ci.yml

name: CI/CD

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write
  actions: read

env:
  REGISTRY: ghcr.io

jobs:
  # ── Unit & integration tests ─────────────────────────────
  test:
    name: Test (Node ${{ matrix.node-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node-version: [20.x, 22.x]

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm

      - run: npm ci

      - name: Run tests
        run: npm test
        env:
          NODE_ENV: test
          JWT_SECRET: ci-test-demo-secret
          STORAGE_BACKEND: json

      - name: Audit dependencies
        run: npm audit --audit-level=high
        continue-on-error: true

  # ── Static security analysis (runs parallel to tests) ───
  scan:
    name: Security Scan
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Semgrep SAST
        run: |
          pip install semgrep
          semgrep scan \
            --config "p/default" \
            --config "p/javascript" \
            --config "p/docker" \
            --config "p/github-actions" \
            --json --output semgrep-results.json || true
        continue-on-error: true

      - name: Upload Semgrep results
        uses: actions/upload-artifact@v4
        if: always() && hashFiles('semgrep-results.json') != ''
        with:
          name: ankra-semgrep-scan
          path: semgrep-results.json
          retention-days: 90

      - name: Checkov IaC scan
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: .
          framework: dockerfile,helm,github_actions
          output_format: json
          output_file_path: checkov-results.json
          soft_fail: true
        continue-on-error: true

      - name: Upload Checkov results
        uses: actions/upload-artifact@v4
        if: always() && hashFiles('checkov-results.json') != ''
        with:
          name: ankra-checkov-scan
          path: checkov-results.json
          retention-days: 90

  # ── Docker build + Helm package (main branch only) ──────
  build:
    name: Build & Publish
    runs-on: ubuntu-latest
    needs: [test, scan]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'

    steps:
      - uses: actions/checkout@v4

      - name: Derive image name (lowercase)
        id: repo
        run: |
          echo "image=${{ env.REGISTRY }}/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
          echo "owner=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

      # ── Docker ───────────────────────────────────────────
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ steps.repo.outputs.image }}
          tags: |
            type=sha
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64

      # ── Image vulnerability scan ────────────────────────
      - name: Get short SHA
        id: vars
        run: echo "short_sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT

      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@v0.35.0
        with:
          image-ref: ${{ steps.repo.outputs.image }}:sha-${{ steps.vars.outputs.short_sha }}
          format: json
          output: trivy-results.json
          severity: CRITICAL,HIGH,MEDIUM,LOW
          trivyignores: .trivyignore
        continue-on-error: true

      - name: Upload Trivy results
        uses: actions/upload-artifact@v4
        if: always() && hashFiles('trivy-results.json') != ''
        with:
          name: ankra-security-scan
          path: trivy-results.json
          retention-days: 90

      # ── Helm ─────────────────────────────────────────────
      - name: Setup Helm
        uses: azure/setup-helm@v4

      - name: Helm lint
        run: helm lint chart/

      - name: Package and push Helm chart
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ${{ env.REGISTRY }} -u ${{ github.actor }} --password-stdin
          helm package chart/
          CHART_PKG=$(ls isms-builder-*.tgz)
          helm push "$CHART_PKG" oci://${{ env.REGISTRY }}/${{ steps.repo.outputs.owner }}/charts

      # ── Make packages public ─────────────────────────────
      # GHCR packages are private by default. Attempt to set public visibility.
      # If GITHUB_TOKEN lacks permission, set visibility manually in GitHub:
      #   Profile → Packages → select package → Package settings → Change visibility
      - name: Make container image public
        run: |
          curl -s -f -X PATCH \
            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/orgs/${{ steps.repo.outputs.owner }}/packages/container/isms-builder/visibility" \
            -d '{"visibility":"public"}' || \
          curl -s -f -X PATCH \
            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/user/packages/container/isms-builder/visibility" \
            -d '{"visibility":"public"}' || true
        continue-on-error: true

      - name: Make Helm chart public
        run: |
          curl -s -f -X PATCH \
            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/orgs/${{ steps.repo.outputs.owner }}/packages/container/charts%2Fisms-builder/visibility" \
            -d '{"visibility":"public"}' || \
          curl -s -f -X PATCH \
            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/user/packages/container/charts%2Fisms-builder/visibility" \
            -d '{"visibility":"public"}' || true
        continue-on-error: true