ci.yml

name: 'CI & PR Security Pipeline'

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read
  security-events: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ============================================================================
  # 1. Quality & Linting Gate
  # ============================================================================
  quality:
    name: 'Code Quality & Formatting'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.29.2

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: 'pnpm'

      - name: Setup Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.13'

      - name: Install Dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify Prettier Code Formatting
        run: pnpm format:check

      - name: Run ESLint & Python AST Linting
        run: pnpm lint

  # ============================================================================
  # 2. CI Secret Scanning Gate (Defense-in-Depth)
  # ============================================================================
  secret-scan:
    name: 'Secret Detection Scan'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Complete Git History
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.29.2

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: 'pnpm'

      - name: Install Root Tooling
        run: pnpm install --frozen-lockfile

      - name: Run Monorepo Secret Scanner
        run: node scripts/scan-secrets.js

      - name: Run Gitleaks Repository Scan
        uses: gitleaks/gitleaks-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_CONFIG: .gitleaks.toml

  # ============================================================================
  # 3. Node.js Applications (Web, Dashboard, Notification) Test & Build
  # ============================================================================
  test-and-build-node:
    name: 'Node.js Apps (Test & Build)'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.29.2

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: 'pnpm'

      - name: Install Dependencies
        run: pnpm install --frozen-lockfile

      - name: Run Jest Unit Tests
        run: pnpm -r --if-present test

      - name: Run Application Production Builds
        run: pnpm -r build

  # ============================================================================
  # 4. Python Django Identity Service Test & Validation
  # ============================================================================
  test-and-build-python:
    name: 'Django Identity Service (Test & Build)'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Setup Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.13'
          cache: 'pip'
          cache-dependency-path: 'apps/identity-service/requirements.txt'

      - name: Install Python Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r apps/identity-service/requirements.txt

      - name: Run Django Test Suite
        env:
          DJANGO_SECRET_KEY: 'django-insecure-ci-test-key-only-not-for-production'
          DJANGO_DEBUG: 'True'
        run: |
          python apps/identity-service/manage.py test

  # ============================================================================
  # 5. Java Spring Boot Orders Service Test & Build
  # ============================================================================
  test-and-build-java:
    name: 'Spring Boot Orders Service (Test & Build)'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Setup Java 21 (Temurin)
        uses: actions/setup-java@v6
        with:
          distribution: 'temurin'
          java-version: '21'
          cache: 'maven'

      - name: Run Spring Boot Tests & Build JAR Package
        run: |
          cd apps/orders-service
          mvn clean test package -B

  # ============================================================================
  # 6. Static Application Security Testing (SAST)
  # ============================================================================
  sast-scan:
    name: 'Semgrep SAST Scan'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Run Semgrep SAST Analysis
        uses: semgrep/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/owasp-top-ten
            security/policies/semgrep.yml
          generateSarif: '1'

      - name: Upload SARIF Results to GitHub Security Tab
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: semgrep.sarif
        continue-on-error: true

  # ============================================================================
  # 7. Dependency Vulnerability Scanning (SCA)
  # ============================================================================
  dependency-security:
    name: 'Trivy Dependency Vulnerability Scan'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Setup Java 21 & Cache Maven Dependencies
        uses: actions/setup-java@v6
        with:
          distribution: 'temurin'
          java-version: '21'
          cache: 'maven'

      - name: Resolve Maven Dependencies into Local Cache
        run: |
          cd apps/orders-service
          mvn dependency:resolve -B || true

      - name: Run Trivy Filesystem Dependency Scanner
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: 'fs'
          scan-ref: '.'
          scanners: 'vuln'
          severity: 'CRITICAL,HIGH'
          exit-code: '0' # Non-blocking in baseline, logs full findings table
          format: 'table'

  # ============================================================================
  # 8. Consolidated CI Summary
  # ============================================================================
  ci-summary:
    name: 'CI Security & Quality Summary'
    runs-on: ubuntu-latest
    needs:
      - quality
      - secret-scan
      - test-and-build-node
      - test-and-build-python
      - test-and-build-java
      - sast-scan
      - dependency-security
    if: always()
    steps:
      - name: Generate Consolidated Summary Table
        run: |
          echo "## 🛡️ DevSecOps CI & PR Security Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Gate / Job | Status | Description |" >> $GITHUB_STEP_SUMMARY
          echo "|---|---|---|" >> $GITHUB_STEP_SUMMARY
          echo "| **Quality & Formatting** | ${{ needs.quality.result == 'success' && '✅ PASSED' || '❌ FAILED' }} | Prettier & ESLint checks |" >> $GITHUB_STEP_SUMMARY
          echo "| **Secret Scan** | ${{ needs.secret-scan.result == 'success' && '✅ PASSED' || '❌ FAILED' }} | Gitleaks & local scanner |" >> $GITHUB_STEP_SUMMARY
          echo "| **Node.js Apps** | ${{ needs.test-and-build-node.result == 'success' && '✅ PASSED' || '❌ FAILED' }} | Web, Dashboard, Notification |" >> $GITHUB_STEP_SUMMARY
          echo "| **Python Identity Service** | ${{ needs.test-and-build-python.result == 'success' && '✅ PASSED' || '❌ FAILED' }} | Django test suite (27 tests) |" >> $GITHUB_STEP_SUMMARY
          echo "| **Java Orders Service** | ${{ needs.test-and-build-java.result == 'success' && '✅ PASSED' || '❌ FAILED' }} | Spring Boot JUnit suite (28 tests) |" >> $GITHUB_STEP_SUMMARY
          echo "| **Semgrep SAST** | ${{ needs.sast-scan.result == 'success' && '✅ PASSED' || '❌ FAILED' }} | Multi-language static analysis |" >> $GITHUB_STEP_SUMMARY
          echo "| **Dependency Security** | ${{ needs.dependency-security.result == 'success' && '✅ PASSED' || '❌ FAILED' }} | Trivy Software Composition Analysis |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

      - name: Verify All Required Gates Passed
        run: |
          if [[ "${{ needs.quality.result }}" != "success" || \
                "${{ needs.secret-scan.result }}" != "success" || \
                "${{ needs.test-and-build-node.result }}" != "success" || \
                "${{ needs.test-and-build-python.result }}" != "success" || \
                "${{ needs.test-and-build-java.result }}" != "success" || \
                "${{ needs.sast-scan.result }}" != "success" ]]; then
            echo "❌ One or more required security/quality gates failed."
            exit 1
          fi
          echo "✅ All CI security and quality gates passed successfully!"