dotnet.yml

name: .NET API Tests, Docker Build & Deploy

on:
  push:
    branches: [ Prod ]
  pull_request:
    branches: [ Prod ]

permissions:
  contents: write
  checks: write
  pull-requests: write
  packages: write

env:
  IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/tablemaster-api

jobs:
  build-and-test:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        dotnet-version: ['10.0.x']

    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET ${{ matrix.dotnet-version }}
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ matrix.dotnet-version }}
          include-prerelease: true

      - name: Restore dependencies
        run: |
          dotnet restore TableMasterApi/TableMasterApi.csproj
          dotnet restore TableMasterApi.Tests/TableMasterApi.Tests.csproj

      - name: Audit vulnerable dependencies
        run: >
          dotnet package list
          --project TableMasterApi/TableMasterApi.csproj
          --vulnerable
          --include-transitive

      - name: Report outdated dependencies
        run: >
          dotnet package list
          --project TableMasterApi/TableMasterApi.csproj
          --outdated
          --include-transitive
          | tee dotnet-outdated.txt

      - name: Build
        run: |
          dotnet build TableMasterApi/TableMasterApi.csproj --no-restore --configuration Release
          dotnet build TableMasterApi.Tests/TableMasterApi.Tests.csproj --no-restore --configuration Release

      - name: Run Unit Tests
        run: >
          dotnet test TableMasterApi.Tests/TableMasterApi.Tests.csproj
          --no-build
          --configuration Release
          --verbosity normal
          --logger "trx;LogFileName=test-results.trx"

      - name: Upload Test Results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: |
            **/test-results.trx
            dotnet-outdated.txt

      - name: Test Report
        if: always()
        uses: dorny/test-reporter@v1
        with:
          name: .NET Test Results
          path: '**/test-results.trx'
          reporter: 'dotnet-trx'

  docker-build-and-push:
    name: Build and push Docker image
    runs-on: ubuntu-latest
    needs: build-and-test

    if: github.event_name == 'push' && github.ref == 'refs/heads/Prod'

    steps:
      - uses: actions/checkout@v4

      - name: Normalize image name
        run: |
          IMAGE_NAME_LOWER=$(echo "${IMAGE_NAME}" | tr '[:upper:]' '[:lower:]')
          echo "IMAGE_NAME_LOWER=$IMAGE_NAME_LOWER" >> $GITHUB_ENV

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push API image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./TableMasterApi/Dockerfile
          push: true
          tags: |
            ${{ env.IMAGE_NAME_LOWER }}:prod
            ${{ env.IMAGE_NAME_LOWER }}:${{ github.sha }}

  deploy:
    name: Deploy to Oracle VPS
    runs-on: ubuntu-latest
    needs: docker-build-and-push

    if: github.event_name == 'push' && github.ref == 'refs/heads/Prod'

    steps:
      - name: Prepare SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.ORACLE_SSH_KEY_B64 }}" | base64 -d > ~/.ssh/oracle_key
          chmod 600 ~/.ssh/oracle_key
          ssh-keyscan -H ${{ secrets.ORACLE_HOST }} >> ~/.ssh/known_hosts

      - name: Deploy with Docker Compose
        run: |
          ssh -i ~/.ssh/oracle_key ${{ secrets.ORACLE_USER }}@${{ secrets.ORACLE_HOST }} << 'EOF'
            set -e

            cd /opt/tablemaster/prod/TableMasterApi

            git fetch origin Prod
            git reset --hard origin/Prod

            test -f .env
            test -f tablemaster-firebase.json

            echo "${{ secrets.GHCR_READ_TOKEN }}" | docker login ghcr.io -u "${{ secrets.GHCR_USERNAME }}" --password-stdin

            chmod +x ../ops/*.sh
            API_IMAGE_TAG="${{ github.sha }}" \
            APP_VERSION="1.0.2+${{ github.run_number }}" \
            SENTRY_RELEASE="tablemaster-api@1.0.2+${{ github.run_number }}" \
              ../ops/deploy-api.sh
          EOF

  release:
    name: Publish API release journal
    runs-on: ubuntu-latest
    needs: deploy

    if: github.event_name == 'push' && github.ref == 'refs/heads/Prod'

    steps:
      - uses: actions/checkout@v4

      - name: Download test evidence
        uses: actions/download-artifact@v4
        with:
          name: test-results
          path: test-results

      - name: Prepare release evidence
        run: |
          mkdir -p release-evidence
          TRX_FILE=$(find test-results -type f -name '*.trx' -print -quit)
          OUTDATED_FILE=$(find test-results -type f -name 'dotnet-outdated.txt' -print -quit)
          test -n "$TRX_FILE"
          test -n "$OUTDATED_FILE"
          cp "$TRX_FILE" release-evidence/test-results.trx
          cp "$OUTDATED_FILE" release-evidence/dotnet-outdated.txt
          sha256sum release-evidence/* CHANGELOG.md > SHA256SUMS

          cat > release-notes.md << EOF
          Release TableMaster API 1.0.2+${{ github.run_number }}

          Commit: ${{ github.sha }}
          Image immuable: ghcr.io/${{ github.repository_owner }}/tablemaster-api:${{ github.sha }}
          Release Sentry: tablemaster-api@1.0.2+${{ github.run_number }}

          Validation:
          - build Release
          - tests xUnit
          - audit des dépendances vulnérables
          - readiness PostgreSQL
          - smoke test post-déploiement

          Consulter CHANGELOG.md pour le détail des évolutions et correctifs.
          EOF

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "api-v1.0.2+${{ github.run_number }}" \
            CHANGELOG.md \
            SHA256SUMS \
            release-evidence/test-results.trx \
            release-evidence/dotnet-outdated.txt \
            --title "TableMaster API 1.0.2+${{ github.run_number }}" \
            --notes-file release-notes.md \
            --latest