# Acceso al clúster Kubernetes
KUBE_CONFIG_DATA          # Base64 del archivo kubeconfig
KUBE_CLUSTER_URL          # URL del clúster
KUBE_TOKEN                # Token de service account

# Registry de contenedores
REGISTRY_USERNAME         # Usuario del registry
REGISTRY_PASSWORD         # Contraseña o token
REGISTRY_URL              # URL del registry

# Notificaciones y herramientas
SLACK_WEBHOOK_URL         # Para notificaciones
SONAR_TOKEN              # Para análisis de código

name: Continuous Integration

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [16.x, 18.x, 20.x]
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Setup Node.js ${{ matrix.node-version }}
      uses: actions/setup-node@v4
      with:
        node-version: ${{ matrix.node-version }}
        cache: 'npm'
        
    - name: Install dependencies
      run: npm ci
      
    - name: Run linting
      run: npm run lint
      
    - name: Run unit tests
      run: npm run test:unit
      
    - name: Run integration tests
      run: npm run test:integration
      
    - name: Generate test coverage
      run: npm run test:coverage
      
    - name: Upload coverage reports to Codecov
      uses: codecov/codecov-action@v3
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        file: ./coverage/lcov.info
        flags: unittests
        name: codecov-umbrella

  security:
    runs-on: ubuntu-latest
    needs: test
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Run CodeQL Analysis
      uses: github/codeql-action/init@v3
      with:
        languages: javascript
        
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      
    - name: Run npm audit
      run: npm audit --audit-level=critical
      
    - name: Run dependency vulnerability scan
      uses: actions/dependency-review-action@v3
      if: github.event_name == 'pull_request'

  build:
    runs-on: ubuntu-latest
    needs: [test, security]
    outputs:
      image-digest: ${{ steps.build.outputs.digest }}
      image-tags: ${{ steps.meta.outputs.tags }}
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
      
    - name: Log in to Container Registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
        
    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=sha,prefix={{branch}}-
          type=raw,value=latest,enable={{is_default_branch}}
          
    - name: Build and push Docker image
      id: build
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
        provenance: false
        
    - name: Container image security scan
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
        format: 'sarif'
        output: 'trivy-results.sarif'
        
    - name: Upload security scan results to GitHub
      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: 'trivy-results.sarif'

# Build stage
FROM node:18-alpine AS builder
WORKDIR /app

# Copy dependency files
COPY package*.json ./

# Install dependencies (including dev dependencies)
RUN npm ci --only=production --silent

# Copy source code
COPY src/ ./src/
COPY public/ ./public/

# Build application
RUN npm run build

# Production stage
FROM node:18-alpine AS production

# Install dumb-init for proper signal handling
RUN apk add --no-cache dumb-init

# Create app directory and user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nextjs -u 1001

WORKDIR /app

# Copy built application from builder stage
COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=nextjs:nodejs /app/dist ./dist
COPY --from=builder --chown=nextjs:nodejs /app/package*.json ./

# Switch to non-root user
USER nextjs

# Expose port
EXPOSE 3000

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD node healthcheck.js

# Start application
ENTRYPOINT ["dumb-init", "--"]
CMD ["node", "dist/index.js"]

name: Continuous Deployment

on:
  workflow_run:
    workflows: ["Continuous Integration"]
    branches: [main]
    types: [completed]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    environment: staging
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Setup kubectl
      uses: azure/setup-kubectl@v3
      with:
        version: 'v1.28.0'
        
    - name: Configure kubectl for staging
      run: |
        echo "${{ secrets.KUBE_CONFIG_STAGING }}" | base64 -d > /tmp/kubeconfig
        export KUBECONFIG=/tmp/kubeconfig
        kubectl config current-context
        
    - name: Deploy to staging with Kustomize
      run: |
        export KUBECONFIG=/tmp/kubeconfig
        cd k8s/overlays/staging
        
        # Update image tag in kustomization
        kustomize edit set image app=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
        
        # Apply configurations
        kustomize build . | kubectl apply -f -
        
        # Wait for rollout
        kubectl rollout status deployment/app -n staging --timeout=300s
        
    - name: Run smoke tests
      run: |
        # Wait for service to be ready
        sleep 30
        
        # Basic health check
        STAGING_URL="https://staging.myapp.com"
        response=$(curl -s -o /dev/null -w "%{http_code}" $STAGING_URL/health)
        
        if [ $response -eq 200 ]; then
          echo "✅ Staging deployment successful"
        else
          echo "❌ Staging health check failed with code: $response"
          exit 1
        fi

  deploy-production:
    runs-on: ubuntu-latest
    needs: deploy-staging
    environment: 
      name: production
      url: https://myapp.com
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Setup kubectl
      uses: azure/setup-kubectl@v3
      with:
        version: 'v1.28.0'
        
    - name: Configure kubectl for production
      run: |
        echo "${{ secrets.KUBE_CONFIG_PRODUCTION }}" | base64 -d > /tmp/kubeconfig
        export KUBECONFIG=/tmp/kubeconfig
        kubectl config current-context
        
    - name: Blue-Green Deployment
      run: |
        export KUBECONFIG=/tmp/kubeconfig
        cd k8s/overlays/production
        
        # Update image tag
        kustomize edit set image app=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
        
        # Deploy green version
        kustomize build . | sed 's/app:/app-green:/g' | kubectl apply -f -
        
        # Wait for green deployment
        kubectl rollout status deployment/app-green -n production --timeout=600s
        
        # Health check on green version
        GREEN_IP=$(kubectl get service app-green -n production -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
        
        for i in {1..30}; do
          if curl -f http://$GREEN_IP/health; then
            echo "Green deployment health check passed"
            break
          fi
          echo "Attempt $i: Health check failed, retrying in 10s..."
          sleep 10
        done
        
        # Switch traffic to green
        kubectl patch service app -n production -p '{"spec":{"selector":{"version":"green"}}}'
        
        echo "✅ Traffic switched to green deployment"
        
        # Wait before cleaning up blue
        sleep 60
        
        # Remove blue deployment
        kubectl delete deployment app-blue -n production --ignore-not-found=true
        
    - name: Post-deployment monitoring
      run: |
        export KUBECONFIG=/tmp/kubeconfig
        
        echo "Monitoring application metrics for 5 minutes..."
        
        # Monitor error rates and response times
        for i in {1..10}; do
          # In a real scenario, query your monitoring system (Prometheus, DataDog, etc.)
          echo "Checking metrics at $(date)"
          
          # Example: Query Prometheus for error rate
          # ERROR_RATE=$(curl -s "http://prometheus:9090/api/v1/query?query=rate(http_requests_total{status=~'5..'}[5m])" | jq -r '.data.result[0].value[1]')
          
          # For demo, simulate successful monitoring
          echo "✅ Error rate: 1%, Response time: 200ms"
          sleep 30
        done
        
    - name: Notify deployment success
      uses: 8398a7/action-slack@v3
      with:
        status: success
        text: |
          🚀 Production deployment successful!
          
          **Repository:** ${{ github.repository }}
          **Commit:** ${{ github.sha }}
          **Author:** ${{ github.actor }}
          **Branch:** ${{ github.ref_name }}
          
          [View Deployment](https://myapp.com)
      env:
        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
      if: success()
      
    - name: Notify deployment failure
      uses: 8398a7/action-slack@v3
      with:
        status: failure
        text: |
          🚨 Production deployment failed!
          
          **Repository:** ${{ github.repository }}
          **Commit:** ${{ github.sha }}
          **Author:** ${{ github.actor }}
          
          [View Logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
      env:
        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
      if: failure()

  rollback:
    runs-on: ubuntu-latest
    if: failure()
    environment: production
    
    steps:
    - name: Emergency rollback
      run: |
        echo "${{ secrets.KUBE_CONFIG_PRODUCTION }}" | base64 -d > /tmp/kubeconfig
        export KUBECONFIG=/tmp/kubeconfig
        
        echo "Performing emergency rollback..."
        kubectl rollout undo deployment/app -n production
        kubectl rollout status deployment/app -n production --timeout=300s
        
        echo "🔄 Rollback completed successfully"

# k8s/base/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
  labels:
    app: myapp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "3000"
        prometheus.io/path: "/metrics"
    spec:
      containers:
      - name: app
        image: app:latest
        ports:
        - containerPort: 3000
          name: http
        env:
        - name: NODE_ENV
          value: "production"
        - name: PORT
          value: "3000"
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /ready
            port: 3000
          initialDelaySeconds: 10
          periodSeconds: 5
          timeoutSeconds: 3
          successThreshold: 1
          failureThreshold: 3
        securityContext:
          runAsNonRoot: true
          runAsUser: 1001
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL
        volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: logs
          mountPath: /app/logs
      volumes:
      - name: tmp
        emptyDir: {}
      - name: logs
        emptyDir: {}
      serviceAccountName: app-sa
      imagePullSecrets:
      - name: registry-secret

# k8s/base/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: app
  labels:
    app: myapp
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
spec:
  type: LoadBalancer
  ports:
  - port: 80
    targetPort: 3000
    protocol: TCP
    name: http
  selector:
    app: myapp

# k8s/base/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  app.properties: |
    # Application configuration
    server.port=3000
    logging.level=info
    
    # Database settings
    database.pool.max=10
    database.timeout=30
    
    # Feature flags
    feature.metrics.enabled=true
    feature.tracing.enabled=true

# k8s/base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- deployment.yaml
- service.yaml
- configmap.yaml
- serviceaccount.yaml
- rbac.yaml

commonLabels:
  app: myapp
  version: v1

images:
- name: app
  newTag: latest

# k8s/overlays/production/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: production

resources:
- ../../base

patchesStrategicMerge:
- deployment-patch.yaml
- service-patch.yaml

replicas:
- name: app
  count: 5

images:
- name: app
  newTag: v1.0.0

configMapGenerator:
- name: app-config
  behavior: merge
  literals:
  - "database.pool.max=20"
  - "logging.level=warn"

secretGenerator:
- name: app-secrets
  literals:
  - "database.password=prod-secret"
  - "api.key=prod-api-key"

# k8s/canary.yaml
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: myapp
  namespace: production
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  progressDeadlineSeconds: 60
  service:
    port: 80
    targetPort: 3000
    gateways:
    - public-gateway
    hosts:
    - myapp.com
  analysis:
    interval: 1m
    threshold: 5
    maxWeight: 50
    stepWeight: 10
    metrics:
    - name: request-success-rate
      thresholdRange:
        min: 99
      interval: 1m
    - name: request-duration
      thresholdRange:
        max: 500
      interval: 30s
    webhooks:
    - name: acceptance-test
      type: pre-rollout
      url: http://flagger-loadtester.test/
      timeout: 30s
      metadata:
        type: bash
        cmd: "curl -sd 'test' http://myapp-canary/token | grep token"
    - name: load-test
      url: http://flagger-loadtester.test/
      timeout: 5s
      metadata:
        cmd: "hey -z 1m -q 10 -c 2 http://myapp-canary/"

# k8s/rollout.yaml
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: myapp
spec:
  replicas: 5
  strategy:
    canary:
      maxSurge: 2
      maxUnavailable: 0
      analysis:
        templates:
        - templateName: success-rate
        args:
        - name: service-name
          value: myapp
      steps:
      - setWeight: 20
      - pause: {duration: 10m}
      - setWeight: 40
      - pause: {duration: 10m}
      - setWeight: 60
      - pause: {duration: 10m}
      - setWeight: 80
      - pause: {duration: 10m}
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: app
        image: myapp:stable
        ports:
        - containerPort: 3000

# k8s/monitoring.yaml
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  selector:
    matchLabels:
      app: myapp
  endpoints:
  - port: http
    interval: 30s
    path: /metrics

# CI/CD Pipeline monitoring query examples
# Deployment frequency
sum(increase(github_actions_workflow_run_conclusion_total{conclusion="success",workflow_name="CD"}[1d]))

# Lead time for changes (time from commit to deployment)
histogram_quantile(0.95, sum(rate(deployment_lead_time_seconds_bucket[5m])) by (le))

# Mean time to recovery
avg(deployment_rollback_duration_seconds)

# Change failure rate
sum(rate(deployment_failure_total[1d])) / sum(rate(deployment_total[1d]))

# GitHub Actions optimizations
- name: Cache Docker layers
  uses: actions/cache@v3
  with:
    path: /tmp/.buildx-cache
    key: ${{ runner.os }}-buildx-${{ github.sha }}
    restore-keys: |
      ${{ runner.os }}-buildx-

- name: Build with cache
  uses: docker/build-push-action@v4
  with:
    cache-from: type=local,src=/tmp/.buildx-cache
    cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max

# End-to-end testing in staging
- name: Run E2E tests
  run: |
    npm install -g @playwright/test
    npx playwright install
    
    # Wait for application to be ready
    kubectl wait --for=condition=ready pod -l app=myapp -n staging --timeout=300s
    
    # Get staging URL
    STAGING_URL=$(kubectl get ingress myapp-ingress -n staging -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
    
    # Run tests
    BASE_URL=https://$STAGING_URL npx playwright test