cd.yml

name: CD Tests

on:
  push:
    branches: [ "main" ]

permissions:
  contents: read

jobs:
  cd-tests:
    name: Python Tests
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4 
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: "3.12"
    - name: Install apt dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y libmariadb3 libmariadb-dev python3-dev build-essential pkg-config
    - name: Install pip dependencies
      run: |
        python -m pip install --upgrade pip
        pip install pytest
        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
        pip install --upgrade "fastapi-mail>=1.4.1"
    - name: Run pytest (CD only)
      env:
        ENV_MAIL_USERNAME: ${{ secrets.ENV_MAIL_USERNAME }}
        ENV_MAIL_PASSWORD: ${{ secrets.ENV_MAIL_PASSWORD }}
        ENV_SECRET_KEY: ${{ secrets.ENV_SECRET_KEY }}
      run: |
        cd webapi
        if [ -f crud_data.db ]; then rm -f crud_data.db; fi
        pytest tests/test_release.py -v

  container-smoke-test:
    name: Container Build & Healthcheck Smoke Test
    runs-on: ubuntu-latest
    needs: cd-tests

    steps:
    - uses: actions/checkout@v4

    - name: Build Docker image
      run: |
        docker build -t webapi:dev .

    - name: Run container
      run: |
        docker run -d --name webapi-test -p 8000:8000 webapi:dev

    - name: Wait for container healthcheck
      run: |
        for i in {1..10}; do
          STATUS=$(docker inspect --format='{{.State.Health.Status}}' webapi-test)
          echo "Current health status: $STATUS"
          if [ "$STATUS" = "healthy" ]; then
            echo "Container is healthy"
            exit 0
          fi
          sleep 2
        done
        echo "Container failed healthcheck"
        docker logs webapi-test
        exit 1

    - name: Stop container
      if: always()
      run: |
        docker stop webapi-test

  snyk-scan:
    name: Snyk Security Scan
    runs-on: ubuntu-latest
    needs: cd-tests
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: "3.12"
    - name: Install apt dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y libmariadb3 libmariadb-dev python3-dev build-essential pkg-config
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
    - name: Run Snyk Scan
      uses: snyk/actions/python@master
      continue-on-error: true
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        command: test --json-file-output=snyk_report.json --severity-threshold=high
    - name: Upload Snyk report
      uses: actions/upload-artifact@v4
      with:
        name: snyk-report
        path: snyk_report.json