test.yaml

name: CI - CD
on: [push]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-buildx-action@v4
      - uses: docker/build-push-action@v7
        with:
          context: .
          tags: data_pass:latest
          outputs: type=docker,dest=/tmp/data_pass.tar
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: false
          sbom: false
      - name: Cache image and ENV file
        id: data_pass-docker
        uses: actions/cache@v5
        with:
          path: |
            /tmp/data_pass.tar
            ./.github/workflows/test.env
          key: v1-${{ hashFiles('Gemfile.lock') }}-${{ hashFiles('Dockerfile') }}

  security:
    name: "Security: Brakeman"
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-buildx-action@v4
      - uses: actions/cache@v5
        with:
          path: |
            /tmp/data_pass.tar
            ./.github/workflows/test.env
          key: v1-${{ hashFiles('Gemfile.lock') }}-${{ hashFiles('Dockerfile') }}
      - run: docker load --input /tmp/data_pass.tar
      - run: docker run --rm --entrypoint="" -v ${{ github.workspace }}:/app data_pass:latest bundle exec brakeman

  rb-lint:
    name: "Linting: Rubocop"
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-buildx-action@v4
      - uses: actions/cache@v5
        with:
          path: |
            /tmp/data_pass.tar
            ./.github/workflows/test.env
          key: v1-${{ hashFiles('Gemfile.lock') }}-${{ hashFiles('Dockerfile') }}
      - run: docker load --input /tmp/data_pass.tar
      - run: docker run --rm --entrypoint="" -v ${{ github.workspace }}:/app data_pass:latest bundle exec rubocop

  js-lint:
    name: "Linting: Standardjs"
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-buildx-action@v4
      - uses: actions/cache@v5
        with:
          path: |
            /tmp/data_pass.tar
            ./.github/workflows/test.env
          key: v1-${{ hashFiles('Gemfile.lock') }}-${{ hashFiles('Dockerfile') }}
      - run: docker load --input /tmp/data_pass.tar
      - run: docker run --rm --entrypoint="" -v ${{ github.workspace }}:/app data_pass:latest standard app/javascript

  yaml-lint:
    name: "Linting: YAML through prettier"
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-buildx-action@v4
      - uses: actions/cache@v5
        with:
          path: |
            /tmp/data_pass.tar
            ./.github/workflows/test.env
          key: v1-${{ hashFiles('Gemfile.lock') }}-${{ hashFiles('Dockerfile') }}
      - run: docker load --input /tmp/data_pass.tar
      - run: docker run --rm --entrypoint="" -v ${{ github.workspace }}:/app data_pass:latest ./bin/lint-yaml

  unit-tests:
    name: "Unit tests: RSpec (${{ matrix.group }}/4)"
    runs-on: ubuntu-latest
    needs: build
    strategy:
      matrix:
        group: [1, 2, 3, 4]
    services:
      postgres:
        image: postgres:16
        ports: ["5432:5432"]
        env:
          POSTGRES_PASSWORD: dummy
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      chrome:
        image: ghcr.io/browserless/chromium
        ports:
          - "3333:3333"
        env:
          PORT: 3333
          CONNECTION_TIMEOUT: 600000
      redis:
        image: redis:7
        ports:
          - "6379:6379"
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-buildx-action@v4
      - uses: actions/cache@v5
        with:
          path: |
            /tmp/data_pass.tar
            ./.github/workflows/test.env
          key: v1-${{ hashFiles('Gemfile.lock') }}-${{ hashFiles('Dockerfile') }}
      - run: docker load --input /tmp/data_pass.tar
      - run: |
          docker run \
            --network="host" \
            --env-file ./.github/workflows/test.env \
            -v ${{ github.workspace }}:/app \
            --rm data_pass bundle exec parallel_rspec \
            -n 4 --only-group ${{ matrix.group }} spec/

  integration-tests:
    name: "Integration tests (${{ matrix.group }}/6)"
    runs-on: ubuntu-latest
    needs: build
    strategy:
      matrix:
        group: [1, 2, 3, 4, 5, 6]
    services:
      postgres:
        image: postgres:16
        ports: ["5432:5432"]
        env:
          POSTGRES_PASSWORD: dummy
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7
        ports:
          - "6379:6379"
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-buildx-action@v4
      - uses: actions/cache@v5
        with:
          path: |
            /tmp/data_pass.tar
            ./.github/workflows/test.env
          key: v1-${{ hashFiles('Gemfile.lock') }}-${{ hashFiles('Dockerfile') }}
      - run: docker load --input /tmp/data_pass.tar
      - name: Start Chrome
        run: |
          docker run -d \
            --name chrome \
            --network="host" \
            -v ${{ github.workspace }}:/app \
            -e PORT=3333 \
            -e CONNECTION_TIMEOUT=600000 \
            ghcr.io/browserless/chromium
          timeout 30 bash -c 'until curl -sf http://localhost:3333/json/version > /dev/null; do sleep 1; done'
      - run: |
          docker run \
            --network="host" \
            --env-file ./.github/workflows/test.env \
            -v ${{ github.workspace }}:/app \
            --rm data_pass bundle exec parallel_cucumber \
            -n 6 --only-group ${{ matrix.group }} \
            -o '--format progress' features/
      - name: Stop Chrome
        if: always()
        run: docker stop chrome || true

  merge-with-main:
    name: "Merge develop with main"
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/develop'
    needs:
      - security
      - rb-lint
      - js-lint
      - yaml-lint
      - unit-tests
      - integration-tests
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Import GPG key to sign main push
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@v7
        with:
          gpg_private_key: ${{ secrets.GPG_SECRET_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}
          git_user_signingkey: true
          git_commit_gpgsign: true

      - name: Force push develop to main
        run: |
          git reset --hard && \
            git push --force origin develop:main && \
            git fetch && \
            [[ ! -s \"$(git rev-parse --git-dir)/shallow\" ]] || git fetch --unshallow
          exit 0

  continuous-deployment-staging:
    name: "Continuous deployment on staging"
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/develop'
    needs:
      - security
      - rb-lint
      - js-lint
      - yaml-lint
      - unit-tests
      - integration-tests
      - merge-with-main
    timeout-minutes: 10
    strategy:
      matrix:
        host: [watchdoge3, watchdoge4]
      fail-fast: false
    environment: sandbox
    env:
      DEPLOY_HTTPS_LOGIN: ${{ secrets.DEPLOY_HTTPS_LOGIN }}
      DEPLOY_HTTPS_PASSWORD: ${{ secrets.DEPLOY_HTTPS_PASSWORD }}
      DEPLOY_HTTPS_REQUEST_URL: ${{ vars.DEPLOY_HTTPS_REQUEST_URL }}
      DEPLOY_HTTPS_RESPONSE_URL: ${{ vars.DEPLOY_HTTPS_RESPONSE_URL }}
      DEPLOY_HOST: host_${{ matrix.host }}
      DEPLOY_APP: datapass_reborn_staging
      DEPLOY_BRANCH: ${{ github.ref_name }}
    steps:
      - name: Download and run deploy script
        shell: bash
        run: |
          git clone https://github.com/etalab/api-entreprise-integration
          cd api-entreprise-integration
          ./deploy-parteprise.sh

  continuous-deployment-production:
    name: "Continuous deployment on production"
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/develop'
    needs:
      - security
      - rb-lint
      - js-lint
      - yaml-lint
      - unit-tests
      - integration-tests
      - merge-with-main
      - continuous-deployment-staging
    timeout-minutes: 20
    strategy:
      matrix:
        host: [watchdoge3, watchdoge4]
      fail-fast: false
    environment: production
    env:
      DEPLOY_HTTPS_LOGIN: ${{ secrets.DEPLOY_HTTPS_LOGIN }}
      DEPLOY_HTTPS_PASSWORD: ${{ secrets.DEPLOY_HTTPS_PASSWORD }}
      DEPLOY_HTTPS_REQUEST_URL: ${{ vars.DEPLOY_HTTPS_REQUEST_URL }}
      DEPLOY_HTTPS_RESPONSE_URL: ${{ vars.DEPLOY_HTTPS_RESPONSE_URL }}
      DEPLOY_HOST: host_${{ matrix.host }}
      DEPLOY_APP: datapass_reborn_production
    steps:
      - name: Download and run deploy script
        shell: bash
        run: |
          git clone https://github.com/etalab/api-entreprise-integration
          cd api-entreprise-integration
          ./deploy-parteprise.sh