ci-cd.yml

name: CI/CD Pipeline

on:
  push:
    branches:
      - main
      - master
      - 'poc/**'
  pull_request:
    branches:
      - main
      - master
  workflow_dispatch:

# Disable concurrent builds
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

# Send notifications to Slack on failure (production branches only)
# Note: You'll need to set up a Slack webhook integration
# https://github.com/marketplace/actions/slack-send

jobs:
  validate-tag:
    name: Validate Release Tag
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Check tag matches semver
        env:
          TAG: ${{ github.ref_name }}
        run: |
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.]+)?$ ]]; then
            echo "Tag '$TAG' is not a valid semver tag (expected vX.Y.Z or vX.Y.Z-suffix)" >&2
            exit 1
          fi
          echo "Tag '$TAG' is valid semver"

  test-portal-generator:
    name: Test Portal Generator
    needs: validate-tag
    if: always() && (needs.validate-tag.result == 'success' || needs.validate-tag.result == 'skipped')
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: scripts/package-lock.json

      - name: Install Python dependencies
        run: pip3 install --no-cache-dir -r scripts/requirements.txt

      - name: Install Node.js dependencies
        run: cd scripts && npm install --ignore-scripts

      - name: Run portal generator tests
        run: make test-portal

  generate-portal:
    name: Generate Portal
    needs: test-portal-generator
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Python dependencies
        run: pip3 install --no-cache-dir -r scripts/requirements.txt

      - name: Generate portal
        run: 'make generate-portal BUILD_LABEL="${{ github.ref_name }}: ${{ github.sha }}"'
        env:
          BRANCH_NAME: ${{ github.ref_name }}
          GIT_COMMIT: ${{ github.sha }}

      - name: Upload portal artifacts
        uses: actions/upload-artifact@v4
        with:
          name: portal
          path: portal/
          retention-days: 30

  validate-specs:
    name: Validate Specs
    needs: generate-portal
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Anypoint CLI
        run: |
          npm install -g anypoint-cli-v4
          anypoint-cli-v4 plugins:install anypoint-cli-api-project-plugin

      - name: Install Python dependencies
        run: pip3 install --no-cache-dir -r scripts/requirements.txt

      - name: Run validation
        run: |
          make validate-all-governed SKIP_GOVERNED="arm-monitoring-query"
          make validate-xorigin
          make validate-jtbd
          make validate-skills
        env:
          ANYPOINT_USERNAME: ${{ secrets.ANYPOINT_USERNAME }}
          ANYPOINT_PASSWORD: ${{ secrets.ANYPOINT_PASSWORD }}

  deploy-to-test:
    name: Deploy to Test
    needs: validate-specs
    runs-on: ubuntu-latest
    # Only run on master branch
    if: github.ref == 'refs/heads/master'
    environment:
      name: test
      url: https://test-dev-portal.mulesoft.com

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Setup SSH key
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "${AKAMAI_PRIVATE_SSH_KEY}" > ~/.ssh/akamai_key
          chmod 600 ~/.ssh/akamai_key
          ssh-keygen -lf ~/.ssh/akamai_key > /dev/null && echo "key parses OK"
        env:
          AKAMAI_PRIVATE_SSH_KEY: ${{ secrets.AKAMAI_PRIVATE_SSH_KEY }}

      - name: Install lftp
        run: sudo apt-get update && sudo apt-get install -y lftp

      - name: Install Python dependencies
        run: pip3 install --no-cache-dir -r scripts/requirements.txt

      - name: Generate portal for test
        run: 'make generate-portal BUILD_LABEL="${{ github.ref_name }}: ${{ github.sha }}" BASE_URL=https://test-dev-portal.mulesoft.com'
        env:
          BRANCH_NAME: ${{ github.ref_name }}
          GIT_COMMIT: ${{ github.sha }}

      - name: Deploy to Akamai test
        run: |
          echo "Deploying portal to TEST environment"
          lftp -u "${AKAMAI_USER},${AKAMAI_PASS}" -e "set sftp:connect-program 'ssh -o BatchMode=yes -o StrictHostKeyChecking=no -o IdentitiesOnly=yes -i ~/.ssh/akamai_key'; mirror -R --overwrite --no-perms --verbose portal/ ${AKAMAI_BASE_PATH}/test; quit" "sftp://${AKAMAI_HOST}"
        env:
          AKAMAI_HOST: ${{ secrets.AKAMAI_HOST }}
          AKAMAI_USER: ${{ secrets.AKAMAI_USER }}
          AKAMAI_PASS: ${{ secrets.AKAMAI_PASS }}
          AKAMAI_BASE_PATH: ${{ secrets.AKAMAI_BASE_PATH }}

  deploy-to-poc:
    name: Deploy to POC
    needs: validate-specs
    runs-on: ubuntu-latest
    # Only run on poc/* branches
    if: startsWith(github.ref, 'refs/heads/poc/')
    environment:
      name: poc

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Setup SSH key
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "${AKAMAI_PRIVATE_SSH_KEY}" > ~/.ssh/akamai_key
          chmod 600 ~/.ssh/akamai_key
          ssh-keygen -lf ~/.ssh/akamai_key > /dev/null && echo "key parses OK"
        env:
          AKAMAI_PRIVATE_SSH_KEY: ${{ secrets.AKAMAI_PRIVATE_SSH_KEY }}

      - name: Install lftp
        run: sudo apt-get update && sudo apt-get install -y lftp

      - name: Install Python dependencies
        run: pip3 install --no-cache-dir -r scripts/requirements.txt

      - name: Derive POC name
        id: poc
        run: |
          raw="${GITHUB_REF_NAME#poc/}"
          # Lowercase, replace any non-alphanumeric run with a single hyphen, trim leading/trailing hyphens
          sanitized="$(printf '%s' "$raw" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9]+/-/g; s/^-+//; s/-+$//')"
          if [ -z "$sanitized" ]; then
            echo "Branch '$GITHUB_REF_NAME' produced an empty POC name after sanitization" >&2
            exit 1
          fi
          echo "name=$sanitized" >> "$GITHUB_OUTPUT"
          echo "Deploying POC as: $sanitized"

      - name: Generate portal for POC
        run: 'make generate-portal BUILD_LABEL="${{ github.ref_name }}: ${{ github.sha }}" BASE_URL=https://test-dev-portal.mulesoft.com/pocs/${{ steps.poc.outputs.name }} PROXY_URL=https://test-dev-portal.mulesoft.com/proxy'
        env:
          BRANCH_NAME: ${{ github.ref_name }}
          GIT_COMMIT: ${{ github.sha }}

      - name: Deploy to Akamai POC
        run: |
          echo "Deploying portal to POC environment | POC=${POC_NAME}"
          lftp -u "${AKAMAI_USER},${AKAMAI_PASS}" -e "set sftp:connect-program 'ssh -o BatchMode=yes -o StrictHostKeyChecking=no -o IdentitiesOnly=yes -i ~/.ssh/akamai_key'; mirror -R --overwrite --no-perms --verbose portal/ ${AKAMAI_BASE_PATH}/test/pocs/${POC_NAME}; quit" "sftp://${AKAMAI_HOST}"
        env:
          AKAMAI_HOST: ${{ secrets.AKAMAI_HOST }}
          AKAMAI_USER: ${{ secrets.AKAMAI_USER }}
          AKAMAI_PASS: ${{ secrets.AKAMAI_PASS }}
          AKAMAI_BASE_PATH: ${{ secrets.AKAMAI_BASE_PATH }}
          POC_NAME: ${{ steps.poc.outputs.name }}

  deploy-to-production:
    name: Deploy to Production
    needs: validate-specs
    runs-on: ubuntu-latest
    # Only run against a release tag (vX.Y.Z), dispatched manually via workflow_dispatch
    if: startsWith(github.ref, 'refs/tags/')
    environment:
      name: production
      url: https://dev-portal.mulesoft.com

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
        

      - name: Setup SSH key
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "${AKAMAI_PRIVATE_SSH_KEY}" > ~/.ssh/akamai_key
          chmod 600 ~/.ssh/akamai_key
          ssh-keygen -lf ~/.ssh/akamai_key > /dev/null && echo "key parses OK"
        env:
          AKAMAI_PRIVATE_SSH_KEY: ${{ secrets.AKAMAI_PRIVATE_SSH_KEY }}

      - name: Install lftp
        run: sudo apt-get update && sudo apt-get install -y lftp

      - name: Install Python dependencies
        run: pip3 install --no-cache-dir -r scripts/requirements.txt

      - name: Generate portal for production
        run: 'make generate-portal BUILD_LABEL="${{ github.ref_name }}: ${{ github.sha }}" BASE_URL=https://dev-portal.mulesoft.com'
        env:
          BRANCH_NAME: ${{ github.ref_name }}
          GIT_COMMIT: ${{ github.sha }}

      - name: Deploy to Akamai production
        run: |
          echo "Deploying portal to PRODUCTION environment"
          lftp -u "${AKAMAI_USER},${AKAMAI_PASS}" -e "set sftp:connect-program 'ssh -o BatchMode=yes -o StrictHostKeyChecking=no -o IdentitiesOnly=yes -i ~/.ssh/akamai_key'; mirror -R --overwrite --no-perms --verbose portal/ ${AKAMAI_BASE_PATH}/prod; quit" "sftp://${AKAMAI_HOST}"
        env:
          AKAMAI_HOST: ${{ secrets.AKAMAI_HOST }}
          AKAMAI_USER: ${{ secrets.AKAMAI_USER }}
          AKAMAI_PASS: ${{ secrets.AKAMAI_PASS }}
          AKAMAI_BASE_PATH: ${{ secrets.AKAMAI_BASE_PATH }}

  notify-on-failure:
    name: Notify on Failure
    needs: [validate-tag, test-portal-generator, generate-portal, validate-specs, deploy-to-test, deploy-to-production]
    runs-on: ubuntu-latest
    if: |
      failure() &&
      (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/'))

    steps:
      - name: Send Slack notification
        uses: slackapi/slack-github-action@v1.25.0
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
        with:
          payload: '{"text":"Pipeline failed: ${{ github.repository }} - Branch: ${{ github.ref_name }} - Commit: ${{ github.sha }} - Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}'