CI/CD Deep Learning: From Beginner to Advanced with Real-World Projects

# docker-compose.yml — Full DevOps Stack
version: '3.8'

services:
  jenkins:
    image: jenkins/jenkins:lts-jdk17
    container_name: jenkins
    ports:
      - "8080:8080"
      - "50000:50000"
    volumes:
      - jenkins_data:/var/jenkins_home
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - JAVA_OPTS=-Djenkins.install.runSetupWizard=false
    restart: unless-stopped

  sonarqube:
    image: sonarqube:lts-community
    container_name: sonarqube
    ports:
      - "9000:9000"
    environment:
      - SONAR_JDBC_URL=jdbc:postgresql://sonar-db:5432/sonar
      - SONAR_JDBC_USERNAME=sonar
      - SONAR_JDBC_PASSWORD=sonar
    volumes:
      - sonar_data:/opt/sonarqube/data
      - sonar_logs:/opt/sonarqube/logs
    depends_on:
      - sonar-db

  sonar-db:
    image: postgres:15
    container_name: sonar-db
    environment:
      - POSTGRES_DB=sonar
      - POSTGRES_USER=sonar
      - POSTGRES_PASSWORD=sonar
    volumes:
      - sonar_db_data:/var/lib/postgresql/data

  nexus:
    image: sonatype/nexus3:latest
    container_name: nexus
    ports:
      - "8081:8081"
      - "8082:8082"
    volumes:
      - nexus_data:/nexus-data
    restart: unless-stopped

volumes:
  jenkins_data:
  sonar_data:
  sonar_logs:
  sonar_db_data:
  nexus_data:

# Save the above as docker-compose.yml, then:
docker compose up -d

# Check all services are running
docker compose ps

# Access:
# Jenkins   → http://localhost:8080
# SonarQube → http://localhost:9000  (admin/admin)
# Nexus     → http://localhost:8081  (admin / see logs)

# Get Nexus initial password
docker exec nexus cat /nexus-data/admin.password

# ── GITFLOW WORKFLOW ──────────────────────────────────

# Initialize git in project
git init
git remote add origin https://github.com/org/project.git

# Create feature branch from develop
git checkout develop
git pull origin develop
git checkout -b feature/user-authentication

# Work, commit with conventional commits
git add .
git commit -m "feat(auth): add JWT token validation"
git commit -m "fix(auth): handle expired token edge case"
git commit -m "test(auth): add unit tests for login flow"

# Push feature branch
git push origin feature/user-authentication

# ── REBASING (Clean History) ──────────────────────────
git fetch origin
git rebase origin/develop

# Interactive rebase — squash commits before PR
git rebase -i HEAD~3

# ── TAGGING FOR RELEASES ──────────────────────────────
git tag -a v1.2.0 -m "Release version 1.2.0 — auth module"
git push origin v1.2.0
git push origin --tags

# ── GIT HOOKS (Pre-commit linting) ────────────────────
cat > .git/hooks/pre-commit << 'EOF'
#!/bin/bash
echo "🔍 Running pre-commit checks..."
npm run lint
if [ $? -ne 0 ]; then
  echo "❌ Linting failed! Fix errors before committing."
  exit 1
fi
echo "✅ Pre-commit checks passed!"
EOF
chmod +x .git/hooks/pre-commit

# ── CHERRY-PICK (Port a specific commit) ──────────────
git log --oneline develop | head -5
git cherry-pick abc1234  # pick specific commit hash

# ── STASH (Save work temporarily) ─────────────────────
git stash push -m "WIP: payment integration"
git stash list
git stash pop              # restore latest stash

pipeline {
    agent {
        docker {
            image 'maven:3.9-eclipse-temurin-17'
            args '-v $HOME/.m2:/root/.m2'  // Cache maven deps
        }
    }

    options {
        timeout(time: 30, unit: 'MINUTES')
        buildDiscarder(logRotator(numToKeepStr: '10'))
        disableConcurrentBuilds()
    }

    environment {
        SONAR_HOST = 'http://sonarqube:9000'
        NEXUS_URL   = 'http://nexus:8081'
        NEXUS_CREDS = credentials('nexus-credentials')
        SONAR_TOKEN = credentials('sonar-token')
        APP_VERSION = sh(script: "mvn help:evaluate -Dexpression=project.version -q -DforceStdout", returnStdout: true).trim()
    }

    stages {
        stage('🔍 Checkout & Validate') {
            steps {
                checkout scm
                sh 'git log --oneline -5'
                sh 'mvn validate'
            }
        }

        stage('📦 Dependency Resolution') {
            steps {
                sh 'mvn dependency:resolve -B'
                sh 'mvn dependency:tree | head -50'
            }
        }

        stage('🔨 Compile') {
            steps {
                sh 'mvn compile -B'
            }
        }

        stage('🔎 Static Analysis') {
            parallel {
                stage('Checkstyle') {
                    steps { sh 'mvn checkstyle:check -B' }
                }
                stage('SpotBugs') {
                    steps { sh 'mvn spotbugs:check -B' }
                }
            }
        }

        stage('🧪 Unit Tests') {
            steps {
                sh 'mvn test -B'
            }
            post {
                always {
                    junit '**/target/surefire-reports/*.xml'
                    jacoco(
                        execPattern: '**/target/jacoco.exec',
                        classPattern: '**/target/classes',
                        sourcePattern: '**/src/main/java',
                        minimumLineCoverage: '80'
                    )
                }
            }
        }

        stage('🔬 Integration Tests') {
            steps {
                sh 'mvn verify -Pintegration-tests -B'
            }
        }

        stage('📊 SonarQube Analysis') {
            steps {
                withSonarQubeEnv('SonarQube') {
                    sh """
                        mvn sonar:sonar \
                          -Dsonar.projectKey=my-app \
                          -Dsonar.host.url=${SONAR_HOST} \
                          -Dsonar.login=${SONAR_TOKEN}
                    """
                }
                timeout(time: 5, unit: 'MINUTES') {
                    waitForQualityGate abortPipeline: true
                }
            }
        }

        stage('📦 Build & Package') {
            steps {
                sh 'mvn package -DskipTests -B'
                archiveArtifacts artifacts: 'target/*.jar', fingerprint: true
            }
        }

        stage('📤 Publish to Nexus') {
            steps {
                nexusArtifactUploader(
                    nexusVersion: 'nexus3',
                    protocol: 'http',
                    nexusUrl: "${NEXUS_URL}",
                    groupId: 'com.myapp',
                    version: "${APP_VERSION}",
                    repository: 'maven-releases',
                    credentialsId: 'nexus-credentials',
                    artifacts: [[
                        artifactId: 'my-app',
                        classifier: '',
                        file: "target/my-app-${APP_VERSION}.jar",
                        type: 'jar'
                    ]]
                )
            }
        }
    }
}

pipeline {
    agent any

    parameters {
        choice(name: 'DEPLOY_ENV', choices: ['dev', 'staging', 'production'])
        booleanParam(name: 'RUN_SMOKE_TESTS', defaultValue: true)
        string(name: 'IMAGE_TAG', defaultValue: 'latest')
    }

    environment {
        REGISTRY    = 'your-registry.io/myapp'
        DEPLOY_USER = credentials('deploy-ssh-key')
        SLACK_HOOK   = credentials('slack-webhook')
    }

    stages {
        stage('🔍 Pre-Deploy Checks') {
            steps {
                sh """
                    echo "Deploying: ${REGISTRY}:${params.IMAGE_TAG}"
                    echo "Target env: ${params.DEPLOY_ENV}"
                    docker pull ${REGISTRY}:${params.IMAGE_TAG}
                """
            }
        }

        stage('🚀 Deploy to Dev') {
            when { expression { params.DEPLOY_ENV == 'dev' } }
            steps {
                sh """
                    ssh deploy@dev.myapp.com \\
                      "docker pull ${REGISTRY}:${params.IMAGE_TAG} && \\
                       docker stop myapp || true && \\
                       docker rm myapp || true && \\
                       docker run -d --name myapp \\
                         -p 3001:3000 \\
                         -e NODE_ENV=development \\
                         ${REGISTRY}:${params.IMAGE_TAG}"
                """
            }
        }

        stage('🧪 Staging Smoke Tests') {
            when {
                allOf {
                    expression { params.DEPLOY_ENV == 'staging' }
                    expression { params.RUN_SMOKE_TESTS }
                }
            }
            steps {
                sh '''
                    # Deploy to staging first
                    docker service update \
                      --image ${REGISTRY}:${IMAGE_TAG} \
                      myapp_staging

                    # Wait for service to stabilize
                    sleep 15

                    # Run smoke tests
                    curl -f https://staging.myapp.com/health || exit 1
                    curl -f https://staging.myapp.com/api/status || exit 1
                    echo "✅ Smoke tests passed!"
                '''
            }
        }

        stage('⏸️ Production Approval') {
            when { expression { params.DEPLOY_ENV == 'production' } }
            steps {
                script {
                    def approved = input(
                        message: "Deploy ${params.IMAGE_TAG} to PRODUCTION?",
                        ok: 'Yes, Deploy!',
                        submitterParameter: 'APPROVED_BY',
                        parameters: [
                            choice(name: 'STRATEGY',
                                   choices: ['canary', 'blue-green', 'rolling'])
                        ]
                    )
                    env.APPROVED_BY = approved.APPROVED_BY
                    env.DEPLOY_STRATEGY = approved.STRATEGY
                }
            }
        }

        stage('🟢 Blue-Green Production Deploy') {
            when { expression { params.DEPLOY_ENV == 'production' } }
            steps {
                sh """
                    # Get current active slot (blue or green)
                    CURRENT=\$(aws elbv2 describe-target-groups \
                      --names myapp-prod --query \
                      'TargetGroups[0].Tags[?Key==`slot`].Value' \
                      --output text)

                    if [ "\$CURRENT" == "blue" ]; then
                        DEPLOY_SLOT="green"
                        CURRENT_SLOT="blue"
                    else
                        DEPLOY_SLOT="blue"
                        CURRENT_SLOT="green"
                    fi

                    echo "Deploying to \$DEPLOY_SLOT slot..."
                    # Deploy to inactive slot
                    # Run tests on inactive slot
                    # Switch load balancer
                    echo "✅ Production deploy complete via \$DEPLOY_SLOT slot"
                    echo "Approved by: ${env.APPROVED_BY}"
                """
            }
        }
    }

    post {
        success {
            sh """
                curl -X POST ${SLACK_HOOK} \
                  -d '{"text":"✅ Deploy SUCCESS: ${params.IMAGE_TAG} → ${params.DEPLOY_ENV}"}'
            """
        }
        failure {
            sh """
                curl -X POST ${SLACK_HOOK} \
                  -d '{"text":"❌ Deploy FAILED: ${params.IMAGE_TAG} → ${params.DEPLOY_ENV}"}'
            """
        }
    }
}

# On the AGENT machine (Ubuntu 22.04)
sudo apt update && sudo apt install openjdk-17-jdk -y

# Create jenkins user for running jobs
sudo useradd -m -s /bin/bash jenkins-agent
sudo mkdir -p /opt/jenkins-agent
sudo chown jenkins-agent:jenkins-agent /opt/jenkins-agent

# Setup SSH key authentication
sudo su - jenkins-agent
ssh-keygen -t ed25519 -C "jenkins-agent-key" -f ~/.ssh/jenkins_agent_key

# Add public key to authorized_keys
cat ~/.ssh/jenkins_agent_key.pub >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# Copy PRIVATE key to Jenkins → Manage Jenkins → Credentials
cat ~/.ssh/jenkins_agent_key  # copy this to Jenkins as SSH private key credential

// vars/buildAndPush.groovy  (Shared Library)
def call(Map config) {
    def registry  = config.registry  ?: 'docker.io'
    def imageName = config.imageName ?: error('imageName required')
    def tag       = config.tag       ?: 'latest'

    stage('🐳 Docker Build') {
        sh """
            docker build \
              --build-arg BUILD_DATE=\$(date -u +%Y-%m-%dT%H:%M:%SZ) \
              --build-arg VCS_REF=\$(git rev-parse --short HEAD) \
              --label org.opencontainers.image.revision=\$(git rev-parse HEAD) \
              -t ${registry}/${imageName}:${tag} \
              -t ${registry}/${imageName}:latest \
              .
        """
    }

    stage('🔒 Image Security Scan') {
        sh """
            trivy image \
              --exit-code 1 \
              --severity HIGH,CRITICAL \
              ${registry}/${imageName}:${tag}
        """
    }

    stage('📤 Push to Registry') {
        withCredentials([usernamePassword(
            credentialsId: 'docker-registry-creds',
            usernameVariable: 'DOCKER_USER',
            passwordVariable: 'DOCKER_PASS'
        )]) {
            sh """
                echo "\$DOCKER_PASS" | docker login ${registry} -u "\$DOCKER_USER" --password-stdin
                docker push ${registry}/${imageName}:${tag}
                docker push ${registry}/${imageName}:latest
                docker logout ${registry}
            """
        }
    }
}

// ─────────────────────────────────────────────────────
// Using shared library in Jenkinsfile:

@Library('my-shared-library@main') _

pipeline {
    agent any
    stages {
        stage('CI') {
            steps {
                script {
                    buildAndPush(
                        registry:  'your-ecr-account.dkr.ecr.ap-south-1.amazonaws.com',
                        imageName: 'my-webapp',
                        tag:       "${env.BUILD_NUMBER}"
                    )
                }
            }
        }
    }
}

name: 🚀 CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment'
        required: true
        default: 'staging'
        type: choice
        options: [staging, production]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  lint-and-test:
    name: 🔍 Lint & Test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18, 20, 22]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run ESLint
        run: npm run lint

      - name: Run tests with coverage
        run: npm test -- --coverage --coverageReporters=lcov

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  security-scan:
    name: 🔒 Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'

      - name: SAST with CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: javascript

  build-and-push:
    name: 🐳 Build & Push Image
    runs-on: ubuntu-latest
    needs: [lint-and-test, security-scan]
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=sha,prefix=sha-
            type=semver,pattern={{version}}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy-staging:
    name: 🌐 Deploy to Staging
    runs-on: ubuntu-latest
    needs: build-and-push
    environment:
      name: staging
      url: https://staging.myapp.com
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to staging via SSH
        uses: appleboy/ssh-action@v1.0.0
        with:
          host: ${{ secrets.STAGING_HOST }}
          username: deploy
          key: ${{ secrets.STAGING_SSH_KEY }}
          script: |
            docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}
            docker compose -f /opt/myapp/docker-compose.yml up -d
            docker image prune -f

# Stage 1: Dependencies
FROM node:20-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force

# Stage 2: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Stage 3: Test
FROM builder AS tester
RUN npm test -- --passWithNoTests

# Stage 4: Production Runtime (minimal)
FROM node:20-alpine AS production

# Security: run as non-root user
RUN addgroup -g 1001 -S nodejs && \
    adduser  -S nextjs -u 1001

WORKDIR /app

# Copy only what's needed
COPY --from=deps     --chown=nextjs:nodejs /app/node_modules ./node_modules
COPY --from=builder  --chown=nextjs:nodejs /app/dist        ./dist
COPY --from=builder  --chown=nextjs:nodejs /app/package.json ./

USER nextjs

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget -qO- http://localhost:3000/health || exit 1

EXPOSE 3000
ENV NODE_ENV=production

CMD ["node", "dist/server.js"]

# ── BUILD ─────────────────────────────────────────────────
# Multi-platform build (amd64 + arm64)
docker buildx build \
  --platform linux/amd64,linux/arm64 \
  --build-arg BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
  --build-arg GIT_COMMIT=$(git rev-parse HEAD) \
  --target production \
  -t myapp:$(git rev-parse --short HEAD) \
  -t myapp:latest \
  --push \
  .

# ── SCAN ──────────────────────────────────────────────────
# Trivy vulnerability scan
trivy image --exit-code 1 \
  --severity HIGH,CRITICAL \
  --format table \
  myapp:latest

# Docker Scout (new Docker vulnerability tool)
docker scout cves myapp:latest

# ── TEST ──────────────────────────────────────────────────
# Run tests inside container
docker run --rm \
  -e NODE_ENV=test \
  -v $(pwd)/reports:/app/reports \
  myapp:latest \
  npm test

# ── PUSH TO ECR ───────────────────────────────────────────
AWS_REGION="ap-south-1"
AWS_ACCOUNT="123456789012"
ECR_REPO="${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/myapp"

# Login to ECR
aws ecr get-login-password --region ${AWS_REGION} | \
  docker login --username AWS --password-stdin ${ECR_REPO}

# Tag and push
docker tag myapp:latest ${ECR_REPO}:latest
docker tag myapp:latest ${ECR_REPO}:$(git rev-parse --short HEAD)
docker push ${ECR_REPO}:latest
docker push ${ECR_REPO}:$(git rev-parse --short HEAD)

# ── CLEAN UP ──────────────────────────────────────────────
docker image prune -f
docker system prune --volumes -f  # CAUTION: removes all unused

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: production
  labels:
    app: myapp
    version: "1.0.42"
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: myapp
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "3000"
    spec:
      serviceAccountName: myapp-sa
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        fsGroup: 2000
      containers:
        - name: myapp
          image: "ghcr.io/myorg/myapp:1.0.42"  # Updated by CI
          ports:
            - containerPort: 3000
          env:
            - name: NODE_ENV
              value: production
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: myapp-secrets
                  key: db-password
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"
          livenessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /ready
              port: 3000
            initialDelaySeconds: 5
            periodSeconds: 5
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: myapp-hpa
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  minReplicas: 3
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp-production
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/myorg/myapp-k8s-config.git
    targetRevision: main
    path: overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true      # Delete resources removed from Git
      selfHeal: true   # Auto-fix manual changes in cluster
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground
    retry:
      limit: 5
      backoff:
        duration: 5s
        maxDuration: 3m
        factor: 2

name: Terraform CI/CD

on:
  pull_request:
    paths: ['terraform/**']
  push:
    branches: [main]
    paths: ['terraform/**']

env:
  TF_VERSION: '1.7.0'
  TF_WORKING_DIR: terraform/environments/production

jobs:
  terraform-plan:
    name: 📋 Terraform Plan
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS Credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_TERRAFORM_ROLE }}
          aws-region: ap-south-1

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Terraform Format Check
        run: terraform fmt -check -recursive
        working-directory: ${{ env.TF_WORKING_DIR }}

      - name: Terraform Init
        run: terraform init -backend-config=backends/prod.hcl
        working-directory: ${{ env.TF_WORKING_DIR }}

      - name: Terraform Validate
        run: terraform validate
        working-directory: ${{ env.TF_WORKING_DIR }}

      - name: tfsec Security Scan
        uses: aquasecurity/tfsec-action@v1.0.0
        with:
          working_directory: ${{ env.TF_WORKING_DIR }}

      - name: Terraform Plan
        id: plan
        run: |
          terraform plan \
            -var-file=vars/production.tfvars \
            -out=tfplan \
            -no-color 2>&1 | tee plan_output.txt
        working-directory: ${{ env.TF_WORKING_DIR }}

      - name: Comment Plan on PR
        uses: actions/github-script@v7
        if: github.event_name == 'pull_request'
        with:
          script: |
            const fs = require('fs');
            const plan = fs.readFileSync('${{ env.TF_WORKING_DIR }}/plan_output.txt', 'utf8');
            const maxLen = 65000;
            const truncated = plan.length > maxLen ? plan.substring(0, maxLen) + '\n...(truncated)' : plan;
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '## 📋 Terraform Plan\n```hcl\n' + truncated + '\n```'
            })

  terraform-apply:
    name: 🚀 Terraform Apply
    runs-on: ubuntu-latest
    needs: terraform-plan
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    environment:
      name: production-infra
    steps:
      - uses: actions/checkout@v4
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_TERRAFORM_ROLE }}
          aws-region: ap-south-1
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}
      - name: Terraform Init & Apply
        run: |
          terraform init -backend-config=backends/prod.hcl
          terraform apply -var-file=vars/production.tfvars -auto-approve
        working-directory: ${{ env.TF_WORKING_DIR }}

groups:
  - name: cicd-alerts
    rules:
      - alert: HighDeploymentFailureRate
        expr: |
          rate(jenkins_builds_failed_total[5m]) /
          rate(jenkins_builds_total[5m]) > 0.2
        for: 2m
        labels:
          severity: warning
        annotations:
          summary: "High build failure rate detected"
          description: "{{ $value | humanizePercentage }} of builds failing"

      - alert: AppErrorRateHigh
        expr: |
          rate(http_requests_total{status=~"5.."}[5m]) /
          rate(http_requests_total[5m]) > 0.05
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Application error rate > 5%"
          runbook_url: https://wiki.company.com/runbooks/high-error-rate

      - alert: PodCrashLooping
        expr: |
          kube_pod_container_status_restarts_total > 5
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Pod {{ $labels.pod }} is crash looping"

name: 🔒 Security Pipeline

on: [push, pull_request]

jobs:
  secrets-scan:
    name: 🔑 Secrets Detection
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for git-secrets
      - name: TruffleHog Secrets Scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          extra_args: --only-verified

  sast:
    name: 🔬 SAST Analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: CodeQL Analysis
        uses: github/codeql-action/init@v3
        with:
          languages: javascript, python
      - name: Autobuild
        uses: github/codeql-action/autobuild@v3
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3

  dependency-scan:
    name: 📦 Dependency Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run npm audit
        run: npm audit --audit-level=high
      - name: OWASP Dependency-Check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: myapp
          path: .
          format: HTML
          args: >
            --enableRetired
            --failOnCVSS 7

  container-scan:
    name: 🐳 Container Scan
    runs-on: ubuntu-latest
    needs: [secrets-scan, sast]
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t scan-target:latest .
      - name: Run Trivy container scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: scan-target:latest
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          format: sarif
          output: trivy-results.sarif
      - name: Upload scan results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

  iac-scan:
    name: 🏗️ IaC Security
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkov IaC Scan (Terraform + K8s)
        uses: bridgecrewio/checkov-action@master
        with:
          directory: .
          framework: terraform,kubernetes,dockerfile
          soft_fail: false

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: myapp-rollout
  namespace: production
spec:
  replicas: 10
  strategy:
    canary:
      canaryService: myapp-canary
      stableService: myapp-stable
      trafficRouting:
        istio:
          virtualService:
            name: myapp-vsvc
      analysis:
        templates:
          - templateName: success-rate
        startingStep: 2
        args:
          - name: service-name
            value: myapp-canary
      steps:
        - setWeight: 5
        - pause: {duration: 2m}
        - setWeight: 20
        - pause: {duration: 5m}
        - setWeight: 50
        - pause: {duration: 5m}
        - setWeight: 100
---
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: success-rate
spec:
  args:
    - name: service-name
  metrics:
    - name: success-rate
      interval: 1m
      successCondition: result[0] >= 0.99
      failureLimit: 3
      provider:
        prometheus:
          address: http://prometheus:9090
          query: |
            sum(rate(http_requests_total{
              service="{{args.service-name}}",
              status!~"5.."
            }[2m])) /
            sum(rate(http_requests_total{
              service="{{args.service-name}}"
            }[2m]))

#!/bin/bash
# bootstrap.sh — Capstone project full setup
set -euo pipefail

echo "🚀 Starting Capstone CI/CD Platform Setup..."

# ── 1. INFRASTRUCTURE ──────────────────────────────────
echo "📦 Provisioning AWS Infrastructure with Terraform..."
cd infrastructure/terraform

# Initialize with remote state (S3 backend)
terraform init \
  -backend-config="bucket=myapp-terraform-state" \
  -backend-config="key=prod/terraform.tfstate" \
  -backend-config="region=ap-south-1"

terraform workspace select production || terraform workspace new production
terraform plan -var-file=vars/production.tfvars -out=tfplan
terraform apply tfplan

# Get EKS kubeconfig
aws eks update-kubeconfig \
  --name myapp-production \
  --region ap-south-1

echo "✅ EKS cluster ready!"

# ── 2. KUBERNETES BOOTSTRAP ────────────────────────────
echo "☸️  Installing core Kubernetes components..."

# Create namespaces
kubectl create namespace production  --dry-run=client -o yaml | kubectl apply -f -
kubectl create namespace staging     --dry-run=client -o yaml | kubectl apply -f -
kubectl create namespace monitoring  --dry-run=client -o yaml | kubectl apply -f -
kubectl create namespace argocd      --dry-run=client -o yaml | kubectl apply -f -

# Install ArgoCD
kubectl apply -n argocd \
  -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Wait for ArgoCD to be ready
kubectl wait --for=condition=available --timeout=300s \
  deployment/argocd-server -n argocd

# Install Argo Rollouts
kubectl create namespace argo-rollouts --dry-run=client -o yaml | kubectl apply -f -
kubectl apply -n argo-rollouts \
  -f https://github.com/argoproj/argo-rollouts/releases/latest/download/install.yaml

# Install monitoring stack
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update
helm upgrade --install kube-prometheus prometheus-community/kube-prometheus-stack \
  --namespace monitoring \
  --values monitoring/prometheus-values.yaml \
  --wait

# Install External Secrets Operator (for AWS Secrets Manager)
helm repo add external-secrets https://charts.external-secrets.io
helm upgrade --install external-secrets external-secrets/external-secrets \
  -n external-secrets-system \
  --create-namespace \
  --wait

echo "✅ Kubernetes platform ready!"

# ── 3. ARGOCD APPLICATIONS ─────────────────────────────
echo "🔄 Configuring ArgoCD Applications..."

# Apply ArgoCD app-of-apps pattern
kubectl apply -f argocd/app-of-apps.yaml

# Get ArgoCD admin password
ARGOCD_PASS=$(kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d)

echo ""
echo "══════════════════════════════════════════════"
echo " 🎉 CAPSTONE PLATFORM DEPLOYED SUCCESSFULLY!"
echo "══════════════════════════════════════════════"
echo " ArgoCD UI:    https://$(kubectl get svc argocd-server -n argocd -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')"
echo " ArgoCD Pass:  ${ARGOCD_PASS}"
echo " Grafana URL:  https://grafana.myapp.com"
echo " App URL:      https://myapp.com"
echo "══════════════════════════════════════════════"

name: 🚀 Capstone CI/CD Pipeline

on:
  push:
    branches: [main]
    tags: ['v*.*.*']
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ─── Quality Gate ──────────────────────────────
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: {fetch-depth: 0}
      - uses: actions/setup-node@v4
        with: {node-version: '20', cache: 'npm'}
      - run: npm ci
      - run: npm run lint && npm run type-check
      - run: npm test -- --coverage
      - name: SonarQube Scan
        uses: SonarSource/sonarcloud-github-action@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  # ─── Security ──────────────────────────────────
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: {fetch-depth: 0}
      - uses: trufflesecurity/trufflehog@main
        with: {path: ./, base: main}
      - uses: github/codeql-action/init@v3
        with: {languages: javascript}
      - uses: github/codeql-action/autobuild@v3
      - uses: github/codeql-action/analyze@v3

  # ─── Build & Push ──────────────────────────────
  build:
    needs: [quality, security]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    outputs:
      image-tag: ${{ steps.meta.outputs.version }}
      image-digest: ${{ steps.push.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_CI_ROLE }}
          aws-region: ap-south-1
      - uses: docker/setup-buildx-action@v3
      - id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
      - id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ steps.login-ecr.outputs.registry }}/myapp
          tags: |
            type=sha,prefix=,format=short
            type=semver,pattern={{version}}
            type=raw,value=latest,enable={{is_default_branch}}
      - id: push
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Trivy scan on pushed image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ steps.login-ecr.outputs.registry }}/myapp:${{ steps.meta.outputs.version }}
          severity: CRITICAL,HIGH
          exit-code: '1'

  # ─── Update K8s Config ─────────────────────────
  update-gitops:
    needs: build
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    steps:
      - name: Checkout k8s config repo
        uses: actions/checkout@v4
        with:
          repository: myorg/myapp-k8s-config
          token: ${{ secrets.GITOPS_PAT }}
      - name: Update image tag in Helm values
        run: |
          sed -i "s|tag:.*|tag: ${{ needs.build.outputs.image-tag }}|" \
            charts/myapp/values/staging.yaml
          git config user.name  "github-actions[bot]"
          git config user.email "actions@github.com"
          git commit -am "ci: update image to ${{ needs.build.outputs.image-tag }}"
          git push
          echo "✅ GitOps repo updated — ArgoCD will auto-sync to staging"