@polymorphism-tech/morph-spec 4.3.4 → 4.3.6

package/.morph/templates/infrastructure/azure/deploy-checklist.md

@@ -0,0 +1,426 @@
+# Deploy Checklist & Scripts
+
+> Guia completo para deploy seguro em Azure.
+
+---
+
+## Pre-Deploy Checklist
+
+### 1. Código
+
+- [ ] Build passa sem erros: `dotnet build`
+- [ ] Testes passando: `dotnet test`
+- [ ] Sem warnings críticos de segurança
+- [ ] Code review aprovado (se aplicável)
+
+### 2. Packages
+
+- [ ] Sem conflitos de versão (NU1605/NU1608)
+- [ ] `Azure.Identity` especificado explicitamente:
+  ```xml
+  <PackageReference Include="Azure.Identity" Version="1.14.2" />
+  ```
+- [ ] Packages atualizados para versões estáveis
+
+### 3. EF Core Migrations
+
+- [ ] Sem pending model changes:
+  ```bash
+  dotnet ef migrations has-pending-model-changes \
+    --project src/Infrastructure \
+    --startup-project src/Web
+  ```
+- [ ] Migration criada se necessário:
+  ```bash
+  dotnet ef migrations add <Name> \
+    --project src/Infrastructure \
+    --startup-project src/Web
+  ```
+- [ ] Script SQL gerado e revisado:
+  ```bash
+  dotnet ef migrations script --idempotent -o migration.sql
+  ```
+
+### 4. Blazor .NET 10 (se aplicável)
+
+- [ ] `.csproj` contém:
+  ```xml
+  <RequiresAspNetWebAssets>true</RequiresAspNetWebAssets>
+  ```
+- [ ] Static assets funcionam localmente
+
+### 5. Docker/Container (se Container Apps)
+
+- [ ] Dockerfile válido
+- [ ] Build funciona:
+  ```bash
+  docker build --no-cache -t myapp:test .
+  ```
+- [ ] Container roda localmente:
+  ```bash
+  docker run -p 8080:8080 myapp:test
+  ```
+
+### 6. Infraestrutura Azure
+
+- [ ] Bicep válido:
+  ```bash
+  az bicep build --file infra/main.bicep
+  ```
+- [ ] Key Vault configurado
+- [ ] Managed Identity habilitada
+- [ ] Connection strings em Key Vault (não hardcoded)
+
+### 7. Segurança
+
+- [ ] Sem secrets em `appsettings.json`:
+  ```bash
+  grep -rE "(Password=|Pwd=|Secret=)" appsettings*.json | grep -v Development
+  ```
+- [ ] HTTPS enforçado
+- [ ] CORS configurado
+
+---
+
+## Scripts de Deploy
+
+### Script Completo - Container Apps
+
+```bash
+#!/bin/bash
+# deploy-container-app.sh
+# Usage: ./deploy-container-app.sh [dev|staging|prod]
+
+set -e
+
+ENV="${1:-staging}"
+PROJECT_NAME="myapp"
+
+# Configurações por ambiente
+case $ENV in
+  dev)
+    RG_NAME="rg-${PROJECT_NAME}-dev"
+    APP_NAME="ca-${PROJECT_NAME}-dev"
+    ACR_NAME="acr${PROJECT_NAME}dev"
+    ;;
+  staging)
+    RG_NAME="rg-${PROJECT_NAME}-stg"
+    APP_NAME="ca-${PROJECT_NAME}-stg"
+    ACR_NAME="acr${PROJECT_NAME}stg"
+    ;;
+  prod)
+    RG_NAME="rg-${PROJECT_NAME}-prod"
+    APP_NAME="ca-${PROJECT_NAME}-prod"
+    ACR_NAME="acr${PROJECT_NAME}prod"
+    ;;
+  *)
+    echo "Ambiente inválido: $ENV"
+    exit 1
+    ;;
+esac
+
+IMAGE_TAG="${GITHUB_SHA:-$(git rev-parse --short HEAD)}"
+
+echo "🚀 Deploying to $ENV environment..."
+echo "   Resource Group: $RG_NAME"
+echo "   Container App:  $APP_NAME"
+echo "   Image Tag:      $IMAGE_TAG"
+
+# 1. Pre-flight checks
+echo "📋 Running pre-flight checks..."
+
+# Check pending migrations
+if ! dotnet ef migrations has-pending-model-changes \
+  --project src/Infrastructure \
+  --startup-project src/Web 2>/dev/null; then
+  echo "⚠️  Warning: Pending model changes detected"
+  read -p "Continue anyway? (y/N) " -n 1 -r
+  echo
+  if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+    exit 1
+  fi
+fi
+
+# 2. Build Docker image
+echo "🐳 Building Docker image..."
+docker build --no-cache -t ${ACR_NAME}.azurecr.io/${PROJECT_NAME}:${IMAGE_TAG} .
+docker tag ${ACR_NAME}.azurecr.io/${PROJECT_NAME}:${IMAGE_TAG} \
+           ${ACR_NAME}.azurecr.io/${PROJECT_NAME}:latest
+
+# 3. Push to ACR
+echo "📤 Pushing to ACR..."
+az acr login --name $ACR_NAME
+docker push ${ACR_NAME}.azurecr.io/${PROJECT_NAME}:${IMAGE_TAG}
+docker push ${ACR_NAME}.azurecr.io/${PROJECT_NAME}:latest
+
+# 4. Update Container App (with timestamp to force new revision)
+echo "🔄 Updating Container App..."
+az containerapp update \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --image ${ACR_NAME}.azurecr.io/${PROJECT_NAME}:${IMAGE_TAG} \
+  --set-env-vars "DEPLOY_TIMESTAMP=$(date +%s)"
+
+# 5. Wait for deployment
+echo "⏳ Waiting for deployment..."
+sleep 10
+
+# 6. Verify
+echo "✅ Verifying deployment..."
+STATUS=$(az containerapp show \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --query "properties.runningStatus" -o tsv)
+
+if [ "$STATUS" == "Running" ]; then
+  echo "✅ Deployment successful!"
+  FQDN=$(az containerapp show \
+    --name $APP_NAME \
+    --resource-group $RG_NAME \
+    --query "properties.configuration.ingress.fqdn" -o tsv)
+  echo "🌐 URL: https://$FQDN"
+else
+  echo "❌ Deployment failed! Status: $STATUS"
+  echo "📋 Checking logs..."
+  az containerapp logs show \
+    --name $APP_NAME \
+    --resource-group $RG_NAME \
+    --tail 50
+  exit 1
+fi
+
+# 7. Health check
+echo "🏥 Running health check..."
+HEALTH_URL="https://$FQDN/health"
+HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" $HEALTH_URL || echo "000")
+
+if [ "$HTTP_CODE" == "200" ]; then
+  echo "✅ Health check passed!"
+else
+  echo "⚠️  Health check returned: $HTTP_CODE"
+fi
+
+echo ""
+echo "🎉 Deploy complete!"
+```
+
+### Script Verificação Pré-Deploy
+
+```bash
+#!/bin/bash
+# preflight-check.sh
+# Valida projeto antes de deploy
+
+set -e
+
+echo "🔍 MORPH Pre-Flight Check"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━"
+
+ERRORS=0
+WARNINGS=0
+
+# 1. Package conflicts
+echo -n "📦 Checking packages... "
+if dotnet restore 2>&1 | grep -qE "NU1605|NU1608"; then
+  echo "❌ Version conflicts detected"
+  ((ERRORS++))
+else
+  echo "✅"
+fi
+
+# 2. Pending migrations
+echo -n "🗄️  Checking migrations... "
+if ! dotnet ef migrations has-pending-model-changes \
+  --project src/Infrastructure \
+  --startup-project src/Web 2>/dev/null; then
+  echo "❌ Pending changes"
+  ((ERRORS++))
+else
+  echo "✅"
+fi
+
+# 3. Build
+echo -n "🔨 Checking build... "
+if ! dotnet build --nologo -v q 2>/dev/null; then
+  echo "❌ Build failed"
+  ((ERRORS++))
+else
+  echo "✅"
+fi
+
+# 4. Blazor assets (.NET 10)
+echo -n "🎨 Checking Blazor assets... "
+if grep -q "net10.0" *.csproj 2>/dev/null; then
+  if ! grep -q "RequiresAspNetWebAssets.*true" *.csproj 2>/dev/null; then
+    echo "❌ Missing RequiresAspNetWebAssets"
+    ((ERRORS++))
+  else
+    echo "✅"
+  fi
+else
+  echo "⏭️  Not .NET 10"
+fi
+
+# 5. Bicep
+echo -n "📐 Checking Bicep... "
+if [ -f "infra/main.bicep" ]; then
+  if ! az bicep build --file infra/main.bicep --stdout >/dev/null 2>&1; then
+    echo "❌ Syntax errors"
+    ((ERRORS++))
+  else
+    echo "✅"
+  fi
+else
+  echo "⏭️  No Bicep files"
+fi
+
+# 6. Secrets scan
+echo -n "🔐 Checking secrets... "
+if grep -rE "(Password=|Pwd=|Secret=)" appsettings*.json 2>/dev/null | grep -v Development; then
+  echo "⚠️  Secrets in config"
+  ((WARNINGS++))
+else
+  echo "✅"
+fi
+
+# Summary
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━"
+if [ $ERRORS -eq 0 ]; then
+  if [ $WARNINGS -eq 0 ]; then
+    echo "✅ All checks passed!"
+  else
+    echo "⚠️  $WARNINGS warning(s), but OK to deploy"
+  fi
+  exit 0
+else
+  echo "❌ $ERRORS error(s) found. Fix before deploy!"
+  exit 1
+fi
+```
+
+---
+
+## Troubleshooting Deploy
+
+### Container App não atualiza
+
+**Sintoma:** Após push, Container App continua com versão antiga.
+
+**Causa:** Mesmo digest de imagem não triggera nova revisão.
+
+**Solução:**
+```bash
+az containerapp update \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --set-env-vars "DEPLOY_TIMESTAMP=$(date +%s)"
+```
+
+### blazor.web.js 404
+
+**Sintoma:** Página Blazor não carrega.
+
+**Solução:** Adicionar ao `.csproj`:
+```xml
+<RequiresAspNetWebAssets>true</RequiresAspNetWebAssets>
+```
+
+### Managed Identity não funciona
+
+**Sintoma:** Acesso negado a Key Vault ou outros recursos.
+
+**Verificar:**
+1. Identity habilitada no Container App
+2. RBAC atribuída (Key Vault Secrets User, etc.)
+3. Aguardar 5-10 min após atribuição
+
+```bash
+# Verificar identity
+az containerapp identity show \
+  --name $APP_NAME \
+  --resource-group $RG_NAME
+
+# Verificar RBAC
+az role assignment list \
+  --assignee <IDENTITY_PRINCIPAL_ID> \
+  --scope <KEY_VAULT_ID>
+```
+
+### DefaultAzureCredential lento
+
+**Sintoma:** Startup demora 30+ segundos.
+
+**Solução:** Desabilitar credenciais não usadas (ver azure.md).
+
+### Migrations não aplicadas
+
+**Sintoma:** `Invalid object name 'TableName'`
+
+**Solução:**
+```bash
+# Opção 1: Rodar migration no pipeline
+dotnet ef database update
+
+# Opção 2: Auto-migrate no startup (dev/staging only)
+app.Services.CreateScope().ServiceProvider
+  .GetRequiredService<AppDbContext>()
+  .Database.Migrate();
+```
+
+---
+
+## Logs e Debugging
+
+### Container Apps Logs
+
+```bash
+# Logs em tempo real
+az containerapp logs show \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --follow
+
+# Últimas 100 linhas
+az containerapp logs show \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --tail 100
+```
+
+### Application Insights
+
+```bash
+# Query de exceptions
+az monitor app-insights query \
+  --app $APPINSIGHTS_NAME \
+  --analytics-query "exceptions | take 10"
+```
+
+### Container App Status
+
+```bash
+# Status geral
+az containerapp show \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --query "{status:properties.runningStatus,replicas:properties.template.scale}"
+
+# Revisões
+az containerapp revision list \
+  --name $APP_NAME \
+  --resource-group $RG_NAME \
+  --query "[].{name:name,active:properties.active,traffic:properties.trafficWeight}"
+```
+
+---
+
+## Referências
+
+- [azure.md](../../standards/azure.md) - Padrões Azure
+- [morph-preflight.md](../../../.claude/commands/morph-preflight.md) - Comando de validação
+- [blazor-efcore.md](../../../../framework/standards/blazor-efcore.md) - EF Core patterns
+
+---
+
+*MORPH-SPEC by Polymorphism Tech*

package/.morph/templates/infrastructure/azure/deploy.ps1

@@ -0,0 +1,229 @@
+# ==============================================================================
+# MORPH-SPEC - Deploy Script (PowerShell)
+# Automated deployment of Azure infrastructure
+# ==============================================================================
+
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$false)]
+    [string]$AppName = "myapp",
+
+    [Parameter(Mandatory=$false)]
+    [ValidateSet("dev", "staging", "prod")]
+    [string]$Environment = "dev",
+
+    [Parameter(Mandatory=$false)]
+    [string]$Location = "eastus",
+
+    [Parameter(Mandatory=$false)]
+    [string]$SubscriptionId,
+
+    [Parameter(Mandatory=$false)]
+    [ValidateSet("appservice", "containerapp")]
+    [string]$HostingType = "appservice",
+
+    [Parameter(Mandatory=$false)]
+    [ValidateSet("F1", "B1", "S1", "P1v2")]
+    [string]$AppServiceSku = "F1",
+
+    [Parameter(Mandatory=$false)]
+    [string]$ContainerImage = "mcr.microsoft.com/hello-world:latest"
+)
+
+# ==============================================================================
+# CONFIGURATION
+# ==============================================================================
+
+$ErrorActionPreference = "Stop"
+
+$ResourceGroup = "rg-$AppName-$Environment"
+$DeploymentName = "deploy-$AppName-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
+
+# ==============================================================================
+# FUNCTIONS
+# ==============================================================================
+
+function Write-InfoLog {
+    param([string]$Message)
+    Write-Host "ℹ️  $Message" -ForegroundColor Blue
+}
+
+function Write-SuccessLog {
+    param([string]$Message)
+    Write-Host "✅ $Message" -ForegroundColor Green
+}
+
+function Write-WarningLog {
+    param([string]$Message)
+    Write-Host "⚠️  $Message" -ForegroundColor Yellow
+}
+
+function Write-ErrorLog {
+    param([string]$Message)
+    Write-Host "❌ $Message" -ForegroundColor Red
+}
+
+function Test-Prerequisites {
+    Write-InfoLog "Checking prerequisites..."
+
+    # Check Azure CLI
+    $azCliInstalled = Get-Command az -ErrorAction SilentlyContinue
+    if (-not $azCliInstalled) {
+        Write-ErrorLog "Azure CLI not found. Install from: https://aka.ms/azure-cli"
+        exit 1
+    }
+
+    # Check login
+    try {
+        $null = az account show 2>$null
+    }
+    catch {
+        Write-ErrorLog "Not logged in to Azure. Run: az login"
+        exit 1
+    }
+
+    # Set subscription if provided
+    if ($SubscriptionId) {
+        Write-InfoLog "Setting subscription to: $SubscriptionId"
+        az account set --subscription $SubscriptionId
+    }
+
+    Write-SuccessLog "Prerequisites checked"
+}
+
+function New-ResourceGroupIfNotExists {
+    Write-InfoLog "Creating resource group: $ResourceGroup"
+
+    $exists = az group exists -n $ResourceGroup
+    if ($exists -eq "true") {
+        Write-WarningLog "Resource group already exists"
+    }
+    else {
+        az group create `
+            --name $ResourceGroup `
+            --location $Location `
+            --tags `
+                environment=$Environment `
+                application=$AppName `
+                managedBy=bicep `
+                framework=morph-spec
+
+        Write-SuccessLog "Resource group created"
+    }
+}
+
+function New-SqlPassword {
+    # Generate secure random password
+    $bytes = New-Object byte[] 32
+    [Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($bytes)
+    $password = [Convert]::ToBase64String($bytes) -replace '[=+/]', '' | Select-Object -First 25
+
+    Write-SuccessLog "SQL password generated (stored in Key Vault after deploy)"
+    return $password
+}
+
+function Deploy-Infrastructure {
+    param([string]$SqlPassword)
+
+    Write-InfoLog "Deploying infrastructure..."
+    Write-InfoLog "  App Name: $AppName"
+    Write-InfoLog "  Environment: $Environment"
+    Write-InfoLog "  Hosting Type: $HostingType"
+    Write-InfoLog "  Location: $Location"
+
+    # Prepare parameters file
+    $paramsFile = "parameters.$Environment.json"
+
+    if (-not (Test-Path $paramsFile)) {
+        Write-ErrorLog "Parameters file not found: $paramsFile"
+        exit 1
+    }
+
+    # Deploy
+    az deployment group create `
+        --resource-group $ResourceGroup `
+        --name $DeploymentName `
+        --template-file main.bicep `
+        --parameters "@$paramsFile" `
+        --parameters `
+            appName=$AppName `
+            environment=$Environment `
+            location=$Location `
+            hostingType=$HostingType `
+            appServiceSku=$AppServiceSku `
+            containerImage=$ContainerImage `
+            sqlAdminPassword=$SqlPassword `
+        --output table
+
+    Write-SuccessLog "Infrastructure deployed"
+}
+
+function Show-Outputs {
+    Write-InfoLog "Retrieving deployment outputs..."
+
+    $appUrl = az deployment group show `
+        -g $ResourceGroup `
+        -n $DeploymentName `
+        --query properties.outputs.appUrl.value -o tsv
+
+    $sqlConnection = az deployment group show `
+        -g $ResourceGroup `
+        -n $DeploymentName `
+        --query properties.outputs.sqlConnectionString.value -o tsv
+
+    $appInsightsConnection = az deployment group show `
+        -g $ResourceGroup `
+        -n $DeploymentName `
+        --query properties.outputs.appInsightsConnectionString.value -o tsv
+
+    Write-Host ""
+    Write-Host "╔════════════════════════════════════════════════════════════════╗" -ForegroundColor Green
+    Write-Host "║              DEPLOYMENT SUCCESSFUL                             ║" -ForegroundColor Green
+    Write-Host "╚════════════════════════════════════════════════════════════════╝" -ForegroundColor Green
+    Write-Host ""
+    Write-Host "🌐 Application URL:" -ForegroundColor Cyan
+    Write-Host "   $appUrl"
+    Write-Host ""
+    Write-Host "🗄️  SQL Connection String:" -ForegroundColor Cyan
+    Write-Host "   $sqlConnection"
+    Write-Host ""
+    Write-Host "📊 App Insights Connection String:" -ForegroundColor Cyan
+    Write-Host "   $appInsightsConnection"
+    Write-Host ""
+    Write-Host "💡 Next steps:" -ForegroundColor Yellow
+
+    if ($HostingType -eq "appservice") {
+        Write-Host "   1. Deploy your code: az webapp up --name app-$AppName-$Environment"
+        Write-Host "   2. View logs: az webapp log tail --name app-$AppName-$Environment -g $ResourceGroup"
+    }
+    else {
+        Write-Host "   1. Build and push container: az acr build --registry <ACR> --image ${AppName}:latest ."
+        Write-Host "   2. Update container app: az containerapp update -n ca-$AppName-$Environment -g $ResourceGroup --image <IMAGE>"
+        Write-Host "   3. View logs: az containerapp logs show -n ca-$AppName-$Environment -g $ResourceGroup --follow"
+    }
+
+    Write-Host ""
+}
+
+# ==============================================================================
+# MAIN
+# ==============================================================================
+
+function Main {
+    Write-Host ""
+    Write-Host "╔════════════════════════════════════════════════════════════════╗" -ForegroundColor Cyan
+    Write-Host "║          MORPH-SPEC - Azure Infrastructure Deploy             ║" -ForegroundColor Cyan
+    Write-Host "╚════════════════════════════════════════════════════════════════╝" -ForegroundColor Cyan
+    Write-Host ""
+
+    Test-Prerequisites
+    New-ResourceGroupIfNotExists
+    $sqlPassword = New-SqlPassword
+    Deploy-Infrastructure -SqlPassword $sqlPassword
+    Show-Outputs
+
+    Write-SuccessLog "Deployment complete! 🚀"
+}
+
+# Run main function
+Main