devsecops-fastapi-admin-aks.yml

name: "DevSecOps — FastAPI ADMIN — Azure AKS"

on:
  push:
    branches: [master, main]
    paths:
      - "dockerized/ADMIN_FASTAPI/**"
      - "azure/aks/deploy/manifest/fastapi-admin/**"
  pull_request:
    branches: [master, main]
    paths:
      - "dockerized/ADMIN_FASTAPI/**"
  workflow_dispatch:

env:
  AZURE_RESOURCE_GROUP: fastapi-rg
  AKS_CLUSTER:          fastapi-aks-cluster
  ACR_NAME:             fastapiregistry
  APP_NAME:             fastapi-admin-app
  AKS_NAMESPACE:        fastapi-admin-namespace
  APP_PORT:             "30443"
  IMAGE_TAG:            ${{ github.sha }}
  PYTHON_VERSION:       "3.11"

permissions:
  contents: read
  security-events: write
  id-token: write

jobs:
# ════════════════════════════════════════════════════════════════════════════
# 1. SECRET SCAN
# ════════════════════════════════════════════════════════════════════════════
  secret-scan:
    name: "🔍 Secret Scan"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - name: TruffleHog scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          extra_args: --only-verified

      - name: GitLeaks scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# ════════════════════════════════════════════════════════════════════════════
# 2. SAST
# ════════════════════════════════════════════════════════════════════════════
  sast:
    name: "🔬 SAST (Bandit + Semgrep)"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - run: pip install bandit semgrep

      - name: Bandit SAST
        run: |
          bandit -r dockerized/ADMIN_FASTAPI/ \
            --configfile dockerized/ADMIN_FASTAPI/.bandit \
            --format sarif --output bandit-results.sarif \
            --severity-level medium || true

      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: bandit-results.sarif, category: bandit }

      - name: Semgrep OWASP scan
        run: |
          semgrep \
            --config p/owasp-top-ten --config p/python --config p/jwt --config p/secrets \
            --config dockerized/ADMIN_FASTAPI/.semgrep.yml \
            dockerized/ADMIN_FASTAPI/ \
            --sarif --output semgrep-results.sarif || true

      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: semgrep-results.sarif, category: semgrep }

# ════════════════════════════════════════════════════════════════════════════
# 3. SCA
# ════════════════════════════════════════════════════════════════════════════
  sca:
    name: "📦 SCA (pip-audit + Trivy FS)"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - run: pip install pip-audit

      - name: pip-audit
        run: |
          pip-audit -r dockerized/ADMIN_FASTAPI/requirements.txt \
            --format sarif --output pip-audit-results.sarif || true
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: pip-audit-results.sarif, category: pip-audit }

      - name: Trivy FS scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          scan-ref: dockerized/ADMIN_FASTAPI/
          format: sarif
          output: trivy-fs-results.sarif
          severity: CRITICAL,HIGH
          exit-code: "0"
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: trivy-fs-results.sarif, category: trivy-fs }

# ════════════════════════════════════════════════════════════════════════════
# 4. BUILD & PUSH — Azure Container Registry
# ════════════════════════════════════════════════════════════════════════════
  build:
    name: "🐳 Build & Push to ACR"
    runs-on: ubuntu-latest
    needs: [secret-scan, sast, sca]
    outputs:
      image: ${{ steps.build-image.outputs.image }}
    steps:
      - uses: actions/checkout@v4

      - name: Azure Login (OIDC)
        uses: azure/login@v2
        with:
          client-id:       ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id:       ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Login to ACR
        run: az acr login --name ${{ env.ACR_NAME }}

      - name: Build and push
        id: build-image
        working-directory: dockerized/ADMIN_FASTAPI
        run: |
          IMAGE="${ACR_NAME}.azurecr.io/${APP_NAME}:${IMAGE_TAG}"
          docker build -t "$IMAGE" .
          docker push "$IMAGE"
          echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"

# ════════════════════════════════════════════════════════════════════════════
# 5. CONTAINER SCAN
# ════════════════════════════════════════════════════════════════════════════
  container-scan:
    name: "🔎 Container Scan (Trivy)"
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Trivy image scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ needs.build.outputs.image }}
          format: sarif
          output: trivy-image-results.sarif
          severity: CRITICAL,HIGH
          exit-code: "0"
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: trivy-image-results.sarif, category: trivy-image }

# ════════════════════════════════════════════════════════════════════════════
# 6. IaC SCAN (Checkov)
# ════════════════════════════════════════════════════════════════════════════
  iac-scan:
    name: "🏗️ IaC Scan (Checkov)"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Checkov — Terraform
        uses: bridgecrewio/checkov-action@master
        with:
          directory: azure/aks/deploy/terraform-fastapi
          framework: terraform
          soft_fail: true

      - name: Checkov — K8s manifests
        uses: bridgecrewio/checkov-action@master
        with:
          directory: azure/aks/deploy/manifest/fastapi-admin
          framework: kubernetes
          soft_fail: true

# ════════════════════════════════════════════════════════════════════════════
# 7. DEPLOY — AKS
# ════════════════════════════════════════════════════════════════════════════
  deploy:
    name: "🚀 Deploy to AKS"
    runs-on: ubuntu-latest
    needs: [build, container-scan, iac-scan]
    environment: staging
    steps:
      - uses: actions/checkout@v4

      - name: Azure Login
        uses: azure/login@v2
        with:
          client-id:       ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id:       ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Get AKS credentials
        uses: azure/aks-set-context@v3
        with:
          resource-group: ${{ env.AZURE_RESOURCE_GROUP }}
          cluster-name:   ${{ env.AKS_CLUSTER }}

      - name: Apply K8s manifests
        env:
          FASTAPI_IMAGE: ${{ needs.build.outputs.image }}
        run: |
          export FASTAPI_IMAGE AKS_NAMESPACE APP_NAME APP_PORT
          for manifest in \
            azure/aks/deploy/manifest/fastapi-admin/namespace.yaml \
            azure/aks/deploy/manifest/fastapi-admin/secret.yaml \
            azure/aks/deploy/manifest/fastapi-admin/configmap.yaml \
            azure/aks/deploy/manifest/fastapi-admin/deployment.yaml \
            azure/aks/deploy/manifest/fastapi-admin/service.yaml \
            azure/aks/deploy/manifest/fastapi-admin/hpa.yaml; do
            envsubst < "$manifest" | kubectl apply -f -
          done
          kubectl rollout status deployment/${APP_NAME} -n ${AKS_NAMESPACE} --timeout=5m

# ════════════════════════════════════════════════════════════════════════════
# 8. DAST
# ════════════════════════════════════════════════════════════════════════════
  dast:
    name: "⚡ DAST (OWASP ZAP)"
    runs-on: ubuntu-latest
    needs: deploy
    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
    steps:
      - uses: actions/checkout@v4

      - name: Get service IP
        id: svc
        run: |
          IP=$(kubectl get svc ${APP_NAME} -n ${AKS_NAMESPACE} \
            -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
          echo "url=https://${IP}:${APP_PORT}" >> "$GITHUB_OUTPUT"

      - name: OWASP ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          target: ${{ steps.svc.outputs.url }}
          rules_file_name: "dockerized/ADMIN_FASTAPI/.zap/rules.tsv"
          fail_action: false

      - uses: actions/upload-artifact@v4
        with: { name: zap-report-admin-aks, path: report_html.html }

# ════════════════════════════════════════════════════════════════════════════
# 9. NOTIFY
# ════════════════════════════════════════════════════════════════════════════
  notify:
    name: "📣 Notify Slack"
    runs-on: ubuntu-latest
    needs: [deploy, dast]
    if: always()
    steps:
      - uses: slackapi/slack-github-action@v1.27.0
        with:
          payload: |
            {
              "text": "*FastAPI ADMIN App — AKS Deploy: ${{ needs.deploy.result }}*",
              "attachments": [{"color": "${{ needs.deploy.result == 'success' && 'good' || 'danger' }}",
                "fields": [
                  {"title": "DAST",   "value": "${{ needs.dast.result }}", "short": true},
                  {"title": "Branch", "value": "${{ github.ref_name }}",   "short": true}
                ]}]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK