name: Continuous integration

on:
  push:
    branches: [main]
  pull_request:

# No long-lived secrets: id-token allows requesting an ephemeral OIDC
# token to authenticate against the cloud and sign with Cosign.
permissions:
  contents: read
  packages: write
  id-token: write
  pull-requests: write

env:
  REGISTRY: registry.rutasnorte.example
  IMAGE: rutasnorte/bookings-api

# Cancels older runs on the same branch: we do not burn runners
# validating commits that are already obsolete.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:

  # ---------------------------------------------------------------
  # 1. Unit tests: fast, no network, no real database.
  # ---------------------------------------------------------------
  tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm

      - name: Install exact dependencies
        # npm ci honours the lock file: reproducible, unlike npm install.
        run: npm ci

      - name: Static analysis
        run: npm run lint

      - name: Unit tests with coverage
        run: npm test -- --coverage --coverageThreshold='{"global":{"lines":80}}'

      - name: Dependency audit
        run: npm audit --audit-level=high

  # ---------------------------------------------------------------
  # 2-6. Build, scan, publish and sign.
  # ---------------------------------------------------------------
  image:
    needs: tests
    runs-on: ubuntu-latest
    outputs:
      # The digest is the output consumed by the following jobs
      # and, finally, by the manifest repository.
      digest: ${{ steps.build.outputs.digest }}
      tag: ${{ steps.meta.outputs.tag }}
    steps:
      - uses: actions/checkout@v4

      - name: Derive the tag from the commit
        id: meta
        run: |
          # Short SHA: a unique, traceable and sortable identifier.
          TAG="$(git rev-parse --short=12 HEAD)"
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-buildx-action@v3

      - name: Authenticate to the registry via OIDC
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          # An ephemeral token for this very run, not a stored credential.
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build the multi-stage image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ steps.meta.outputs.tag }}
          # Layer cache in the registry itself: a typical build drops
          # from 4 min to about 50 s by reusing node_modules.
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:cache
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:cache,mode=max
          provenance: true    # SLSA provenance attestation
          sbom: true          # software bill of materials

      - name: Scan with Trivy
        uses: aquasecurity/[email protected]
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE }}@${{ steps.build.outputs.digest }}
          format: table
          # Breaks the build only on CRITICAL. HIGH findings are recorded
          # and reviewed weekly: if you break on HIGH, the team learns
          # to bypass the control rather than to fix it.
          severity: CRITICAL
          exit-code: '1'
          ignore-unfixed: true    # with no patch available there is nothing to do today

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign keylessly with the workflow identity
        # There is no private key anywhere: Cosign obtains an ephemeral
        # certificate from Fulcio using this run's OIDC token and records
        # the signature in the public Rekor log. The signing identity is
        # the workflow itself, verifiable in the admission policy.
        run: |
          cosign sign --yes \
            "${REGISTRY}/${IMAGE}@${{ steps.build.outputs.digest }}"

      - name: Run summary
        run: |
          {
            echo "### Image published"
            echo "- Tag: \`${{ steps.meta.outputs.tag }}\`"
            echo "- Digest: \`${{ steps.build.outputs.digest }}\`"
            echo "- Signed by: \`${{ github.workflow_ref }}\`"
          } >> "$GITHUB_STEP_SUMMARY"

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-rutasnorte-signature
spec:
  validationFailureAction: Enforce
  rules:
    - name: verify-signature
      match:
        any:
          - resources:
              kinds: [Pod]
              namespaces: ["rutas-norte-*"]
      verifyImages:
        - imageReferences: ["registry.rutasnorte.example/rutasnorte/*"]
          attestors:
            - entries:
                - keyless:
                    subject: "https://github.com/rutasnorte/*/.github/workflows/integration.yml@refs/heads/main"
                    issuer: "https://token.actions.githubusercontent.com"

# syntax=docker/dockerfile:1.7

# --- Stage 1: dependencies --------------------------------------
FROM node:22-bookworm-slim AS deps
WORKDIR /app
COPY package.json package-lock.json ./
# The npm cache is mounted, not copied: it does not bloat any layer.
RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev

# --- Stage 2: build ---------------------------------------------
FROM node:22-bookworm-slim AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm npm ci
COPY . .
RUN npm run build

# --- Stage 3: final image ---------------------------------------
FROM gcr.io/distroless/nodejs22-debian12:nonroot
WORKDIR /app
# Only the essentials: no compilers, no shell, no package manager.
COPY --from=deps  /app/node_modules ./node_modules
COPY --from=build /app/dist ./dist
COPY package.json ./
USER 10001:10001
EXPOSE 8080 9090
CMD ["dist/server.js"]

  integration:
    needs: image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Bring up a kind cluster
        uses: helm/kind-action@v1
        with:
          cluster_name: ci-rutasnorte
          # One node is enough: we test correct behaviour, not high availability.
          config: .github/kind/cluster.yaml
          wait: 120s

      - name: Deploy real dependencies
        # A real PostgreSQL and Redis, not fakes: we want to catch
        # SQL and connection errors, which is where these things fail.
        run: |
          helm repo add bitnami https://charts.bitnami.com/bitnami
          helm install pg bitnami/postgresql \
            --set auth.database=bookings \
            --set auth.username=app_bookings \
            --set auth.password=testing \
            --set primary.persistence.enabled=false \
            --wait --timeout 5m
          helm install redis bitnami/redis \
            --set auth.enabled=false \
            --set master.persistence.enabled=false \
            --wait --timeout 5m

      - name: Load the freshly built image into kind
        run: |
          IMG="${REGISTRY}/${IMAGE}@${{ needs.image.outputs.digest }}"
          docker pull "$IMG"
          kind load docker-image "$IMG" --name ci-rutasnorte

      - name: Deploy the Rutas Norte chart
        run: |
          helm upgrade --install bookings-api ./chart \
            --values ./chart/values-ci.yaml \
            --set image.digest='${{ needs.image.outputs.digest }}' \
            --set postgres.host=pg-postgresql \
            --set redis.url=redis://redis-master:6379 \
            --wait --timeout 5m

      - name: Schema migrations
        run: kubectl wait --for=condition=complete job/bookings-api-migrations --timeout=3m

      - name: Smoke tests
        run: |
          kubectl port-forward svc/bookings-api 8080:80 &
          sleep 5
          npm run test:smoke -- --base-url http://localhost:8080

      - name: Diagnostics if something fails
        if: failure()
        run: |
          kubectl get pods -o wide
          kubectl describe pods -l app.kubernetes.io/name=bookings-api
          kubectl logs -l app.kubernetes.io/name=bookings-api --tail=200 --all-containers
          kubectl get events --sort-by=.lastTimestamp | tail -40

// tests/smoke.spec.js — run on kind and also after every real deployment
describe('bookings-api smoke', () => {
  test('responds to the readiness probe', async () => {
    const r = await fetch(`${base}/ready`);
    expect(r.status).toBe(200);
  });

  test('exposes metrics in Prometheus format', async () => {
    const t = await (await fetch(`${base}/metrics`)).text();
    expect(t).toMatch(/^bookings_api_requests_total/m);
  });

  test('queries timetables against the real database', async () => {
    const r = await fetch(`${base}/schedules?line=BIL-SAN&date=2026-08-14`);
    expect(r.status).toBe(200);
    expect(Array.isArray((await r.json()).departures)).toBe(true);
  });

  test('creates a booking and is idempotent', async () => {
    const body = { line: 'BIL-SAN', date: '2026-08-14', seats: 2 };
    const headers = { 'Idempotency-Key': 'smoke-test-001', 'Content-Type': 'application/json' };
    const r1 = await fetch(`${base}/bookings`, { method: 'POST', headers, body: JSON.stringify(body) });
    const r2 = await fetch(`${base}/bookings`, { method: 'POST', headers, body: JSON.stringify(body) });
    expect(r1.status).toBe(201);
    expect((await r2.json()).id).toBe((await r1.json()).id);  // no duplicate
  });
});

  update-manifests:
    needs: [image, integration]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - name: Clone the manifest repository
        uses: actions/checkout@v4
        with:
          repository: rutasnorte/manifests
          # A GitHub App token scoped to this repository,
          # not a personal token with access to the whole organisation.
          token: ${{ secrets.MANIFESTS_TOKEN }}

      - name: Write the new digest into the dev overlay
        run: |
          cd overlays/dev
          kustomize edit set image \
            "bookings-api=${REGISTRY}/${IMAGE}@${{ needs.image.outputs.digest }}"

      - name: Open a pull request and merge it automatically
        uses: peter-evans/create-pull-request@v7
        with:
          token: ${{ secrets.MANIFESTS_TOKEN }}
          branch: auto/bookings-api-${{ needs.image.outputs.tag }}
          commit-message: "dev: bookings-api ${{ needs.image.outputs.tag }}"
          title: "dev: bookings-api ${{ needs.image.outputs.tag }}"
          body: |
            Automatic update from `rutasnorte/bookings-api`.

            - Commit: ${{ github.sha }}
            - Digest: `${{ needs.image.outputs.digest }}`
            - Trivy: no critical vulnerabilities
            - Signature: verified (keyless)
            - Integration tests on kind: passed
          labels: automatic,dev

# Run by a person (or by a button that does exactly this)
cd manifests
DIGEST=$(yq '.images[] | select(.name=="bookings-api") | .digest' overlays/dev/kustomization.yaml)
git switch -c promotion/bookings-api-pre
cd overlays/pre
kustomize edit set image "bookings-api=registry.rutasnorte.example/rutasnorte/bookings-api@${DIGEST}"
git commit -am "pre: promote bookings-api ${DIGEST:0:19}"
gh pr create --title "pre: promote bookings-api" --body-file ../.github/templates/promotion.md

## Promotion to production — bookings-api

- **Digest:** `sha256:...`
- **Changes included:** (links to the code pull requests)
- **Does it include a schema migration?** Yes / No — if yes, is it backwards compatible?
- **k6 result in pre:** p95 = ___ ms (threshold 300 ms), errors = ___ % (threshold 0.1 %)
- **Estimated risk:** low / medium / high — justification:
- **Rollback plan:** `git revert <sha>` + estimated time ___ min
- **Window:** is there a freeze in force? Yes / No
- **Approvals:** platform @____ · product @____

  ephemeral-environment:
    if: github.event_name == 'pull_request'
    needs: image
    runs-on: ubuntu-latest
    environment:
      name: pr-${{ github.event.number }}
      url: https://pr-${{ github.event.number }}.dev.rutasnorte.example
    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to the development cluster via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::111122223333:role/ci-rutasnorte-ephemeral
          aws-region: eu-west-1
      - run: aws eks update-kubeconfig --name rutasnorte-dev

      - name: Deploy the environment
        env:
          NS: rutas-norte-pr-${{ github.event.number }}
        run: |
          kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f -
          # Labels that govern quotas, policies and automatic cleanup.
          kubectl label namespace "$NS" --overwrite \
            rutasnorte.example/ephemeral=true \
            rutasnorte.example/pr=${{ github.event.number }} \
            rutasnorte.example/created=$(date +%Y-%m-%d) \
            pod-security.kubernetes.io/enforce=restricted
          helm upgrade --install bookings-api ./chart \
            --namespace "$NS" \
            --values ./chart/values-ephemeral.yaml \
            --set image.digest='${{ needs.image.outputs.digest }}' \
            --set ingress.host=pr-${{ github.event.number }}.dev.rutasnorte.example \
            --wait --timeout 8m

      - name: Comment the URL on the pull request
        uses: peter-evans/create-or-update-comment@v4
        with:
          issue-number: ${{ github.event.number }}
          body: |
            Test environment ready: https://pr-${{ github.event.number }}.dev.rutasnorte.example
            Namespace: `rutas-norte-pr-${{ github.event.number }}`

  cleanup-ephemeral:
    if: github.event.action == 'closed'
    runs-on: ubuntu-latest
    steps:
      - run: kubectl delete namespace "rutas-norte-pr-${{ github.event.number }}" --ignore-not-found

apiVersion: batch/v1
kind: CronJob
metadata:
  name: cleanup-ephemeral-namespaces
  namespace: platform
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: ephemeral-cleaner
          restartPolicy: OnFailure
          containers:
            - name: cleanup
              image: registry.rutasnorte.example/tools/kubectl:1.30
              command:
                - /bin/sh
                - -c
                - |
                  LIMIT=$(date -d '7 days ago' +%Y-%m-%d)
                  kubectl get ns -l rutasnorte.example/ephemeral=true \
                    -o jsonpath='{range .items[*]}{.metadata.name} {.metadata.labels.rutasnorte\.example/created}{"\n"}{end}' |
                  while read -r NS CREATED; do
                    [ "$CREATED" \< "$LIMIT" ] && kubectl delete ns "$NS"
                  done

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Federated": "arn:aws:iam::111122223333:oidc-provider/token.actions.githubusercontent.com" },
    "Action": "sts:AssumeRoleWithWebIdentity",
    "Condition": {
      "StringEquals": { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
      "StringLike": {
        "token.actions.githubusercontent.com:sub": "repo:rutasnorte/bookings-api:pull_request"
      }
    }
  }]
}

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ci-ephemeral
rules:
  # It can create and delete namespaces (needed for the ephemeral ones)...
  - apiGroups: [""]
    resources: [namespaces]
    verbs: [get, list, create, delete, patch]
  # ...and manage workloads inside them.
  - apiGroups: ["", apps, networking.k8s.io, batch, autoscaling]
    resources: ["*"]
    verbs: [get, list, create, update, patch, delete]
  # Explicitly NOT: nodes, clusterroles, clusterrolebindings,
  # persistentvolumes or secrets in other namespaces.

# Argo CD sync hook: runs AFTER syncing.
apiVersion: batch/v1
kind: Job
metadata:
  name: smoke-bookings-api
  namespace: rutas-norte-pro
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
  backoffLimit: 2
  activeDeadlineSeconds: 300
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: smoke
          image: registry.rutasnorte.example/rutasnorte/smoke-tests@sha256:e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4
          env:
            - name: BASE_URL
              value: https://api.rutasnorte.example
            - name: MODE
              value: read-only         # in pro we do not create real bookings

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: bookings-api-pro
  namespace: argocd
spec:
  source:
    repoURL: https://github.com/rutasnorte/manifests
    path: overlays/pro
    targetRevision: main
  destination:
    server: https://kubernetes.default.svc
    namespace: rutas-norte-pro
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    retry:
      limit: 2
      backoff: { duration: 30s, factor: 2, maxDuration: 3m }
  revisionHistoryLimit: 20

# The automatic rollback flow, in essence
gh workflow run rollback.yml -f environment=pro -f reason="PostSync smoke failed"
# ...which does:
git revert --no-edit "$(git log -1 --format=%H -- overlays/pro)"
git push origin main
argocd app sync bookings-api-pro --prune
argocd app wait bookings-api-pro --health --timeout 300

# Deployment frequency to pro over the last 30 days
git log --since='30 days ago' --oneline -- overlays/pro | wc -l

# Lead time: difference between the code commit and the promotion commit
git log --since='30 days ago' --format='%H %ct' -- overlays/pro

on: [push]
permissions: write-all
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t registry.rutasnorte.example/rutasnorte/promotions:latest .
      - run: docker push registry.rutasnorte.example/rutasnorte/promotions:latest
      - run: echo "${{ secrets.KUBECONFIG_PRO }}" > /tmp/kc
      - run: KUBECONFIG=/tmp/kc kubectl -n rutas-norte-pro apply -f k8s/
      - run: KUBECONFIG=/tmp/kc kubectl -n rutas-norte-pro rollout restart deploy/promotions