMENTGROUPID).html" -DestinationPath "$($env:SYSTEM_DEFAULTWORKINGDIRECTORY)/$($env:OUTPUTPATH)/AzGovViz_$($env:MANAGEMENTGROUPID).zip" -ErrorAction Stop
                  }
                  catch {
                    throw 'Make sure that the ManagementGroupId variable in the AzGovViz.variables.yml has correct casing (Linux!=linuX)'
                  }
                }
                else {
                  try {
                    Compress-Archive -Path "$($env:SYSTEM_DEFAULTWORKINGDIRECTORY)/$($env:OUTPUTPATH)/AzGovViz_$($env:MANAGEMENTGROUPID).html", "$($env:SYSTEM_DEFAULTWORKINGDIRECTORY)/$($env:OUTPUTPATH)/AzGovViz_$($env:MANAGEMENTGROUPID)_DefinitionInsights.html" -DestinationPath "$($env:SYSTEM_DEFAULTWORKINGDIRECTORY)/$($env:OUTPUTPATH)/AzGovViz_$($env:MANAGEMENTGROUPID).zip" -ErrorAction Stop
                  }
                  catch {
                    throw 'Make sure that the ManagementGroupId variable in the AzGovViz.variables.yml has correct casing (Linux!=linuX)'
                  }
                }

                $null = Select-AzSubscription -SubscriptionId $($env:WEBAPPSUBSCRIPTIONID)
                if (Publish-AzWebApp -ResourceGroupName $($env:WEBAPPRESOURCEGROUP) -Name $($env:WEBAPPNAME) -ArchivePath "$($env:SYSTEM_DEFAULTWORKINGDIRECTORY)/$($env:OUTPUTPATH)/AzGovViz_$($env:MANAGEMENTGROUPID).zip" -Force) {
                    if ($($env:NODEFINITIONINSIGHTSDEDICATEDHTML)) {
                        Write-Host "Published AzGovViz_$($env:MANAGEMENTGROUPID).html"
                    }
                    else {
                        Write-Host "Published AzGovViz_$($env:MANAGEMENTGROUPID).html and AzGovViz_$($env:MANAGEMENTGROUPID)_DefinitionInsights.html"
                    }
                    Write-Host "Available URL to access the HTML: https://$((Get-AzWebApp -ResourceGroupName $($env:WEBAPPRESOURCEGROUP) -Name $($env:WEBAPPNAME)).DefaultHostName)"
                }
            }
            catch {
                $_
                Write-Host "HTML NOT published"
                Write-Host "RBAC Role 'Website Contributor' is required"
                exit 1
            }
        }
        else {
            Write-Host "Assuming and insisting that you do not want to publish your tenant insights to the public"
            Write-Host "HTML NOT published. Please configure authentication on the Azure Web App ($($env:WEBAPPNAME))."
            exit 1
        }
      azurePowerShellVersion: latestVersion
    displayName: 'Publish HTML to WebApp'