image: node:18-alpine

stages:
  - build
  - test
  - security
  - deploy

# Cache node_modules for faster builds
cache:
  key: ${CI_COMMIT_REF_SLUG}
  paths:
    - node_modules/
    - .npm/

# Build stage
build-job:
  stage: build
  script:
    - npm ci --cache .npm --prefer-offline
    - npm run build
  artifacts:
    paths:
      - dist/
    expire_in: 1 week

# Test stage with parallel jobs
test-unit:
  stage: test
  script:
    - npm run test:unit -- --coverage --passWithNoTests
  artifacts:
    reports:
      junit: reports/junit.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura-coverage.xml
  coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'

test-integration:
  stage: test
  script:
    - npm run test:integration
  dependencies:
    - build-job

# Security scanning
security-audit:
  stage: security
  script:
    - npm audit --audit-level=high
    - npx snyk test --severity-threshold=high
  allow_failure: false

# Linting job (runs in parallel)
lint:
  stage: test
  script:
    - npm run lint
    - npm run type-check

# Deploy to staging
deploy-staging:
  stage: deploy
  script:
    - echo "Deploying to staging environment..."
    - npm run deploy:staging
  environment:
    name: staging
    url: https://staging-api.example.com
  only:
    - develop

# Deploy to production
deploy-production:
  stage: deploy
  script:
    - echo "Deploying to production..."
    - npm run deploy:production
  environment:
    name: production
    url: https://api.example.com
  when: manual
  only:
    - main

# Use Docker-in-Docker (dind) service
image: docker:20.10

services:
  - docker:20.10-dind

variables:
  DOCKER_TLS_CERTDIR: "/certs"
  DOCKER_DRIVER: overlay2
  # Use GitLab Container Registry
  CONTAINER_IMAGE: $CI_REGISTRY/$CI_PROJECT_NAMESPACE/$CI_PROJECT_NAME:$CI_COMMIT_SHA
  CONTAINER_IMAGE_LATEST: $CI_REGISTRY/$CI_PROJECT_NAMESPACE/$CI_PROJECT_NAME:latest

stages:
  - build
  - test
  - scan
  - push

# Docker Build stage
docker-build:
  stage: build
  script:
    # Login to GitLab Container Registry
    - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin $CI_REGISTRY
    # Build Docker image
    - docker build --pull -t $CONTAINER_IMAGE -t $CONTAINER_IMAGE_LATEST .
    # Save image as artifact
    - docker save $CONTAINER_IMAGE > image.tar
  artifacts:
    paths:
      - image.tar
    expire_in: 1 hour

# Multi-architecture build (optional)
docker-buildx:
  stage: build
  script:
    - |
      docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
      docker buildx create --name multiarch --use
      docker buildx inspect --bootstrap
      docker buildx build --platform linux/amd64,linux/arm64 \
        -t $CONTAINER_IMAGE \
        -t $CONTAINER_IMAGE_LATEST \
        --push .
  only:
    - main
    - tags

# Security scan with Trivy
docker-scan:
  stage: scan
  image: aquasec/trivy:latest
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CONTAINER_IMAGE
    - trivy image --format template --template "@/contrib/gitlab.tpl" --output "gl-dependency-scanning-report.json" $CONTAINER_IMAGE
  artifacts:
    reports:
      dependency_scanning: gl-dependency-scanning-report.json
  allow_failure: false

# Push to GitLab Registry
docker-push:
  stage: push
  script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin $CI_REGISTRY
    - docker push $CONTAINER_IMAGE
    - docker push $CONTAINER_IMAGE_LATEST
  dependencies:
    - docker-build
    - docker-scan
  only:
    - main
    - develop
    - /^release\/.*$/

# Stage 1: Build
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

# Stage 2: Production
FROM node:18-alpine AS production
WORKDIR /app
ENV NODE_ENV=production
USER node

# Copy built application
COPY --from=builder --chown=node:node /app/dist ./dist
COPY --from=builder --chown=node:node /app/node_modules ./node_modules
COPY --from=builder --chown=node:node /app/package*.json ./

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD node -e "require('http').get('http://localhost:${PORT:-3000}/health', (r) => {if(r.statusCode!==200)throw new Error()})"

EXPOSE 3000
CMD ["node", "dist/index.js"]

image: alpine/helm:3.12

stages:
  - lint
  - test
  - package
  - deploy

variables:
  HELM_EXPERIMENTAL_OCI: 1
  KUBE_NAMESPACE: ${CI_PROJECT_NAME}-${CI_ENVIRONMENT_NAME}

# Lint Helm charts
lint-helm:
  stage: lint
  script:
    - helm lint ./charts/myapp
    - helm lint ./charts/myapp --strict

# Test Helm charts with helm test
test-helm:
  stage: test
  script:
    - helm install myapp-test ./charts/myapp --dry-run --debug
    # Run helm test if tests are defined
    - |
      if [ -d "./charts/myapp/templates/tests" ]; then
        helm install test-release ./charts/myapp --wait
        helm test test-release
        helm uninstall test-release
      fi

# Package Helm chart
package-helm:
  stage: package
  script:
    - helm package ./charts/myapp --version ${CI_COMMIT_TAG:-0.0.0+${CI_COMMIT_SHA:0:8}} --app-version ${CI_COMMIT_TAG:-0.0.0}
    - ls -la *.tgz
  artifacts:
    paths:
      - "*.tgz"
    expire_in: 1 week

# Deploy to Kubernetes (Manual approval)
deploy-staging:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - |
      # Configure kubectl
      echo "$KUBECONFIG_STAGING" | base64 -d > kubeconfig.yaml
      export KUBECONFIG=kubeconfig.yaml
      
      # Deploy with Helm
      helm upgrade --install myapp ./charts/myapp \
        --namespace ${KUBE_NAMESPACE} \
        --values ./charts/myapp/values-staging.yaml \
        --set image.tag=${CI_COMMIT_SHA} \
        --atomic \
        --timeout 5m \
        --wait
  environment:
    name: staging
    url: https://staging.myapp.example.com
  only:
    - develop

# Production deployment with manual trigger
deploy-production:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - |
      echo "$KUBECONFIG_PRODUCTION" | base64 -d > kubeconfig.yaml
      export KUBECONFIG=kubeconfig.yaml
      
      helm upgrade --install myapp ./charts/myapp \
        --namespace ${KUBE_NAMESPACE} \
        --values ./charts/myapp/values-production.yaml \
        --set image.tag=${CI_COMMIT_SHA} \
        --atomic \
        --timeout 10m \
        --wait \
        --history-max 5
  environment:
    name: production
    url: https://myapp.example.com
  when: manual
  only:
    - main
    - tags

# Rollback job
rollback-production:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - |
      echo "$KUBECONFIG_PRODUCTION" | base64 -d > kubeconfig.yaml
      export KUBECONFIG=kubeconfig.yaml
      helm rollback myapp 0 --namespace ${KUBE_NAMESPACE}
  when: manual
  only:
    - main
  allow_failure: false

image: postgres:15-alpine

services:
  - postgres:15-alpine

variables:
  POSTGRES_DB: test_db
  POSTGRES_USER: postgres
  POSTGRES_PASSWORD: postgres
  # Use GitLab CI/CD variables for production DB credentials
  # DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PASSWORD

stages:
  - validate
  - test-migration
  - migrate
  - rollback-plan

# Validate migration files
validate-migrations:
  stage: validate
  script:
    - |
      # Check SQL syntax
      for file in migrations/*.sql; do
        echo "Validating $file"
        psql -v ON_ERROR_STOP=1 -f "$file" --dry-run
      done
    # Validate with Liquibase/Flyway
    - |
      if [ -f "liquibase.properties" ]; then
        liquibase validate
      fi
  artifacts:
    paths:
      - migrations/

# Test migrations on temporary database
test-migration:
  stage: test-migration
  script:
    - |
      # Create test database
      createdb -U postgres migration_test
      
      # Apply migrations
      for file in migrations/*.sql; do
        echo "Applying $file to test database"
        psql -U postgres -d migration_test -f "$file"
      done
      
      # Run data integrity tests
      psql -U postgres -d migration_test -f tests/data-integrity-check.sql
      
      # Take schema snapshot for comparison
      pg_dump -U postgres -s migration_test > schema_snapshot.sql
  artifacts:
    paths:
      - schema_snapshot.sql
    expire_in: 1 week

# Apply migrations to staging database
migrate-staging:
  stage: migrate
  script:
    - |
      # Use environment-specific credentials
      export PGHOST=${STAGING_DB_HOST}
      export PGPORT=${STAGING_DB_PORT}
      export PGDATABASE=${STAGING_DB_NAME}
      export PGUSER=${STAGING_DB_USER}
      export PGPASSWORD=${STAGING_DB_PASSWORD}
      
      # Backup before migration
      pg_dump -Fc > backup_${CI_COMMIT_SHA}.dump
      
      # Apply migrations with transaction
      psql -v ON_ERROR_STOP=1 <