@polymorphism-tech/morph-spec 2.2.0 → 2.4.0

package/content/.morph/templates/infra/deploy-checklist.md

@@ -0,0 +1,426 @@
+# Deploy Checklist & Scripts
+
+> Guia completo para deploy seguro em Azure.
+
+---
+
+## Pre-Deploy Checklist
+
+### 1. Código
+
+- [ ] Build passa sem erros: `dotnet build`
+- [ ] Testes passando: `dotnet test`
+- [ ] Sem warnings críticos de segurança
+- [ ] Code review aprovado (se aplicável)
+
+### 2. Packages
+
+- [ ] Sem conflitos de versão (NU1605/NU1608)
+- [ ] `Azure.Identity` especificado explicitamente:
+  ```xml
+  <PackageReference Include="Azure.Identity" Version="1.14.2" />
+  ```
+- [ ] Packages atualizados para versões estáveis
+
+### 3. EF Core Migrations
+
+- [ ] Sem pending model changes:
+  ```bash
+  dotnet ef migrations has-pending-model-changes \
+    --project src/Infrastructure \
+    --startup-project src/Web
+  ```
+- [ ] Migration criada se necessário:
+  ```bash
+  dotnet ef migrations add <Name> \
+    --project src/Infrastructure \
+    --startup-project src/Web
+  ```
+- [ ] Script SQL gerado e revisado:
+  ```bash
+  dotnet ef migrations script --idempotent -o migration.sql
+  ```
+
+### 4. Blazor .NET 10 (se aplicável)
+
+- [ ] `.csproj` contém:
+  ```xml
+  <RequiresAspNetWebAssets>true</RequiresAspNetWebAssets>
+  ```
+- [ ] Static assets funcionam localmente
+
+### 5. Docker/Container (se Container Apps)
+
+- [ ] Dockerfile válido
+- [ ] Build funciona:
+  ```bash
+  docker build --no-cache -t myapp:test .
+  ```
+- [ ] Container roda localmente:
+  ```bash
+  docker run -p 8080:8080 myapp:test
+  ```
+
+### 6. Infraestrutura Azure
+
+- [ ] Bicep válido:
+  ```bash
+  az bicep build --file infra/main.bicep
+  ```
+- [ ] Key Vault configurado
+- [ ] Managed Identity habilitada
+- [ ] Connection strings em Key Vault (não hardcoded)
+
+### 7. Segurança
+
+- [ ] Sem secrets em `appsettings.json`:
+  ```bash
+  grep -rE "(Password=|Pwd=|Secret=)" appsettings*.json | grep -v Development
+  ```
+- [ ] HTTPS enforçado
+- [ ] CORS configurado
+
+---
+
+## Scripts de Deploy
+
+### Script Completo - Container Apps
+
+```bash
+#!/bin/bash
+# deploy-container-app.sh
+# Usage: ./deploy-container-app.sh [dev|staging|prod]
+
+set -e
+
+ENV="${1:-staging}"
+PROJECT_NAME="myapp"
+
+# Configurações por ambiente
+case $ENV in
+  dev)
+    RG_NAME="rg-${PROJECT_NAME}-dev"
+    APP_NAME="ca-${PROJECT_NAME}-dev"
+    ACR_NAME="acr${PROJECT_NAME}dev"
+    ;;
+  staging)
+    RG_NAME="rg-${PROJECT_NAME}-stg"
+    APP_NAME="ca-${PROJECT_NAME}-stg"
+    ACR_NAME="acr${PROJECT_NAME}stg"
+    ;;
+  prod)
+    RG_NAME="rg-${PROJECT_NAME}-prod"
+    APP_NAME="ca-${PROJECT_NAME}-prod"
+    ACR_NAME="acr${PROJECT_NAME}prod"
+    ;;
+  *)
+    echo "Ambiente inválido: $ENV"
+    exit 1
+    ;;
+esac
+
+IMAGE_TAG="${GITHUB_SHA:-$(git rev-parse --short HEAD)}"
+
+echo "🚀 Deploying to $ENV environment..."
+echo "   Resource Group: $RG_NAME"
+echo "   Container App:  $APP_NAME"
+echo "   Image Tag:      $IMAGE_TAG"
+
+# 1. Pre-flight checks
+echo "📋 Running pre-flight checks..."
+
+# Check pending migrations
+if ! dotnet ef migrations has-pending-model-changes \
+  --project src/Infrastructure \
+  --startup-project src/Web 2>/dev/null; then
+  echo "⚠️  Warning: Pending model changes detected"
+  read -p "Continue anyway? (y/N) " -n 1 -r
+  echo
+  if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+    exit 1
+  fi
+fi
+
+# 2. Build Docker image
+echo "🐳 Building Docker image..."
+docker build --no-cache -t ${ACR_NAME}.azurecr.io/${PROJECT_NAME}:${IMAGE_TAG} .
+docker tag ${ACR_NAME}.azurecr.io/${PROJECT_NAME}:${IMAGE_TAG} \
+           ${ACR_NAME}.azurecr.io/${PROJECT_NAME}:latest
+
+# 3. Push to ACR
+echo "📤 Pushing to ACR..."
+az acr login --name $ACR_NAME
+docker push ${ACR_NAME}.azurecr.io/${PROJECT_NAME}:${IMAGE_TAG}
+docker push ${ACR_NAME}.azurecr.io/${PROJECT_NAME}:latest
+
+# 4. Update Container App (with timestamp to force new revision)
+echo "🔄 Updating Container App..."
+az containerapp update \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --image ${ACR_NAME}.azurecr.io/${PROJECT_NAME}:${IMAGE_TAG} \
+  --set-env-vars "DEPLOY_TIMESTAMP=$(date +%s)"
+
+# 5. Wait for deployment
+echo "⏳ Waiting for deployment..."
+sleep 10
+
+# 6. Verify
+echo "✅ Verifying deployment..."
+STATUS=$(az containerapp show \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --query "properties.runningStatus" -o tsv)
+
+if [ "$STATUS" == "Running" ]; then
+  echo "✅ Deployment successful!"
+  FQDN=$(az containerapp show \
+    --name $APP_NAME \
+    --resource-group $RG_NAME \
+    --query "properties.configuration.ingress.fqdn" -o tsv)
+  echo "🌐 URL: https://$FQDN"
+else
+  echo "❌ Deployment failed! Status: $STATUS"
+  echo "📋 Checking logs..."
+  az containerapp logs show \
+    --name $APP_NAME \
+    --resource-group $RG_NAME \
+    --tail 50
+  exit 1
+fi
+
+# 7. Health check
+echo "🏥 Running health check..."
+HEALTH_URL="https://$FQDN/health"
+HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" $HEALTH_URL || echo "000")
+
+if [ "$HTTP_CODE" == "200" ]; then
+  echo "✅ Health check passed!"
+else
+  echo "⚠️  Health check returned: $HTTP_CODE"
+fi
+
+echo ""
+echo "🎉 Deploy complete!"
+```
+
+### Script Verificação Pré-Deploy
+
+```bash
+#!/bin/bash
+# preflight-check.sh
+# Valida projeto antes de deploy
+
+set -e
+
+echo "🔍 MORPH Pre-Flight Check"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━"
+
+ERRORS=0
+WARNINGS=0
+
+# 1. Package conflicts
+echo -n "📦 Checking packages... "
+if dotnet restore 2>&1 | grep -qE "NU1605|NU1608"; then
+  echo "❌ Version conflicts detected"
+  ((ERRORS++))
+else
+  echo "✅"
+fi
+
+# 2. Pending migrations
+echo -n "🗄️  Checking migrations... "
+if ! dotnet ef migrations has-pending-model-changes \
+  --project src/Infrastructure \
+  --startup-project src/Web 2>/dev/null; then
+  echo "❌ Pending changes"
+  ((ERRORS++))
+else
+  echo "✅"
+fi
+
+# 3. Build
+echo -n "🔨 Checking build... "
+if ! dotnet build --nologo -v q 2>/dev/null; then
+  echo "❌ Build failed"
+  ((ERRORS++))
+else
+  echo "✅"
+fi
+
+# 4. Blazor assets (.NET 10)
+echo -n "🎨 Checking Blazor assets... "
+if grep -q "net10.0" *.csproj 2>/dev/null; then
+  if ! grep -q "RequiresAspNetWebAssets.*true" *.csproj 2>/dev/null; then
+    echo "❌ Missing RequiresAspNetWebAssets"
+    ((ERRORS++))
+  else
+    echo "✅"
+  fi
+else
+  echo "⏭️  Not .NET 10"
+fi
+
+# 5. Bicep
+echo -n "📐 Checking Bicep... "
+if [ -f "infra/main.bicep" ]; then
+  if ! az bicep build --file infra/main.bicep --stdout >/dev/null 2>&1; then
+    echo "❌ Syntax errors"
+    ((ERRORS++))
+  else
+    echo "✅"
+  fi
+else
+  echo "⏭️  No Bicep files"
+fi
+
+# 6. Secrets scan
+echo -n "🔐 Checking secrets... "
+if grep -rE "(Password=|Pwd=|Secret=)" appsettings*.json 2>/dev/null | grep -v Development; then
+  echo "⚠️  Secrets in config"
+  ((WARNINGS++))
+else
+  echo "✅"
+fi
+
+# Summary
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━"
+if [ $ERRORS -eq 0 ]; then
+  if [ $WARNINGS -eq 0 ]; then
+    echo "✅ All checks passed!"
+  else
+    echo "⚠️  $WARNINGS warning(s), but OK to deploy"
+  fi
+  exit 0
+else
+  echo "❌ $ERRORS error(s) found. Fix before deploy!"
+  exit 1
+fi
+```
+
+---
+
+## Troubleshooting Deploy
+
+### Container App não atualiza
+
+**Sintoma:** Após push, Container App continua com versão antiga.
+
+**Causa:** Mesmo digest de imagem não triggera nova revisão.
+
+**Solução:**
+```bash
+az containerapp update \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --set-env-vars "DEPLOY_TIMESTAMP=$(date +%s)"
+```
+
+### blazor.web.js 404
+
+**Sintoma:** Página Blazor não carrega.
+
+**Solução:** Adicionar ao `.csproj`:
+```xml
+<RequiresAspNetWebAssets>true</RequiresAspNetWebAssets>
+```
+
+### Managed Identity não funciona
+
+**Sintoma:** Acesso negado a Key Vault ou outros recursos.
+
+**Verificar:**
+1. Identity habilitada no Container App
+2. RBAC atribuída (Key Vault Secrets User, etc.)
+3. Aguardar 5-10 min após atribuição
+
+```bash
+# Verificar identity
+az containerapp identity show \
+  --name $APP_NAME \
+  --resource-group $RG_NAME
+
+# Verificar RBAC
+az role assignment list \
+  --assignee <IDENTITY_PRINCIPAL_ID> \
+  --scope <KEY_VAULT_ID>
+```
+
+### DefaultAzureCredential lento
+
+**Sintoma:** Startup demora 30+ segundos.
+
+**Solução:** Desabilitar credenciais não usadas (ver azure.md).
+
+### Migrations não aplicadas
+
+**Sintoma:** `Invalid object name 'TableName'`
+
+**Solução:**
+```bash
+# Opção 1: Rodar migration no pipeline
+dotnet ef database update
+
+# Opção 2: Auto-migrate no startup (dev/staging only)
+app.Services.CreateScope().ServiceProvider
+  .GetRequiredService<AppDbContext>()
+  .Database.Migrate();
+```
+
+---
+
+## Logs e Debugging
+
+### Container Apps Logs
+
+```bash
+# Logs em tempo real
+az containerapp logs show \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --follow
+
+# Últimas 100 linhas
+az containerapp logs show \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --tail 100
+```
+
+### Application Insights
+
+```bash
+# Query de exceptions
+az monitor app-insights query \
+  --app $APPINSIGHTS_NAME \
+  --analytics-query "exceptions | take 10"
+```
+
+### Container App Status
+
+```bash
+# Status geral
+az containerapp show \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --query "{status:properties.runningStatus,replicas:properties.template.scale}"
+
+# Revisões
+az containerapp revision list \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --query "[].{name:name,active:properties.active,traffic:properties.trafficWeight}"
+```
+
+---
+
+## Referências
+
+- [azure.md](../../standards/azure.md) - Padrões Azure
+- [morph-preflight.md](../../../.claude/commands/morph-preflight.md) - Comando de validação
+- [blazor-efcore.md](../../../../framework/standards/blazor-efcore.md) - EF Core patterns
+
+---
+
+*MORPH-SPEC by Polymorphism Tech*