server-ci.yml

name: Server CI Pipeline

on:
  push:
    branches: ["main", "develop"]
    paths:
      - "server/**"
      - ".github/workflows/server-ci.yml"
  pull_request:
    branches: ["main", "develop"]
    paths:
      - "server/**"
      - ".github/workflows/server-ci.yml"

concurrency:
  group: server-ci-${{ github.ref }}
  cancel-in-progress: true
  
jobs:
  build-and-test:
    name: Build and Test
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: server

    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_DB: koinonia_daily
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Set up JDK 25
      uses: actions/setup-java@v4
      with:
        java-version: '25'
        distribution: 'temurin'
        cache: maven

    - name: Build and Test
      run: mvn clean package
      env:
        SPRING_PROFILES_ACTIVE: test
        SPRING_DATASOURCE_URL: jdbc:postgresql://localhost:5432/koinonia_daily
        SPRING_DATASOURCE_USERNAME: test
        SPRING_DATASOURCE_PASSWORD: test
        JWT_SECRET: ${{ secrets.JWT_SECRET }}

    - name: Upload test results
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: junit-test-results
        path: server/target/surefire-reports/
    
    - name: Upload coverage report
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: jacoco-report
        path: server/target/site/jacoco/
    
    - name: Upload JAR artifact
      uses: actions/upload-artifact@v4
      with:
        name: app-jar
        path: server/target/*.jar
        retention-days: 1

  security-scan:
    name: Security Scan (CodeQL + Trivy)
    runs-on: ubuntu-latest

    permissions:
      actions: read
      contents: read
      security-events: write
    
    defaults:
      run:
        working-directory: server

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up JDK 25
      uses: actions/setup-java@v4
      with:
        java-version: '25'
        distribution: 'temurin'
        cache: maven
      
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: java

    - name: Build for CodeQL
      run: mvn -B clean compile -DskipTests

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4
      
    - name: Run Trivy FS scan
      uses: aquasecurity/trivy-action@0.20.0
      with:
        scan-type: fs
        scan-ref: ./server
        severity: 'CRITICAL, HIGH'
        format: sarif
        output: trivy-fs-results.sarif
        scanners: vuln,secret,config


    - name: Upload Trivy FS results
      uses: github/codeql-action/upload-sarif@v4
      if: always()
      with:
        sarif_file: trivy-fs-results.sarif
        category: "Trivy FS Scan"

  code-quality:
    name: Code Quality Analysis (Checkstyle + SpotBugs)
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: server

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up JDK 25
      uses: actions/setup-java@v4
      with:
        java-version: '25'
        distribution: 'temurin'
        cache: maven

    - name: Run Checkstyle
      run: mvn checkstyle:check

    - name: Run SpotBugs
      run: mvn verify -DskipTests

    - name: Upload Checkstyle report
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: checkstyle-report
        path: server/target/checkstyle-results.xml

    - name: Upload SpotBugs report
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: spotbugs-report
        path: server/target/spotbugsXml.xml
  
  build-docker:
    name: Build, Push & Scan Docker Image
    runs-on: ubuntu-latest
    needs: [build-and-test, security-scan, code-quality]
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')

    defaults:
      run:
        working-directory: server
    
    permissions:
      contents: read
      security-events: write

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to Docker Hub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
    
    - name: Build Docker Image (local)
      uses: docker/build-push-action@v6
      with:
        context: ./server
        file: ./server/Dockerfile
        push: false
        load: true
        tags: ${{ secrets.DOCKERHUB_USERNAME }}/koinonia-daily-server:${{ github.sha }}
      
    - name: Scan Docker Image with Trivy (Sarif)
      uses: aquasecurity/trivy-action@0.20.0
      with:
        image-ref: ${{ secrets.DOCKERHUB_USERNAME }}/koinonia-daily-server:${{ github.sha }}
        severity: 'CRITICAL,HIGH'
        exit-code: '0'
        format: sarif
        output: trivy-image-results.sarif

    - name: Upload Trivy Image Scan results
      uses: github/codeql-action/upload-sarif@v4
      if: always()
      with:
        sarif_file: trivy-image-results.sarif
        category: "Trivy Docker Image Scan"

    - name: Scan Docker Image with Trivy (Table)
      uses: aquasecurity/trivy-action@0.20.0
      with:
        image-ref: ${{ secrets.DOCKERHUB_USERNAME }}/koinonia-daily-server:${{ github.sha }}
        severity: 'CRITICAL,HIGH'
        exit-code: '1'
        format: table
        
    - name: Push Docker Image
      if: success()
      run: |
        docker tag ${{ secrets.DOCKERHUB_USERNAME }}/koinonia-daily-server:${{ github.sha }} ${{ secrets.DOCKERHUB_USERNAME }}/koinonia-daily-server:latest
        docker push ${{ secrets.DOCKERHUB_USERNAME }}/koinonia-daily-server:${{ github.sha }}
        docker push ${{ secrets.DOCKERHUB_USERNAME }}/koinonia-daily-server:latest