The Classic CI/CD Pipeline

repos:
  - repo: https://github.com/psf/black
    rev: 24.3.0
    hooks:
      - id: black

  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.4.1
    hooks:
      - id: ruff
        args: [--fix]

  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.6.0
    hooks:
      - id: detect-private-key
      - id: trailing-whitespace
      - id: end-of-file-fixer

  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets

on:
  push:
    branches: [develop]       # every push to develop triggers CI
  pull_request:
    branches: [main, develop]  # every PR targeting either branch

name: CI

on:
  push:
    branches: [develop]
  pull_request:
    branches: [main, develop]

jobs:
  backend:
    name: Python / FastAPI
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_USER: testuser
          POSTGRES_PASSWORD: testpass
          POSTGRES_DB: gls_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      DATABASE_URL: postgresql://testuser:testpass@localhost:5432/gls_test
      ENVIRONMENT: test

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Install dependencies
        run: pip install -r requirements.txt ruff black pytest pytest-asyncio httpx

      - name: Run migrations
        run: alembic upgrade head

      - name: Lint (ruff)
        run: ruff check .

      - name: Format check (black)
        run: black --check .   # --check fails if files need reformatting

      - name: Run tests
        run: pytest tests/ -v

  frontend:
    name: Next.js / TypeScript
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm

      - name: Install dependencies
        working-directory: ./frontend
        run: npm ci   # clean lockfile install — faster, deterministic

      - name: Lint (ESLint)
        working-directory: ./frontend
        run: npm run lint

      - name: Type check
        working-directory: ./frontend
        run: npx tsc --noEmit

      - name: Build check
        working-directory: ./frontend
        run: npm run build
        env:
          NEXT_PUBLIC_API_URL: http://localhost:8000

jobs:
  build-and-push:
    name: Build + push images
    runs-on: ubuntu-latest

    outputs:
      sha: ${{ steps.tag.outputs.SHA }}

    steps:
      - uses: actions/checkout@v4

      - id: auth
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      - name: Configure Docker for Artifact Registry
        run: gcloud auth configure-docker asia-east1-docker.pkg.dev --quiet

      - name: Set image tag
        id: tag
        run: echo "SHA=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Build backend image
        run: |
          docker build \
            -t asia-east1-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/images/backend:${{ steps.tag.outputs.SHA }} \
            ./backend

      - name: Push backend image
        run: |
          docker push \
            asia-east1-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/images/backend:${{ steps.tag.outputs.SHA }}

      - name: Build frontend image
        run: |
          docker build \
            -t asia-east1-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/images/frontend:${{ steps.tag.outputs.SHA }} \
            ./frontend \
            --build-arg NEXT_PUBLIC_API_URL=${{ secrets.STAGING_API_URL }}

      - name: Push frontend image
        run: |
          docker push \
            asia-east1-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/images/frontend:${{ steps.tag.outputs.SHA }}

# Create the repository
gcloud artifacts repositories create images \
  --repository-format=docker \
  --location=asia-east1 \
  --description="GLS_CH_Hub container images"

# Enable vulnerability scanning
gcloud services enable containerscanning.googleapis.com

# Set retention policy — keep last 10 images per service
gcloud artifacts repositories set-cleanup-policies images \
  --location=asia-east1 \
  --policy='[{"name":"keep-last-10","action":{"type":"Keep"},"condition":{"tagState":"tagged","mostRecentVersions":{"keepCount":10}}}]'

  deploy-staging:
    name: Deploy to staging
    needs: build-and-push
    runs-on: ubuntu-latest

    steps:
      - id: auth
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      - name: Deploy backend to staging
        run: |
          gcloud run deploy gls-backend-staging \
            --image asia-east1-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/images/backend:${{ needs.build-and-push.outputs.sha }} \
            --region asia-east1 \
            --platform managed \
            --set-secrets DATABASE_URL=staging-db-url:latest,STRIPE_SECRET_KEY=stripe-key-staging:latest \
            --set-env-vars ENVIRONMENT=staging \
            --allow-unauthenticated

      - name: Smoke test staging
        run: |
          sleep 10
          curl --fail https://gls-backend-staging-xxxx.run.app/health
          curl --fail https://gls-frontend-staging-xxxx.run.app/

  deploy-production:
    name: Deploy to production
    needs: deploy-staging
    runs-on: ubuntu-latest
    environment: production   # requires manual approval in GitHub

    steps:
      - id: auth
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      # Deploy new revision with NO traffic yet
      - name: Deploy to prod (no traffic)
        run: |
          gcloud run deploy gls-backend-prod \
            --image asia-east1-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/images/backend:${{ needs.build-and-push.outputs.sha }} \
            --region asia-east1 \
            --no-traffic \
            --tag canary \
            --set-secrets DATABASE_URL=prod-db-url:latest,STRIPE_SECRET_KEY=stripe-key-prod:latest,PINECONE_API_KEY=pinecone-key:latest \
            --set-env-vars ENVIRONMENT=production

      # Send 10% to new revision — canary phase
      - name: Canary — 10% traffic
        run: |
          gcloud run services update-traffic gls-backend-prod \
            --region asia-east1 \
            --to-tags canary=10

      - name: Monitor canary (60s)
        run: sleep 60

      # Promote fully
      - name: Promote to 100%
        run: |
          gcloud run services update-traffic gls-backend-prod \
            --region asia-east1 \
            --to-tags canary=100

# Point 100% of traffic back to any previous revision immediately
gcloud run services update-traffic gls-backend-prod \
  --region asia-east1 \
  --to-revisions=PREVIOUS-REVISION-NAME=100

@app.get("/health")
def health():
    # Simple, fast, no auth, no DB call
    # curl --fail will exit non-zero if this returns anything other than 200
    return {"status": "ok", "env": settings.ENVIRONMENT}