ci.yml

name: CI

on:
  pull_request:
    branches:
      - develop
      - main
      - "release/**"
      - "rc/**"
  push:
    branches:
      - develop
      - main
      - "feature/**"
      - "release/**"
      - "rc/**"
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    name: validate
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Format check
        run: npm run format:check

      - name: Lint
        run: npm run lint

      - name: Typecheck
        run: npm run typecheck

      - name: Build
        run: npm run build

      - name: Install browser dependencies
        run: npx playwright install --with-deps chromium

      - name: End-to-end tests
        run: npm run test:e2e

      - name: Lighthouse
        run: npm run test:lighthouse

      - name: Audit dependencies (block on high and above)
        run: npm audit --audit-level=high

  dependency-review:
    name: dependency-review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Dependency review (block on high and above)
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
        with:
          fail-on-severity: high

  image-scan:
    name: image-scan
    runs-on: ubuntu-latest
    needs: validate
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Build image for scanning
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          load: true
          tags: benchfinity-website:scan
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan image (block on fixable high and critical)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: benchfinity-website:scan
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          vuln-type: os,library
          exit-code: "1"
          format: table

  docker:
    name: docker
    runs-on: ubuntu-latest
    needs: [validate, image-scan]
    if: github.event_name == 'push'
    permissions:
      contents: read
      packages: write
    outputs:
      image: ${{ steps.meta.outputs.image }}
      tags: ${{ steps.meta.outputs.tags }}
      version: ${{ steps.meta.outputs.version }}
      release_tag: ${{ steps.meta.outputs.release_tag }}
      release_name: ${{ steps.meta.outputs.release_name }}
      deploy_tag: ${{ steps.meta.outputs.deploy_tag }}
      prerelease: ${{ steps.meta.outputs.prerelease }}
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22

      - name: Compute image tags
        id: meta
        shell: bash
        run: |
          version="$(node -p "require('./package.json').version")"
          short_sha="${GITHUB_SHA::7}"
          image="ghcr.io/${GITHUB_REPOSITORY,,}"
          branch="${GITHUB_REF_NAME}"
          release_tag=""
          release_name=""
          deploy_tag=""
          prerelease="false"

          if [[ "${branch}" == "main" ]]; then
            # Publish both the human-readable :<version> and an immutable
            # :<version>-<sha> that production pins to (so every release
            # changes the CD desired state and ArgoCD rolls it out).
            tags="${image}:${version}"$'\n'"${image}:${version}-${short_sha}"
            deploy_tag="${version}-${short_sha}"
            release_tag="v${version}"
            release_name="Benchfinity Website v${version}"
          elif [[ "${branch}" == "develop" ]]; then
            tags="${image}:${version}-SNAPSHOT.${short_sha}"$'\n'"${image}:develop"
          elif [[ "${branch}" == release/* || "${branch}" == rc/* ]]; then
            tags="${image}:${version}-rc.${short_sha}"
            release_tag="v${version}-rc.${short_sha}"
            release_name="Benchfinity Website v${version} RC ${short_sha}"
            prerelease="true"
          elif [[ "${branch}" == feature/* ]]; then
            safe_branch="$(printf '%s' "${branch#feature/}" | tr '[:upper:]' '[:lower:]' | sed -E 's#[^a-z0-9_.-]+#-#g; s#-+#-#g; s#(^-|-$)##g')"
            tags="${image}:${version}-${safe_branch}-${short_sha}-SNAPSHOT"
          else
            safe_branch="$(printf '%s' "${branch}" | tr '[:upper:]' '[:lower:]' | sed -E 's#[^a-z0-9_.-]+#-#g; s#-+#-#g; s#(^-|-$)##g')"
            tags="${image}:${version}-${safe_branch}-${short_sha}-SNAPSHOT"
          fi

          {
            echo "image=${image}"
            echo "version=${version}"
            echo "release_tag=${release_tag}"
            echo "release_name=${release_name}"
            echo "deploy_tag=${deploy_tag}"
            echo "prerelease=${prerelease}"
            echo "tags<<TAGS"
            printf '%s\n' "${tags}"
            echo "TAGS"
          } >> "${GITHUB_OUTPUT}"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Login to GHCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          platforms: linux/amd64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: |
            org.opencontainers.image.title=Benchfinity Website
            org.opencontainers.image.description=Benchfinity marketing and content site
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ steps.meta.outputs.version }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  release:
    name: release
    runs-on: ubuntu-latest
    needs: docker
    if: github.event_name == 'push' && needs.docker.outputs.release_tag != ''
    permissions:
      contents: write
    steps:
      - name: Publish GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ needs.docker.outputs.release_tag }}
          RELEASE_NAME: ${{ needs.docker.outputs.release_name }}
          PRERELEASE: ${{ needs.docker.outputs.prerelease }}
          IMAGE: ${{ needs.docker.outputs.image }}
          IMAGE_TAGS: ${{ needs.docker.outputs.tags }}
        shell: bash
        run: |
          if gh release view "${TAG}" -R "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
            echo "Release ${TAG} already exists"
            exit 0
          fi

          body="$(printf 'Container image:\n\n%s\n\nCommit: %s\n' "${IMAGE_TAGS}" "${GITHUB_SHA}")"

          gh api -X POST "repos/${GITHUB_REPOSITORY}/releases" \
            -f tag_name="${TAG}" \
            -f target_commitish="${GITHUB_SHA}" \
            -f name="${RELEASE_NAME}" \
            -f body="${body}" \
            -F prerelease="${PRERELEASE}" \
            -F generate_release_notes=true

  deploy:
    name: deploy
    runs-on: ubuntu-latest
    needs: docker
    # Only production (main) auto-deploys, and only once the immutable image
    # has been published. Bumps the pinned tag in the Website-CD GitOps repo;
    # ArgoCD (benchfinity-website-prod) reconciles it onto k8s-prod.
    if: github.event_name == 'push' && needs.docker.outputs.deploy_tag != ''
    # Uses the SSH deploy key for Website-CD, not GITHUB_TOKEN — so this job
    # needs no token write scope. Explicit minimal permissions (CodeQL).
    permissions:
      contents: read
    steps:
      - name: Roll production by bumping Website-CD image tag
        env:
          DEPLOY_TAG: ${{ needs.docker.outputs.deploy_tag }}
          DEPLOY_KEY: ${{ secrets.WEBSITE_CD_DEPLOY_KEY }}
          SOURCE_SHA: ${{ github.sha }}
          CD_REPO: BenchFinity/Website-CD
          CD_BRANCH: main
          OVERLAY: overlays/production/kustomization.yaml
          IMAGE_NAME: ghcr.io/benchfinity/website
        shell: bash
        run: |
          set -euo pipefail

          if [[ -z "${DEPLOY_KEY}" ]]; then
            echo "::error::WEBSITE_CD_DEPLOY_KEY secret is not set; cannot push to ${CD_REPO}." \
                 "Add a write deploy key to ${CD_REPO} and store its private key as that secret."
            exit 1
          fi

          # Authenticate to the CD repo over SSH with a scoped, write-only deploy key.
          mkdir -p ~/.ssh
          printf '%s\n' "${DEPLOY_KEY}" > ~/.ssh/cd_deploy_key
          chmod 600 ~/.ssh/cd_deploy_key
          ssh-keyscan -t ed25519,rsa github.com >> ~/.ssh/known_hosts 2>/dev/null
          export GIT_SSH_COMMAND="ssh -i ~/.ssh/cd_deploy_key -o IdentitiesOnly=yes"

          git clone --depth 1 --branch "${CD_BRANCH}" "git@github.com:${CD_REPO}.git" cd-repo
          cd cd-repo

          # Pin production to the immutable image just published. DEPLOY_TAG and
          # IMAGE_NAME are CI-derived (package.json version + commit SHA), not
          # user-controlled input, so they are safe to pass to yq via env.
          DEPLOY_TAG="${DEPLOY_TAG}" IMAGE_NAME="${IMAGE_NAME}" yq -i \
            '(.images[] | select(.name == strenv(IMAGE_NAME)) | .newTag) = strenv(DEPLOY_TAG)' \
            "${OVERLAY}"

          if git diff --quiet -- "${OVERLAY}"; then
            echo "Production already pinned to ${DEPLOY_TAG}; nothing to deploy."
            exit 0
          fi

          git config user.name "benchfinity-website-ci[bot]"
          git config user.email "ci@benchfinity.com"
          git add "${OVERLAY}"
          git commit -m "deploy(website): roll production to ${DEPLOY_TAG}" \
                     -m "Auto-bumped by Website CI from BenchFinity/Website@${SOURCE_SHA}. ArgoCD reconciles."
          git push origin "HEAD:${CD_BRANCH}"
          echo "Pushed ${DEPLOY_TAG} to ${CD_REPO}@${CD_BRANCH}; ArgoCD will roll it out."