Authenticate with the Storage Container to upload Playwright reports

.github/workflows/test-deployment.yml

@@ -3,11 +3,11 @@ run-name: Deployment tests for '${{ inputs.environment }}' - `${{ inputs.branch-
 
 on:
   workflow_call:
-    inputs: 
-      environment: 
+    inputs:
+      environment:
         required: true
         type: string
-      branch-name: 
+      branch-name:
         required: true
         type: string
 env:
@@ -62,9 +62,27 @@ jobs:
           TEST_USER_ACCOUNT_PASSWORD: ${{ secrets.TEST_USER_ACCOUNT_PASSWORD }}
         run: npm run test:deployment
 
-      - uses: actions/upload-artifact@v3
-        if: always()
+      - name: Prepare report for upload
+        run: |
+          zip -qq -r ${{ inputs.environment }}-${{ env.checked_out_sha }}.zip ./playwright-report/
+
+      - name: Azure login with SPN
+        if: '!cancelled()'
+        uses: azure/login@v1
+        with:
+          creds: ${{ secrets.CI_REPORTS_AZ_CREDENTIALS }}
+
+      - name: Push report to blob storage
+        if: '!cancelled()'
+        uses: azure/CLI@v1
+        id: azure
         with:
-          name: deployment-tests-playwright-report
-          path: tests/playwright/playwright-report/
-          retention-days: 7
+          azcliversion: 2.50.0
+          inlineScript: |
+            az storage blob upload \
+              --container-name ${{ secrets.CI_REPORTS_STORAGE_CONTAINER_NAME }} \
+              --account-name ${{ secrets.CI_REPORTS_STORAGE_ACCOUNT_NAME }} \
+              --file "./tests/playwright/${{ inputs.environment }}-${{ env.checked_out_sha }}.zip" \
+              --name "Dfe.FindInformationAcademiesTrusts/playwright-report/" \
+              --auth-mode login \
+              --overwrite

terraform/ci-storage.tf

@@ -15,18 +15,10 @@ resource "azurerm_storage_account" "ci-test-reports" {
   tags = local.tags
 }
 
-resource "azurerm_storage_account_network_rules" "ci-test-reports" {
-  storage_account_id         = azurerm_storage_account.ci-test-reports.id
-  default_action             = "Deny"
-  bypass                     = []
-  virtual_network_subnet_ids = []
-  ip_rules                   = local.test_reports_storage_ipv4_allow_list
-}
-
 resource "azurerm_storage_container" "ci-test-reports" {
   name                  = "${local.resource_prefix}-reports"
   storage_account_name  = azurerm_storage_account.ci-test-reports.name
-  container_access_type = "blob"
+  container_access_type = "private"
 }
 
 resource "azurerm_monitor_diagnostic_setting" "ci-test-reports" {