ci.yml

name: CI Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  AWS_REGION: us-east-1
  AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}

jobs:
  lint-and-test-user-service:
    name: Lint & Test User Service
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: user-service/package-lock.json

      - name: Install dependencies
        working-directory: user-service
        run: npm ci

      - name: Run tests
        working-directory: user-service
        run: npm test

  lint-and-test-product-service:
    name: Lint & Test Product Service
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install dependencies
        working-directory: product-service
        run: pip install -r requirements.txt

      - name: Run tests
        working-directory: product-service
        run: python -m pytest src/ -v --tb=short || echo "No tests yet"

  build-and-push:
    name: Build & Push to ECR
    runs-on: ubuntu-latest
    needs: [lint-and-test-user-service, lint-and-test-product-service]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build & push user-service
        env:
          IMAGE_TAG: ${{ github.sha }}
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        run: |
          docker build -t $ECR_REGISTRY/ecommerce/user-service:$IMAGE_TAG ./user-service
          docker push $ECR_REGISTRY/ecommerce/user-service:$IMAGE_TAG
          echo "user-service image: $ECR_REGISTRY/ecommerce/user-service:$IMAGE_TAG"

      - name: Build & push product-service
        env:
          IMAGE_TAG: ${{ github.sha }}
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        run: |
          docker build -t $ECR_REGISTRY/ecommerce/product-service:$IMAGE_TAG ./product-service
          docker push $ECR_REGISTRY/ecommerce/product-service:$IMAGE_TAG
          echo "product-service image: $ECR_REGISTRY/ecommerce/product-service:$IMAGE_TAG"
      - name: Scan image with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "${{ steps.login-ecr.outputs.registry }}/ecommerce/product-service:${{ github.sha }}"
          format: "table"
          exit-code: "0"
          severity: "CRITICAL,HIGH"