deploy-dev.yml

# Deploy — DEV environment
#
# Triggered by every push to the develop branch.
# Pipeline order:
#   1. Quality checks + security scans (parallel)
#   2. Terraform apply  ──┐  (parallel after all checks pass)
#      Build Lambda image ─┘
#   3. Build frontend (needs Terraform outputs for VITE env vars)
#      Update Lambda function code  (parallel after step 2)
#   4. Sync frontend to S3 + invalidate CloudFront
#   5. DAST — OWASP ZAP baseline scan
#
# Secrets required (set in the "dev" GitHub Environment):
#   UNSPLASH_ACCESS_KEY — Unsplash API key for SSM
#   SNS_FROM_NUMBER     — SMS origination number (TF_VAR_sns_from_number)
#   ALERT_EMAIL         — owner email for the billing alarm + research-download notices
# Secrets required at repo level:
#   SONAR_TOKEN — SonarCloud analysis token
#
# GitHub Environment "dev" must exist before this workflow can run.
# The OIDC deploy role (bba-dev-deploy) is created by terraform.

name: Deploy DEV

on:
  push:
    branches: [develop]

permissions:
  contents: read

concurrency:
  group: deploy-dev
  cancel-in-progress: true

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  AWS_ACCOUNT_ID: "958941188378"
  AWS_REGION: us-east-1
  ENVIRONMENT: dev
  NODE_VERSION: "20"
  TF_VERSION: "1.9.8"
  TF_STATE_KEY: bba/dev/terraform.tfstate

jobs:
  # ---------------------------------------------------------------------------
  # Phase 1 — Quality checks (parallel)
  # ---------------------------------------------------------------------------
  frontend-quality:
    name: Frontend — Lint & Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - run: npm ci
        working-directory: frontend
      - run: npm run lint
        working-directory: frontend
      - run: npm test -- --coverage --watchAll=false
        working-directory: frontend
        env:
          CI: true
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: frontend-coverage
          path: frontend/coverage/
          retention-days: 1

  backend-quality:
    name: Backend — Lint & Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: backend/package-lock.json
      - run: npm ci
        working-directory: backend
      - run: npm run lint
        working-directory: backend
      - run: npm test -- --coverage
        working-directory: backend
        env:
          CI: true
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: backend-coverage
          path: backend/coverage/
          retention-days: 1

  sast:
    name: SAST — Semgrep
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: semgrep/semgrep-action@v1
        with:
          config: "p/security-audit p/secrets p/typescript p/owasp-top-ten"

  secrets-scan:
    name: Secrets — Gitleaks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  dep-scan:
    name: Dependencies — Trivy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: fs
          scan-ref: .
          format: table
          exit-code: "1"
          ignore-unfixed: true
          severity: CRITICAL,HIGH
          skip-dirs: legacy

  iac-scan:
    name: IaC — Checkov & tfsec
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkov
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: infra/
          soft_fail: true
      - name: Trivy IaC scan
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: config
          scan-ref: infra/
          format: table
          exit-code: "0"
          severity: CRITICAL,HIGH

  sbom:
    name: SBOM — Syft
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: anchore/sbom-action@v0
        with:
          format: cyclonedx-json
          artifact-name: bba-dev-sbom.cdx.json

  sonarcloud:
    name: Code Quality — SonarCloud
    needs: [frontend-quality, backend-quality]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/download-artifact@v4
        with:
          name: frontend-coverage
          path: frontend/coverage
      - uses: actions/download-artifact@v4
        with:
          name: backend-coverage
          path: backend/coverage
      - uses: SonarSource/sonarcloud-github-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  # ---------------------------------------------------------------------------
  # Phase 2a — Terraform apply (after all checks pass)
  # ---------------------------------------------------------------------------
  terraform:
    name: Terraform — DEV
    needs:
      [
        frontend-quality,
        backend-quality,
        sast,
        secrets-scan,
        dep-scan,
        iac-scan,
      ]
    runs-on: ubuntu-latest
    environment: dev
    permissions:
      contents: read
      id-token: write
    outputs:
      cognito_user_pool_id: ${{ steps.tf-out.outputs.cognito_user_pool_id }}
      cognito_client_id: ${{ steps.tf-out.outputs.cognito_client_id }}
      graphql_url: ${{ steps.tf-out.outputs.graphql_url }}
      frontend_bucket: ${{ steps.tf-out.outputs.frontend_bucket }}
      cloudfront_distribution_id: ${{ steps.tf-out.outputs.cloudfront_distribution_id }}
      ecr_repository_url: ${{ steps.tf-out.outputs.ecr_repository_url }}
      lambda_function_name: ${{ steps.tf-out.outputs.lambda_function_name }}
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/bba-dev-deploy
          role-session-name: gh-deploy-dev-${{ github.run_id }}
          aws-region: ${{ env.AWS_REGION }}
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}
          terraform_wrapper: false  # wrapper interferes with output parsing
      - name: Terraform Init
        working-directory: infra
        run: terraform init -backend-config="key=${{ env.TF_STATE_KEY }}"
      - name: Create ECR repository
        working-directory: infra
        env:
          TF_VAR_environment: ${{ env.ENVIRONMENT }}
          TF_VAR_unsplash_access_key: ${{ secrets.UNSPLASH_ACCESS_KEY }}
          TF_VAR_sns_from_number: ${{ secrets.SNS_FROM_NUMBER }}
          TF_VAR_alert_email: ${{ secrets.ALERT_EMAIL }}
        run: |
          terraform apply -auto-approve \
            -target=aws_ecr_repository.lambda \
            -target=aws_ecr_lifecycle_policy.lambda
      - name: Push placeholder image if ECR is empty
        env:
          ECR_URL: ${{ env.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/bba-${{ env.ENVIRONMENT }}-graphql
        run: |
          IMAGE_COUNT=$(aws ecr describe-images \
            --repository-name bba-$ENVIRONMENT-graphql \
            --query 'length(imageDetails)' --output text 2>/dev/null || echo "0")
          if [ "$IMAGE_COUNT" = "0" ]; then
            aws ecr get-login-password --region $AWS_REGION | \
              docker login --username AWS --password-stdin $ECR_URL
            docker pull --platform linux/amd64 public.ecr.aws/lambda/nodejs:20
            docker tag public.ecr.aws/lambda/nodejs:20 $ECR_URL:placeholder
            docker push $ECR_URL:placeholder
          fi
      # Apply the CloudFront distribution first so any removed origin-request-policy
      # resources are detached before Terraform tries to delete them in the full apply.
      # (Deleting a custom policy while the distribution still references it returns 409.)
      - name: Terraform Apply — CloudFront
        working-directory: infra
        env:
          TF_VAR_environment: ${{ env.ENVIRONMENT }}
          TF_VAR_unsplash_access_key: ${{ secrets.UNSPLASH_ACCESS_KEY }}
          TF_VAR_sns_from_number: ${{ secrets.SNS_FROM_NUMBER }}
          TF_VAR_alert_email: ${{ secrets.ALERT_EMAIL }}
        run: terraform apply -auto-approve -target=aws_cloudfront_distribution.main
      - name: Terraform Apply
        working-directory: infra
        env:
          TF_VAR_environment: ${{ env.ENVIRONMENT }}
          TF_VAR_unsplash_access_key: ${{ secrets.UNSPLASH_ACCESS_KEY }}
          TF_VAR_sns_from_number: ${{ secrets.SNS_FROM_NUMBER }}
          TF_VAR_alert_email: ${{ secrets.ALERT_EMAIL }}
        run: terraform apply -auto-approve
      - name: Read outputs
        id: tf-out
        working-directory: infra
        run: |
          echo "cognito_user_pool_id=$(terraform output -raw cognito_user_pool_id)" >> $GITHUB_OUTPUT
          echo "cognito_client_id=$(terraform output -raw cognito_client_id)"       >> $GITHUB_OUTPUT
          echo "graphql_url=$(terraform output -raw graphql_url)"                   >> $GITHUB_OUTPUT
          echo "frontend_bucket=$(terraform output -raw frontend_bucket)"           >> $GITHUB_OUTPUT
          echo "cloudfront_distribution_id=$(terraform output -raw cloudfront_distribution_id)" >> $GITHUB_OUTPUT
          echo "ecr_repository_url=$(terraform output -raw ecr_repository_url)"   >> $GITHUB_OUTPUT
          echo "lambda_function_name=$(terraform output -raw lambda_function_name)" >> $GITHUB_OUTPUT

  # ---------------------------------------------------------------------------
  # Phase 2b — Build + push Lambda image (parallel with Terraform)
  # ---------------------------------------------------------------------------
  build-lambda:
    name: Lambda — Build & Push
    needs:
      [
        frontend-quality,
        backend-quality,
        sast,
        secrets-scan,
        dep-scan,
        terraform,
      ]
    runs-on: ubuntu-latest
    environment: dev
    permissions:
      contents: read
      id-token: write
    outputs:
      image-uri: ${{ steps.push.outputs.image-uri }}
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/bba-dev-deploy
          role-session-name: gh-lambda-dev-${{ github.run_id }}
          aws-region: ${{ env.AWS_REGION }}
      - uses: aws-actions/amazon-ecr-login@v2
      - name: Build image
        env:
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build \
            --platform linux/amd64 \
            -t bba-dev-graphql:$IMAGE_TAG \
            backend/
      - name: Scan image — Trivy
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          image-ref: bba-dev-graphql:${{ github.sha }}
          format: table
          exit-code: "0"
          ignore-unfixed: true
          severity: CRITICAL
          trivyignores: .trivyignore
      - name: Push to ECR
        id: push
        env:
          ECR_URL: ${{ needs.terraform.outputs.ecr_repository_url }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker tag bba-dev-graphql:$IMAGE_TAG $ECR_URL:$IMAGE_TAG
          docker push $ECR_URL:$IMAGE_TAG
          echo "image-uri=$ECR_URL:$IMAGE_TAG" >> $GITHUB_OUTPUT

  # ---------------------------------------------------------------------------
  # Phase 3 — Build frontend (needs Terraform outputs for VITE env vars)
  # ---------------------------------------------------------------------------
  build-frontend:
    name: Frontend — Build
    needs: [terraform]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - run: npm ci
        working-directory: frontend
      - name: Build
        working-directory: frontend
        env:
          VITE_COGNITO_USER_POOL_ID: ${{ needs.terraform.outputs.cognito_user_pool_id }}
          VITE_COGNITO_CLIENT_ID: ${{ needs.terraform.outputs.cognito_client_id }}
          VITE_GRAPHQL_URL: ${{ needs.terraform.outputs.graphql_url }}
        run: npm run build
      - uses: actions/upload-artifact@v4
        with:
          name: frontend-dist
          path: frontend/dist/
          retention-days: 1

  # ---------------------------------------------------------------------------
  # Phase 4 — Deploy frontend + update Lambda (parallel after builds)
  # ---------------------------------------------------------------------------
  deploy:
    name: Deploy — DEV
    needs: [build-frontend, build-lambda, terraform]
    runs-on: ubuntu-latest
    environment: dev
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/bba-dev-deploy
          role-session-name: gh-deploy-sync-dev-${{ github.run_id }}
          aws-region: ${{ env.AWS_REGION }}
      - uses: actions/download-artifact@v4
        with:
          name: frontend-dist
          path: dist/
      - name: Sync frontend to S3
        run: |
          aws s3 sync dist/ s3://${{ needs.terraform.outputs.frontend_bucket }}/ \
            --delete \
            --cache-control "public, max-age=31536000, immutable" \
            --exclude "index.html"
          # index.html must not be cached so new deploys are picked up immediately
          aws s3 cp dist/index.html s3://${{ needs.terraform.outputs.frontend_bucket }}/index.html \
            --cache-control "no-cache, no-store, must-revalidate"
      - name: Update Lambda image
        run: |
          aws lambda update-function-code \
            --function-name ${{ needs.terraform.outputs.lambda_function_name }} \
            --image-uri ${{ needs.build-lambda.outputs.image-uri }}
          # Wait for the update to complete before invalidating CloudFront
          aws lambda wait function-updated \
            --function-name ${{ needs.terraform.outputs.lambda_function_name }}
      - name: Invalidate CloudFront
        run: |
          aws cloudfront create-invalidation \
            --distribution-id ${{ needs.terraform.outputs.cloudfront_distribution_id }} \
            --paths "/*"

  # ---------------------------------------------------------------------------
  # Phase 5 — DAST (post-deploy, dev only)
  # ---------------------------------------------------------------------------
  dast:
    name: DAST — OWASP ZAP
    needs: [deploy, terraform]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
    steps:
      - name: Derive CloudFront URL
        id: cf
        env:
          GRAPHQL_URL: ${{ needs.terraform.outputs.graphql_url }}
        run: |
          # Allow a short warm-up period after deploy
          sleep 30
          # graphql_url is https://<cloudfront-domain>/graphql — strip the path suffix
          echo "url=${GRAPHQL_URL%/graphql}" >> $GITHUB_OUTPUT
      - uses: actions/checkout@v4
      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.12.0
        continue-on-error: true
        with:
          target: ${{ steps.cf.outputs.url }}
          rules_file_name: .zap/rules.tsv
          fail_action: false
          artifact_name: zap-scan-dev