ci.yml

# CI/CD 파이프라인 - 지속적 통합
name: CI Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

env:
  PYTHON_VERSION: '3.11'
  NODE_VERSION: '18'

jobs:
  # 코드 품질 검사
  code-quality:
    name: Code Quality Check
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ env.PYTHON_VERSION }}
    
    - name: Cache pip dependencies
      uses: actions/cache@v3
      with:
        path: ~/.cache/pip
        key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
        restore-keys: |
          ${{ runner.os }}-pip-
    
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install black flake8 mypy bandit safety
    
    - name: Code formatting check (Black)
      run: black --check --diff .
    
    - name: Linting (Flake8)
      run: flake8 app tests --max-line-length=88 --extend-ignore=E203,W503
    
    - name: Type checking (MyPy)
      run: mypy app --ignore-missing-imports
    
    - name: Security check (Bandit)
      run: bandit -r app -f json -o bandit-report.json
    
    - name: Dependency vulnerability check (Safety)
      run: safety check --json --output safety-report.json
    
    - name: Upload security reports
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: security-reports
        path: |
          bandit-report.json
          safety-report.json

  # 단위 테스트
  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-latest
    
    strategy:
      matrix:
        python-version: ['3.9', '3.10', '3.11']
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python-version }}
    
    - name: Cache pip dependencies
      uses: actions/cache@v3
      with:
        path: ~/.cache/pip
        key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('**/requirements.txt') }}
        restore-keys: |
          ${{ runner.os }}-pip-${{ matrix.python-version }}-
    
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
    
    - name: Run unit tests
      run: |
        pytest tests/unit/ -v \
          --cov=app \
          --cov-report=xml \
          --cov-report=html \
          --cov-fail-under=90 \
          --junitxml=junit-results.xml
    
    - name: Upload test results
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: test-results-${{ matrix.python-version }}
        path: |
          junit-results.xml
          htmlcov/
    
    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v3
      if: matrix.python-version == '3.11'
      with:
        file: ./coverage.xml
        flags: unittests
        name: codecov-umbrella

  # 통합 테스트
  integration-tests:
    name: Integration Tests
    runs-on: ubuntu-latest
    
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_PASSWORD: testpass
          POSTGRES_USER: testuser
          POSTGRES_DB: testdb
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
      
      redis:
        image: redis:7
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ env.PYTHON_VERSION }}
    
    - name: Install system dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y postgresql-client
    
    - name: Install Python dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
    
    - name: Run database migrations
      env:
        DATABASE_URL: postgresql://testuser:testpass@localhost:5432/testdb
      run: |
        alembic upgrade head
    
    - name: Run integration tests
      env:
        DATABASE_URL: postgresql://testuser:testpass@localhost:5432/testdb
        REDIS_URL: redis://localhost:6379/0
        TESTING: true
      run: |
        pytest tests/integration/ -v \
          --junitxml=integration-results.xml
    
    - name: Upload integration test results
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: integration-test-results
        path: integration-results.xml

  # Docker 이미지 빌드 테스트
  docker-build:
    name: Docker Build Test
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    
    - name: Build production image
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ./Dockerfile
        push: false
        tags: backup-manager:test
        cache-from: type=gha
        cache-to: type=gha,mode=max
    
    - name: Build development image
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ./Dockerfile.dev
        push: false
        tags: backup-manager:dev-test
        cache-from: type=gha
        cache-to: type=gha,mode=max
    
    - name: Test Docker Compose
      run: |
        docker-compose -f docker-compose.yml config
        docker-compose -f docker-compose.dev.yml config

  # 성능 테스트 (선택적)
  performance-tests:
    name: Performance Tests
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ env.PYTHON_VERSION }}
    
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
    
    - name: Run performance tests
      run: |
        pytest tests/performance/ -v -m performance \
          --junitxml=performance-results.xml
    
    - name: Upload performance test results
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: performance-test-results
        path: performance-results.xml

  # 보안 스캔
  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    
    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        output: 'trivy-results.sarif'
    
    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v2
      if: always()
      with:
        sarif_file: 'trivy-results.sarif'

  # 결과 요약
  test-summary:
    name: Test Summary
    runs-on: ubuntu-latest
    needs: [code-quality, unit-tests, integration-tests, docker-build]
    if: always()
    
    steps:
    - name: Download all artifacts
      uses: actions/download-artifact@v3
    
    - name: Generate test summary
      run: |
        echo "## 🧪 Test Results Summary" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        
        if [ "${{ needs.code-quality.result }}" == "success" ]; then
          echo "✅ Code Quality: PASSED" >> $GITHUB_STEP_SUMMARY
        else
          echo "❌ Code Quality: FAILED" >> $GITHUB_STEP_SUMMARY
        fi
        
        if [ "${{ needs.unit-tests.result }}" == "success" ]; then
          echo "✅ Unit Tests: PASSED" >> $GITHUB_STEP_SUMMARY
        else
          echo "❌ Unit Tests: FAILED" >> $GITHUB_STEP_SUMMARY
        fi
        
        if [ "${{ needs.integration-tests.result }}" == "success" ]; then
          echo "✅ Integration Tests: PASSED" >> $GITHUB_STEP_SUMMARY
        else
          echo "❌ Integration Tests: FAILED" >> $GITHUB_STEP_SUMMARY
        fi
        
        if [ "${{ needs.docker-build.result }}" == "success" ]; then
          echo "✅ Docker Build: PASSED" >> $GITHUB_STEP_SUMMARY
        else
          echo "❌ Docker Build: FAILED" >> $GITHUB_STEP_SUMMARY
        fi
        
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "📊 **Coverage Report**: Available in artifacts" >> $GITHUB_STEP_SUMMARY
        echo "🔒 **Security Report**: Available in Security tab" >> $GITHUB_STEP_SUMMARY