name: CD Production

# Pipeline de production — Hetzner k3s (infra/prod/).
#
# Enchaînement : qualité → vérification → promotion/rebuild → déploiement → contrôle
#
# TROIS RÈGLES STRUCTURANTES
#
# 1. Le BACKEND est PROMU depuis la preprod, jamais reconstruit.
#    Promouvoir garantit que le binaire déployé en production est exactement
#    celui qui a passé la chaîne de preprod (lint, tests unitaires, tests
#    d'intégration, build). Un rebuild casserait cette garantie.
#
# 2. Le FRONTEND est RECONSTRUIT pour la production.
#    next.config.js fige NEXT_PUBLIC_API_URL au moment du build. Promouvoir
#    l'image de preprod livrerait une application qui appelle
#    api.preprod.xpeditis.com en production. C'est la raison pour laquelle ce
#    workflow ne peut pas se contenter de re-taguer.
#
# 3. Le déploiement passe par SSH, pas par l'API Kubernetes.
#    L'API k3s (6443) n'est ouverte qu'aux IP d'administration. Les runners
#    Gitea n'ont pas d'IP fixe : le job ouvre le port 22 pour la seule IP du
#    runner via un firewall Hetzner dédié, puis le referme systématiquement.
#
# Secrets, runners et limites Gitea : voir docs/CI-CD-SECURITY.md

on:
  push:
    branches: [main]

env:
  REGISTRY: rg.fr-par.scw.cloud/weworkstudio
  K8S_NAMESPACE: xpeditis-prod

jobs:
  security:
    name: Security gate
    runs-on: ubuntu-latest
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.gitea/actions/setup-node
      - name: Install Trivy
        shell: bash
        run: |
          trivy_bin=$(bash scripts/ci/install-tool.sh trivy)
          "$trivy_bin" --version
      - name: Validate workflows and deployment checks
        shell: bash
        run: |
          actionlint_bin=$(bash scripts/ci/install-tool.sh actionlint)
          ACTIONLINT_BIN="$actionlint_bin" bash scripts/ci/validate-workflows.sh
      - name: Audit dependencies, secrets and infrastructure
        shell: bash
        run: bash scripts/ci/security-audit.sh
      - name: Show security results
        if: always()
        shell: bash
        run: python3 scripts/ci/summarize-security.py
      - name: Save security reports on Gitea
        if: always()
        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3, Gitea artifact protocol
        with:
          name: security-reports
          path: ${{ runner.temp }}/security-reports/*.json
          retention-days: 7
          if-no-files-found: error

  # ═══ 1. Qualité ══════════════════════════════════════════════════════════
  backend-quality:
    name: Backend — Lint
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/backend
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.gitea/actions/setup-node
      - run: npm ci --legacy-peer-deps
      - run: npm run lint -- --no-fix

  frontend-quality:
    name: Frontend — Lint & Type-check
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/frontend
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.gitea/actions/setup-node
      - run: npm ci --legacy-peer-deps
      - run: npm run lint
      - run: npm run type-check

  backend-tests:
    name: Backend — Tests unitaires
    runs-on: ubuntu-latest
    needs: backend-quality
    defaults:
      run:
        working-directory: apps/backend
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.gitea/actions/setup-node
      - run: npm ci --legacy-peer-deps
      - run: npm test -- --ci --runInBand

  frontend-tests:
    name: Frontend — Tests unitaires
    runs-on: ubuntu-latest
    needs: frontend-quality
    defaults:
      run:
        working-directory: apps/frontend
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.gitea/actions/setup-node
      - run: npm ci --legacy-peer-deps
      - run: npm test -- --ci --runInBand

  # ═══ 2. Vérification de la provenance ════════════════════════════════════
  # Exige un pipeline preprod réussi ET un arbre Git identique au code testé ici.
  verify-image:
    name: Vérifier l'image de preprod
    runs-on: ubuntu-latest
    needs: [security, backend-tests, frontend-tests]
    outputs:
      sha: ${{ steps.sha.outputs.short }}
      backend_digest: ${{ steps.sha.outputs.backend_digest }}
      log_exporter_digest: ${{ steps.sha.outputs.log_exporter_digest }}
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ${{ env.REGISTRY }}
          username: nologin
          password: ${{ secrets.REGISTRY_TOKEN }}
      - name: Resolve validated preprod release
        id: sha
        run: bash scripts/ci/resolve-release.sh

  # ═══ 3b. Reconstruction du frontend avec les URLs de production ══════════
  build-frontend:
    name: Reconstruire le frontend (URLs de production)
    runs-on: ubuntu-latest
    needs: verify-image
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
          # Cet arbre Git est identique à celui de la release preprod vérifiée.
          ref: ${{ github.sha }}
      - uses: https://github.com/docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
        with:
          platforms: amd64,arm64
          cache-image: false
      - uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ${{ env.REGISTRY }}
          username: nologin
          password: ${{ secrets.REGISTRY_TOKEN }}
      - id: build
        uses: https://github.com/docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: ./apps/frontend
          file: ./apps/frontend/Dockerfile
          push: true
          platforms: linux/amd64
          tags: |
            ${{ env.REGISTRY }}/xpeditis-frontend:candidate-prod-${{ github.sha }}-${{ github.run_id }}
          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache-prod
          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache-prod,mode=max
          build-args: |
            NEXT_PUBLIC_API_URL=${{ secrets.NEXT_PUBLIC_API_URL_PROD }}
            NEXT_PUBLIC_APP_URL=${{ secrets.NEXT_PUBLIC_APP_URL_PROD }}

      - name: Contrôle — l'URL de preprod ne doit pas figurer dans le bundle
        run: |
          IMAGE="${{ env.REGISTRY }}/xpeditis-frontend@${{ steps.build.outputs.digest }}"
          CID=$(docker create --platform linux/amd64 "$IMAGE")
          trap 'docker rm "$CID" >/dev/null' EXIT
          docker cp "$CID:/app/.next" /tmp/next-check
          test -d /tmp/next-check
          trap - EXIT
          docker rm "$CID" >/dev/null
          if grep -rq "api.preprod.xpeditis.com" /tmp/next-check 2>/dev/null; then
            echo "::error::L'URL de preprod est figée dans le bundle de production."
            echo "Vérifiez le secret NEXT_PUBLIC_API_URL_PROD."
            exit 1
          fi
          echo "Aucune URL de preprod dans le bundle."

  image-security:
    name: Image security (${{ matrix.service }}, ${{ matrix.arch }})
    runs-on: ubuntu-latest
    needs: [verify-image, build-frontend]
    strategy:
      fail-fast: false
      matrix:
        service: [backend, frontend, log-exporter]
        arch: [amd64]
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.gitea/actions/setup-trivy
      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ${{ env.REGISTRY }}
          username: nologin
          password: ${{ secrets.REGISTRY_TOKEN }}
      - name: Scan the exact image before deployment
        env:
          IMAGE: ${{ env.REGISTRY }}/xpeditis-${{ matrix.service }}@${{ matrix.service == 'frontend' && needs.build-frontend.outputs.digest || (matrix.service == 'backend' && needs.verify-image.outputs.backend_digest || needs.verify-image.outputs.log_exporter_digest) }}
          PLATFORM: linux/${{ matrix.arch }}
        run: |
          trivy image --platform "$PLATFORM" --scanners vuln --severity HIGH,CRITICAL \
            --ignore-unfixed=false --exit-code 1 --timeout 15m --format json \
            --output "$RUNNER_TEMP/image-security.json" "$IMAGE"
      - name: Save image report
        if: always()
        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3, Gitea artifact protocol
        with:
          name: image-security-${{ matrix.service }}-${{ matrix.arch }}
          path: ${{ runner.temp }}/image-security.json
          retention-days: 14
          if-no-files-found: error

  # ═══ 4. Déploiement ══════════════════════════════════════════════════════
  deploy:
    name: Déployer en production
    runs-on: xpeditis-deploy
    needs: [verify-image, build-frontend, image-security]
    # Gitea 1.22 ignores environments: serialize on the dedicated deployment runner.
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false

      - uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ${{ env.REGISTRY }}
          username: nologin
          password: ${{ secrets.REGISTRY_TOKEN }}
      - name: Publish scanned production images
        env:
          IMAGE_SHA: ${{ needs.verify-image.outputs.sha }}
          BACKEND_DIGEST: ${{ needs.verify-image.outputs.backend_digest }}
          FRONTEND_DIGEST: ${{ needs.build-frontend.outputs.digest }}
          LOG_EXPORTER_DIGEST: ${{ needs.verify-image.outputs.log_exporter_digest }}
        run: |
          for service in backend frontend log-exporter; do
            case "$service" in
              backend) digest="$BACKEND_DIGEST" ;;
              frontend) digest="$FRONTEND_DIGEST" ;;
              log-exporter) digest="$LOG_EXPORTER_DIGEST" ;;
            esac
            docker buildx imagetools create \
              --tag "$REGISTRY/xpeditis-$service:prod-$IMAGE_SHA" \
              --tag "$REGISTRY/xpeditis-$service:latest" \
              "$REGISTRY/xpeditis-$service@$digest"
          done

      - name: Installer le client Hetzner
        run: |
          hcloud_bin=$(bash scripts/ci/install-tool.sh hcloud)
          "$hcloud_bin" version

      - name: Ouvrir le port 22 pour l'IP de ce runner
        env:
          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN_CICD }}
        run: |
          RUNNER_IP="$(curl -fsS --max-time 10 https://ifconfig.me)"
          echo "IP du runner : ${RUNNER_IP}"
          cat > /tmp/fw-open.json <<JSON
          [{
            "direction": "in",
            "protocol": "tcp",
            "port": "22",
            "source_ips": ["${RUNNER_IP}/32"],
            "description": "Gitea Actions run ${{ github.run_id }}"
          }]
          JSON
          hcloud firewall replace-rules "${{ vars.HCLOUD_CICD_FIREWALL }}" --rules-file /tmp/fw-open.json

      - name: Préparer SSH
        env:
          DEPLOY_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
        run: |
          mkdir -p "$RUNNER_TEMP/deploy-ssh" && chmod 700 "$RUNNER_TEMP/deploy-ssh"
          printf '%s\n' "$DEPLOY_SSH_KEY" > "$RUNNER_TEMP/deploy-ssh/id_ed25519"
          chmod 600 "$RUNNER_TEMP/deploy-ssh/id_ed25519"
          # Empreinte épinglée : un détournement DNS ou BGP ne peut pas
          # rediriger le déploiement vers une machine tierce.
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$RUNNER_TEMP/deploy-ssh/known_hosts"
          chmod 600 "$RUNNER_TEMP/deploy-ssh/known_hosts"

      - name: Synchroniser infra/prod sur le serveur
        run: |
          rsync -az --delete \
            --exclude '.terraform' --exclude '*.tfstate*' --exclude '*.tfvars' \
            -e "ssh -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\"$RUNNER_TEMP/deploy-ssh/known_hosts\" -i \"$RUNNER_TEMP/deploy-ssh/id_ed25519\"" \
            infra/prod/ \
            "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}:/opt/xpeditis/infra-prod/"

      - name: Déployer
        id: deploy
        run: |
          SHA="${{ needs.verify-image.outputs.sha }}"
          ssh -o StrictHostKeyChecking=yes -o UserKnownHostsFile="$RUNNER_TEMP/deploy-ssh/known_hosts" -i "$RUNNER_TEMP/deploy-ssh/id_ed25519" \
            "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}" \
            "deploy prod-${SHA}"

      - name: Tests de fumée depuis l'extérieur
        id: smoke
        env:
          PROD_API_URL: ${{ vars.PROD_API_URL }}
          PROD_APP_URL: ${{ vars.PROD_APP_URL }}
        run: bash infra/prod/scripts/smoke-test.sh

      - name: Retour arrière si le déploiement a échoué
        if: failure() && (steps.deploy.conclusion == 'failure' || steps.smoke.conclusion == 'failure')
        run: |
          ssh -o StrictHostKeyChecking=yes -o UserKnownHostsFile="$RUNNER_TEMP/deploy-ssh/known_hosts" -i "$RUNNER_TEMP/deploy-ssh/id_ed25519" \
            "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}" \
            "rollback" || true

      - name: Refermer le firewall
        # `always()` : la fenêtre d'exposition se referme même si le
        # déploiement a échoué, si le job a été annulé ou s'il a expiré.
        if: always()
        env:
          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN_CICD }}
        run: |
          echo '[]' > /tmp/fw-close.json
          hcloud firewall replace-rules "${{ vars.HCLOUD_CICD_FIREWALL }}" --rules-file /tmp/fw-close.json
          echo "Firewall CI refermé."

      - name: Effacer la clé SSH
        if: always()
        run: shred -u "$RUNNER_TEMP/deploy-ssh/id_ed25519" 2>/dev/null || rm -f "$RUNNER_TEMP/deploy-ssh/id_ed25519"

  # ═══ 5. Notifications ════════════════════════════════════════════════════
  notify-success:
    name: Notifier le succès
    runs-on: ubuntu-latest
    needs: [verify-image, deploy]
    if: success()
    steps:
      - run: |
          curl -sf -H "Content-Type: application/json" -d '{
            "embeds": [{
              "title": "Production déployée et saine",
              "color": 3066993,
              "fields": [
                {"name": "Auteur", "value": "${{ github.actor }}", "inline": true},
                {"name": "Version", "value": "`prod-${{ needs.verify-image.outputs.sha }}`", "inline": true},
                {"name": "Cible", "value": "Hetzner k3s — xpeditis-prod", "inline": false},
                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
              ],
              "footer": {"text": "Xpeditis CI/CD - Production"}
            }]
          }' ${{ secrets.DISCORD_WEBHOOK_URL }}

  notify-failure:
    name: Notifier l'échec
    runs-on: ubuntu-latest
    needs: [security, backend-quality, frontend-quality, backend-tests, frontend-tests, verify-image, build-frontend, image-security, deploy]
    if: failure()
    steps:
      - run: |
          curl -sf -H "Content-Type: application/json" -d '{
            "content": "@here ECHEC DU PIPELINE DE PRODUCTION",
            "embeds": [{
              "title": "Pipeline de production en échec",
              "description": "Un retour arrière a été tenté si l échec est survenu pendant le déploiement. Vérifiez l état réel avant toute nouvelle tentative.",
              "color": 15158332,
              "fields": [
                {"name": "Auteur", "value": "${{ github.actor }}", "inline": true},
                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false},
                {"name": "A vérifier", "value": "Le firewall CI est-il bien refermé ? `hcloud firewall describe xpeditis-prod-fw-cicd`", "inline": false}
              ],
              "footer": {"text": "Xpeditis CI/CD - Production"}
            }]
          }' ${{ secrets.DISCORD_WEBHOOK_URL }}