cicd.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ "main", "develop" ]
  pull_request:
    branches: [ "main", "develop" ]

permissions:
  contents: read
  security-events: write

jobs:
  build-test-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  #  Crucial for Sentry and Checkov to see full history

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install Dependencies
        run: npm ci

      - name: Run ESLint
        run: npm run lint

      - name: Run Tests
        run: npm test -- --passWithNoTests

      - name: Dependency Audit
        run: npm audit --audit-level=high

      #  IaC Security Scans 
      - name: Checkov Scan (IaC security)
        run: |
          pip install checkov
          checkov -d infra/ -d helm/ \
            --check "CKV_K8S_*" \
            --skip-check CKV_SECRET_6 \
            --output sarif \
            --output-file-path checkov.sarif \
            --quiet

      - name: Upload Checkov SARIF results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: checkov.sarif

      - name: Terrascan Scan (IaC security)
        run: |
          echo "🔍 Running Terrascan..."
          curl -L "$(curl -s https://api.github.com/repos/tenable/terrascan/releases/latest | grep -o -E "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz
          tar -xf terrascan.tar.gz terrascan && rm terrascan.tar.gz
          sudo mv terrascan /usr/local/bin/
          terrascan scan -d infra/ -i terraform -t k8s || echo "Terrascan completed"

      #  Build + Scan Image
      - name: Build Docker Images
        run: |
          docker build -t mydev:${{ github.sha }} .
          docker build -t mydev-alertmanager:${{ github.sha }} infra/alertmanager/
          docker build -t mydev-grafana:${{ github.sha }} infra/grafana/
          docker build -t mydev-prometheus:${{ github.sha }} infra/prometheus/

      - name: Trivy Scan All Images
        run: |
          # Scan main app
          trivy image --format table --severity HIGH,CRITICAL mydev:${{ github.sha }} || echo "Main app vulnerabilities found"
    
          # Scan infrastructure images
          for image in mydev-alertmanager mydev-grafana mydev-prometheus; do
            echo "Scanning $image..."
            trivy image --format table --severity HIGH,CRITICAL $image:${{ github.sha }} || echo "$image vulnerabilities found"
          done

      - name: Trivy Scan SARIF (Main App Only)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: mydev:${{ github.sha }}
          format: sarif
          output: trivy.sarif
          exit-code: 0
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          skip-version-check: true

      - name: Upload Trivy SARIF results
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy.sarif

      - name: Push to Docker Hub
        run: |
          echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
          IMAGE_NAME=docker.io/${{ secrets.DOCKERHUB_USERNAME }}/mydev
          docker tag mydev:${{ github.sha }} $IMAGE_NAME:${{ github.sha }}
          docker push $IMAGE_NAME:${{ github.sha }}
          docker tag mydev:${{ github.sha }} $IMAGE_NAME:latest
          docker push $IMAGE_NAME:latest

  deploy-staging:
    runs-on: ubuntu-latest
    needs: build-test-scan
    if: github.ref == 'refs/heads/develop'
    steps:
      - name: Checkout Code (full history)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Trigger Render Staging Deploy
        uses: fjogeleit/http-request-action@v1
        with:
          url: "https://api.render.com/v1/services/${{ secrets.RENDER_SERVICE_ID }}/deploys"
          method: "POST"
          customHeaders: '{"Accept": "application/json", "Authorization": "Bearer ${{ secrets.RENDER_API_KEY }}"}'

      - name: Sentry Release (Staging)
        uses: getsentry/action-release@v2
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
        with:
          environment: staging
          version: ${{ github.sha }}
          set_commits: auto
          ignore_missing: true


  deploy-prod:
    runs-on: ubuntu-latest
    needs: build-test-scan
    if: github.ref == 'refs/heads/main'
    steps:
      - name: Checkout Code (full history)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Trigger Render Production Deploy
        uses: fjogeleit/http-request-action@v1
        with:
          url: "https://api.render.com/v1/services/${{ secrets.RENDER_SERVICE_ID_PROD }}/deploys"
          method: "POST"
          customHeaders: '{"Accept": "application/json", "Authorization": "Bearer ${{ secrets.RENDER_API_KEY }}"}'

      - name: Sentry Release (Production)
        uses: getsentry/action-release@v2
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
        with:
          environment: production
          version: ${{ github.sha }}
          set_commits: auto
          ignore_missing: true 


  notify:
    runs-on: ubuntu-latest
    needs: [build-test-scan, deploy-staging, deploy-prod]
    if: always()
    steps:
      - name: Slack Notification for Staging
        if: github.ref == 'refs/heads/develop'
        uses: rtCamp/action-slack-notify@v2
        env:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_USERNAME: Wizfi-Pipeline
          SLACK_COLOR: ${{ job.status }}
          SLACK_TITLE: "Staging Deployment Status"
          SLACK_MESSAGE: |
            Repository: ${{ github.repository }}
            Branch: ${{ github.ref }}
            Commit: ${{ github.sha }}
            Status: ${{ job.status }}
            Environment: Staging

      - name: Slack Notification for Production
        if: github.ref == 'refs/heads/main'
        uses: rtCamp/action-slack-notify@v2
        env:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_USERNAME: Wizfi-Pipeline
          SLACK_COLOR: ${{ job.status }}
          SLACK_TITLE: "Production Deployment Status"
          SLACK_MESSAGE: |
            Repository: ${{ github.repository }}
            Branch: ${{ github.ref }}
            Commit: ${{ github.sha }}
            Status: ${{ job.status }}
            Environment: Production

      - name: Debug Directory Structure
        run: |
          echo "Current directory:"
          pwd
          echo "Directory contents:"
          ls -la
          echo "Infra contents:"
          ls -la infra/ || echo "No infra directory"
          echo "Helm contents:"
          ls -la helm/ || echo "No helm directory"