deploy.yml

name: Deploy

on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write   # required for OIDC — GitHub mints a short-lived token, no stored secret

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Azure login
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Build and push image to ACR
        run: az acr build --registry screeningacr1 --image screening:latest .

      - name: Update Container App
        run: |
          az containerapp update \
            --name screening-app \
            --resource-group screening-rg \
            --image screeningacr1.azurecr.io/screening:latest