ci.yml

name: Unified CI/CD & Deployment

on:
  pull_request:
    branches: [staging, main]
  push:
    branches: [staging, main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  DOTNET_VERSION: "10.0.x"
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  TRIVY_DOCKER_IMAGE: "aquasec/trivy:0.69.1"

permissions:
  contents: write
  packages: write
  security-events: write
  actions: read

jobs:
  # --- JOB 1: BUILD AND TEST ---
  build-and-test:
    name: Build and Test (.NET)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6.0.2

      - name: Setup .NET
        uses: actions/setup-dotnet@v5.1.0
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Cache NuGet packages
        uses: actions/cache@v5.0.3
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/*.props', '**/*.targets') }}
          restore-keys: ${{ runner.os }}-nuget-

      - name: Restore & Build
        run: |
          dotnet restore
          dotnet build --configuration Release --no-restore

      - name: Run Tests
        run: dotnet test --configuration Release --no-build --verbosity normal --collect:"XPlat Code Coverage" --results-directory ./coverage

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5.5.2
        with:
          directory: ./coverage
          fail_ci_if_error: false

      - name: Upload test artifacts
        if: always()
        uses: actions/upload-artifact@v6.0.0
        with:
          name: test-results
          path: ./coverage
          retention-days: 14

  # --- JOB 2: CODEQL ---
  codeql-analysis:
    name: CodeQL Security Analysis (C#)
    runs-on: ubuntu-latest
    needs: build-and-test
    permissions:
      security-events: write
      actions: read
      contents: read
    strategy:
      fail-fast: false
      matrix:
        language: ['csharp']
    steps:
      - name: Checkout code
        uses: actions/checkout@v6.0.2
      - name: Setup .NET
        uses: actions/setup-dotnet@v5.1.0
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4.32.4
        with:
          languages: ${{ matrix.language }}
          build-mode: none
      - name: Build for CodeQL
        run: |
          dotnet restore OpenReferralApi.sln
          dotnet build OpenReferralApi.sln --configuration Release --no-restore --verbosity normal
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4.32.4

  # --- JOB 3: TRIVY FS ---
  security-scan-fs:
    name: Trivy Filesystem Scan
    runs-on: ubuntu-latest
    needs: build-and-test
    steps:
      - name: Checkout code
        uses: actions/checkout@v6.0.2
      - name: Cache Trivy database
        uses: actions/cache@v5.0.3
        with:
          path: ~/.cache/trivy
          key: trivy-db-${{ github.run_id }}
          restore-keys: trivy-db-
      - name: Run Trivy (fs)
        uses: aquasecurity/trivy-action@0.34.1
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-fs-results.sarif'
          severity: 'CRITICAL,HIGH,MEDIUM,UNKNOWN'
      - name: Upload Trivy FS SARIF
        uses: github/codeql-action/upload-sarif@v4.32.4
        if: always()
        with:
          sarif_file: trivy-fs-results.sarif

  # --- JOB 4: DOCKER BUILD & PUSH ---
  docker-build:
    name: Build & Push Docker Image to GHCR
    runs-on: ubuntu-latest
    needs: [codeql-analysis, security-scan-fs]
    outputs:
      image_ref: ${{ steps.image_ref.outputs.image_ref }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6.0.2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.12.0
      - name: Login to GHCR
        uses: docker/login-action@v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Prepare lowercase image name
        id: lowercase
        run: |
          echo "repo_owner=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
          echo "repo_name=$(echo "${{ github.event.repository.name }}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
      - name: Extract Docker metadata & tags
        id: meta
        uses: docker/metadata-action@v5.10.0
        with:
          images: ghcr.io/${{ steps.lowercase.outputs.repo_owner }}/${{ steps.lowercase.outputs.repo_name }}
          tags: |
            # Explicitly use the same SHA as your manual Record step
            type=sha,format=short,prefix=sha-,value=${{ github.event.pull_request.head.sha || github.sha }}
      - name: Determine commit SHA
        id: vars
        run: |
          COMMIT_SHA=${{ github.event.pull_request.head.sha || github.sha }}
          SHORT_SHA=$(echo $COMMIT_SHA | cut -c1-7)
          echo "commit_sha=$COMMIT_SHA" >> $GITHUB_OUTPUT
          echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
      - name: Build and push
        id: build
        uses: docker/build-push-action@v6.19.2
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Record image reference with digest
        id: image_ref
        run: |
          IMAGE_NAME="ghcr.io/${{ steps.lowercase.outputs.repo_owner }}/${{ steps.lowercase.outputs.repo_name }}"
          DIGEST="${{ steps.build.outputs.digest }}"
          echo "image_ref=${IMAGE_NAME}@${DIGEST}" >> "$GITHUB_OUTPUT"
          echo "Image reference: ${IMAGE_NAME}@${DIGEST}"
      - name: Verify image push
        run: |
          echo "Verifying image: ${{ steps.image_ref.outputs.image_ref }}"
          docker pull ${{ steps.image_ref.outputs.image_ref }}
          echo "✓ Image successfully pushed and pulled"

  # --- JOB 5: TRIVY IMAGE SCAN ---
  security-scan-image:
    name: Trivy Image Vulnerability Scan
    runs-on: ubuntu-latest
    needs: docker-build
    steps:
      - name: Checkout code
        uses: actions/checkout@v6.0.2
      - name: Cache Trivy database
        uses: actions/cache@v5.0.3
        with:
          path: ~/.cache/trivy
          key: trivy-db-${{ github.run_id }}
          restore-keys: trivy-db-
      - name: Login to GHCR
        uses: docker/login-action@v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Run Trivy (image)
        id: trivy_scan
        uses: aquasecurity/trivy-action@0.34.1
        continue-on-error: true
        with:
          image-ref: ${{ needs.docker-build.outputs.image_ref }}
          format: 'sarif'
          output: 'trivy-image-results.sarif'
          severity: 'CRITICAL,HIGH,MEDIUM,UNKNOWN'

      - name: Upload Trivy Image SARIF
        uses: github/codeql-action/upload-sarif@v4.32.4
        if: always() && hashFiles('trivy-image-results.sarif') != ''
        with:
          sarif_file: trivy-image-results.sarif

  # --- JOB 6: ZAP SCAN ---
  zap-scan:
    name: OWASP ZAP Baseline Scan
    runs-on: ubuntu-latest
    needs: docker-build
    steps:
      - name: Checkout code
        uses: actions/checkout@v6.0.2
      - name: Login to GHCR
        uses: docker/login-action@v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Pull & Run Container
        run: |
          echo "Pulling image: ${{ needs.docker-build.outputs.image_ref }}"
          # Retry logic for docker pull
          for i in {1..3}; do
            if docker pull ${{ needs.docker-build.outputs.image_ref }}; then
              echo "✓ Image pulled successfully"
              break
            fi
            if [ $i -eq 3 ]; then
              echo "✗ Failed to pull image after 3 attempts"
              echo "Checking if image exists in registry..."
              docker manifest inspect ${{ needs.docker-build.outputs.image_ref }} || echo "Image not found in registry"
              exit 1
            fi
            echo "Retry $i/3 - waiting 5 seconds..."
            sleep 5
          done
          docker network create zap-network
          docker run -d --name app --network zap-network -p 8080:80 ${{ needs.docker-build.outputs.image_ref }}
      - name: Wait for Application Ready
        run: |
          for i in {1..30}; do
            if curl -f http://localhost:8080/health-check/live > /dev/null 2>&1; then
              echo "✓ Application health check passed"
              break
            fi
            if [ $i -eq 30 ]; then
              echo "✗ Application failed to start"
              docker logs app
              exit 1
            fi
            echo "Waiting for app... ($i/30)"
            sleep 2
          done
      - name: Run ZAP Scan
        run: |
          mkdir -p ${{ github.workspace }}/zap-reports
          chmod 777 ${{ github.workspace }}/zap-reports
          docker run --rm --network zap-network -v ${{ github.workspace }}/zap-reports:/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t http://app:80 -J report_json.json -I || true
      - name: Upload ZAP results
        if: always() && hashFiles('zap-reports/*') != ''
        uses: actions/upload-artifact@v6.0.0
        with:
          name: zap-scan-results
          path: zap-reports/

  # --- JOB 7: DEPLOY STAGING ---
  deploy-staging:
    name: Deploy to Staging
    needs: [docker-build, security-scan-image, zap-scan]
    if: github.event_name == 'push' && github.ref == 'refs/heads/staging'
    runs-on: ubuntu-latest
    steps:
      - name: Install Heroku CLI
        run: curl https://cli-assets.heroku.com/install.sh | sh
      - name: Deploy to Heroku
        env:
          HEROKU_API_KEY: ${{ secrets.HEROKU_API_KEY }}
          IMAGE_TAG: ${{ needs.docker-build.outputs.image_ref }}
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
          docker pull $IMAGE_TAG
          heroku container:login
          heroku stack:set container --app ${{ vars.HEROKU_STAGING_APP }}
          docker tag $IMAGE_TAG registry.heroku.com/${{ vars.HEROKU_STAGING_APP }}/web:latest
          docker push registry.heroku.com/${{ vars.HEROKU_STAGING_APP }}/web:latest
          heroku container:release web --app ${{ vars.HEROKU_STAGING_APP }}
          sleep 12
          curl --fail "${{ vars.STAGING_HEALTH_ENDPOINT }}" || echo "⚠️ Staging health check failed"

  # --- JOB 8: DEPLOY PRODUCTION ---
  deploy-production:
    name: Deploy to Production
    needs: [docker-build, security-scan-image, zap-scan]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - name: Install Heroku CLI
        run: curl https://cli-assets.heroku.com/install.sh | sh
      - name: Deploy to Heroku
        env:
          HEROKU_API_KEY: ${{ secrets.HEROKU_API_KEY }}
          IMAGE_TAG: ${{ needs.docker-build.outputs.image_ref }}
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
          docker pull $IMAGE_TAG
          heroku container:login
          heroku stack:set container --app ${{ vars.HEROKU_PROD_APP }}
          docker tag $IMAGE_TAG registry.heroku.com/${{ vars.HEROKU_PROD_APP }}/web:latest
          docker push registry.heroku.com/${{ vars.HEROKU_PROD_APP }}/web:latest
          heroku container:release web --app ${{ vars.HEROKU_PROD_APP }}
          sleep 12
          curl --fail "${{ vars.HEALTH_ENDPOINT }}" || echo "⚠️ Production health check failed"
      - name: Create Release
        uses: softprops/action-gh-release@v2.5.0
        with:
          tag_name: v${{ github.run_number }}
          name: Release v${{ github.run_number }}
          draft: false
          prerelease: false
          token: ${{ secrets.GITHUB_TOKEN }}