ci-cd.yml

name: Continuous Integration

on:
  push:
    branches:
      - main
      - develop
      - feature/**
      - fix/**
      - hotfix/**
      - chore/**
      - refactor/**
    tags-ignore:
      - "v*.*.*"
  pull_request:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  NODE_VERSION: "20"

jobs:
  quality:
    name: Quality Gate
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Validate project structure
        run: npm run lint

      - name: Run static smoke tests
        run: npm test

      - name: Upload validation summary
        if: always()
        run: |
          echo "# Quality Gate" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "- npm ci completed" >> "$GITHUB_STEP_SUMMARY"
          echo "- Project validation passed" >> "$GITHUB_STEP_SUMMARY"
          echo "- Static smoke tests passed" >> "$GITHUB_STEP_SUMMARY"

  security:
    name: Security Checks
    runs-on: ubuntu-latest
    needs: quality
    timeout-minutes: 15

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Run gitleaks secret scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run npm audit
        run: npm audit --audit-level=high

      - name: Run Snyk dependency scan
        uses: snyk/actions/node@v1.0.0
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          command: test
          args: --severity-threshold=high --all-projects

      - name: Security summary
        if: always()
        run: |
          echo "# Security Checks" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "- gitleaks secret scan executed" >> "$GITHUB_STEP_SUMMARY"
          echo "- npm audit executed at high severity threshold" >> "$GITHUB_STEP_SUMMARY"
          echo "- Snyk dependency scan executed" >> "$GITHUB_STEP_SUMMARY"

  docker-smoke:
    name: Docker Smoke Test
    runs-on: ubuntu-latest
    needs:
      - quality
      - security
    timeout-minutes: 15

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Build production container
        run: docker build --target production --tag resume-matcher:ci .

      - name: Run container
        run: docker run -d --name resume-matcher-ci -p 8080:8080 resume-matcher:ci

      - name: Verify container health endpoint
        run: |
          for attempt in {1..15}; do
            if curl -fsS http://127.0.0.1:8080/health > /dev/null; then
              echo "Container health endpoint is reachable."
              exit 0
            fi
            sleep 2
          done
          echo "Container health endpoint did not become ready in time."
          docker logs resume-matcher-ci
          exit 1

      - name: Stop container
        if: always()
        run: docker rm -f resume-matcher-ci

  notify:
    name: Notification Stage
    runs-on: ubuntu-latest
    env:
      SMTP_USER: ${{ secrets.SMTP_USER }}
      SMTP_PASS: ${{ secrets.SMTP_PASS }}
    needs:
      - quality
      - security
      - docker-smoke
    if: always()

    steps:
      - name: Compute notification status
        id: status
        run: |
          if [[ "${{ needs.quality.result }}" == "success" && \
                "${{ needs.security.result }}" == "success" && \
                "${{ needs.docker-smoke.result }}" == "success" ]]; then
            echo "state=success" >> "$GITHUB_OUTPUT"
            echo "message=CI pipeline completed successfully. No production deployment was triggered." >> "$GITHUB_OUTPUT"
          else
            echo "state=failure" >> "$GITHUB_OUTPUT"
            echo "message=CI pipeline failed. Review the workflow logs before merging." >> "$GITHUB_OUTPUT"
          fi

      - name: Send pipeline email notification
        if: always() && env.SMTP_USER != '' && env.SMTP_PASS != ''
        uses: dawidd6/action-send-mail@v3
        with:
          server_address: smtp.gmail.com
          server_port: 587
          username: ${{ env.SMTP_USER }}
          password: ${{ env.SMTP_PASS }}
          subject: "[${{ steps.status.outputs.state }}] ${{ github.repository }} CI"
          to: ${{ env.SMTP_USER }}
          from: GitHub Actions <${{ env.SMTP_USER }}>
          body: |
            Repository: ${{ github.repository }}
            Branch: ${{ github.ref_name }}
            Commit: ${{ github.sha }}

            Quality Gate: ${{ needs.quality.result }}
            Security Checks: ${{ needs.security.result }}
            Docker Smoke Test: ${{ needs.docker-smoke.result }}

            ${{ steps.status.outputs.message }}
            Run URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

      - name: Write notification summary
        run: |
          echo "# Notification Stage" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "- Status: ${{ steps.status.outputs.state }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- Quality Gate: ${{ needs.quality.result }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- Security Checks: ${{ needs.security.result }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- Docker Smoke Test: ${{ needs.docker-smoke.result }}" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "${{ steps.status.outputs.message }}" >> "$GITHUB_STEP_SUMMARY"