ci.yaml

name: CI/CD

on:
  push:
    branches:
      - prod
      - main
      - dev

  pull_request:
    branches:
      - '**'

jobs:
  test:
    name: Run tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run tests, first attempt
        id: first_run
        continue-on-error: true
        run: npm test -- --coverage --json --outputFile=test-results.json

      - name: Identify failed test suites
        if: steps.first_run.outcome == 'failure'
        id: failed_tests
        run: |
          if [ ! -f test-results.json ]; then
            echo "No test results file found, treating as full failure"
            exit 1
          fi
          FAILED_SUITES=$(node -e "
            const results = require('./test-results.json');
            const failed = results.testResults
              .filter(suite => suite.status === 'failed')
              .map(suite => suite.name)
              .join('\n');
            console.log(failed);
          ")
          if [ -z "$FAILED_SUITES" ]; then
            echo "No failed suites identified despite failure exit code"
            exit 1
          fi
          echo "Failed test suites:"
          echo "$FAILED_SUITES"
          echo "$FAILED_SUITES" > failed-suites.txt
      - name: Re-run failed test suites individually
        if: steps.first_run.outcome == 'failure'
        run: |
          OVERALL_EXIT=0
          while IFS= read -r suite; do
            if [ -n "$suite" ]; then
              echo ""
              echo "=== Re-running: $suite ==="
              if ! npx jest "$suite"; then
                echo "Still failing: $suite"
                OVERALL_EXIT=1
              else
                echo "Passed on retry: $suite"
              fi
            fi
          done < failed-suites.txt
          exit $OVERALL_EXIT

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          url: ${{ secrets.CODECOV_URL }}
          slug: Alt-Org/Altzone-Server
          files: ./coverage/coverage-final.json

  build-and-push:
    name: Build and Push Docker Image
    needs: test
    if: github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'prod'
    runs-on: [self-hosted, gh-runner-common]
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push image
        uses: docker/build-push-action@v7
        env:
          DOCKER_BUILD_RECORD_UPLOAD: false
        with:
          context: .
          push: true
          load: true
          tags: |
            ${{ secrets.DOCKERHUB_USERNAME }}/${{ secrets.DOCKERHUB_REPO }}:${{ github.ref_name }}-${{ github.run_number }}
            ${{ secrets.DOCKERHUB_USERNAME }}/${{ secrets.DOCKERHUB_REPO }}:${{ github.ref_name }}-latest

      - name: Scan image for vulnerabilities
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          image-ref: ${{ secrets.DOCKERHUB_USERNAME }}/${{ secrets.DOCKERHUB_REPO }}:${{ github.ref_name }}-${{ github.run_number }}
          format: json
          ignore-unfixed: true
          exit-code: '0'
          output: trivy-results.json

      - name: Upload vulnerabilities to summary tab
        if: always()
        run: |
          {
            echo "## Vulnerability scan results"
            echo ""
            echo "| Target | Package | CVE | Severity | Installed | Fixed |"
            echo "|---|---|---|---|---|---|"
            jq -r '
              .Results[]?
              | select(.Vulnerabilities != null)
              | .Target as $t
              | .Vulnerabilities[]
              | "| \($t) | \(.PkgName) | \(.VulnerabilityID) | \(.Severity) | \(.InstalledVersion) | \(.FixedVersion // "-") |"
            ' trivy-results.json
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Convert scan results to SARIF format
        if: always()
        run: trivy convert --format sarif --output trivy-results.sarif trivy-results.json

      - name: Upload vulnerabilities to Security tab
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: trivy-results.sarif

  notify:
    name: Notify server about new image build
    needs: build-and-push
    if: github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'prod'
    runs-on: [self-hosted, gh-runner-common]
    steps:
      - name: Notify server
        env:
          WEBHOOK_SECRET: ${{ secrets.SERVER_WEBHOOK_NOTIFY_SECRET }}
          WEBHOOK_URL: ${{ secrets.SERVER_WEBHOOK_NOTIFY_URL }}
          PAYLOAD: '{"name": "api", "tag": "${{ github.ref_name }}"}'
        run: |
          SIGNATURE=$(echo "$PAYLOAD" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | sed 's/^.* //')
          
          curl -s -o /dev/null -X POST "$WEBHOOK_URL" \
            -H "Content-Type: application/json" \
            -H "X-Hub-Signature: sha256=$SIGNATURE" \
            -d "$PAYLOAD" \
            --insecure