ci-cd.yml

# SPDX-License-Identifier: MPL-2.0
name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop, 'claude/**' ]
  pull_request:
    branches: [ main, develop ]
  schedule:
    # Run security scans daily at 2 AM UTC
    - cron: '0 2 * * *'

permissions:
  contents: read

env:
  JULIA_VERSION: '1.12'
  RUST_VERSION: 'stable'
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  # Code quality checks
  quality:
    name: Code Quality
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0  # Full history for SonarCloud

      - name: Set up Julia
        uses: julia-actions/setup-julia@fa02766e078afaaf09b14210362cee14137e6a32 # v2.8.0
        with:
          version: ${{ env.JULIA_VERSION }}

      - name: Install dependencies
        run: |
          cd src/julia/RobotVacuum
          julia --project=. -e 'using Pkg; Pkg.instantiate()'
          julia --project=. -e 'using Pkg; Pkg.add("JuliaFormatter")'

      - name: Run JuliaFormatter (code formatting)
        run: |
          cd src/julia/RobotVacuum
          julia --project=. -e 'using JuliaFormatter; exit(format("src"; overwrite=false) ? 0 : 1)'
        continue-on-error: true

  # Security scanning
  security:
    name: Security Scanning
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Run GitLeaks (secrets detection)
        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

      - name: Run Trivy vulnerability scanner (filesystem)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.33.0
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '0'
          limit-severities-for-sarif: true

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v3.28.1
        if: always() && hashFiles('trivy-results.sarif') != ''
        with:
          sarif_file: 'trivy-results.sarif'
          category: 'trivy-filesystem'

      - name: Run Snyk security scan
        uses: snyk/actions/node@8e119fbb6c251787721d34ba683ed48eba792766 # master 2024-12-09
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

      - name: OWASP Dependency Check
        uses: dependency-check/Dependency-Check_Action@1e54355a8b4c8abaa8cc7d0b70aa655a3bb15a6c # main 2024-12-09
        with:
          project: 'robot-vacuum-cleaner'
          path: '.'
          format: 'HTML'
          out: 'reports'
        continue-on-error: true

      - name: Upload dependency check report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
        if: always()
        with:
          name: dependency-check-report
          path: reports/

  # Julia tests
  test-julia:
    name: Julia Tests
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      matrix:
        julia-version: ['1.12', 'nightly']
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Julia ${{ matrix.julia-version }}
        uses: julia-actions/setup-julia@fa02766e078afaaf09b14210362cee14137e6a32 # v2.8.0
        with:
          version: ${{ matrix.julia-version }}

      - name: Install dependencies
        run: |
          cd src/julia/RobotVacuum
          julia --project=. -e 'using Pkg; Pkg.instantiate()'

      - name: Run tests with coverage
        run: |
          cd src/julia/RobotVacuum
          julia --project=. -e 'using Pkg; Pkg.test(coverage=true)'

      - name: Process coverage
        uses: julia-actions/julia-processcoverage@03114f09f119417c3242a9fb6e0b722676aedf38 # v1.2.2
        with:
          directories: src/julia/RobotVacuum/src

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v5.0.7
        with:
          files: lcov.info
          flags: julia-${{ matrix.julia-version }}
          name: julia-${{ matrix.julia-version }}
          token: ${{ secrets.CODECOV_TOKEN }}

  # Rust tests
  test-rust:
    name: Rust Tests
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
        with:
          toolchain: ${{ env.RUST_VERSION }}
          components: rustfmt, clippy

      - name: Cargo format check
        run: cargo fmt --all -- --check
        working-directory: src/rust
        continue-on-error: true

      - name: Cargo clippy
        run: cargo clippy --all-targets --all-features -- -D warnings
        working-directory: src/rust
        continue-on-error: true

      - name: Run Rust tests
        run: cargo test --verbose
        working-directory: src/rust

      - name: Generate coverage
        run: |
          cargo install cargo-tarpaulin
          cargo tarpaulin --out Xml --output-dir coverage
        working-directory: src/rust
        continue-on-error: true

      - name: Upload Rust coverage
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v5.0.7
        with:
          file: src/rust/coverage/cobertura.xml
          flags: rust
          name: rust
          token: ${{ secrets.CODECOV_TOKEN }}
        continue-on-error: true

  # Build and scan container images
  container-build:
    name: Build & Scan Containers
    runs-on: ubuntu-latest
    needs: [quality, test-julia]
    permissions:
      contents: read
      packages: write
      security-events: write
      id-token: write
      attestations: write
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to Container Registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix={{branch}}-
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build container image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ./docker/Containerfile
          push: false
          load: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Run Trivy vulnerability scanner (image)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.33.0
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
          format: 'sarif'
          output: 'trivy-image-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '0'
          limit-severities-for-sarif: true

      - name: Upload Trivy image results
        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v3.28.1
        if: always() && hashFiles('trivy-image-results.sarif') != ''
        with:
          sarif_file: 'trivy-image-results.sarif'
          category: 'trivy-container'

      - name: Run Hadolint (Dockerfile linting)
        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
        with:
          dockerfile: docker/Containerfile
          failure-threshold: warning

      - name: Scan with Grype
        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v5.0.0
        with:
          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
          fail-build: false
          severity-cutoff: high

      - name: Push container image
        id: push
        if: github.event_name != 'pull_request'
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ./docker/Containerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Attest container provenance
        if: github.event_name != 'pull_request'
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

  # SonarCloud analysis
  sonarcloud:
    name: SonarCloud Analysis
    runs-on: ubuntu-latest
    needs: [test-julia]
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Download Julia coverage
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: julia-coverage
          path: htmlcov/

      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@ffc3010689be73b8e5ae0c57ce35968afd7909e8 # v3.1.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >
            -Dsonar.projectKey=robot-vacuum-cleaner
            -Dsonar.organization=${{ github.repository_owner }}
            -Dsonar.coverage.reportPaths=lcov.info
            -Dsonar.sources=src/
            -Dsonar.tests=tests/
            -Dsonar.exclusions=**/*_test.py,**/test_*.py

  # Integration tests
  integration:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: [container-build]
    permissions:
      contents: read
    services:
      redis:
        image: redis:alpine
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379

      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_DB: robot_vacuum_test
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Julia
        uses: julia-actions/setup-julia@fa02766e078afaaf09b14210362cee14137e6a32 # v2.8.0
        with:
          version: ${{ env.JULIA_VERSION }}

      - name: Install dependencies
        run: |
          cd src/julia/RobotVacuum
          julia --project=. -e 'using Pkg; Pkg.instantiate()'

      - name: Run integration tests
        env:
          REDIS_HOST: localhost
          POSTGRES_HOST: localhost
          POSTGRES_DB: robot_vacuum_test
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
        run: |
          cd src/julia/RobotVacuum
          julia --project=. -e 'using Pkg; Pkg.test()'

  # Deployment (only on main branch)
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    needs: [integration, security, sonarcloud]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    permissions:
      contents: read
    environment:
      name: production
      url: https://robot-vacuum.example.com
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Deploy to production
        run: |
          echo "Deploying to production environment..."
          # Add actual deployment commands here
          # e.g., kubectl apply, helm upgrade, etc.

      - name: Notify deployment
        uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.18.3
        if: always()
        with:
          status: ${{ job.status }}
          text: 'Deployment to production ${{ job.status }}'
          webhook_url: ${{ secrets.SLACK_WEBHOOK }}
        continue-on-error: true

  # Notification job
  notify:
    name: Notify
    runs-on: ubuntu-latest
    needs: [quality, security, test-julia, test-rust, container-build, integration]
    if: always()
    permissions: {}
    steps:
      - name: Check job statuses
        id: check
        run: |
          if [ "${{ contains(needs.*.result, 'failure') }}" == "true" ]; then
            echo "status=failure" >> $GITHUB_OUTPUT
          elif [ "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]; then
            echo "status=cancelled" >> $GITHUB_OUTPUT
          else
            echo "status=success" >> $GITHUB_OUTPUT
          fi

      - name: Send notification
        run: |
          echo "Pipeline status: ${{ steps.check.outputs.status }}"
          # Add notification logic (Slack, email, etc.)