# .gitlab-ci.yml — Denomas standart pipeline
image: python:3.10-slim

variables:
  # Genel
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
  PRE_COMMIT_HOME: "$CI_PROJECT_DIR/.cache/pre-commit"
  # Docker
  DOCKER_IMAGE: "$CI_REGISTRY_IMAGE"
  DOCKER_TAG: "$CI_COMMIT_SHORT_SHA"
  # Deployment
  ANSIBLE_INVENTORY: "inventory/$CI_ENVIRONMENT_NAME"
  ANSIBLE_FORCE_COLOR: "true"
  # SAST
  SAST_EXCLUDED_PATHS: "tests/,migrations/,docs/"
  SECURE_LOG_LEVEL: "warn"

cache:
  key: ${CI_COMMIT_REF_SLUG}
  paths:
    - .cache/pip
    - .cache/pre-commit
    - .venv/

stages:
  - lint
  - test
  - build
  - scan
  - deploy-staging
  - deploy-prod

# ─── LINT ─────────────────────────────────────────────
lint:pre-commit:
  stage: lint
  script:
    - pip install pre-commit
    - pre-commit run --all-files
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "develop"'

lint:mypy:
  stage: lint
  script:
    - pip install -r requirements-dev.txt
    - mypy src/ --ignore-missing-imports
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  allow_failure: false

# ─── TEST ─────────────────────────────────────────────
test:unit:
  stage: test
  services:
    - postgres:15-alpine
    - redis:7-alpine
  variables:
    POSTGRES_DB: test_db
    POSTGRES_USER: test_user
    POSTGRES_PASSWORD: $CI_DB_PASSWORD
    DATABASE_URL: "postgresql://test_user:$CI_DB_PASSWORD@postgres:5432/test_db"
    REDIS_URL: "redis://redis:6379/0"
  script:
    - pip install -r requirements-dev.txt
    - pytest --cov=src --cov-report=xml --cov-report=term --cov-fail-under=80
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
    expire_in: 30 days
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "develop"'

test:integration:
  stage: test
  services:
    - postgres:15-alpine
    - redis:7-alpine
  script:
    - pip install -r requirements-dev.txt
    - pytest tests/integration/ -v --tb=short
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

# ─── BUILD ────────────────────────────────────────────
build:docker:
  stage: build
  image: docker:24.0
  services:
    - docker:24.0-dind
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build -t $DOCKER_IMAGE:$DOCKER_TAG -t $DOCKER_IMAGE:latest .
    - docker push $DOCKER_IMAGE:$DOCKER_TAG
    - docker push $DOCKER_IMAGE:latest
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop"'
    - if: '$CI_COMMIT_BRANCH == "main"'
    - if: '$CI_COMMIT_TAG'

# ─── SCAN ─────────────────────────────────────────────
scan:bandit:
  stage: scan
  script:
    - pip install bandit[toml]
    - bandit -c pyproject.toml -r src/ -f json -o bandit-report.json
  artifacts:
    paths:
      - bandit-report.json
    expire_in: 30 days
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

scan:semgrep:
  stage: scan
  image: returntocorp/semgrep
  script:
    - semgrep --config=p/owasp-top-ten --config=p/python --json -o semgrep-report.json src/
  artifacts:
    paths:
      - semgrep-report.json
    expire_in: 30 days
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

scan:trivy:
  stage: scan
  image:
    name: aquasec/trivy:latest
    entrypoint: [""]
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $DOCKER_IMAGE:$DOCKER_TAG
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop"'
    - if: '$CI_COMMIT_BRANCH == "main"'

include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml

# ─── DEPLOY STAGING ───────────────────────────────────
deploy_staging:
  stage: deploy-staging
  image: ansible/ansible-runner:latest
  script:
    - ansible-playbook deploy-staging.yml -e "docker_tag=$DOCKER_TAG"
    - ansible-playbook smoke-test.yml -e "environment=staging"
  environment:
    name: staging
    url: https://staging.denomas.com
  rules:
    - if: '$CI_COMMIT_BRANCH == "staging"'

# ─── DEPLOY PRODUCTION ───────────────────────────────
deploy_canary:
  stage: deploy-prod
  image: ansible/ansible-runner:latest
  script:
    - ansible-playbook deploy-canary.yml -e "docker_tag=$DOCKER_TAG canary_weight=5"
  environment:
    name: canary
    url: https://canary.denomas.com
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
  when: manual

deploy_production:
  stage: deploy-prod
  image: ansible/ansible-runner:latest
  script:
    - ansible-playbook deploy-production.yml -e "docker_tag=$DOCKER_TAG"
    - ansible-playbook smoke-test.yml -e "environment=production"
  environment:
    name: production
    url: https://denomas.com
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
  when: manual
  needs: ["deploy_canary"]