ci_cd.yaml

name: ci-cd
run-name: ${{ github.workflow }}

on:
  pull_request:
    branches:
      - main
    paths:
      - "src/**"
      - ".github/workflows/ci_cd.yaml"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository}}

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      checks: write
      contents: read
      pull-requests: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python 3.10
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Install dependencies
        working-directory: src
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install -r test-requirements.txt

      - name: Lint with black
        working-directory: src
        run: |
          black .
          black --check .

      - name: Test with pytest
        working-directory: src
        run: pytest -rA --junitxml=test-results.xml --cov=tests --cov-report=xml

      - name: Code coverage summary report
        uses: irongut/CodeCoverageSummary@v1.3.0
        with:
          filename: src/coverage.xml
          badge: true
          output: both
          format: markdown
          indicators: true
          thresholds: "60 80"
          fail_below_min: false
          hide_complexity: true
          hide_branch_rate: false

      - name: Upload test and coverage results
        if: success() || failure()
        uses: actions/upload-artifact@v4
        with:
          name: pytest-results
          path: |
            src/coverage.xml
            src/test-results.xml
            code-coverage-results.md
          retention-days: 5

      - name: Publish test results
        uses: EnricoMi/publish-unit-test-result-action@v2
        if: success() || failure()
        with:
          check_name: pytest-results
          junit_files: src/test-results.xml
          comment_mode: always
          fail_on: test failures
          action_fail: false
          ignore_runs: false
          job_summary: true
          compare_to_earlier_commit: true
          check_run_annotations: all tests, skipped tests

      - name: Pytest coverage summary
        if: success() || failure()
        run: |
          echo "## coverage-results" >> $GITHUB_STEP_SUMMARY
          cat code-coverage-results.md >> $GITHUB_STEP_SUMMARY

      - name: Add coverage PR comment
        uses: marocchino/sticky-pull-request-comment@v2
        if: (success() || failure()) && github.event_name == 'pull_request'
        with:
          path: code-coverage-results.md
          recreate: true

  publish-docker-image:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        id: build-push-image
        uses: docker/build-push-action@v6
        with:
          context: ${{ github.workspace }}/src
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
  
  deploy-development:
    needs: publish-docker-image
    runs-on: ubuntu-latest
    environment:
      url: https://${{ vars.WEBAPP_NAME }}.azurewebsites.net
      name: development-application
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
  
      - name: Azure login
        uses: Azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
      
      - name: Configure webapp
        run: |
          az webapp config container set \
          --name ${{ vars.WEBAPP_NAME }} \
          --resource-group ${{ vars.RESOURCE_GROUP_NAME }} \
          --docker-custom-image-name '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}' \
          --docker-registry-server-url ${{ env.REGISTRY }} \
          --docker-registry-server-user ${{ github.repository_owner }} \
          --docker-registry-server-password ${{ secrets.PACKAGES_PAT }}

  deploy-production:
    needs: deploy-development
    runs-on: ubuntu-latest
    environment:
      url: https://${{ vars.WEBAPP_NAME }}.azurewebsites.net
      name: production-application
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
  
      - name: Azure login
        uses: Azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
      
      - name: Configure webapp
        run: |
          az webapp config container set \
          --name ${{ vars.WEBAPP_NAME }} \
          --resource-group ${{ vars.RESOURCE_GROUP_NAME }} \
          --docker-custom-image-name '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}' \
          --docker-registry-server-url ${{ env.REGISTRY }} \
          --docker-registry-server-user ${{ github.repository_owner }} \
          --docker-registry-server-password ${{ secrets.PACKAGES_PAT }}