Pipeline Stages

on:
  push:
    branches: [main, develop]
    paths:
      - 'src/**'          # Only trigger if source code changed
      - 'package.json'    # Or dependencies changed
      - '!**.md'          # Ignore documentation changes
 
  pull_request:
    branches: [main]
 
  schedule:
    - cron: '0 2 * * MON-FRI'  # Weekdays at 2 AM UTC
 
  workflow_dispatch:           # Manual trigger button
    inputs:
      environment:
        description: 'Deploy to which environment?'
        required: true
        default: 'staging'
        type: choice
        options:
          - staging
          - production

workflow:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "main"'
    - if: '$CI_COMMIT_BRANCH == "develop"'
    - if: '$CI_PIPELINE_SOURCE == "schedule"'

pipeline {
  triggers {
    pollSCM('H/5 * * * *')  // Check for changes every 5 minutes
    cron('0 2 * * *')        // Nightly build at 2 AM
  }
}

# GitHub Actions
lint:
  name: Code Quality
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
 
    - uses: actions/setup-node@v4
      with:
        node-version: '20'
        cache: 'npm'
 
    - run: npm ci
 
    # JavaScript/TypeScript linting
    - name: ESLint
      run: npm run lint -- --max-warnings=0
 
    # Type checking
    - name: TypeScript
      run: npx tsc --noEmit
 
    # Formatting check
    - name: Prettier
      run: npx prettier --check "src/**/*.{ts,tsx,js,jsx}"
 
    # Commit message linting
    - name: Commitlint
      run: |
        npm install @commitlint/cli @commitlint/config-conventional
        echo "${{ github.event.head_commit.message }}" | npx commitlint

build:
  name: Build Application
  runs-on: ubuntu-latest
  needs: lint  # Only build if lint passes
 
  steps:
    - uses: actions/checkout@v4
 
    - uses: actions/setup-node@v4
      with:
        node-version: '20'
        cache: 'npm'
 
    - name: Install dependencies
      run: npm ci
 
    - name: Build application
      run: npm run build
      env:
        NODE_ENV: production
 
    - name: Build Docker image
      run: |
        docker build \
          --tag myapp:${{ github.sha }} \
          --tag myapp:latest \
          --build-arg BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
          --build-arg GIT_SHA=${{ github.sha }} \
          .
 
    - name: Push to container registry
      run: |
        echo "${{ secrets.DOCKER_PASSWORD }}" | \
          docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
        docker push myapp:${{ github.sha }}
        docker push myapp:latest
 
    # Save build output for later stages
    - name: Upload build artifacts
      uses: actions/upload-artifact@v4
      with:
        name: build-output
        path: dist/
        retention-days: 7

# Stage 1: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force
COPY . .
RUN npm run build
 
# Stage 2: Production (tiny image)
FROM node:20-alpine AS production
WORKDIR /app
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./package.json
USER appuser
EXPOSE 3000
HEALTHCHECK --interval=30s CMD wget -q --spider http://localhost:3000/health || exit 1
CMD ["node", "dist/server.js"]

test-unit:
  name: Unit Tests
  runs-on: ubuntu-latest
  needs: build
 
  strategy:
    matrix:
      node-version: [18, 20, 22]  # Test on multiple versions
 
  steps:
    - uses: actions/checkout@v4
 
    - uses: actions/setup-node@v4
      with:
        node-version: ${{ matrix.node-version }}
        cache: 'npm'
 
    - run: npm ci
 
    - name: Run unit tests with coverage
      run: npm test -- --coverage --watchAll=false
      env:
        CI: true
 
    - name: Check coverage threshold
      run: |
        COVERAGE=$(npx istanbul-coverage-check --statements 80 --branches 75 --functions 80 --lines 80)
        echo "Coverage check: $COVERAGE"
 
    - name: Upload coverage report
      uses: codecov/codecov-action@v4
      with:
        files: ./coverage/lcov.info
        fail_ci_if_error: true
        flags: unit-tests
 
    - name: Upload test results
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: test-results-node-${{ matrix.node-version }}
        path: junit.xml

test-integration:
  name: Integration Tests
  runs-on: ubuntu-latest
  needs: build
 
  services:
    # Spin up real databases for testing
    postgres:
      image: postgres:16
      env:
        POSTGRES_DB: testdb
        POSTGRES_USER: testuser
        POSTGRES_PASSWORD: testpass
      ports:
        - 5432:5432
      options: >-
        --health-cmd pg_isready
        --health-interval 10s
        --health-timeout 5s
        --health-retries 5
 
    redis:
      image: redis:7-alpine
      ports:
        - 6379:6379
      options: >-
        --health-cmd "redis-cli ping"
        --health-interval 10s
        --health-timeout 5s
        --health-retries 5
 
  steps:
    - uses: actions/checkout@v4
 
    - uses: actions/setup-node@v4
      with:
        node-version: '20'
        cache: 'npm'
 
    - run: npm ci
 
    - name: Run database migrations
      run: npm run db:migrate
      env:
        DATABASE_URL: postgresql://testuser:testpass@localhost:5432/testdb
 
    - name: Seed test data
      run: npm run db:seed
      env:
        DATABASE_URL: postgresql://testuser:testpass@localhost:5432/testdb
 
    - name: Run integration tests
      run: npm run test:integration
      env:
        DATABASE_URL: postgresql://testuser:testpass@localhost:5432/testdb
        REDIS_URL: redis://localhost:6379
        NODE_ENV: test

security:
  name: Security Scanning
  runs-on: ubuntu-latest
  needs: build
 
  steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0  # Full history for secret scanning
 
    # 1. Dependency vulnerability scanning
    - name: npm audit
      run: npm audit --audit-level=high
      continue-on-error: false
 
    # 2. Secret detection
    - name: TruffleHog scan
      uses: trufflesecurity/trufflehog@main
      with:
        path: ./
        extra_args: --only-verified
 
    # 3. SAST with CodeQL
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: javascript-typescript
 
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
 
    # 4. Container image scanning
    - name: Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: myapp:${{ github.sha }}
        format: 'sarif'
        output: 'trivy-results.sarif'
        severity: 'CRITICAL,HIGH'
        exit-code: '1'  # Fail pipeline on critical/high
 
    - name: Upload security results
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: trivy-results.sarif

deploy-staging:
  name: Deploy to Staging
  runs-on: ubuntu-latest
  needs: [test-unit, test-integration, security]
  if: github.ref == 'refs/heads/develop'
 
  environment:
    name: staging
    url: https://staging.myapp.com
 
  steps:
    - uses: actions/checkout@v4
 
    - name: Configure kubectl
      uses: azure/setup-kubectl@v3
 
    - name: Set Kubernetes context
      uses: azure/k8s-set-context@v3
      with:
        kubeconfig: ${{ secrets.KUBE_CONFIG_STAGING }}
 
    - name: Deploy to staging
      run: |
        kubectl set image deployment/myapp \
          myapp=myregistry.io/myapp:${{ github.sha }} \
          -n staging
 
    - name: Wait for rollout
      run: kubectl rollout status deployment/myapp -n staging --timeout=5m
 
    - name: Run smoke tests
      run: |
        # Wait for service to be ready
        for i in $(seq 1 30); do
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://staging.myapp.com/health)
          if [ "$STATUS" = "200" ]; then
            echo "✅ Health check passed"
            break
          fi
          echo "Waiting for staging... ($i/30)"
          sleep 5
        done
 
        # Verify critical endpoints
        curl -f https://staging.myapp.com/api/status
        curl -f https://staging.myapp.com/api/version
 
    - name: Run E2E tests against staging
      run: |
        npx playwright test --config=playwright.staging.config.ts
      env:
        BASE_URL: https://staging.myapp.com
 
    - name: Notify team
      if: always()
      uses: 8398a7/action-slack@v3
      with:
        status: ${{ job.status }}
        text: |
          Staging deployment: ${{ job.status }}
          Version: ${{ github.sha }}
          URL: https://staging.myapp.com
        webhook_url: ${{ secrets.SLACK_WEBHOOK }}

deploy-production:
  name: Deploy to Production
  runs-on: ubuntu-latest
  needs: deploy-staging
 
  environment:
    name: production
    url: https://myapp.com
 
  steps:
    - uses: actions/checkout@v4
 
    - name: Configure kubectl
      uses: azure/setup-kubectl@v3
 
    - name: Set Kubernetes context
      uses: azure/k8s-set-context@v3
      with:
        kubeconfig: ${{ secrets.KUBE_CONFIG_PRODUCTION }}
 
    # Rolling deployment with health checks
    - name: Deploy to production
      run: |
        kubectl set image deployment/myapp \
          myapp=myregistry.io/myapp:${{ github.sha }} \
          -n production
 
    - name: Monitor rollout
      run: |
        kubectl rollout status deployment/myapp \
          -n production \
          --timeout=10m
 
    # Post-deployment validation
    - name: Production smoke tests
      run: |
        sleep 30  # Wait for DNS propagation
 
        # Health check
        curl -f https://myapp.com/health
 
        # API validation
        curl -f https://myapp.com/api/status
 
        # Response time check
        RESPONSE_TIME=$(curl -w "%{time_total}" -o /dev/null -s https://myapp.com)
        echo "Response time: ${RESPONSE_TIME}s"
 
        if (( $(echo "$RESPONSE_TIME > 3.0" | bc -l) )); then
          echo "❌ Response time too slow!"
          exit 1
        fi
 
    # Auto-rollback on failure
    - name: Rollback on failure
      if: failure()
      run: |
        echo "❌ Production deployment failed! Rolling back..."
        kubectl rollout undo deployment/myapp -n production
        kubectl rollout status deployment/myapp -n production
 
    - name: Create release tag
      if: success()
      run: |
        gh release create "v$(date +%Y%m%d-%H%M%S)" \
          --title "Production Release" \
          --notes "Deployed commit: ${{ github.sha }}"
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
    - name: Notify deployment
      if: always()
      run: |
        STATUS="${{ job.status }}"
        curl -X POST ${{ secrets.SLACK_WEBHOOK }} \
          -H 'Content-Type: application/json' \
          -d "{\"text\":\"🚀 Production deployment: ${STATUS}\nCommit: ${{ github.sha }}\nURL: https://myapp.com\"}"

name: Full CI/CD Pipeline
 
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
 
jobs:
  # Stage 1: Source (trigger is automatic)
 
  # Stage 2: Lint
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci
      - run: npm run lint
      - run: npx tsc --noEmit
 
  # Stage 3: Build
  build:
    needs: lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci
      - run: npm run build
      - uses: actions/upload-artifact@v4
        with: { name: build, path: dist/ }
 
  # Stage 4: Unit Tests
  test-unit:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci
      - run: npm test -- --coverage
      - uses: codecov/codecov-action@v4
 
  # Stage 5: Integration Tests
  test-integration:
    needs: build
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env: { POSTGRES_DB: test, POSTGRES_USER: test, POSTGRES_PASSWORD: test }
        ports: ['5432:5432']
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci
      - run: npm run test:integration
 
  # Stage 6: Security
  security:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm audit --audit-level=high
      - uses: github/codeql-action/init@v3
        with: { languages: javascript-typescript }
      - uses: github/codeql-action/analyze@v3
 
  # Stage 7: Deploy to Staging
  deploy-staging:
    needs: [test-unit, test-integration, security]
    if: github.ref == 'refs/heads/develop'
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - run: echo "Deploying to staging..."
      # kubectl deploy commands here
 
  # Stage 8: Deploy to Production
  deploy-production:
    needs: [test-unit, test-integration, security]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: echo "Deploying to production..."
      # kubectl deploy commands here

jobs:
  build:
    timeout-minutes: 15  # Kill if stuck