ci.yml

name: CI — MedTech Platform

on:
  push:
    branches: [main, develop]
    paths-ignore:
      - 'docs/**'
      - '**/*.md'
  pull_request:
    branches: [main]
    paths-ignore:
      - 'docs/**'
      - '**/*.md'
  schedule:
    - cron: '0 2 * * *'

jobs:
  # ── Lint ────────────────────────────────────────────────────────────────────
  lint:
    name: Lint
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Validate docker-compose syntax
        run: |
          docker compose -f docker-compose.yml config --quiet
          docker compose -f docker-compose.yml -f docker-compose.build.yml config --quiet

      - name: Validate all YAML files in .github/
        run: |
          python3 - <<'EOF'
          import yaml, sys, pathlib
          errors = []
          for f in pathlib.Path('.github').rglob('*.yml'):
              try:
                  yaml.safe_load(f.read_text())
              except yaml.YAMLError as e:
                  errors.append(f"{f}: {e}")
          if errors:
              print('\n'.join(errors), file=sys.stderr)
              sys.exit(1)
          print(f"✅ All YAML files valid")
          EOF

      - name: Lint Dockerfile
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile
        continue-on-error: true

  # ── Test ─────────────────────────────────────────────────────────────────────
  test:
    name: Test
    runs-on: ubuntu-latest
    needs: [lint]

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Check Python test file syntax
        run: python3 -m py_compile tests/integration_test.py

      - name: Validate compose override merges cleanly
        run: |
          # Ensure build override is compatible with the base compose file
          docker compose \
            -f docker-compose.yml \
            -f docker-compose.build.yml \
            config --quiet

  # ── Security ─────────────────────────────────────────────────────────────────
  security:
    name: Security scan
    runs-on: ubuntu-latest
    needs: lint

    steps:
      - uses: actions/checkout@v4

      - name: Check for hardcoded secrets in compose files
        run: |
          if grep -rEn "(password|secret|api_key)\s*[:=]\s*['\"][^'\"]{8,}" \
            docker-compose.yml docker-compose.build.yml 2>/dev/null; then
            echo "::warning::Possible hardcoded secret detected in compose files"
          fi

      - name: Run Trivy vulnerability scan on Dockerfile
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: config
          scan-ref: .
          exit-code: '0'       # advisory only — do not fail CI
          format: table
        continue-on-error: true

  # ── Smoke-test ───────────────────────────────────────────────────────────────
  smoke-test:
    name: Smoke-test platform stack
    runs-on: ubuntu-latest
    needs: [lint, test]
    timeout-minutes: 15

    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Authenticate so the composite action can pull the pinned service images
      # from GHCR (vitals-publisher, edge-analytics, clinician-ui).
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build platform image (local, not pushed)
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          load: true
          tags: medtech-platform:ci
          cache-from: type=gha
          cache-to:   type=gha,mode=max

      # registry-token is intentionally omitted — the runner is already
      # authenticated from the Login step above.
      - name: Run smoke tests
        uses: ./.github/actions/smoke-test
        with:
          image: medtech-platform:ci

  # ── Status gate ──────────────────────────────────────────────────────────────
  status:
    name: CI Status
    runs-on: ubuntu-latest
    needs: [lint, test, security, smoke-test]
    if: always()

    steps:
      - name: Evaluate required job results
        run: |
          if [[ "${{ needs.lint.result }}"       != "success" ]] || \
             [[ "${{ needs.smoke-test.result }}" != "success" ]]; then
            echo "::error::Required CI jobs failed (lint: ${{ needs.lint.result }}, smoke-test: ${{ needs.smoke-test.result }})"
            exit 1
          fi
          echo "✅ All required checks passed"