deploy.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

env:
  PYTHON_VERSION: '3.12'

jobs:
  # Job 1: Linting and code quality
  lint:
    name: Code Quality Checks
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      
      - name: Cache pip dependencies
        uses: actions/cache@v3
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-
      
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install flake8 black isort
          pip install -r requirements.txt
      
      - name: Run Black (code formatting check)
        run: black --check .
        continue-on-error: true
      
      - name: Run isort (import sorting check)
        run: isort --check-only .
        continue-on-error: true
      
      - name: Run Flake8 (linting)
        run: |
          flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
          flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
  
  # Job 2: Security scanning
  security:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      
      - name: Install safety
        run: pip install safety
      
      - name: Check for security vulnerabilities
        run: safety check --json || true
  
  # Job 3: Testing with coverage
  test:
    name: Run Tests
    runs-on: ubuntu-latest
    needs: [lint]
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      
      - name: Cache pip dependencies
        uses: actions/cache@v3
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-
      
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install pytest pytest-cov pytest-flask pytest-mock requests
      
      - name: Run pytest with coverage
        run: |
          export PYTHONPATH="${PYTHONPATH}:${PWD}"
          pytest tests/ -v --cov=. --cov-report=xml --cov-report=html --cov-report=term-missing
        env:
          FLASK_ENV: testing
          SECRET_KEY: test-secret-key
          PYTHONPATH: ${{ github.workspace }}
      
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v3
        with:
          files: ./coverage.xml
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false
      
      - name: Archive coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: htmlcov/
  
  # Job 4: Build Docker image (optional)
  build:
    name: Build Application
    runs-on: ubuntu-latest
    needs: [test]
    if: github.ref == 'refs/heads/main'
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
      
      - name: Archive production artifacts
        uses: actions/upload-artifact@v4
        with:
          name: production-files
          path: |
            .
            !venv/
            !.git/
            !__pycache__/
            !*.pyc
  
  # Job 5: Deploy to production
  deploy:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: [build, security]
    if: false  # Disabled until production server is configured
    # if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    environment:
      name: production
      url: https://your-domain.com
    steps:
      - name: Download production artifacts
        uses: actions/download-artifact@v4
        with:
          name: production-files
      
      - name: Deploy via SSH
        uses: appleboy/ssh-action@master
        with:
          host: ${{ secrets.PRODUCTION_HOST }}
          username: ${{ secrets.PRODUCTION_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          port: ${{ secrets.SSH_PORT || 22 }}
          script: |
            cd /var/www/portfolio
            git pull origin main
            source venv/bin/activate
            pip install -r requirements.txt
            flask db upgrade || echo "No migrations to run"
            sudo systemctl restart portfolio
            sudo systemctl reload nginx
      
      - name: Health check
        run: |
          sleep 10
          curl --fail https://your-domain.com/health || exit 1
      
      - name: Notify deployment success
        if: success()
        run: |
          echo "✅ Deployment successful!"
          # Add notification service here (Slack, Discord, email, etc.)
      
      - name: Notify deployment failure
        if: failure()
        run: |
          echo "❌ Deployment failed!"
          # Add notification service here

  # Job 6: Database backup (runs after deploy)
  backup:
    name: Backup Database
    runs-on: ubuntu-latest
    needs: [deploy]
    if: false  # Disabled until production server is configured
    # if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - name: Backup database via SSH
        uses: appleboy/ssh-action@master
        with:
          host: ${{ secrets.PRODUCTION_HOST }}
          username: ${{ secrets.PRODUCTION_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd /var/www/portfolio
            mkdir -p backups
            if [ -f instance/portfolio.db ]; then
              cp instance/portfolio.db backups/portfolio_$(date +%Y%m%d_%H%M%S).db
              # Keep only last 7 backups
              ls -t backups/portfolio_*.db | tail -n +8 | xargs -r rm
            fi