nimbuscloud-platform/.github/workflows/deploy.yml at 380c5b40d341b71647a8a59cdc8c7d0e3828f22a · alain-Sortnext/nimbuscloud-platform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
# NimbusCloud Platform — GitHub Actions CI/CD Pipeline
# ⚠️ BROKEN — multiple issues preventing successful deployment
# Last modified: 2026-04-20 (Jordan Reeves)
# Status: FAILING — see most recent run for error details
#
# KNOWN ISSUES (candidate must fix all):
# 1. Missing secret: DOCKER_PASSWORD not configured in repo settings
# 2. Wrong ECR registry path: references old registry nimbuscloud-ecr-old
# 3. No lint step — broken code can reach production
# 4. No test step — no quality gate
# 5. Deploy step references deleted Kubernetes context nimbuscloud-prod-old

name: NimbusCloud Platform CI/CD

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

env:
  AWS_REGION: eu-west-2
  # ⚠️ BUG: ECR registry path is wrong — old registry no longer exists
  ECR_REGISTRY: ${{ secrets.ECR_REGISTRY_OLD }}  # ← WRONG — should be ECR_REGISTRY

jobs:
  # ─────────────────────────────────────────────
  # ⚠️ MISSING: lint job — no code quality gate
  # Candidate must add an ESLint / flake8 / golint step
  # ─────────────────────────────────────────────

  # ─────────────────────────────────────────────
  # ⚠️ MISSING: test job — no automated tests run
  # Candidate must add npm test / pytest / go test step
  # ─────────────────────────────────────────────

  build:
    name: Build and Push Images
    runs-on: ubuntu-latest
    # ⚠️ Missing needs: [lint, test] — add when those jobs exist

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          # ⚠️ BUG: DOCKER_PASSWORD secret is not configured in repository settings
          # Pipeline fails here with: Error: Username and password required
          password: ${{ secrets.DOCKER_PASSWORD }}  # ← SECRET NOT CONFIGURED

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push booking-api
        uses: docker/build-push-action@v5
        with:
          context: ./services/booking-api
          push: ${{ github.event_name != 'pull_request' }}
          # ⚠️ BUG: ECR_REGISTRY_OLD is wrong variable name
          tags: ${{ env.ECR_REGISTRY }}/booking-api:${{ github.sha }},${{ env.ECR_REGISTRY }}/booking-api:latest

      - name: Build and push payment-api
        uses: docker/build-push-action@v5
        with:
          context: ./services/payment-api
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ env.ECR_REGISTRY }}/payment-api:${{ github.sha }},${{ env.ECR_REGISTRY }}/payment-api:latest

      - name: Build and push auth-service
        uses: docker/build-push-action@v5
        with:
          context: ./services/auth-service
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ env.ECR_REGISTRY }}/auth-service:${{ github.sha }},${{ env.ECR_REGISTRY }}/auth-service:latest

      - name: Build and push notification-service
        uses: docker/build-push-action@v5
        with:
          context: ./services/notification-service
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ env.ECR_REGISTRY }}/notification-service:${{ github.sha }},${{ env.ECR_REGISTRY }}/notification-service:latest

  deploy:
    name: Deploy to Kubernetes
    runs-on: ubuntu-latest
    needs: build
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Set up kubectl
        uses: azure/setup-kubectl@v3
        with:
          version: 'v1.28.0'

      - name: Update kubeconfig
        run: |
          # ⚠️ BUG: cluster name nimbuscloud-prod-old no longer exists
          # Should be: nimbuscloud-platform-cluster
          aws eks update-kubeconfig \
            --region ${{ env.AWS_REGION }} \
            --name nimbuscloud-prod-old   # ← WRONG cluster name

      - name: Deploy to Kubernetes
        run: |
          kubectl set image deployment/booking-api \
            booking-api=${{ env.ECR_REGISTRY }}/booking-api:${{ github.sha }}
          kubectl set image deployment/payment-api \
            payment-api=${{ env.ECR_REGISTRY }}/payment-api:${{ github.sha }}
          kubectl set image deployment/auth-service \
            auth-service=${{ env.ECR_REGISTRY }}/auth-service:${{ github.sha }}
          kubectl set image deployment/notification-service \
            notification-service=${{ env.ECR_REGISTRY }}/notification-service:${{ github.sha }}

      - name: Verify deployment
        run: |
          kubectl rollout status deployment/booking-api --timeout=120s
          kubectl rollout status deployment/payment-api --timeout=120s
          kubectl rollout status deployment/auth-service --timeout=120s
          kubectl rollout status deployment/notification-service --timeout=120s