ci.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  test:
    runs-on: ubuntu-latest
    
    services:
      mlflow:
        image: python:3.11-slim
        ports:
          - 5000:5000
        options: >-
          --health-cmd "curl -f http://localhost:5000/health || exit 1"
          --health-interval 30s
          --health-timeout 10s
          --health-retries 5
    
    strategy:
      matrix:
        python-version: [3.9, 3.10, 3.11]
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python-version }}
    
    - name: Cache pip packages
      uses: actions/cache@v4
      with:
        path: ~/.cache/pip
        key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements-enhanced.txt') }}
        restore-keys: |
          ${{ runner.os }}-pip-
    
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements-enhanced.txt
    
    lint:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: 3.11
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements-enhanced.txt
    - name: Lint with flake8
      run: |
        flake8 src/ --count --select=E9,F63,F7,F82 --show-source --statistics
        flake8 src/ --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics

  type-check:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: 3.11
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements-enhanced.txt
    - name: Type check with mypy
      run: |
        mypy src/ --ignore-missing-imports

  format-check:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: 3.11
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements-enhanced.txt
    - name: Format check with black
      run: |
        black --check src/
    
    test:
    needs: [lint, type-check, format-check]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: [3.9, 3.10, 3.11]
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python-version }}
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements-enhanced.txt
    - name: Run tests
      run: |
        pytest tests/ -v --cov=src --cov-report=xml
    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v4
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        files: ./coverage.xml
        fail_ci_if_error: true
    - name: Test Summary
      run: |
        echo "### Test Summary" >> $GITHUB_STEP_SUMMARY
        echo "- Python version: ${{ matrix.python-version }}" >> $GITHUB_STEP_SUMMARY
        echo "- Test results: passed" >> $GITHUB_STEP_SUMMARY
        
    - name: Run integration tests
      run: |
        pytest tests/integration/ -v
      env:
        MLFLOW_TRACKING_URI: http://localhost:5000
        JWT_SECRET_KEY: test-secret-key
    
    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v4
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        files: ./coverage.xml
        fail_ci_if_error: true

  security:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: 3.11
    - name: Install security scanning tools
      run: |
        pip install bandit safety
    - name: Run Bandit security scan
      run: |
        bandit -r src/ -f json -o bandit-report.json
    - name: Run Safety vulnerability check
      run: |
        safety check --json --output safety-report.json
    - name: Upload security reports
      uses: actions/upload-artifact@v4
      with:
        name: security-reports
        path: |
          bandit-report.json
          safety-report.json

  build-and-push:
    needs: [test, security]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    
    - name: Login to Container Registry
      uses: docker/login-action@v3
      with:
        registry: ${{ secrets.REGISTRY_URL }}
        username: ${{ secrets.REGISTRY_USERNAME }}
        password: ${{ secrets.REGISTRY_PASSWORD }}
    
    - name: Build and push API image
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ./docker/Dockerfile.api
        push: true
        tags: |
          ${{ secrets.REGISTRY_URL }}/credit-gam-api:latest
          ${{ secrets.REGISTRY_URL }}/credit-gam-api:${{ github.sha }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
    
    - name: Build and push Dashboard image
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ./docker/Dockerfile.dash
        push: true
        tags: |
          ${{ secrets.REGISTRY_URL }}/credit-gam-dash:latest
          ${{ secrets.REGISTRY_URL }}/credit-gam-dash:${{ github.sha }}
        cache-from: type=gha
        cache-to: type=gha,mode=max

  deploy-staging:
    needs: build-and-push
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    environment: staging
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Deploy to staging
      run: |
        echo "Deploying to staging environment..."
        # Add deployment script here
        # kubectl apply -f k8s/staging/
        # Or use Helm, ArgoCD, etc.

  model-validation:
    needs: deploy-staging
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: 3.11
    
    - name: Install dependencies
      run: |
        pip install -r requirements-enhanced.txt
    
    - name: Run model validation tests
      run: |
        python scripts/validate_model_performance.py
      env:
        MLFLOW_TRACKING_URI: ${{ secrets.STAGING_MLFLOW_URI }}
        MODEL_URI: ${{ secrets.STAGING_MODEL_URI }}

  deploy-production:
    needs: model-validation
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    environment: production
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Deploy to production
      run: |
        echo "Deploying to production environment..."
        # Add production deployment script here
        # kubectl apply -f k8s/production/