ci.yml

# ============================================================
# 🚀 CI/CD Pipeline - Cloud-Native API
# ============================================================
# Stages:
#   1. Lint     → Code quality (ruff)
#   2. Test     → Unit tests + coverage (pytest)
#   3. Security → Container vulnerability scan (Trivy)
#   4. Build    → Multi-stage Docker image
#   5. Push     → Push to AWS ECR (only on main, requires secrets)
# ============================================================

name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  PYTHON_VERSION: "3.12"
  DOCKER_IMAGE: cloud-native-api

permissions:
  contents: read
  security-events: write

jobs:
  # ---- Stage 1: Lint ----
  lint:
    name: 🔍 Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install ruff
        run: pip install ruff

      - name: Run linter
        run: ruff check app/ --output-format=github

  # ---- Stage 2: Test ----
  test:
    name: 🧪 Test
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: pip

      - name: Install dependencies
        run: pip install -r requirements.txt

      - name: Run tests with coverage
        run: |
          pytest app/tests/ \
            -v \
            --cov=app \
            --cov-report=term-missing \
            --cov-report=xml:coverage.xml \
            --cov-fail-under=80

      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: coverage-report
          path: coverage.xml

  # ---- Stage 3: Security Scan ----
  security:
    name: 🛡️ Security Scan
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4

      - name: Build image for scanning
        run: docker build -t ${{ env.DOCKER_IMAGE }}:scan .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.28.0
        with:
          image-ref: ${{ env.DOCKER_IMAGE }}:scan
          format: table
          exit-code: 1
          ignore-unfixed: true
          severity: CRITICAL,HIGH

      - name: Run Trivy (SARIF output for GitHub Security)
        uses: aquasecurity/trivy-action@0.28.0
        if: always()
        with:
          image-ref: ${{ env.DOCKER_IMAGE }}:scan
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH

      - name: Upload Trivy SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy-results.sarif

  # ---- Stage 4: Build & Push ----
  build-and-push:
    name: 🐳 Build & Push
    runs-on: ubuntu-latest
    needs: security
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build production image
        run: |
          docker build \
            --tag ${{ env.DOCKER_IMAGE }}:${{ github.sha }} \
            --tag ${{ env.DOCKER_IMAGE }}:latest \
            --label "org.opencontainers.image.revision=${{ github.sha }}" \
            --label "org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
            .

      # ---- Push to ECR (requires AWS secrets) ----
      - name: Configure AWS credentials
        if: env.AWS_ACCESS_KEY_ID != ''
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION || 'us-east-1' }}
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}

      - name: Login to Amazon ECR
        if: env.AWS_ACCESS_KEY_ID != ''
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}

      - name: Push to ECR
        if: steps.login-ecr.outcome == 'success'
        run: |
          ECR_URI=${{ steps.login-ecr.outputs.registry }}/cloud-native-api-dev
          docker tag ${{ env.DOCKER_IMAGE }}:${{ github.sha }} $ECR_URI:${{ github.sha }}
          docker tag ${{ env.DOCKER_IMAGE }}:latest $ECR_URI:latest
          docker push $ECR_URI:${{ github.sha }}
          docker push $ECR_URI:latest
          echo "### 🐳 Image pushed to ECR" >> $GITHUB_STEP_SUMMARY
          echo "- \`$ECR_URI:${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY

      - name: Summary (no AWS configured)
        if: env.AWS_ACCESS_KEY_ID == ''
        run: |
          echo "### ✅ Docker image built successfully" >> $GITHUB_STEP_SUMMARY
          echo "ECR push skipped — no AWS credentials configured." >> $GITHUB_STEP_SUMMARY
          echo "To enable, add AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY to repository secrets." >> $GITHUB_STEP_SUMMARY
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}