name: CI/CD

on:
  push:
    branches: [main]

jobs:
  # ---------------------------------------------------------------------
  # 1. Unit tests — moeten slagen voordat er iets gebouwd wordt
  # ---------------------------------------------------------------------
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Installeer dependencies
        run: pip install -r requirements.txt
      - name: Lint (ruff)
        run: ruff check .
      - name: Unit tests (pytest)
        run: pytest tests/ -v

  # ---------------------------------------------------------------------
  # 2. SonarQube — codekwaliteit-gate
  # ---------------------------------------------------------------------
  sonarqube:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # SonarQube wil de volledige git-historie zien
      - name: SonarQube scan
        uses: sonarsource/sonarqube-scan-action@v6
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}

  # ---------------------------------------------------------------------
  # 3. Image bouwen + Trivy security-scan + naar Gitea-registry pushen
  # ---------------------------------------------------------------------
  build-and-scan:
    runs-on: ubuntu-latest
    needs: [test, sonarqube]
    steps:
      - uses: actions/checkout@v4
      - name: Build Docker image
        run: docker build -t gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }} .

      - name: Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }}
          severity: CRITICAL,HIGH
          exit-code: "1" # laat de pipeline falen bij kritieke kwetsbaarheden
          # gitea.token is geen geldig GitHub-token; leeg laten zodat setup-trivy
          # de aquasecurity/trivy-repo anoniem kan clonen in plaats van een
          # ongeldige Authorization-header naar github.com te sturen.
          token-setup-trivy: ""

      - name: Login bij Gitea-registry
        run: echo "${{ secrets.GLUCOSE_TOKEN }}" | docker login gitea.zb-kw.duckdns.org -u willemjan --password-stdin

      - name: Tag en push
        run: |
          docker tag gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }} gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:latest
          docker push gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }}
          docker push gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:latest

  # ---------------------------------------------------------------------
  # 4. Deploy — SSH naar de LXC en herstart met de nieuwe image
  # ---------------------------------------------------------------------
  deploy:
    runs-on: ubuntu-latest
    needs: build-and-scan
    steps:
      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          script: |
            cd /opt/glucose-dashboard
            docker compose pull
            docker compose up -d