ci.yml

name: ci

on:
  pull_request:
    branches: [production, development]
  push:
    branches: [production, development]

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  build-test:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7.0.0
        with:
          go-version: '1.26.10'
          cache-dependency-path: |
            backend/libs/pkg/go.sum
            backend/services/*/go.sum
      - run: (cd backend && go work sync)
      - run: make build
      - run: make test

  web:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: '24'
      - run: npm install -g pnpm@12.6.0
      - run: make web-check
      - run: make web-build

  exam-v1:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: '24'
      - run: npm install -g pnpm@12.6.0
      - run: make exam-check
      - run: make exam-build

  integration-test:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7.0.0
        with:
          go-version: '1.26.10'
          cache-dependency-path: |
            backend/libs/pkg/go.sum
            backend/services/*/go.sum
      - run: (cd backend && go work sync)
      - run: make test-integration

  migration-verification:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7.0.0
        with:
          go-version: '1.26.10'
          cache-dependency-path: backend/libs/pkg/go.sum
      - run: make test-migrations
      - name: Validate Soft Delete Implementation
        run: ./backend/scripts/validate-soft-delete.sh

  lint-contracts:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7.0.0
        with:
          go-version: '1.26.10'
          cache-dependency-path: backend/libs/pkg/go.sum
      - run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
      - run: go install github.com/bufbuild/buf/cmd/buf@v1.72.0
      - run: make fmt-check
      - run: make vet
      - run: make lint
      - run: (cd backend/libs/proto && buf lint)

  vulnerability-scan:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7.0.0
        with:
          go-version: '1.26.10'
          cache-dependency-path: |
            backend/libs/pkg/go.sum
            backend/services/*/go.sum
      - run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
      - run: make vuln

  build-images:
    needs: [build-test]
    if: github.event_name == 'push'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        service:
          - gateway
          - identity
          - tenant
          - user
          - question-bank
          - assessment
          - submission
          - judge
          - seb
          - notification
          - analytics
        include:
          - service: frontend
            context: frontend
            file: frontend/Dockerfile
          - service: tools
            context: .
            file: deploy/single-server/Dockerfile.tools

    steps:
      - uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to GitHub Container Registry
        if: github.ref == 'refs/heads/production'
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build (and push on production)
        id: build
        uses: docker/build-push-action@v7
        with:
          context: ${{ matrix.context || 'backend' }}
          file: ${{ matrix.file || format('backend/services/{0}/Dockerfile', matrix.service) }}
          push: ${{ github.ref == 'refs/heads/production' }}
          tags: |
            ghcr.io/${{ github.repository_owner }}/aethercode-${{ matrix.service }}:latest
            ghcr.io/${{ github.repository_owner }}/aethercode-${{ matrix.service }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64

      - name: Install cosign
        if: github.ref == 'refs/heads/production'
        uses: sigstore/cosign-installer@v3

      - name: Sign image (keyless)
        if: github.ref == 'refs/heads/production'
        run: |
          cosign sign --yes \
            ghcr.io/${{ github.repository_owner }}/aethercode-${{ matrix.service }}@${{ steps.build.outputs.digest }}

      - name: Generate SBOM
        if: github.ref == 'refs/heads/production'
        uses: anchore/sbom-action@v0
        with:
          image: ghcr.io/${{ github.repository_owner }}/aethercode-${{ matrix.service }}@${{ steps.build.outputs.digest }}
          format: spdx-json
          output-file: sbom-${{ matrix.service }}.spdx.json
          artifact-name: sbom-${{ matrix.service }}

      - name: Attach SBOM to image
        if: github.ref == 'refs/heads/production'
        run: |
          cosign attach sbom \
            --sbom sbom-${{ matrix.service }}.spdx.json \
            ghcr.io/${{ github.repository_owner }}/aethercode-${{ matrix.service }}@${{ steps.build.outputs.digest }}

  helm-lint:
    needs: [build-test]
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - name: Install Helm
        uses: azure/setup-helm@v5
      - name: Lint and render all charts
        run: deploy/helm/lint.sh

  deploy:
    needs:
      - build-test
      - web
      - exam-v1
      - integration-test
      - migration-verification
      - lint-contracts
      - vulnerability-scan
      - build-images
      - helm-lint
    if: github.event_name == 'push' && github.ref == 'refs/heads/production'
    runs-on: ubuntu-24.04
    timeout-minutes: 150
    environment: production
    steps:
      - uses: actions/checkout@v7
      - uses: azure/setup-helm@v5
      - uses: azure/setup-kubectl@v4

      - name: Configure kubeconfig
        env:
          KUBECONFIG_CONTENT: ${{ secrets.KUBECONFIG }}
        run: |
          set -euo pipefail
          test -n "$KUBECONFIG_CONTENT"
          mkdir -p "$HOME/.kube"
          chmod 700 "$HOME/.kube"
          printf '%s\n' "$KUBECONFIG_CONTENT" > "$HOME/.kube/config"
          chmod 600 "$HOME/.kube/config"

      - name: Run migrations and deploy production images
        env:
          IMAGE_TAG: ${{ github.sha }}
        run: |
          set -euo pipefail
          namespace=aethercode
          chart=deploy/helm/platform-service
          services=(gateway identity tenant user question-bank assessment submission judge seb notification analytics frontend)

          helm upgrade migrations deploy/helm/platform-migrations \
            --namespace "$namespace" \
            --reuse-values \
            --set image.tag="$IMAGE_TAG" \
            --wait --atomic --timeout 15m

          for service in "${services[@]}"; do
            helm upgrade "$service" "$chart" \
              --namespace "$namespace" \
              --reuse-values \
              --values "deploy/helm/platform-service/values-$service.yaml" \
              --set image.tag="$IMAGE_TAG" \
              --wait --atomic --timeout 10m
          done

      - name: Show production workload status
        if: always()
        run: kubectl get deployments,pods -n aethercode