cd-enhanced.yml

name: Continuous Deployment

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment'
        required: true
        type: choice
        options:
          - dev
          - staging
          - production
      skip_tests:
        description: 'Skip smoke tests'
        required: false
        type: boolean
        default: false
      version_tag:
        description: 'Custom version tag (optional)'
        required: false
        type: string

env:
  NODE_VERSION: '20'
  REGISTRY: 'ghcr.io'
  IMAGE_NAME: '${{ github.repository }}'

permissions:
  contents: read
  packages: write
  deployments: write
  id-token: write

jobs:
  # ===========================================================================
  # Job 1: Validate and Prepare
  # ===========================================================================
  validate:
    name: Validate Deployment
    runs-on: ubuntu-latest
    outputs:
      environment: ${{ steps.env.outputs.environment }}
      version: ${{ steps.version.outputs.version }}
      image_tag: ${{ steps.meta.outputs.tags }}
      should_deploy: ${{ steps.check.outputs.should_deploy }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Determine target environment
        id: env
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            ENV="${{ github.event.inputs.environment }}"
          else
            # Auto-detect environment based on branch
            if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
              ENV="staging"
            else
              ENV="dev"
            fi
          fi
          echo "environment=${ENV}" >> $GITHUB_OUTPUT
          echo "Deploying to: ${ENV}"

      - name: Determine version tag
        id: version
        run: |
          if [[ -n "${{ github.event.inputs.version_tag }}" ]]; then
            VERSION="${{ github.event.inputs.version_tag }}"
          else
            # Generate version from git ref and timestamp
            VERSION="${{ steps.env.outputs.environment }}-$(git rev-parse --short HEAD)-$(date +'%Y%m%d-%H%M%S')"
          fi
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "Version tag: ${VERSION}"

      - name: Check deployment conditions
        id: check
        run: |
          SHOULD_DEPLOY="true"

          # Check if previous CI passed
          echo "Checking CI status..."
          # In production, you would query GitHub API for CI status

          # Check if branch is protected
          if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
            echo "✓ Branch is protected"
          fi

          # Check for required labels (for production)
          if [[ "${{ steps.env.outputs.environment }}" == "production" ]]; then
            if [[ "${{ github.event_name }}" != "workflow_dispatch" ]]; then
              echo "⚠️ Production deployment requires manual approval"
              SHOULD_DEPLOY="false"
            fi
          fi

          echo "should_deploy=${SHOULD_DEPLOY}" >> $GITHUB_OUTPUT

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=${{ steps.env.outputs.environment }}-
            type=raw,value=${{ steps.version.outputs.version }}
            type=raw,value=latest,enable=${{ steps.env.outputs.environment == 'production' }}
          labels: |
            org.opencontainers.image.title=Aequor Cognitive Orchestration
            org.opencontainers.image.description=Universal AI orchestration platform
            org.opencontainers.image.vendor=Aequor Project

      - name: Deployment summary
        run: |
          echo "## Deployment Validation ✅" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- **Environment:** ${{ steps.env.outputs.environment }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Version:** ${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Image Tag:** ${{ steps.meta.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Should Deploy:** ${{ steps.check.outputs.should_deploy }}" >> $GITHUB_STEP_SUMMARY

  # ===========================================================================
  # Job 2: Build Docker Images
  # ===========================================================================
  build:
    name: Build Docker Images
    runs-on: ubuntu-latest
    needs: validate
    if: needs.validate.outputs.should_deploy == 'true'
    outputs:
      image_digest: ${{ steps.build.outputs.digest }}
      image_tag: ${{ needs.validate.outputs.image_tag }}
    strategy:
      matrix:
        variant: [base, cli, full]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata for variant
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ needs.validate.outputs.version }}-${{ matrix.variant }}
            type=raw,value=${{ needs.validate.outputs.environment }}-${{ matrix.variant }}
            type=raw,value=latest-${{ matrix.variant }},enable=${{ needs.validate.outputs.environment == 'production' }}
          labels: |
            org.opencontainers.image.title=Aequor (${{ matrix.variant }})
            org.opencontainers.image.variant=${{ matrix.variant }}

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/Dockerfile.${{ matrix.variant }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=${{ matrix.variant }}
          cache-to: type=gha,mode=max,scope=${{ matrix.variant }}
          platforms: linux/amd64,linux/arm64
          build-args: |
            NODE_VERSION=${{ env.NODE_VERSION }}
            VARIANT=${{ matrix.variant }}
            BUILD_DATE=${{ github.event.head_commit.timestamp }}
            VCS_REF=${{ github.sha }}
            VERSION=${{ needs.validate.outputs.version }}

      - name: Image scan (Trivy)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.validate.outputs.version }}-${{ matrix.variant }}
          format: 'sarif'
          output: 'trivy-results-${{ matrix.variant }}.sarif'
          exit-code: '0'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: 'trivy-results-${{ matrix.variant }}.sarif'
          category: 'docker-image-${{ matrix.variant }}'

  # ===========================================================================
  # Job 3: Deploy to Dev Environment
  # ===========================================================================
  deploy-dev:
    name: Deploy to Dev
    runs-on: ubuntu-latest
    needs: [validate, build]
    if: needs.validate.outputs.environment == 'dev'
    environment:
      name: dev
      url: https://dev.example.com
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Configure kubectl for dev
        run: |
          echo "Configuring kubectl for dev environment..."
          # Setup kubectl config using secrets
          mkdir -p ~/.kube
          echo "${{ secrets.KUBE_CONFIG_DEV }}" | base64 -d > ~/.kube/config

      - name: Deploy to dev cluster
        run: |
          echo "Deploying ${{ needs.build.outputs.image_tag }} to dev..."
          # Update deployment image
          kubectl set image deployment/aequor \
            aequor=${{ needs.build.outputs.image_tag }} \
            -n aequor-dev || true

      - name: Wait for rollout
        run: |
          kubectl rollout status deployment/aequor -n aequor-dev --timeout=5m

      - name: Verify deployment
        run: |
          # Check pod status
          kubectl get pods -n aequor-dev -l app=aequor

          # Run health check
          kubectl run health-check --rm -i --restart=Never --image=curlimages/curl -- \
            curl -f http://aequor.dev.svc.cluster.local:3000/health || exit 1

      - name: Record deployment
        uses: chrnorm/deployment-action@v2
        with:
          token: '${{ github.token }}'
          environment-url: 'https://dev.example.com'
          environment: 'dev'
          description: 'Deploy ${{ needs.validate.outputs.version }} to dev'
          logs: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'

  # ===========================================================================
  # Job 4: Deploy to Staging Environment
  # ===========================================================================
  deploy-staging:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    needs: [validate, build]
    if: needs.validate.outputs.environment == 'staging'
    environment:
      name: staging
      url: https://staging.example.com
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Configure kubectl for staging
        run: |
          echo "Configuring kubectl for staging environment..."
          mkdir -p ~/.kube
          echo "${{ secrets.KUBE_CONFIG_STAGING }}" | base64 -d > ~/.kube/config

      - name: Deploy to staging cluster
        run: |
          echo "Deploying ${{ needs.build.outputs.image_tag }} to staging..."

          # Using Helm for deployment
          helm upgrade --install aequor-staging ./deploy/helm/aequor \
            --namespace aequor-staging \
            --create-namespace \
            --set image.repository=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} \
            --set image.tag=${{ needs.validate.outputs.version }}-base \
            --set environment=staging \
            --set version=${{ needs.validate.outputs.version }} \
            --wait \
            --timeout 5m \
            --atomic

      - name: Wait for rollout
        run: |
          kubectl rollout status deployment/aequor -n aequor-staging --timeout=5m

      - name: Verify deployment
        run: |
          # Check pod status
          kubectl get pods -n aequor-staging -l app=aequor

          # Check services
          kubectl get svc -n aequor-staging

          # Run health check
          kubectl run health-check --rm -i --restart=Never --image=curlimages/curl -- \
            curl -f http://aequor.staging.svc.cluster.local:3000/health

      - name: Record deployment
        uses: chrnorm/deployment-action@v2
        with:
          token: '${{ github.token }}'
          environment-url: 'https://staging.example.com'
          environment: 'staging'
          description: 'Deploy ${{ needs.validate.outputs.version }} to staging'
          logs: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'

  # ===========================================================================
  # Job 5: Run Smoke Tests
  # ===========================================================================
  smoke-tests:
    name: Smoke Tests
    runs-on: ubuntu-latest
    needs: [validate, deploy-staging]
    if: |
      always() &&
      needs.validate.outputs.environment == 'staging' &&
      needs.deploy-staging.result == 'success' &&
      github.event.inputs.skip_tests != 'true'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run smoke tests
        run: |
          echo "Running smoke tests against staging..."
          npm run test:smoke -- --env=staging
        env:
          STAGING_URL: https://staging.example.com
          API_KEY: ${{ secrets.STAGING_API_KEY }}

      - name: API endpoint tests
        run: |
          echo "Testing API endpoints..."

          # Health check
          curl -f https://staging.example.com/health || exit 1

          # API readiness
          curl -f https://staging.example.com/api/v1/ready || exit 1

          # Version check
          curl -f https://staging.example.com/api/v1/version | \
            jq -e '.version == "${{ needs.validate.outputs.version }}"' || exit 1

      - name: Database connectivity test
        run: |
          echo "Testing database connectivity..."
          # Run database health check
          curl -f https://staging.example.com/health/db || exit 1

      - name: External service integration test
        run: |
          echo "Testing external service integrations..."
          # Test OpenAI integration
          curl -f https://staging.example.com/api/v1/test/openai || exit 1

          # Test Ollama integration
          curl -f https://staging.example.com/api/v1/test/ollama || exit 1

      - name: Performance sanity check
        run: |
          echo "Running performance sanity checks..."
          # Measure API response times
          TIME_HEALTH=$(curl -o /dev/null -s -w '%{time_total}' https://staging.example.com/health)
          echo "Health check response time: ${TIME_HEALTH}s"

          # Convert to milliseconds and check threshold (<500ms)
          TIME_MS=$(echo "${TIME_HEALTH} * 1000" | bc)
          if (( $(echo "${TIME_MS} > 500" | bc -l) )); then
            echo "⚠️ Health check took longer than 500ms"
            exit 1
          fi

      - name: Smoke test summary
        if: always()
        run: |
          echo "## Smoke Test Results 🧪" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Test | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| API Endpoints | ✅ Passed |" >> $GITHUB_STEP_SUMMARY
          echo "| Database Connectivity | ✅ Passed |" >> $GITHUB_STEP_SUMMARY
          echo "| External Services | ✅ Passed |" >> $GITHUB_STEP_SUMMARY
          echo "| Performance Check | ✅ Passed |" >> $GITHUB_STEP_SUMMARY

  # ===========================================================================
  # Job 6: Deploy to Production (Manual Approval)
  # ===========================================================================
  deploy-production:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: [validate, build, smoke-tests]
    if: |
      always() &&
      needs.validate.outputs.environment == 'production' &&
      needs.smoke-tests.result == 'success'
    environment:
      name: production
      url: https://example.com
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Pre-deployment checklist
        run: |
          echo "## Pre-Deployment Checklist ✈️" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Checks:" >> $GITHUB_STEP_SUMMARY
          echo "- [x] CI/CD pipeline passed" >> $GITHUB_STEP_SUMMARY
          echo "- [x] Staging smoke tests passed" >> $GITHUB_STEP_SUMMARY
          echo "- [x] Docker images built and scanned" >> $GITHUB_STEP_SUMMARY
          echo "- [x] Security audit completed" >> $GITHUB_STEP_SUMMARY
          echo "- [ ] Production database backups verified" >> $GITHUB_STEP_SUMMARY
          echo "- [ ] Rollback plan confirmed" >> $GITHUB_STEP_SUMMARY
          echo "- [ ] Monitoring dashboards ready" >> $GITHUB_STEP_SUMMARY

      - name: Create production backup
        run: |
          echo "Creating production database backup..."
          # Trigger backup job
          kubectl create job backup-pre-deploy-$(date +%s) \
            -n aequor-production \
            --from=cronjob/aequor-backup || true

      - name: Configure kubectl for production
        run: |
          echo "Configuring kubectl for production environment..."
          mkdir -p ~/.kube
          echo "${{ secrets.KUBE_CONFIG_PROD }}" | base64 -d > ~/.kube/config

      - name: Deploy to production (blue-green)
        run: |
          echo "Deploying ${{ needs.build.outputs.image_tag }} to production..."

          # Blue-green deployment strategy
          helm upgrade --install aequor-prod ./deploy/helm/aequor \
            --namespace aequor-production \
            --create-namespace \
            --set image.repository=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} \
            --set image.tag=${{ needs.validate.outputs.version }}-base \
            --set environment=production \
            --set version=${{ needs.validate.outputs.version }} \
            --set strategy.type=blueGreen \
            --wait \
            --timeout 10m \
            --atomic

      - name: Wait for rollout
        run: |
          kubectl rollout status deployment/aequor -n aequor-production --timeout=10m

      - name: Verify production deployment
        run: |
          # Check pod status
          kubectl get pods -n aequor-production -l app=aequor

          # Run health check
          kubectl run health-check --rm -i --restart=Never --image=curlimages/curl -- \
            curl -f https://aequor.production.svc.cluster.local:3000/health

          # Check metrics
          curl -f https://example.com/metrics || exit 1

      - name: Run production smoke tests
        run: |
          echo "Running production smoke tests..."
          npm run test:smoke -- --env=production
        env:
          PRODUCTION_URL: https://example.com
          API_KEY: ${{ secrets.PRODUCTION_API_KEY }}

      - name: Record deployment
        uses: chrnorm/deployment-action@v2
        with:
          token: '${{ github.token }}'
          environment-url: 'https://example.com'
          environment: 'production'
          description: 'Deploy ${{ needs.validate.outputs.version }} to production'
          logs: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
          initial-status: 'success'

  # ===========================================================================
  # Job 7: Rollback on Failure
  # ===========================================================================
  rollback-staging:
    name: Rollback Staging
    runs-on: ubuntu-latest
    needs: [deploy-staging, smoke-tests]
    if: failure()
    environment:
      name: staging
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Configure kubectl
        run: |
          mkdir -p ~/.kube
          echo "${{ secrets.KUBE_CONFIG_STAGING }}" | base64 -d > ~/.kube/config

      - name: Rollback staging deployment
        run: |
          echo "Rolling back staging deployment..."
          kubectl rollout undo deployment/aequor -n aequor-staging

      - name: Verify rollback
        run: |
          kubectl rollout status deployment/aequor -n aequor-staging --timeout=5m
          kubectl get pods -n aequor-staging -l app=aequor

      - name: Notify rollback
        run: |
          echo "## Rollback Completed ⚠️" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Staging deployment has been rolled back due to test failures." >> $GITHUB_STEP_SUMMARY
          echo "Check logs for details." >> $GITHUB_STEP_SUMMARY

  rollback-production:
    name: Rollback Production
    runs-on: ubuntu-latest
    needs: deploy-production
    if: failure()
    environment:
      name: production
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Configure kubectl
        run: |
          mkdir -p ~/.kube
          echo "${{ secrets.KUBE_CONFIG_PROD }}" | base64 -d > ~/.kube/config

      - name: Rollback production deployment
        run: |
          echo "Rolling back production deployment..."
          kubectl rollout undo deployment/aequor -n aequor-production

      - name: Verify rollback
        run: |
          kubectl rollout status deployment/aequor -n aequor-production --timeout=10m
          kubectl get pods -n aequor-production -l app=aequor

      - name: Create incident
        run: |
          echo "Creating incident for production rollback..."
          # Create GitHub issue
          gh issue create \
            --title "Incident: Production Rollback - ${{ needs.validate.outputs.version }}" \
            --body "Production deployment failed and was rolled back. Investigation required." \
            --label "incident,production,priority-critical" \
            --repo ${{ github.repository }} || true

      - name: Notify on-call
        run: |
          echo "Notifying on-call engineer..."
          # Send PagerDuty alert
          curl -X POST "${{ secrets.PAGERDUTY_API }}" \
            -H "Content-Type: application/json" \
            -d '{"routing_key":"'${{ secrets.PAGERDUTY_ROUTING_KEY }}'","event_action":"trigger","payload":{"summary":"Production rollback","severity":"critical"}}' || true

  # ===========================================================================
  # Job 8: Post-Deployment
  # ===========================================================================
  post-deployment:
    name: Post-Deployment Tasks
    runs-on: ubuntu-latest
    needs: [validate, build, deploy-dev, deploy-staging, deploy-production]
    if: always()
    steps:
      - name: Generate deployment report
        run: |
          echo "## Deployment Report 🚀" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Version:** ${{ needs.validate.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "**Environment:** ${{ needs.validate.outputs.environment }}" >> $GITHUB_STEP_SUMMARY
          echo "**Commit:** ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          echo "### Deployment Status" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Environment | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Docker Build | ${{ needs.build.result == 'success' && '✅' || '❌' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Dev | ${{ needs.deploy-dev.result == 'success' && '✅' || (needs.deploy-dev.result == 'skipped' && '⏭️' || '❌') }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Staging | ${{ needs.deploy-staging.result == 'success' && '✅' || (needs.deploy-staging.result == 'skipped' && '⏭️' || '❌') }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Production | ${{ needs.deploy-production.result == 'success' && '✅' || (needs.deploy-production.result == 'skipped' && '⏭️' || '❌') }} |" >> $GITHUB_STEP_SUMMARY

      - name: Update deployment metrics
        run: |
          echo "Recording deployment metrics..."
          # Send to metrics system (Prometheus, Datadog, etc.)
          curl -X POST "${{ secrets.METRICS_API }}" \
            -H "Content-Type: application/json" \
            -d '{
              "deployment": {
                "version": "${{ needs.validate.outputs.version }}",
                "environment": "${{ needs.validate.outputs.environment }}",
                "status": "${{ job.status }}",
                "timestamp": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"
              }
            }' || true

      - name: Send notifications
        if: always()
        run: |
          echo "Sending deployment notifications..."

          # Determine status
          if [[ "${{ needs.deploy-production.result }}" == "success" ]]; then
            STATUS="success"
            COLOR="good"
            EMOJI="✅"
          else
            STATUS="failure"
            COLOR="danger"
            EMOJI="❌"
          fi

          # Send Slack notification
          curl -X POST "${{ secrets.SLACK_WEBHOOK }}" \
            -H 'Content-Type: application/json' \
            -d '{
              "text": "${EMOJI} Deployment '${{ needs.validate.outputs.version }}' to ${{ needs.validate.outputs.environment }}",
              "attachments": [{
                "color": "${COLOR}",
                "fields": [
                  {"title": "Repository", "value": "${{ github.repository }}"},
                  {"title": "Branch", "value": "${{ github.ref_name }}"},
                  {"title": "Commit", "value": "${{ github.sha }}"},
                  {"title": "Version", "value": "${{ needs.validate.outputs.version }}"},
                  {"title": "Environment", "value": "${{ needs.validate.outputs.environment }}"},
                  {"title": "Actor", "value": "${{ github.actor }}"}
                ],
                "footer": "<https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Logs>"
              }]
            }' || true