python-ci.yml

name: Python CI/CD Pipeline

on:
  push:
    branches: [ main, master, lab03 ]
    paths:
      - 'app_python/**'
      - '.github/workflows/python-ci.yml'
  pull_request:
    branches: [ main, master ]
    paths:
      - 'app_python/**'
      - '.github/workflows/python-ci.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  PYTHON_VERSION: '3.11'
  DOCKER_IMAGE: netimaaaa/devops-info-service

jobs:
  test:
    name: Test & Lint
    runs-on: ubuntu-latest
    
    strategy:
      matrix:
        python-version: ['3.11', '3.12']
      fail-fast: true
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'
          cache-dependency-path: 'app_python/requirements.txt'
      
      - name: Install dependencies
        run: |
          cd app_python
          python -m pip install --upgrade pip
          pip install -r requirements.txt
      
      - name: Lint with pylint
        run: |
          cd app_python
          pylint app.py --disable=C0114,C0116,R0903,W0718 || true
      
      - name: Format check with black
        run: |
          cd app_python
          black --check app.py tests/ || true
      
      - name: Run tests with pytest
        run: |
          cd app_python
          pytest tests/ -v --tb=short
      
      - name: Run tests with coverage
        run: |
          cd app_python
          pytest tests/ --cov=. --cov-report=xml --cov-report=term
      
      - name: Upload coverage to Codecov
        if: matrix.python-version == '3.11'
        uses: codecov/codecov-action@v4
        with:
          file: ./app_python/coverage.xml
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      
      - name: Install dependencies
        run: |
          cd app_python
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install safety bandit
      
      - name: Run safety check
        run: |
          cd app_python
          safety check --json || true
      
      - name: Run bandit security scan
        run: |
          cd app_python
          bandit -r . -f json || true

  docker:
    name: Build & Push Docker Image
    runs-on: ubuntu-latest
    needs: [test, security]
    if: github.event_name == 'push' && github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/lab03'
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      
      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}
      
      - name: Generate version tags
        id: meta
        run: |
          # Calendar versioning: YYYY.MM.BUILD_NUMBER
          VERSION=$(date +'%Y.%m').${{ github.run_number }}
          MONTH_VERSION=$(date +'%Y.%m')
          
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "month_version=${MONTH_VERSION}" >> $GITHUB_OUTPUT
          
          # Generate tags
          TAGS="${{ env.DOCKER_IMAGE }}:${VERSION}"
          TAGS="${TAGS},${{ env.DOCKER_IMAGE }}:${MONTH_VERSION}"
          TAGS="${TAGS},${{ env.DOCKER_IMAGE }}:latest"
          
          echo "tags=${TAGS}" >> $GITHUB_OUTPUT
          
          echo "Generated version: ${VERSION}"
          echo "Generated tags: ${TAGS}"
      
      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: ./app_python
          file: ./app_python/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=registry,ref=${{ env.DOCKER_IMAGE }}:buildcache
          cache-to: type=registry,ref=${{ env.DOCKER_IMAGE }}:buildcache,mode=max
          labels: |
            org.opencontainers.image.title=DevOps Info Service
            org.opencontainers.image.description=DevOps course info service
            org.opencontainers.image.version=${{ steps.meta.outputs.version }}
            org.opencontainers.image.created=${{ github.event.head_commit.timestamp }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.source=${{ github.repositoryUrl }}
      
      - name: Image digest
        run: echo "Image pushed with tags ${{ steps.meta.outputs.tags }}"