ci-cd.yaml

name: CI/CD

on:
  merge_group:
  pull_request:
  push:
  workflow_dispatch:

concurrency:
  cancel-in-progress: true
  group: ${{ github.repository }}-${{ github.workflow }}-${{ github.head_ref || github.ref_name }}

env:
  FORCE_COLOR: 1

jobs:
  pre-commit:
    name: Run pre-commit
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install Poetry
        run: pipx install poetry

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          cache: poetry
          cache-dependency-path: backend/poetry.lock
          python-version: '3.12'

      - name: Run pre-commit
        uses: pre-commit/action@v3.0.1

  code-ql:
    name: CodeQL
    needs:
      - pre-commit
    permissions:
      security-events: write
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: python

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: '/language:python'

  run-tests:
    name: Run tests
    needs:
      - pre-commit
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install Poetry
        run: pipx install poetry

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          cache: poetry
          cache-dependency-path: backend/poetry.lock
          python-version: '3.12'

      - name: Run tests
        run: |
          make test

  build-docker-images:
    name: Build Docker Images
    environment: staging
    if: |
      github.ref == 'refs/heads/main'
    needs:
      - run-tests
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build backend image
        uses: docker/build-push-action@v6
        with:
          context: backend
          file: backend/Dockerfile.staging
          platforms: linux/amd64
          push: true
          tags: ${{ secrets.DOCKERHUB_USERNAME }}/owasp-nest-backend:latest

  deploy-staging:
    name: Deploy Nest Staging
    env:
      ANSIBLE_HOST_KEY_CHECKING: False
      STAGING_HOST_IP_ADDRESS: '${{ secrets.STAGING_HOST_IP_ADDRESS }}'
      STAGING_SSH_PRIVATE_KEY_PATH: '~/.ssh/nest_staging_private_key'
    environment: staging
    if: |
      github.ref == 'refs/heads/main'
    needs:
      - build-docker-images
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Prepare SSH key
        run: |
          mkdir -m 700 ~/.ssh
          echo "${{ secrets.STAGING_SSH_PRIVATE_KEY }}" > ${{ env.STAGING_SSH_PRIVATE_KEY_PATH }}
          chmod 400 ${{ env.STAGING_SSH_PRIVATE_KEY_PATH }}

      - name: Run Nest deploy
        working-directory: .github/ansible
        run: ansible-playbook -i inventory.yaml staging/deploy.yaml -e "github_workspace=$GITHUB_WORKSPACE"