ci.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop, "claude/*" ]
  pull_request:
    branches: [ main, develop ]

env:
  PYTHON_VERSION: "3.11"
  POETRY_VERSION: "1.7.1"

jobs:
  # Job 1: Code Quality Checks
  code-quality:
    name: Code Quality Checks
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
          cache-dependency-path: requirements-dev.txt

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-dev.txt

      - name: Run Black (Code Formatting Check)
        run: black --check app/ tests/

      - name: Run isort (Import Sorting Check)
        run: isort --check-only app/ tests/

      - name: Run Flake8 (Linting)
        run: flake8 app/ tests/ --max-line-length=88 --extend-ignore=E203,W503

      - name: Run MyPy (Type Checking)
        run: mypy app/ --ignore-missing-imports

  # Job 2: Unit Tests
  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-latest
    needs: code-quality

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
          cache-dependency-path: requirements-dev.txt

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-dev.txt

      - name: Run unit tests with coverage
        run: |
          pytest tests/unit/ -v \
            --cov=app \
            --cov-report=xml \
            --cov-report=term-missing \
            --cov-fail-under=70

      - name: Upload coverage reports
        uses: codecov/codecov-action@v4
        if: always()
        with:
          file: ./coverage.xml
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  # Job 3: Integration Tests with Services
  integration-tests:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: unit-tests

    services:
      # Redis service container
      redis:
        image: redis:7.2-alpine
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379

      # Qdrant service container
      qdrant:
        image: qdrant/qdrant:v1.6.1
        options: >-
          --health-cmd "curl -f http://localhost:6333/health || exit 1"
          --health-interval 30s
          --health-timeout 10s
          --health-retries 3
        ports:
          - 6333:6333

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
          cache-dependency-path: requirements-dev.txt

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-dev.txt

      - name: Wait for Redis
        run: |
          for i in {1..10}; do
            if redis-cli -h localhost -p 6379 ping; then
              echo "Redis is ready"
              break
            fi
            echo "Waiting for Redis... attempt $i"
            sleep 2
          done

      - name: Wait for Qdrant
        run: |
          for i in {1..10}; do
            if curl -f http://localhost:6333/health; then
              echo "Qdrant is ready"
              break
            fi
            echo "Waiting for Qdrant... attempt $i"
            sleep 3
          done

      - name: Run integration tests
        env:
          REDIS_HOST: localhost
          REDIS_PORT: 6379
          QDRANT_HOST: localhost
          QDRANT_PORT: 6333
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          pytest tests/integration/ -v -m integration

  # Job 4: Docker Build Test
  docker-build:
    name: Docker Build Test
    runs-on: ubuntu-latest
    needs: code-quality

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build development Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          target: development
          push: false
          tags: ragcache:dev
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build production Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          target: production
          push: false
          tags: ragcache:prod
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # Job 5: Security Scan
  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: code-quality

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
          cache-dependency-path: requirements-dev.txt

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install safety bandit

      - name: Run Safety (Dependency Vulnerability Check)
        run: safety check --json || true
        continue-on-error: true

      - name: Run Bandit (Security Issues)
        run: bandit -r app/ -f json -o bandit-report.json || true
        continue-on-error: true

      - name: Upload Bandit report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: bandit-security-report
          path: bandit-report.json

  # Job 6: Deployment Summary
  deployment-summary:
    name: Deployment Summary
    runs-on: ubuntu-latest
    needs: [unit-tests, integration-tests, docker-build, security-scan]
    if: always()

    steps:
      - name: Check test results
        run: |
          echo "::notice::All CI checks completed successfully!"
          echo "Unit Tests: ${{ needs.unit-tests.result }}"
          echo "Integration Tests: ${{ needs.integration-tests.result }}"
          echo "Docker Build: ${{ needs.docker-build.result }}"
          echo "Security Scan: ${{ needs.security-scan.result }}"

      - name: Deployment ready check
        if: |
          needs.unit-tests.result == 'success' &&
          needs.integration-tests.result == 'success' &&
          needs.docker-build.result == 'success'
        run: |
          echo "::notice::✅ All critical checks passed - Ready for deployment!"
          echo "PR_READY=true" >> $GITHUB_ENV