ci.yml

name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  PYTHON_VERSION: '3.11'
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  # ==========================================
  # Security & Quality Gates
  # ==========================================
  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'

      - name: Install dependencies
        run: |
          pip install --upgrade pip
          pip install -r requirements.txt
          pip install bandit safety

      - name: Run Bandit (security linter)
        run: bandit -r . -f json -o bandit-report.json || true

      - name: Check for known vulnerabilities
        run: safety check --json --output safety-report.json || true

      - name: Upload security reports
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: security-reports
          path: |
            bandit-report.json
            safety-report.json

  # ==========================================
  # Lint & Type Check
  # ==========================================
  lint:
    name: Lint & Format Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'

      - name: Install linting tools
        run: |
          pip install flake8 black isort mypy
          pip install -r requirements.txt

      - name: Check code formatting with Black
        run: black --check --diff . || true

      - name: Check import sorting with isort
        run: isort --check-only --diff . || true

      - name: Run Flake8
        run: flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics || true

      - name: Type check with mypy
        run: mypy . --ignore-missing-imports || true

  # ==========================================
  # Test with Coverage
  # ==========================================
  test:
    name: Test Suite
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ['3.10', '3.11', '3.12']
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'

      - name: Install dependencies
        run: |
          pip install --upgrade pip
          pip install pytest pytest-cov pytest-asyncio
          pip install -r requirements.txt

      - name: Run tests with coverage
        run: |
          pytest --cov=. --cov-report=xml --cov-report=html -v || echo "No tests yet"

      - name: Upload coverage reports
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: coverage-reports-${{ matrix.python-version }}
          path: |
            htmlcov/
            coverage.xml

      - name: Upload coverage to Codecov
        if: matrix.python-version == '3.11'
        uses: codecov/codecov-action@v4
        with:
          file: ./coverage.xml
          fail_ci_if_error: false
          verbose: true
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  # ==========================================
  # Build & Package
  # ==========================================
  build:
    name: Build Application
    runs-on: ubuntu-latest
    needs: [security-scan, lint, test]
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'

      - name: Install dependencies
        run: |
          pip install --upgrade pip
          pip install -r requirements.txt
          pip install pyinstaller

      - name: Verify imports
        run: |
          python -c "import main; print('Import successful')"

      - name: Build Docker image
        run: |
          docker build -t edit-banana:${{ github.sha }} . || echo "No Dockerfile yet"

  # ==========================================
  # Deploy to Staging
  # ==========================================
  deploy-staging:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    needs: [build]
    if: github.ref == 'refs/heads/develop'
    environment: staging
    steps:
      - uses: actions/checkout@v4

      - name: Deploy to Staging
        run: |
          echo "Deploying to staging environment..."
          echo "STAGING_API_KEY=${{ secrets.STAGING_API_KEY }}" >> $GITHUB_ENV
          # Add your staging deployment commands here
          # e.g., ssh, scp, or API calls to your hosting provider

  # ==========================================
  # Deploy to Production
  # ==========================================
  deploy-production:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: [build]
    if: github.ref == 'refs/heads/main'
    environment: production
    steps:
      - uses: actions/checkout@v4

      - name: Deploy to Production
        run: |
          echo "Deploying to production environment..."
          echo "PROD_API_KEY=${{ secrets.PROD_API_KEY }}" >> $GITHUB_ENV
          # Add your production deployment commands here

  # ==========================================
  # Notify
  # ==========================================
  notify:
    name: Notify Status
    runs-on: ubuntu-latest
    needs: [security-scan, lint, test, build]
    if: always()
    steps:
      - name: Notify Slack on failure
        if: failure()
        uses: 8398a7/action-slack@v3
        with:
          status: ${{ job.status }}
          fields: repo,message,commit,author,action,eventName,ref,workflow
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

      - name: Summary
        run: |
          echo "## CI/CD Pipeline Summary" >> $GITHUB_STEP_SUMMARY
          echo "- Security Scan: ${{ needs.security-scan.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- Lint: ${{ needs.lint.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- Test: ${{ needs.test.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- Build: ${{ needs.build.result }}" >> $GITHUB_STEP_SUMMARY