ci.yml

name: CI Pipeline

on:
  push:
    branches: [ main, develop, 'feature/CI-CD-improve' ]
  pull_request:
    branches: [ main ]

env:
  PYTHON_VERSION: '3.10'

jobs:
  lint:
    name: Code Linting
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install black flake8 mypy isort types-PyYAML
          pip install -r requirements.txt

      - name: Run Black (code formatting)
        run: black --check --diff src/ tests/

      - name: Run isort (import sorting)
        run: isort --check-only --diff src/ tests/

      - name: Run Flake8 (linting)
        run: flake8 src/ tests/ --max-line-length=100 --extend-ignore=E203,W503

      - name: Run MyPy (type checking)
        run: mypy src/ --ignore-missing-imports

  test:
    name: Unit & Integration Tests
    runs-on: ubuntu-latest
    needs: lint

    services:
      postgres:
        image: postgres:14
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: test_db
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pytest pytest-cov pytest-mock pytest-asyncio
          pip install -r requirements.txt

      - name: Run unit tests
        run: |
          pytest tests/unit/ -v \
            --cov=src \
            --cov-report=xml \
            --cov-report=html \
            --cov-report=term-missing

      - name: Run integration tests
        run: |
          pytest tests/integration/ -v \
            --cov=src --cov-append \
            --cov-report=xml
        env:
          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test_db

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          file: ./coverage.xml
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Upload coverage report as artifact
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: htmlcov/

  docker-build:
    name: Docker Build & Test
    runs-on: ubuntu-latest
    needs: test

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Free Disk Space (Manual)
        run: |
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /usr/local/lib/android
          sudo rm -rf /opt/ghc
          sudo rm -rf /opt/hostedtoolcache/CodeQL
          sudo docker image prune --all --force

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Airflow image
        run: |
          docker build -f docker/airflow/Dockerfile -t churn-airflow:test .

      - name: Build MLflow image
        run: |
          docker build -f docker/mlflow/Dockerfile -t churn-mlflow:test .

      - name: Build Inference image
        run: |
          docker build -f docker/inference/Dockerfile -t churn-inference:test .

      - name: Test Docker Compose
        run: |
          docker compose -f docker-compose.yml config
          docker compose up -d
          sleep 30
          docker compose ps
          docker compose logs
          docker compose down -v

  security-scan:
    name: Security Scanning
    runs-on: ubuntu-latest
    needs: lint
    permissions:
      contents: read
      security-events: write
      actions: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Run Bandit security linter
        run: |
          pip install bandit
          bandit -r src/ -f json -o bandit-report.json || true

      - name: Upload Bandit report
        uses: actions/upload-artifact@v4
        with:
          name: bandit-security-report
          path: bandit-report.json