ci.yml

name: QueryGrade CI/CD

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

env:
  PYTHON_VERSION: '3.11'
  NODE_VERSION: '18'

jobs:
  test:
    name: Test Suite
    runs-on: ubuntu-latest

    services:
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

      postgres:
        image: postgres:15-alpine
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: querygrade_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
        lfs: true

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        cache: 'pip'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install coverage pytest-django pytest-cov

    - name: Check code formatting
      run: |
        pip install black isort flake8
        black --check .
        isort --check-only .
        flake8 .

    - name: Run security checks
      run: |
        pip install bandit safety
        bandit -r analyzer/ querygrade/
        safety check

    - name: Run Django system checks
      env:
        DJANGO_SETTINGS_MODULE: querygrade.settings
        DB_ENGINE: django.db.backends.postgresql
        DB_NAME: querygrade_test
        DB_USER: postgres
        DB_PASSWORD: postgres
        DB_HOST: localhost
        DB_PORT: 5432
        REDIS_URL: redis://localhost:6379/1
        SECRET_KEY: test-secret-key-for-ci
      run: |
        python manage.py check --deploy

    - name: Run migrations
      env:
        DJANGO_SETTINGS_MODULE: querygrade.settings
        DB_ENGINE: django.db.backends.postgresql
        DB_NAME: querygrade_test
        DB_USER: postgres
        DB_PASSWORD: postgres
        DB_HOST: localhost
        DB_PORT: 5432
        REDIS_URL: redis://localhost:6379/1
        SECRET_KEY: test-secret-key-for-ci
      run: |
        python manage.py migrate

    - name: Run tests with coverage
      env:
        DJANGO_SETTINGS_MODULE: querygrade.settings
        DB_ENGINE: django.db.backends.postgresql
        DB_NAME: querygrade_test
        DB_USER: postgres
        DB_PASSWORD: postgres
        DB_HOST: localhost
        DB_PORT: 5432
        REDIS_URL: redis://localhost:6379/1
        SECRET_KEY: test-secret-key-for-ci
      run: |
        coverage run --source='.' manage.py test
        coverage xml

    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v3
      with:
        file: ./coverage.xml
        flags: unittests
        name: codecov-umbrella

  docker:
    name: Docker Build
    runs-on: ubuntu-latest
    needs: test

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Build Docker image
      uses: docker/build-push-action@v5
      with:
        context: .
        push: false
        tags: querygrade:test
        cache-from: type=gha
        cache-to: type=gha,mode=max

  security:
    name: Security Scan
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        output: 'trivy-results.sarif'

    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v2
      if: always()
      with:
        sarif_file: 'trivy-results.sarif'