az login
az account set --subscription "<your-subscription-id>"

# Verify
az account show

terraform/
├── main.tf               # Core resource definitions
├── variables.tf          # Input variable declarations
├── outputs.tf            # Output values (connection strings, URIs)
├── providers.tf          # Provider configuration and backend
├── environments/
│   ├── backend-dev.hcl   # Dev backend configuration (state storage)
│   ├── backend-test.hcl  # Test backend configuration
│   ├── backend-prod.hcl  # Prod backend configuration
│   ├── dev.tfvars        # Dev-specific variable overrides
│   ├── test.tfvars       # Test-specific variable overrides
│   └── prod.tfvars       # Prod-specific variable overrides
├── modules/
│   ├── apim/             # API Management module
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── outputs.tf
│   ├── app-registration/ # Azure AD App Registration module
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── outputs.tf
│   ├── function-app/     # Function App module
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── outputs.tf
│   ├── keyvault/         # Key Vault module
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── outputs.tf
│   └── storage/          # Storage Account module
│       ├── main.tf
│       ├── variables.tf
│       └── outputs.tf
├── .github/
│   └── workflows/
│       └── terraform-deploy.yml  # CI/CD pipeline
└── CONTRIBUTING.md       # Contributor guidelines with CLA info

# providers.tf
terraform {
  required_version = ">= 1.5.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.90"
    }
    azuread = {
      source  = "hashicorp/azuread"
      version = "~> 2.47"
    }
  }

  # Remote state in Azure Blob Storage — required for team environments
  backend "azurerm" {
    resource_group_name  = "rg-terraform-state"
    storage_account_name = "sttfstate<unique-suffix>"
    container_name       = "tfstate"
    key                  = "powerplatform.tfstate"
  }
}

provider "azurerm" {
  features {
    key_vault {
      purge_soft_delete_on_destroy    = true
      recover_soft_deleted_key_vaults = true
    }
  }
}

provider "azuread" {}

# variables.tf
variable "environment" {
  description = "Deployment environment (dev, test, prod)"
  type        = string
  validation {
    condition     = contains(["dev", "test", "prod"], var.environment)
    error_message = "Environment must be dev, test, or prod."
  }
}

variable "location" {
  description = "Azure region for all resources"
  type        = string
  default     = "westeurope"
}

variable "project_name" {
  description = "Short project name used for resource naming (max 8 chars)"
  type        = string
}

variable "tags" {
  description = "Resource tags applied to all resources"
  type        = map(string)
  default     = {}
}

# environments/dev.tfvars
# ─── Dev Environment Variables ────────────────────────────────────────────────
# ⚠️  Do NOT add secrets here. Secrets are injected by the pipeline.

environment  = "dev"
location     = "westeurope"
project_name = "myproj"

# Feature flags — APIM is expensive; disable for dev
deploy_apim             = false
deploy_function_app     = true
deploy_app_registration = true

# Key Vault
keyvault_sku              = "standard"
keyvault_soft_delete_days = 7
keyvault_purge_protection = false

# Storage
storage_replication_type    = "LRS"
storage_blob_retention_days = 7

# Function App
function_dotnet_version = "v8.0"
function_allowed_origins = [
  "https://make.powerautomate.com",
  "https://make.powerapps.com"
]

# APIM (not deployed in dev, but variables required by validation)
apim_publisher_name  = "Power Platform Team"
apim_publisher_email = "powerplatform@yourorg.com"

# App Registration
app_registration_secret_end_date = "2026-12-31T00:00:00Z"

tags = {
  Environment = "Development"
  Project     = "MyProject"
  ManagedBy   = "Terraform"
  Owner       = "PowerPlatformTeam"
  CostCenter  = "IT-Dev"
}

# environments/dev.tfvars
environment  = "dev"
location     = "westeurope"
project_name = "myproj"

tags = {
  Environment = "Development"
  Project     = "MyProject"
  ManagedBy   = "Terraform"
  Owner       = "PowerPlatformTeam"
  CostCenter  = "IT-Dev"
}

# main.tf

data "azurerm_client_config" "current" {}

# Resource Group following Azure naming conventions
# https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming
resource "azurerm_resource_group" "main" {
  name     = "rg-${var.project_name}-${var.environment}"
  location = var.location
  tags     = var.tags
}

# Azure Key Vault
resource "azurerm_key_vault" "main" {
  name                        = "kv-${var.project_name}-${var.environment}"
  location                    = azurerm_resource_group.main.location
  resource_group_name         = azurerm_resource_group.main.name
  tenant_id                   = data.azurerm_client_config.current.tenant_id
  sku_name                    = "standard"
  soft_delete_retention_days  = 7
  purge_protection_enabled    = false # Set to true for production compliance

  tags = var.tags
}

# Grant the deploying service principal access
resource "azurerm_key_vault_access_policy" "deployer" {
  key_vault_id = azurerm_key_vault.main.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = data.azurerm_client_config.current.object_id

  secret_permissions = [
    "Get", "List", "Set", "Delete", "Recover", "Purge"
  ]
}

# Store a custom connector API key as a Key Vault secret
resource "azurerm_key_vault_secret" "connector_api_key" {
  name         = "custom-connector-api-key"
  value        = var.connector_api_key   # injected from pipeline secret variable
  key_vault_id = azurerm_key_vault.main.id

  depends_on = [azurerm_key_vault_access_policy.deployer]

  tags = var.tags
}

# Storage Account — naming: no hyphens, max 24 chars, lowercase
resource "azurerm_storage_account" "main" {
  name                     = "st${var.project_name}${var.environment}"
  resource_group_name      = azurerm_resource_group.main.name
  location                 = azurerm_resource_group.main.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  min_tls_version          = "TLS1_2"
  allow_nested_items_to_be_public = false  # Security: disable public blob access

  blob_properties {
    versioning_enabled = true
    delete_retention_policy {
      days = 30
    }
    container_delete_retention_policy {
      days = 7
    }
  }

  tags = var.tags
}

# Container for incoming Power Automate uploads
resource "azurerm_storage_container" "uploads" {
  name                  = "uploads"
  storage_account_name  = azurerm_storage_account.main.name
  container_access_type = "private"
}

# Container for processed documents
resource "azurerm_storage_container" "processed" {
  name                  = "processed"
  storage_account_name  = azurerm_storage_account.main.name
  container_access_type = "private"
}

# Automatically store connection string in Key Vault
# Power Automate can reference this secret instead of using a stored credential
resource "azurerm_key_vault_secret" "storage_connection_string" {
  name         = "storage-connection-string"
  value        = azurerm_storage_account.main.primary_connection_string
  key_vault_id = azurerm_key_vault.main.id

  depends_on = [azurerm_key_vault_access_policy.deployer]
}

# App Service Plan (Consumption/Serverless)
resource "azurerm_service_plan" "functions" {
  name                = "asp-${var.project_name}-${var.environment}"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  os_type             = "Windows"
  sku_name            = "Y1"   # Consumption plan — pay-per-execution

  tags = var.tags
}

# Application Insights for monitoring and diagnostics
resource "azurerm_application_insights" "main" {
  name                = "appi-${var.project_name}-${var.environment}"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  application_type    = "web"

  tags = var.tags
}

# Windows Function App
resource "azurerm_windows_function_app" "main" {
  name                = "func-${var.project_name}-${var.environment}"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location

  storage_account_name       = azurerm_storage_account.main.name
  storage_account_access_key = azurerm_storage_account.main.primary_access_key
  service_plan_id            = azurerm_service_plan.functions.id

  site_config {
    application_stack {
      dotnet_version              = "v8.0"
      use_dotnet_isolated_runtime = true
    }
    cors {
      # Only allow Power Platform origins
      allowed_origins = [
        "https://make.powerautomate.com",
        "https://*.powerapps.com",
        "https://make.powerapps.com"
      ]
    }
  }

  app_settings = {
    "APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.main.instrumentation_key
    "APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.main.connection_string
    "FUNCTIONS_WORKER_RUNTIME"       = "dotnet-isolated"
    # Reference Key Vault URI — secrets resolved at runtime via Managed Identity
    "KeyVaultUri"                    = azurerm_key_vault.main.vault_uri
  }

  # System-Assigned Managed Identity — no credentials needed
  identity {
    type = "SystemAssigned"
  }

  tags = var.tags
}

# Grant Function App Managed Identity read access to Key Vault
resource "azurerm_key_vault_access_policy" "function_app" {
  key_vault_id = azurerm_key_vault.main.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = azurerm_windows_function_app.main.identity[0].principal_id

  secret_permissions = ["Get", "List"]
}

# App Registration in Microsoft Entra ID (formerly Azure AD)
resource "azuread_application" "custom_connector" {
  display_name = "app-${var.project_name}-connector-${var.environment}"

  api {
    requested_access_token_version = 2
  }

  # Dataverse / Common Data Service API permissions
  # Resource App ID: 00000007-0000-0000-c000-000000000000 = Dataverse
  required_resource_access {
    resource_app_id = "00000007-0000-0000-c000-000000000000"

    resource_access {
      id   = "78ce3f0f-a1ce-49c2-8cde-64b5c0896db4" # user_impersonation scope
      type = "Scope"
    }
  }
}

resource "azuread_service_principal" "custom_connector" {
  client_id = azuread_application.custom_connector.client_id
}

# Client secret — rotated by updating end_date and running terraform apply
resource "azuread_application_password" "custom_connector" {
  application_id = azuread_application.custom_connector.id
  display_name   = "terraform-managed-${var.environment}"
  end_date       = "2026-12-31T00:00:00Z"
}

# Persist client credentials securely in Key Vault
resource "azurerm_key_vault_secret" "connector_client_id" {
  name         = "connector-client-id"
  value        = azuread_application.custom_connector.client_id
  key_vault_id = azurerm_key_vault.main.id
  depends_on   = [azurerm_key_vault_access_policy.deployer]
}

resource "azurerm_key_vault_secret" "connector_client_secret" {
  name         = "connector-client-secret"
  value        = azuread_application_password.custom_connector.value
  key_vault_id = azurerm_key_vault.main.id
  depends_on   = [azurerm_key_vault_access_policy.deployer]
}

resource "azurerm_api_management" "main" {
  name                = "apim-${var.project_name}-${var.environment}"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  publisher_name      = "Power Platform Team"
  publisher_email     = "powerplatform@yourorg.com"

  # Developer_1 for non-prod; Standard_1 for production
  sku_name = var.environment == "prod" ? "Standard_1" : "Developer_1"

  identity {
    type = "SystemAssigned"
  }

  tags = var.tags
}

# API definition — imports OpenAPI spec from your Function App
resource "azurerm_api_management_api" "connector_api" {
  name                  = "connector-api"
  resource_group_name   = azurerm_resource_group.main.name
  api_management_name   = azurerm_api_management.main.name
  revision              = "1"
  display_name          = "Power Platform Connector API"
  path                  = "connector"
  protocols             = ["https"]
  subscription_required = true

  import {
    content_format = "openapi+json-link"
    content_value  = "https://${azurerm_windows_function_app.main.default_hostname}/api/openapi.json"
  }
}

# APIM subscription key for Power Platform custom connector authentication
resource "azurerm_api_management_subscription" "connector" {
  api_management_name = azurerm_api_management.main.name
  resource_group_name = azurerm_resource_group.main.name
  display_name        = "Power Platform Connector Subscription"
  api_id              = azurerm_api_management_api.connector_api.id
  state               = "active"
}

# Store the subscription key in Key Vault for use in custom connector definition
resource "azurerm_key_vault_secret" "apim_subscription_key" {
  name         = "apim-subscription-key"
  value        = azurerm_api_management_subscription.connector.primary_key
  key_vault_id = azurerm_key_vault.main.id
  depends_on   = [azurerm_key_vault_access_policy.deployer]
}

resource "azurerm_api_management" "main" {
  name                = "apim-${var.project_name}-${var.environment}"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  publisher_name      = "Power Platform Team"
  publisher_email     = "powerplatform@yourorg.com"

  # Developer_1 for non-prod; Standard_1 for production
  sku_name = var.environment == "prod" ? "Standard_1" : "Developer_1"

  identity {
    type = "SystemAssigned"
  }

  tags = var.tags
}

# API definition — imports OpenAPI spec from your Function App
resource "azurerm_api_management_api" "connector_api" {
  name                  = "connector-api"
  resource_group_name   = azurerm_resource_group.main.name
  api_management_name   = azurerm_api_management.main.name
  revision              = "1"
  display_name          = "Power Platform Connector API"
  path                  = "connector"
  protocols             = ["https"]
  subscription_required = true

  import {
    content_format = "openapi+json-link"
    content_value  = "https://${azurerm_windows_function_app.main.default_hostname}/api/openapi.json"
  }
}

# APIM subscription key for Power Platform custom connector authentication
resource "azurerm_api_management_subscription" "connector" {
  api_management_name = azurerm_api_management.main.name
  resource_group_name = azurerm_resource_group.main.name
  display_name        = "Power Platform Connector Subscription"
  api_id              = azurerm_api_management_api.connector_api.id
  state               = "active"
}

# Store the subscription key in Key Vault for use in custom connector definition
resource "azurerm_key_vault_secret" "apim_subscription_key" {
  name         = "apim-subscription-key"
  value        = azurerm_api_management_subscription.connector.primary_key
  key_vault_id = azurerm_key_vault.main.id
  depends_on   = [azurerm_key_vault_access_policy.deployer]
}

# .github/workflows/terraform-deploy.yml
name: Terraform — Deploy Azure Infrastructure

on:
  push:
    branches: [main]
    paths: ['terraform/**']
  pull_request:
    branches: [main]
    paths: ['terraform/**']
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment'
        required: true
        default: 'dev'
        type: choice
        options: [dev, test, prod]
      action:
        description: 'Terraform action'
        required: true
        default: 'plan-and-apply'
        type: choice
        options:
          - plan-only
          - plan-and-apply
          - destroy

permissions:
  id-token: write       # Required for OIDC
  contents: read
  pull-requests: write  # Post plan to PR

env:
  TF_VERSION: '1.7.5'
  WORKING_DIR: './terraform'

jobs:
  # ── Plan ─────────────────────────────────────────────────────────────────────
  terraform-plan:
    name: Plan — ${{ github.event.inputs.environment || 'dev' }}
    runs-on: ubuntu-latest
    environment: ${{ github.event.inputs.environment || 'dev' }}
    outputs:
      plan_exitcode: ${{ steps.plan.outputs.exitcode }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Azure Login via OIDC
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}
          terraform_wrapper: false

      - name: Terraform Init
        working-directory: ${{ env.WORKING_DIR }}
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          ARM_USE_OIDC: "true"
          ARM_USE_CLI: "false"
        run: |
          terraform init \
            -backend-config="environments/backend-${{ github.event.inputs.environment || 'dev' }}.hcl"

      - name: Terraform Format Check
        working-directory: ${{ env.WORKING_DIR }}
        run: terraform fmt -check -recursive

      - name: Terraform Validate
        working-directory: ${{ env.WORKING_DIR }}
        run: terraform validate

      - name: Terraform Plan
        id: plan
        working-directory: ${{ env.WORKING_DIR }}
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          ARM_USE_OIDC: "true"
          ARM_USE_CLI: "false"
          TF_VAR_connector_api_key: ${{ secrets.CONNECTOR_API_KEY }}
        run: |
          terraform plan \
            -var-file="environments/${{ github.event.inputs.environment || 'dev' }}.tfvars" \
            -out=tfplan \
            -detailed-exitcode \
            -no-color 2>&1 | tee plan_output.txt
          echo "exitcode=${PIPESTATUS[0]}" >> $GITHUB_OUTPUT

      - name: Post Plan to PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const plan = fs.readFileSync('terraform/plan_output.txt', 'utf8');
            const truncated = plan.length > 60000
              ? plan.substring(0, 60000) + '\n...(truncated)'
              : plan;
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## 🏗️ Terraform Plan — \`${{ github.event.inputs.environment || 'dev' }}\`\n\`\`\`hcl\n${truncated}\n\`\`\``
            });

      - name: Upload Terraform Plan
        uses: actions/upload-artifact@v4
        with:
          name: tfplan-${{ github.event.inputs.environment || 'dev' }}
          path: ${{ env.WORKING_DIR }}/tfplan
          retention-days: 5

  # ── Apply ─────────────────────────────────────────────────────────────────────
  terraform-apply:
    name: Apply — ${{ github.event.inputs.environment || 'dev' }}
    runs-on: ubuntu-latest
    environment: ${{ github.event.inputs.environment || 'dev' }}
    needs: terraform-plan
    if: |
      github.event_name != 'pull_request' &&
      (github.event.inputs.action == 'plan-and-apply' || 
       (github.event_name == 'push' && github.ref == 'refs/heads/main')) &&
      needs.terraform-plan.outputs.plan_exitcode == '2'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Azure Login via OIDC
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}
          terraform_wrapper: false

      - name: Download Plan Artifact
        uses: actions/download-artifact@v4
        with:
          name: tfplan-${{ github.event.inputs.environment || 'dev' }}
          path: ${{ env.WORKING_DIR }}

      - name: Terraform Init
        working-directory: ${{ env.WORKING_DIR }}
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          ARM_USE_OIDC: "true"
          ARM_USE_CLI: "false"
        run: |
          terraform init \
            -backend-config="environments/backend-${{ github.event.inputs.environment || 'dev' }}.hcl"

      - name: Terraform Apply
        working-directory: ${{ env.WORKING_DIR }}
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          ARM_USE_OIDC: "true"
          ARM_USE_CLI: "false"
        run: terraform apply -auto-approve tfplan

      - name: Export Terraform Outputs
        working-directory: ${{ env.WORKING_DIR }}
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          ARM_USE_OIDC: "true"
          ARM_USE_CLI: "false"
        run: |
          FUNC_HOSTNAME=$(terraform output -raw function_app_hostname 2>/dev/null || echo "")
          KV_URI=$(terraform output -raw key_vault_uri)
          echo "FUNCTION_APP_HOSTNAME=$FUNC_HOSTNAME" >> $GITHUB_ENV
          echo "KEY_VAULT_URI=$KV_URI" >> $GITHUB_ENV
          echo "### ✅ Terraform Apply Complete" >> $GITHUB_STEP_SUMMARY
          echo "| Output | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|--------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| Key Vault URI | $KV_URI |" >> $GITHUB_STEP_SUMMARY
          echo "| Function App | $FUNC_HOSTNAME |" >> $GITHUB_STEP_SUMMARY

  # ── Destroy ───────────────────────────────────────────────────────────────────
  terraform-destroy:
    name: Destroy — ${{ github.event.inputs.environment || 'dev' }}
    runs-on: ubuntu-latest
    environment: ${{ github.event.inputs.environment || 'dev' }}
    needs: terraform-plan
    if: |
      github.event_name == 'workflow_dispatch' &&
      github.event.inputs.action == 'destroy'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Azure Login via OIDC
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}
          terraform_wrapper: false

      - name: Terraform Init
        working-directory: ${{ env.WORKING_DIR }}
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          ARM_USE_OIDC: "true"
          ARM_USE_CLI: "false"
        run: |
          terraform init \
            -backend-config="environments/backend-${{ github.event.inputs.environment || 'dev' }}.hcl"

      - name: Terraform Destroy
        working-directory: ${{ env.WORKING_DIR }}
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          ARM_USE_OIDC: "true"
          ARM_USE_CLI: "false"
          TF_VAR_connector_api_key: ${{ secrets.CONNECTOR_API_KEY }}
        run: |
          terraform destroy \
            -var-file="environments/${{ github.event.inputs.environment || 'dev' }}.tfvars" \
            -auto-approve

      - name: Destruction Summary
        run: |
          echo "### Terraform Destroy Complete" >> $GITHUB_STEP_SUMMARY
          echo "**Environment:** \`${{ github.event.inputs.environment }}\`" >> $GITHUB_STEP_SUMMARY

# azure-pipelines-terraform.yml
trigger:
  branches:
    include: [main]
  paths:
    include: ['terraform/**']

pr:
  branches:
    include: [main]
  paths:
    include: ['terraform/**']

parameters:
  - name: environment
    displayName: Target Environment
    type: string
    default: dev
    values: [dev, test, prod]

variables:
  - group: terraform-common
  - group: terraform-${{ parameters.environment }}
  - name: TF_VERSION
    value: '1.7.5'
  - name: WORKING_DIR
    value: '$(System.DefaultWorkingDirectory)/terraform'
  - name: ENVIRONMENT
    value: ${{ parameters.environment }}

stages:
  # ── Stage 1: Validate ─────────────────────────────────────────────
  - stage: Validate
    displayName: Validate Terraform
    jobs:
      - job: ValidateJob
        displayName: Terraform Validate
        pool:
          vmImage: 'ubuntu-latest'
        steps:
          - task: TerraformInstaller@1
            displayName: Install Terraform $(TF_VERSION)
            inputs:
              terraformVersion: $(TF_VERSION)

          - task: TerraformTaskV4@4
            displayName: Terraform Init
            inputs:
              provider: 'azurerm'
              command: 'init'
              workingDirectory: $(WORKING_DIR)
              backendServiceArm: 'AzureServiceConnection'
              backendAzureRmResourceGroupName: $(TF_STATE_RG)
              backendAzureRmStorageAccountName: $(TF_STATE_SA)
              backendAzureRmContainerName: $(TF_STATE_CONTAINER)
              backendAzureRmKey: '$(ENVIRONMENT).tfstate'

          - task: TerraformTaskV4@4
            displayName: Terraform Validate
            inputs:
              provider: 'azurerm'
              command: 'validate'
              workingDirectory: $(WORKING_DIR)

          - bash: terraform fmt -check -recursive
            displayName: Terraform Format Check
            workingDirectory: $(WORKING_DIR)

  # ── Stage 2: Plan ─────────────────────────────────────────────────
  - stage: Plan
    displayName: 'Plan: $(ENVIRONMENT)'
    dependsOn: Validate
    jobs:
      - job: PlanJob
        displayName: Terraform Plan
        pool:
          vmImage: 'ubuntu-latest'
        steps:
          - task: TerraformInstaller@1
            inputs:
              terraformVersion: $(TF_VERSION)

          - task: TerraformTaskV4@4
            displayName: Terraform Init
            inputs:
              provider: 'azurerm'
              command: 'init'
              workingDirectory: $(WORKING_DIR)
              backendServiceArm: 'AzureServiceConnection'
              backendAzureRmResourceGroupName: $(TF_STATE_RG)
              backendAzureRmStorageAccountName: $(TF_STATE_SA)
              backendAzureRmContainerName: $(TF_STATE_CONTAINER)
              backendAzureRmKey: '$(ENVIRONMENT).tfstate'

          - task: TerraformTaskV4@4
            displayName: Terraform Plan
            inputs:
              provider: 'azurerm'
              command: 'plan'
              workingDirectory: $(WORKING_DIR)
              commandOptions: >
                -var-file="environments/$(ENVIRONMENT).tfvars"
                -var="connector_api_key=$(CONNECTOR_API_KEY)"
                -out=$(Pipeline.Workspace)/tfplan
                -detailed-exitcode
              environmentServiceNameAzureRM: 'AzureServiceConnection'

          - task: PublishPipelineArtifact@1
            displayName: Publish Terraform Plan
            inputs:
              targetPath: '$(Pipeline.Workspace)/tfplan'
              artifact: 'tfplan-$(ENVIRONMENT)'

  # ── Stage 3: Apply ────────────────────────────────────────────────
  - stage: Apply
    displayName: 'Apply: $(ENVIRONMENT)'
    dependsOn: Plan
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    jobs:
      - deployment: ApplyJob
        displayName: Apply Infrastructure
        pool:
          vmImage: 'ubuntu-latest'
        environment: $(ENVIRONMENT)   # 🔒 Requires manual approval for test/prod
        strategy:
          runOnce:
            deploy:
              steps:
                - checkout: self

                - task: TerraformInstaller@1
                  inputs:
                    terraformVersion: $(TF_VERSION)

                - task: DownloadPipelineArtifact@2
                  displayName: Download Terraform Plan
                  inputs:
                    artifactName: 'tfplan-$(ENVIRONMENT)'
                    targetPath: '$(WORKING_DIR)'

                - task: TerraformTaskV4@4
                  displayName: Terraform Init
                  inputs:
                    provider: 'azurerm'
                    command: 'init'
                    workingDirectory: $(WORKING_DIR)
                    backendServiceArm: 'AzureServiceConnection'
                    backendAzureRmResourceGroupName: $(TF_STATE_RG)
                    backendAzureRmStorageAccountName: $(TF_STATE_SA)
                    backendAzureRmContainerName: $(TF_STATE_CONTAINER)
                    backendAzureRmKey: '$(ENVIRONMENT).tfstate'

                - task: TerraformTaskV4@4
                  displayName: Terraform Apply
                  inputs:
                    provider: 'azurerm'
                    command: 'apply'
                    workingDirectory: $(WORKING_DIR)
                    commandOptions: '-auto-approve tfplan'
                    environmentServiceNameAzureRM: 'AzureServiceConnection'

                - bash: |
                    cd $(WORKING_DIR)
                    FUNC_URL=$(terraform output -raw function_app_hostname)
                    KV_URI=$(terraform output -raw key_vault_uri)
                    APIM_URL=$(terraform output -raw apim_gateway_url)
                    echo "##vso[task.setvariable variable=FunctionAppUrl;isOutput=true]https://$FUNC_URL"
                    echo "##vso[task.setvariable variable=KeyVaultUri;isOutput=true]$KV_URI"
                    echo "##vso[task.setvariable variable=ApimGatewayUrl;isOutput=true]$APIM_URL"
                  displayName: Export Terraform Outputs
                  name: TerraformOutputs

  # ── Stage 4: Deploy Power Platform Solution ───────────────────────
  - stage: DeployPowerPlatform
    displayName: 'Deploy PP Solution: $(ENVIRONMENT)'
    dependsOn: Apply
    variables:
      FunctionAppUrl: $[ stageDependencies.Apply.ApplyJob.outputs['ApplyJob.TerraformOutputs.FunctionAppUrl'] ]
      KeyVaultUri: $[ stageDependencies.Apply.ApplyJob.outputs['ApplyJob.TerraformOutputs.KeyVaultUri'] ]
    jobs:
      - job: DeployJob
        pool:
          vmImage: 'ubuntu-latest'
        steps:
          - task: PowerPlatformToolInstaller@2
            displayName: Install Power Platform Tools
            inputs:
              DefaultVersion: true

          - task: PowerPlatformImportSolution@2
            displayName: Import Power Platform Solution
            inputs:
              authenticationType: 'PowerPlatformSPN'
              PowerPlatformSPN: 'PowerPlatformServiceConnection'
              Environment: $(PP_ENVIRONMENT_URL)
              SolutionInputFile: '$(Pipeline.Workspace)/MySolution.zip'
              AsyncOperation: true
              MaxAsyncWaitTime: 60