azureFwGitOps.yml

parameters:
- name: mode
  type: string
  default: WriteToCsv
  values:
  - WriteToCsv
  - WriteToArm

- name: merge
  type: boolean
  default: false

- name: armFolder
  displayName: FirewallArmDirectory
  type: string

- name: policyFolder
  displayName: FirewallPolicyDirectory
  type: string

- name: force
  displayName: Force execution regardless of git changes
  type: boolean
  default: false

steps:

  #
  # Get Latest AzureFwGitOps version
  # Query PowerShell Gallery for the latest AzureFwGitOps version
  # to be used as cache key if no version is specified
  # To enforce specific version variable AZFWGITOPS_MODULE_VERSION 
  #

  - task: PowerShell@2
    displayName: "Get Latest AzureFwGitOps version"
    condition: eq(variables['AZFWGITOPS_MODULE_VERSION'], '')
    inputs:
      targetType: "inline"
      script: |
        $latestVersionUri = "https://www.powershellgallery.com/api/v2/FindPackagesById()?id='AzureFwGitOps'&`$filter=IsLatestVersion"
        $latestVersionId = (Invoke-RestMethod $latestVersionUri).properties.NormalizedVersion
        Write-Host "##vso[task.setvariable variable=AZFWGITOPS_MODULE_VERSION;]$latestVersionId"

  #
  # Cache Dependencies
  # Cache dependencies if version has not changed
  #

  - task: Cache@2
    displayName: Cache AzureFwGitOps module
    condition: ne(variables['AZFWGITOPS_MODULE_VERSION'], '')
    # This task will restore modules from cache if key is found.
    inputs:
      key:  '"AzureFwGitOpsModule" | "$(AZFWGITOPS_MODULE_VERSION)"'
      path: $(modulesFolder)
      cacheHitVar: AzureFwGitOpsModule_IsCached

  #
  # Dependencies
  # Install required runtime modules
  #

  - task: PowerShell@2
    displayName: "Dependencies"
    condition: or(eq(variables['AZFWGITOPS_MODULE_VERSION'], ''), ne(variables['AzureFwGitOpsModule_IsCached'], 'true'))
    inputs:
      targetType: "inline"
      script: |
        if(-not (Test-Path -Path '$(modulesFolder)')) {
          mkdir '$(modulesFolder)'
        }
        $params = @{
          Name            = 'AzureFwGitOps'
          Path            = '$(modulesFolder)'
          Force           = $true
        }
        if('$(AZFWGITOPS_MODULE_VERSION)') {
          $params.RequiredVersion = '$(AZFWGITOPS_MODULE_VERSION)'
        }
        Save-Module @params
  #
  # Diff
  # Run Azure Fw GitOps
  #

  - task: PowerShell@2
    ${{ if not(eq(parameters.mode, 'WriteToCsv')) }}:
      displayName: "ConvertTo-ArmFw"
    ${{ else }}:
      displayName: "ConvertFrom-ArmFw"
    inputs:
      targetType: "inline"
      script: |
        $armFolder = Get-Item '${{parameters.armFolder}}' | Select -ExpandProperty FullName
        Try{
          $policyFolder = Get-Item '${{parameters.policyFolder}}' | Select -ExpandProperty FullName
        }
        Catch{
          #first run
          New-Item '${{parameters.policyFolder}}' -ItemType "directory" -Force | Out-null
          $policyFolder = Get-Item '${{parameters.policyFolder}}' | Select -ExpandProperty FullName
        }
        $Merge = ('${{parameters.merge}}' -eq 'true')
        $Force = ('${{parameters.force}}' -eq 'true')

        # Find removed or changed rules
        $gitDiff = git diff --name-status HEAD^ HEAD
        if($null -ne $gitDiff -and $merge -eq $true) {
          If($gitDiff.GetType().Name -eq 'String'){
            If($gitDiff.EndsWith('.csv')){
              [array]$csvFiles = ($gitDiff)
            }
            $settingsUpdated = If(($gitDiff.EndsWith('policySettings.json')) -contains $true){$true}Else{$false}
          }
          Else{
            $csvFiles = $gitDiff | Where-object{$_.EndsWith('.csv')}
            $settingsUpdated = If(($gitDiff.EndsWith('policySettings.json')) -contains $true){$true}Else{$false}
          }
          If(($csvFiles -or $settingsUpdated)){$changes = @()}
          If($csvFiles){
            $csvFiles | Write-Output
            $csvFiles | Foreach-Object{
              $change = $_
              $operation, $filename = ($change -split "`t")[0, -1]
              if ($operation -eq 'D') {
                Write-Warning 'This pipeline is currently not able to handle delete operations, $change'
              }
              if ($operation -in 'M', 'R') {
                # Now we need to see if rules are removed
                If($filename.StartsWith('${{parameters.policyFolder}}')){
                  [array]$removedRows = (git show HEAD^:$filename) | Where {(git show HEAD:$filename) -NotContains $_}
                  [array]$addedRows = (git show HEAD:$filename) | Where {(git show HEAD^:$filename) -NotContains $_}
                  $changes += [pscustomobject]@{
                    type = 'rule'
                    file = $filename
                    removedRows = $removedRows
                    addedRows = $addedRows
                  }
                }
              }
            }
          }
          If($settingsUpdated){
            $changes += [pscustomobject]@{
              type = 'settings'
              innerData = ((git show HEAD:${{parameters.policyFolder}}/policySettings.json) | ConvertFrom-Json)
            }
          }
          If($changes){
            Write-Host "Changes detected:"
            $changes | ConvertTo-Json -depth 100 | Write-Output
          }
        }
        else {
            If(-not $Force){
              Write-Host '##[error]The validation pipeline failed because there is currently no change to be processed'
              exit 1
            }
        }

        $Env:PSModulePath = $Env:PSModulePath, '$(modulesFolder)' -join [IO.Path]::PathSeparator
        import-module AzureFwGitOps
        
        $params = @{
          ArmFolder = $armFolder
          PolicyFolder = $policyFolder
        }

        If('${{parameters.mode}}' -eq 'WriteToCsv'){
          If($merge){
            #Include changeset
            $params.add('changes',$changes)
          }
          ConvertFrom-ArmFw @params -merge:$Merge -Verbose
        }
        Else{
          If($changes | where-object{$_.type -eq 'settings'}){
            #include changes if settings exist. This is really only relevant if merge is also a thing
            $params.add('changes',$changes)
          }
          ConvertTo-ArmFw @params -Verbose
        }