ci-cd.yml

name: CI CD api

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  DOTNET_VERSION: '10.x'
  SOLUTION: CleanArchitecture.slnx

# SonarQube runs in automatic continuous analysis mode — not invoked here

jobs:
  # ────────────────────────────────────────────────────────────────────────────
  # Quality gates: restore, build, test, publish, filesystem vulnerability scan
  # Runs on GitHub-hosted runner for clean, reproducible environment
  # ────────────────────────────────────────────────────────────────────────────
  quality:
    name: Quality Gates
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write  # required for SARIF upload

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Cache NuGet packages
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props', '**/*.csproj') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Restore dependencies
        run: dotnet restore ${{ env.SOLUTION }} 2>&1 | tee restore.log

      - name: Build application
        run: dotnet build ${{ env.SOLUTION }} --configuration Release --no-restore 2>&1 | tee build.log

      - name: Test application
        run: dotnet test ${{ env.SOLUTION }} --configuration Release --no-restore --no-build --logger "trx;LogFileName=test-results.trx" 2>&1 | tee test.log

      - name: Publish application
        run: dotnet publish src/Web.Api/Web.Api.csproj --configuration Release --no-restore --no-build --output publish 2>&1 | tee publish.log

      # - name: Scan filesystem for vulnerabilities (Trivy)
      #   uses: aquasecurity/trivy-action@v0.36.0
      #   with:
      #     scan-type: fs
      #     scan-ref: .
      #     exit-code: '1'
      #     severity: CRITICAL,HIGH
      #     ignore-unfixed: true
      #     format: sarif
      #     output: trivy-fs-results.sarif

      # - name: Upload Trivy filesystem scan results to GitHub Security tab
      #   uses: github/codeql-action/upload-sarif@v4
      #   if: always()
      #   with:
      #     sarif_file: trivy-fs-results.sarif

      - name: Upload build artifact and logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: build-publish-${{ github.sha }}
          path: |
            publish/
            restore.log
            build.log
            test.log
            publish.log
            **/TestResults/*.trx
          retention-days: 30

  # ────────────────────────────────────────────────────────────────────────────
  # Docker: build production image, push to GHCR, scan image, attest provenance
  # ────────────────────────────────────────────────────────────────────────────
  docker:
    name: Build & Push Docker Image
    runs-on: [self-hosted, nexus, api]
    needs: quality
    permissions:
      contents: read
      packages: write
      id-token: write         # required for provenance attestation
      security-events: write  # required for SARIF upload

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=branch,suffix=-latest
            type=sha,prefix=sha-,format=short
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: src/Web.Api/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: false
          sbom: false
          # cache-from: type=gha
          # cache-to: type=gha,mode=max
          build-args: |
            BUILD_DATE=${{ github.event.head_commit.timestamp }}
            GIT_REVISION=${{ github.sha }}
            VERSION=${{ github.ref_name }}

      # - name: Set lowercase image ref for Trivy
      #   id: image-ref
      #   run: |
      #     echo "value=ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')@${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT

      # - name: Scan filesystem for vulnerabilities - readable output
      #   uses: aquasecurity/trivy-action@v0.36.0
      #   with:
      #     scan-type: fs
      #     scan-ref: .
      #     exit-code: '1'
      #     severity: CRITICAL,HIGH
      #     ignore-unfixed: true
      #     scanners: vuln
      #     format: table

      # - name: Generate Trivy filesystem SARIF report
      #   if: always()
      #   uses: aquasecurity/trivy-action@v0.36.0
      #   with:
      #     scan-type: fs
      #     scan-ref: .
      #     exit-code: '0'
      #     severity: CRITICAL,HIGH
      #     ignore-unfixed: true
      #     scanners: vuln
      #     format: sarif
      #     output: trivy-fs-results.sarif

      # - name: Upload Trivy filesystem scan results to GitHub Security tab
      #   uses: github/codeql-action/upload-sarif@v4
      #   if: always()
      #   with:
      #     sarif_file: trivy-fs-results.sarif
      
      - name: Setup .NET for migrations
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Restore dependencies
        run: dotnet restore ${{ env.SOLUTION }}

      - name: Install dotnet-ef tool and apply migrations
        env:
          ConnectionStrings__Database: ${{ secrets.DB_CONNECTION_STRING }}
        run: |
          dotnet tool install --global dotnet-ef
          export PATH="$PATH:$HOME/.dotnet/tools"
          dotnet ef database update \
            --project src/Infrastructure \
            --startup-project src/Web.Api \
            --configuration Release
   #         --connection "$(cat /opt/nexus/secrets/db_connection_string)" \
        

  # ────────────────────────────────────────────────────────────────────────────
  # Deploy: pull latest image and redeploy via docker compose
  # Runs only on push to master (not on PRs)
  # ────────────────────────────────────────────────────────────────────────────
  deploy:
    name: Deploy Nexus Api
    runs-on: [self-hosted, nexus, api]
    needs: docker
    if: github.ref == 'refs/heads/master' && github.event_name == 'push'
    permissions:
      packages: read
    env:
      COMPOSE_DIR: /opt/nexus
      GARAGE_ACCESS_KEY: ${{ secrets.GARAGE_ACCESS_KEY }}
      GARAGE_SECRET_KEY: ${{ secrets.GARAGE_SECRET_KEY }}

    steps:
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Pull & redeploy
        working-directory: ${{ env.COMPOSE_DIR }}
        run: |
          docker compose pull nexus-api
          docker compose up -d nexus-api --remove-orphans