ci.yml

name: Enterprise Polyglot CI

permissions:
  contents: read
  packages: write

on:
  push:
    branches: [main, master, develop]
  pull_request:
    branches: [main, master, develop]

env:
  REGISTRY: ghcr.io
  IMAGE_TAG: ${{ github.sha }}

jobs:
  frontend-check:
    name: Frontend CI
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Install dependencies
        run: npm ci
      - name: Lint
        run: npm run lint
      - name: TypeCheck
        run: npx tsc --noEmit
      - name: Run unit tests
        run: npm test
      - name: Security audit
        run: npm audit --audit-level=high
        continue-on-error: true
      - name: Build
        run: npm run build
        env:
          NEXT_PUBLIC_API_URL: http://localhost:8080/api

  node-services-check:
    name: Node Services CI
    runs-on: ubuntu-latest
    strategy:
      matrix:
        service: [api-gateway-node, auth-service]
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: services/${{ matrix.service }}/package-lock.json
      - name: Install dependencies
        run: npm ci
        working-directory: services/${{ matrix.service }}
      - name: Security audit
        run: npm audit --audit-level=high
        continue-on-error: true
        working-directory: services/${{ matrix.service }}
      - name: Syntax check
        run: node -c index.js
        working-directory: services/${{ matrix.service }}
      - name: Run unit tests
        run: npm test
        working-directory: services/${{ matrix.service }}

  go-services-check:
    name: Go Services CI
    runs-on: ubuntu-latest
    strategy:
      matrix:
        service: [notification-go-service, attendance-service]
    steps:
      - uses: actions/checkout@v4
      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: "1.21"
      - name: Install dependencies
        run: go mod download
        working-directory: services/${{ matrix.service }}
      - name: Vet
        run: go vet ./...
        working-directory: services/${{ matrix.service }}
      - name: Compile check
        run: go build -v ./...
        working-directory: services/${{ matrix.service }}
      - name: Run unit tests
        run: go test -v -count=1 ./...
        working-directory: services/${{ matrix.service }}
      - name: Security scan
        run: |
          go install github.com/securego/gosec/v2/cmd/gosec@latest
          gosec -no-fail -fmt sarif -out gosec-results.sarif ./...
        working-directory: services/${{ matrix.service }}

  python-services-check:
    name: Python Services CI
    runs-on: ubuntu-latest
    strategy:
      matrix:
        service: [employee-python-service, analytics-python-service, integration-service, ai-service, security-service, live-service, employee-lifecycle-service, workforce-planning-service]
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.11"
          cache: 'pip'
          cache-dependency-path: services/${{ matrix.service }}/requirements.txt
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
        working-directory: services/${{ matrix.service }}
      - name: Install linting tools
        run: pip install flake8 pytest httpx bandit
        working-directory: services/${{ matrix.service }}
      - name: Syntax check
        run: python -m py_compile main.py
        working-directory: services/${{ matrix.service }}
      - name: Lint Python
        run: flake8 . --max-line-length=120
        continue-on-error: true
        working-directory: services/${{ matrix.service }}
      - name: Security scan
        run: bandit -r . --severity high
        working-directory: services/${{ matrix.service }}
        continue-on-error: true
      - name: Set test environment variables
        run: |
          echo "RABBITMQ_USER=guest" >> $GITHUB_ENV
          echo "RABBITMQ_PASSWORD=guest" >> $GITHUB_ENV
          if [[ "${{ matrix.service }}" == "employee-python-service" ]]; then
            echo "MONGO_USER=test" >> $GITHUB_ENV
            echo "MONGO_PASSWORD=test" >> $GITHUB_ENV
            echo "INTERNAL_KEY=test-internal-key" >> $GITHUB_ENV
          elif [[ "${{ matrix.service }}" == "analytics-python-service" ]]; then
            echo "POSTGRES_USER=test" >> $GITHUB_ENV
            echo "POSTGRES_PASSWORD=test" >> $GITHUB_ENV
            echo "INTERNAL_JWT_SECRET=test-secret" >> $GITHUB_ENV
          elif [[ "${{ matrix.service }}" == "integration-service" ]]; then
            echo "INTERNAL_API_KEY=test-key" >> $GITHUB_ENV
            echo "DATABASE_URL=sqlite:///test.db" >> $GITHUB_ENV
          elif [[ "${{ matrix.service }}" == "security-service" ]]; then
            echo "DATABASE_URL=sqlite:///test.db" >> $GITHUB_ENV
            echo "INTERNAL_API_KEY=test-key" >> $GITHUB_ENV
          elif [[ "${{ matrix.service }}" == "live-service" ]]; then
            echo "INTERNAL_JWT_SECRET=test-secret" >> $GITHUB_ENV
          elif [[ "${{ matrix.service }}" == "employee-lifecycle-service" ]]; then
            echo "DATABASE_URL=sqlite:///test.db" >> $GITHUB_ENV
          elif [[ "${{ matrix.service }}" == "workforce-planning-service" ]]; then
            echo "DATABASE_URL=sqlite:///test.db" >> $GITHUB_ENV
          fi
      - name: Test Python
        if: hashFiles(format('services/{0}/test_*.py', matrix.service)) != '' || hashFiles(format('services/{0}/tests/**', matrix.service)) != ''
        run: pytest -v
        working-directory: services/${{ matrix.service }}

  java-services-check:
    name: Java Services CI
    runs-on: ubuntu-latest
    strategy:
      matrix:
        service: [payroll-java-service, leave-service]
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: "17"
          distribution: "temurin"
          cache: maven
      - name: Install atlas-common dependency
        run: mvn install -DskipTests
        working-directory: services/atlas-common
      - name: Set test environment variables
        run: |
          echo "SPRING_DATASOURCE_PASSWORD=test" >> $GITHUB_ENV
          echo "INTERNAL_JWT_SECRET=test-secret" >> $GITHUB_ENV
      - name: Compile and test
        run: mvn clean test
        working-directory: services/${{ matrix.service }}

  docker-build:
    name: Docker Build
    runs-on: ubuntu-latest
    strategy:
      matrix:
        image:
          - frontend
          - api-gateway-node
          - auth-service
          - notification-go-service
          - attendance-service
          - employee-python-service
          - analytics-python-service
          - payroll-java-service
          - leave-service
    steps:
      - uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
        if: github.event_name == 'push'
      - name: Determine Docker context
        id: context
        shell: bash
        run: |
          if [[ "${{ matrix.image }}" == "frontend" ]]; then
            echo "context=frontend" >> $GITHUB_OUTPUT
            echo "file=frontend/Dockerfile" >> $GITHUB_OUTPUT
          elif [[ "${{ matrix.image }}" =~ python-service$ ]]; then
            echo "context=." >> $GITHUB_OUTPUT
            echo "file=services/${{ matrix.image }}/Dockerfile" >> $GITHUB_OUTPUT
          elif [[ "${{ matrix.image }}" == "payroll-java-service" ]] || [[ "${{ matrix.image }}" == "leave-service" ]] || [[ "${{ matrix.image }}" == "performance-service" ]]; then
            echo "context=." >> $GITHUB_OUTPUT
            echo "file=services/${{ matrix.image }}/Dockerfile" >> $GITHUB_OUTPUT
          else
            echo "context=services/${{ matrix.image }}" >> $GITHUB_OUTPUT
            echo "file=services/${{ matrix.image }}/Dockerfile" >> $GITHUB_OUTPUT
          fi
      - name: Lowercase repository name for Docker tags
        id: repo_lower
        run: echo "name=${GITHUB_REPOSITORY,,}" >> $GITHUB_OUTPUT
      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: ${{ steps.context.outputs.context }}
          file: ${{ steps.context.outputs.file }}
          push: ${{ github.event_name == 'push' }}
          tags: |
            ${{ env.REGISTRY }}/${{ steps.repo_lower.outputs.name }}/${{ matrix.image }}:${{ env.IMAGE_TAG }}
            ${{ env.REGISTRY }}/${{ steps.repo_lower.outputs.name }}/${{ matrix.image }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          scan-ref: .
          format: sarif
          output: trivy-results.sarif
          severity: HIGH,CRITICAL
          exit-code: 1
        continue-on-error: true
      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif
        if: always() && hashFiles('trivy-results.sarif') != ''