deploy.yml

name: Secure Build & Deploy

on:
  pull_request: # Trigger on PRs to any branch
  push:
    branches: ['main'] # Only auto-deploy from main
  merge_group:
    branches: ['main'] # Only auto-deploy from main
  workflow_dispatch:

# 🔒 LOCK DOWN PERMISSIONS (Least Privilege)
permissions:
  contents: read

jobs:
  # ------------------------------------------------------------------
  # JOB 1: GUARD (Runs on all PRs and pushes)
  # ------------------------------------------------------------------
  guard:
    name: 🛡️ Build Guard
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read # Allow cache restore without high-privilege write access
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '20.19.0'

      - name: Install dependencies
        run: npm ci

      - name: Run linter
        run: npm run lint

      - name: Build check
        run: npm run build

  # ------------------------------------------------------------------
  # JOB 1b: LIGHTHOUSE CI (Performance + Accessibility)
  # ------------------------------------------------------------------
  lighthouse:
    needs: guard
    name: 🔦 Lighthouse CI
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '20.19.0'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Run Lighthouse CI (desktop)
        uses: treosh/lighthouse-ci-action@fcd65974f7c4c2bf0ee9d09b84d2489183c29726 # v12.6.1
        with:
          configPath: ./lighthouserc.json
          uploadArtifacts: true
          temporaryPublicStorage: true
          artifactName: lighthouse-results-desktop

      - name: Run Lighthouse CI (mobile)
        uses: treosh/lighthouse-ci-action@fcd65974f7c4c2bf0ee9d09b84d2489183c29726 # v12.6.1
        with:
          configPath: ./lighthouserc.mobile.json
          uploadArtifacts: true
          temporaryPublicStorage: true
          artifactName: lighthouse-results-mobile

  # ------------------------------------------------------------------
  # JOB 2: SECURITY AUDIT (SAST + SCA)
  # ------------------------------------------------------------------
  audit:
    needs: guard
    if: |
      github.event_name == 'push' ||
      github.event_name == 'workflow_dispatch' ||
      github.event_name == 'merge_group' ||
      github.event_name == 'pull_request'
    name: 🛡️ Security Audit
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      # 🛡️ HARDEN RUNNER: Monitor network traffic
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      # 🔍 TRIVY: Scan for known vulnerabilities in dependencies
      - name: Run Trivy Vulnerability Scanner
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # v0.34.2
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          format: 'table'
          exit-code: '1'
          severity: 'CRITICAL,HIGH'

  # ------------------------------------------------------------------
  # JOB 3: BUILD, PUSH & SIGN DOCKER IMAGE
  # ------------------------------------------------------------------
  build-push-sign:
    name: 🏗️ Build, Push & Sign
    needs: audit
    if: |
      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: write # Required for cache and artifact operations
      id-token: write # Required for Sigstore signing
      packages: write # Required for GHCR push
      attestations: write # Required for GitHub attestations
    env:
      SIGSTORE_ROOT_FILE: ''
      TUF_ROOT: https://tuf-repo-cdn.sigstore.dev
    outputs:
      digest: ${{ steps.build.outputs.digest }}
      image: ${{ steps.image.outputs.image }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare metadata
        id: prep
        run: |
          TIMESTAMP=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
          echo "created=$TIMESTAMP" >> $GITHUB_OUTPUT
          echo "started_on=$TIMESTAMP" >> $GITHUB_OUTPUT

      - name: Build and push Docker image
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
        id: build
        with:
          context: .
          push: true
          tags: |
            ghcr.io/${{ github.repository }}:main
            ghcr.io/${{ github.repository }}:${{ github.sha }}
            ghcr.io/${{ github.repository }}:latest
          platforms: linux/amd64
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            APP_COMMIT_SHA=${{ github.sha }}
            SOURCE_DATE_EPOCH=1767225600
            AUDIT_STATUS=PASSED (Trivy)
            SIGNATURE_STATUS=SLSA_PROVENANCE_GENERATED
            NEXT_PUBLIC_SITE_URL=https://devakesu.com
            NEXT_PUBLIC_ANALYTICS_ENABLED=true
            BUILD_ID=${{ github.run_number }}
            GITHUB_REPOSITORY=${{ github.repository }}
            GITHUB_RUN_ID=${{ github.run_id }}
          labels: |
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.created=${{ steps.prep.outputs.created }}

      - name: Set image output
        id: image
        run: echo "image=ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"

      # Install cosign
      - name: Install cosign
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      # Initialize Sigstore with latest TUF root
      - name: Initialize Sigstore
        run: |
          cosign version
          if cosign initialize --mirror=https://tuf-repo-cdn.sigstore.dev --root=https://tuf-repo-cdn.sigstore.dev/5.root.json; then
            echo "✅ Sigstore TUF initialization successful"
          else
            echo "⚠️ Manual TUF initialization failed (exit code: $?), relying on automatic initialization"
          fi

      # 📦 GENERATE SBOM
      - name: Generate SBOM
        uses: anchore/sbom-action@17ae1740179002c89186b61233e0f892c3118b11 # v0.23.0
        with:
          image: ${{ steps.image.outputs.image }}
          format: cyclonedx-json
          output-file: sbom.json

      - name: Upload SBOM
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: sbom
          path: sbom.json

      # 🔑 ATTEST SBOM
      - name: Attest SBOM
        env:
          COSIGN_EXPERIMENTAL: 'true'
        run: |
          cosign attest \
            --yes \
            --predicate sbom.json \
            --type cyclonedx \
            ${{ steps.image.outputs.image }}

      # 📝 GENERATE PROVENANCE (SLSA)
      - name: Generate provenance
        run: |
          cat <<EOF > provenance.json
          {
            "builder": {
              "id": "${{ github.server_url }}/${{ github.repository }}/.github/workflows/${{ github.workflow }}"
            },
            "buildType": "https://github.com/slsa-framework/slsa-github-generator/container@v1",
            "invocation": {
              "configSource": {
                "uri": "${{ github.server_url }}/${{ github.repository }}",
                "digest": {
                  "gitCommit": "${{ github.sha }}"
                }
              }
            },
            "metadata": {
              "buildInvocationID": "${{ github.run_id }}",
              "startedOn": "${{ steps.prep.outputs.started_on }}"
            }
          }
          EOF

      # 🔏 ATTEST PROVENANCE (SLSA)
      - name: Attest provenance (SLSA)
        run: |
          cosign attest \
            --yes \
            --predicate provenance.json \
            --type slsaprovenance \
            ${{ steps.image.outputs.image }}

      # ✍️ SIGN IMAGE (keyless)
      - name: Sign image (keyless)
        env:
          COSIGN_EXPERIMENTAL: 'true'
        run: |
          cosign sign --yes \
            ${{ steps.image.outputs.image }}

      # 🏆 GITHUB ATTESTATION
      - name: Generate GitHub Attestation
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

  # ------------------------------------------------------------------
  # JOB 4: DEPLOY
  # ------------------------------------------------------------------
  deploy:
    name: 🚀 Deploy to Coolify
    needs: build-push-sign
    if: |
      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Trigger Coolify Deploy
        env:
          COOLIFY_BASE_URL: ${{ secrets.COOLIFY_BASE_URL }}
          COOLIFY_APP_ID: ${{ secrets.COOLIFY_APP_ID }}
          COOLIFY_API_TOKEN: ${{ secrets.COOLIFY_API_TOKEN }}
        run: |
          curl --fail --show-error --retry 3 --retry-delay 5 --max-time 60 -X POST \
            "$COOLIFY_BASE_URL/api/v1/deploy?uuid=$COOLIFY_APP_ID" \
            -H "Authorization: Bearer $COOLIFY_API_TOKEN"