name: DevSecOps Pipeline v3 (Progressive + Promotion)

on:
  push:
    branches: [ main ]
    tags: [ "v*.*.*" ]
  pull_request:
    branches: [ main ]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  id-token: write
  contents: read
  security-events: write
  pull-requests: read

env:
  AWS_REGION: us-east-1
  ECR_REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.us-east-1.amazonaws.com
  IMAGE_NAME: my-app

jobs:

  # ─── 0. DEPENDENCY REVIEW (PRs only) ───────────────────────────────────────
  dependency-review:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v4
      - uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: high

  # ─── 1. CODE QUALITY GATE ───────────────────────────────────────────────────
  code-quality:
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    timeout-minutes: 20
    permissions:
      security-events: write
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - uses: github/codeql-action/init@v3
        with:
          languages: auto
      - uses: github/codeql-action/autobuild@v3
      - uses: github/codeql-action/analyze@v3
        with:
          category: codeql-source
      - uses: returntocorp/semgrep-action@v1
        with:
          config: >
            p/owasp-top-ten p/secrets p/ci
      - uses: super-linter/super-linter@v7
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DEFAULT_BRANCH: main
          VALIDATE_ALL_CODEBASE: false

  # ─── 2. BUILD ONCE ─────────────────────────────────────────────────────────
  build:
    runs-on: ubuntu-latest
    needs: code-quality
    if: github.event_name == 'push'
    timeout-minutes: 20
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-ecr
          aws-region: ${{ env.AWS_REGION }}
      - uses: aws-actions/amazon-ecr-login@v2
      - name: Build and Push Image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          provenance: true
          sbom: true
          tags: ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ─── 3. SECURITY SCAN + SIGN ────────────────────────────────────────────────
  scan-sign:
    runs-on: ubuntu-latest
    needs: build
    timeout-minutes: 15
    outputs:
      image_uri: ${{ steps.uri.outputs.image_uri }}
    steps:
      - uses: actions/checkout@v4
      - uses: sigstore/cosign-installer@v3
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-ecr
          aws-region: ${{ env.AWS_REGION }}
      - uses: aws-actions/amazon-ecr-login@v2
      - uses: aquasecurity/trivy-action@0.24.0
        with:
          image-ref: ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          severity: CRITICAL,HIGH
          exit-code: "1"
      - uses: aquasecurity/trivy-action@0.24.0
        if: always()
        with:
          image-ref: ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy-results.sarif
          category: trivy-container
      - name: Compute Image URI (digest-based)
        id: uri
        run: |
          echo "image_uri=${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }}" >> $GITHUB_OUTPUT
      - name: Sign Image
        run: cosign sign --yes ${{ steps.uri.outputs.image_uri }}

  # ─── 4. DEPLOY TO STAGING (CANARY) ─────────────────────────────────────────
  deploy-staging:
    runs-on: ubuntu-latest
    needs: scan-sign
    timeout-minutes: 30
    environment:
      name: staging
      url: https://staging.my-app.example.com
    steps:
      - uses: actions/checkout@v4
      - uses: sigstore/cosign-installer@v3
      - uses: azure/setup-kubectl@v4
      - uses: azure/setup-helm@v4
      - name: Install Argo Rollouts CLI
        run: |
          curl -LO https://github.com/argoproj/argo-rollouts/releases/latest/download/kubectl-argo-rollouts-linux-amd64
          chmod +x kubectl-argo-rollouts-linux-amd64
          sudo mv kubectl-argo-rollouts-linux-amd64 /usr/local/bin/kubectl-argo-rollouts
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-eks-staging
          aws-region: ${{ env.AWS_REGION }}
      - run: aws eks update-kubeconfig --name my-eks-staging
      - name: Verify Image Signature
        run: |
          cosign verify \
            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
            ${{ needs.scan-sign.outputs.image_uri }}
      - name: Deploy via Helm (Argo Rollout)
        run: |
          helm upgrade --install my-app ./helm/my-app \
            --namespace staging --create-namespace \
            --set image.digest=${{ needs.build.outputs.digest }}
      - name: Monitor Canary Rollout
        run: kubectl argo rollouts status my-app -n staging --timeout 10m

  # ─── 5. DAST — STAGING ──────────────────────────────────────────────────────
  dast-staging:
    runs-on: ubuntu-latest
    needs: deploy-staging
    timeout-minutes: 20
    steps:
      - uses: zaproxy/action-baseline@v0.12.0
        with:
          target: https://staging.my-app.example.com   # ← update this
          fail_action: true
          issue_title: "ZAP Baseline Scan — Staging"

  # ─── 6. PROMOTION GATE (MANUAL APPROVAL) ────────────────────────────────────
  promote:
    runs-on: ubuntu-latest
    needs: dast-staging
    timeout-minutes: 60
    environment:
      name: production
    steps:
      - run: echo "Approved for production deployment"

  # ─── 7. DEPLOY TO PRODUCTION (CANARY) ───────────────────────────────────────
  deploy-prod:
    runs-on: ubuntu-latest
    needs: [ promote, scan-sign ]
    timeout-minutes: 45
    environment:
      name: production
      url: https://my-app.example.com
    steps:
      - uses: actions/checkout@v4
      - uses: sigstore/cosign-installer@v3
      - uses: azure/setup-kubectl@v4
      - uses: azure/setup-helm@v4
      - name: Install Argo Rollouts CLI
        run: |
          curl -LO https://github.com/argoproj/argo-rollouts/releases/latest/download/kubectl-argo-rollouts-linux-amd64
          chmod +x kubectl-argo-rollouts-linux-amd64
          sudo mv kubectl-argo-rollouts-linux-amd64 /usr/local/bin/kubectl-argo-rollouts
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-eks-prod
          aws-region: ${{ env.AWS_REGION }}
      - run: aws eks update-kubeconfig --name my-eks-prod
      - name: Verify Image Signature
        run: |
          cosign verify \
            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
            ${{ needs.scan-sign.outputs.image_uri }}
      - name: Deploy via Helm (same digest)
        run: |
          helm upgrade --install my-app ./helm/my-app \
            --namespace production --create-namespace \
            --set image.digest=${{ needs.build.outputs.digest }}
      - name: Monitor Canary Rollout
        run: kubectl argo rollouts status my-app -n production --timeout 15m

  # ─── 8. ROLLBACK ON PRODUCTION FAILURE ──────────────────────────────────────
  rollback-prod:
    runs-on: ubuntu-latest
    needs: deploy-prod
    if: failure()
    timeout-minutes: 20
    environment:
      name: production
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-eks-prod
          aws-region: ${{ env.AWS_REGION }}
      - run: aws eks update-kubeconfig --name my-eks-prod
      - name: Install Argo Rollouts CLI
        run: |
          curl -LO https://github.com/argoproj/argo-rollouts/releases/latest/download/kubectl-argo-rollouts-linux-amd64
          chmod +x kubectl-argo-rollouts-linux-amd64
          sudo mv kubectl-argo-rollouts-linux-amd64 /usr/local/bin/kubectl-argo-rollouts
      - name: Rollback Argo Rollout
        run: |
          kubectl argo rollouts undo my-app -n production
          kubectl argo rollouts status my-app -n production --timeout 10m

# setup-tools.yml
# Reusable workflow: installs the common deploy toolchain
# (Cosign, kubectl, Helm, Argo Rollouts CLI)
#
# Place in .github/workflows/setup-tools.yml
# Call with: uses: ./.github/workflows/setup-tools.yml

name: Setup Deploy Tools (Reusable)

on:
  workflow_call:

jobs:
  setup:
    runs-on: ubuntu-latest
    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Install kubectl
        uses: azure/setup-kubectl@v4

      - name: Install Helm
        uses: azure/setup-helm@v4

      - name: Install Argo Rollouts CLI
        run: |
          curl -LO https://github.com/argoproj/argo-rollouts/releases/latest/download/kubectl-argo-rollouts-linux-amd64
          chmod +x kubectl-argo-rollouts-linux-amd64
          sudo mv kubectl-argo-rollouts-linux-amd64 /usr/local/bin/kubectl-argo-rollouts