ci-cd.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

env:
  TERRAFORM_VERSION: 1.5.0
  ANSIBLE_VERSION: 2.15.0

jobs:
  lint-and-validate:
    name: Lint and Validate
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.11'

    - name: Install dependencies
      run: |
        pip install ansible==${{ env.ANSIBLE_VERSION }} ansible-lint yamllint
        
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        terraform_version: ${{ env.TERRAFORM_VERSION }}

    - name: Terraform Format Check
      run: |
        cd terraform
        terraform fmt -check -recursive

    - name: Terraform Validate
      run: |
        cd terraform
        terraform init -backend=false
        terraform validate

    - name: Ansible Lint
      run: |
        cd ansible
        ansible-lint playbooks/

    - name: YAML Lint
      run: |
        yamllint kubernetes/manifests/
        yamllint ansible/

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Run Checkov
      uses: bridgecrewio/checkov-action@master
      with:
        directory: .
        framework: terraform,kubernetes,dockerfile

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        output: 'trivy-results.sarif'

    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v2
      if: always()
      with:
        sarif_file: 'trivy-results.sarif'

  terraform-plan:
    name: Terraform Plan
    runs-on: ubuntu-latest
    needs: lint-and-validate
    if: github.event_name == 'pull_request'
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        terraform_version: ${{ env.TERRAFORM_VERSION }}

    - name: Terraform Init
      run: |
        cd terraform
        terraform init

    - name: Terraform Plan
      run: |
        cd terraform
        terraform plan -out=tfplan

  deploy-staging:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    needs: [lint-and-validate, security-scan]
    if: github.ref == 'refs/heads/develop'
    environment: staging
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Deploy to staging
      run: |
        echo "Deploying to staging environment"
        # Add your deployment commands here

  deploy-production:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: [lint-and-validate, security-scan]
    if: github.ref == 'refs/heads/main'
    environment: production
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Deploy to production
      run: |
        echo "Deploying to production environment"
        # Add your deployment commands here