ci.yaml

name: CI - CD
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  security-scan:
    name: Security scan dependencies
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
      - name: Download Shai-Hulud IOC list
        run: |
          curl -o iocs.csv https://raw.githubusercontent.com/DataDog/indicators-of-compromise/refs/heads/main/shai-hulud-2.0/consolidated_iocs.csv
      - name: Scan dependencies against IOCs
        run: node scripts/scan-dependencies.js
  validations:
    needs: security-scan
    runs-on: ubuntu-latest
    env:
      DATABASE_URL: postgresql://catalogi:pg_password@localhost:5432/db
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: catalogi
          POSTGRES_PASSWORD: pg_password
          POSTGRES_DB: db
        ports:
          - 5432:5432
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
      - name: Install dependencies
        run: corepack enable && pnpm install --frozen-lockfile
      - name: Build back
        run: cd api && pnpm build
      - name: Migrate db
        run: cd api && pnpm migrate latest
      - name: Fullcheck
        run: pnpm fullcheck
  
  e2e:
    name: E2E tests
    runs-on: ubuntu-latest
    needs: security-scan
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
      - name: Install dependencies
        run: corepack enable && pnpm install --frozen-lockfile
      - name: Get Playwright version
        id: playwright-version
        run: echo "version=$(cd e2e && pnpm exec playwright --version | awk '{print $2}')" >> "$GITHUB_OUTPUT"
      - name: Restore Playwright browsers cache
        id: playwright-cache
        uses: actions/cache/restore@v4
        with:
          path: ~/.cache/ms-playwright
          key: playwright-v3-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}
      - name: Install Playwright system dependencies
        timeout-minutes: 10
        run: cd e2e && pnpm exec playwright install-deps chromium
      - name: Install Playwright browsers
        timeout-minutes: 10
        run: cd e2e && pnpm exec playwright install chromium
      - name: Save Playwright browsers cache
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: ~/.cache/ms-playwright
          key: playwright-v3-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}
      - name: Run e2e tests
        run: cd e2e && pnpm test:e2e

  check_if_version_upgraded:
    name: Check if version upgrade
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    needs: [validations, e2e]
    outputs:
      is_upgraded_in_preprod: ${{ steps.check_version.outputs.is_upgraded_in_preprod }}
      is_upgraded_version: ${{ steps.check_version.outputs.is_upgraded_version }}
      to_version: ${{ steps.check_version.outputs.to_version }}
      from_version: ${{ steps.check_version.outputs.from_version }}
    steps:
      - uses: actions/checkout@v6
      - name: Check version upgrade
        id: check_version
        run: |
          # Get current version from package.json
          CURRENT_VERSION=$(jq -r '.version' package.json)
          echo "Version in package.json: $CURRENT_VERSION"

          # Get deployed version from preprod API
          PRE_PROD_DEPLOYED_VERSION=$(curl -s "https://code.gouv.fr/sill-preprod/api/getApiVersion" | jq -r '.result.data.json')
          PROD_DEPLOYED_VERSION=$(curl -s "https://code.gouv.fr/sill/api/getApiVersion" | jq -r '.result.data.json')
          echo "Deployed version in preprod: $PRE_PROD_DEPLOYED_VERSION"
          echo "Deployed version in prod: $PROD_DEPLOYED_VERSION"
          
          # Simple comparison: check if versions are different
          if [ "$CURRENT_VERSION" != "$PRE_PROD_DEPLOYED_VERSION" ]; then
            IS_UPGRADED_IN_PRE_PROD="true"
            IS_UPGRADED="true"
            echo "✅ Version different from preprod ($PRE_PROD_DEPLOYED_VERSION), should deploy: $CURRENT_VERSION"
          elif [ "$CURRENT_VERSION" != "$PROD_DEPLOYED_VERSION" ]; then
            IS_UPGRADED="true"
            echo "✅ Version different from prod ($PROD_DEPLOYED_VERSION), should deploy: $CURRENT_VERSION"
          else
            IS_UPGRADED="false"
            echo "ℹ️ Version unchanged: $CURRENT_VERSION"
          fi
          
          echo "Is version upgraded: $IS_UPGRADED"
          
          # Set outputs
          echo "is_upgraded_version=$IS_UPGRADED" >> $GITHUB_OUTPUT
          echo "is_upgraded_in_preprod=$IS_UPGRADED_IN_PRE_PROD" >> $GITHUB_OUTPUT
          echo "to_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
          echo "from_version=$PRE_PROD_DEPLOYED_VERSION" >> $GITHUB_OUTPUT

  trigger_pre_production_deploy:
    needs:
      - check_if_version_upgraded
    if: needs.check_if_version_upgraded.outputs.is_upgraded_in_preprod == 'true'
    uses: ./.github/workflows/trigger-deploy.yaml
    with:
      server_host: code.gouv.fr
      server_user: web
      deploy_script_path: ./update-sill-preprod.sh
      server_ssh_key_path: ~/.ssh/sill-data
      environment_name: pre-production
      version: v${{ needs.check_if_version_upgraded.outputs.to_version }}
    secrets:
      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}


  trigger_production_deploy:
    needs:
      - trigger_pre_production_deploy
      - check_if_version_upgraded
    if: needs.check_if_version_upgraded.outputs.is_upgraded_version == 'true' && (needs.trigger_pre_production_deploy.result == 'success' || needs.trigger_pre_production_deploy.result == 'skipped')
    uses: ./.github/workflows/trigger-deploy.yaml
    with:
      server_host: code.gouv.fr
      server_user: web
      deploy_script_path: ./update-sill-docker-compose.sh
      server_ssh_key_path: ~/.ssh/sill-data
      environment_name: production
      version: v${{ needs.check_if_version_upgraded.outputs.to_version }}
      github_environment: production
    secrets:
      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}