decision/.woodpecker/maquette.yml

# La maquette Nuxt v2 (FastAPI + Postgres + IPFS), conservée telle quelle pour
# présenter le projet. Depuis la v3 elle vit sur maquette.decision.librodrome.org ;
# le produit (.woodpecker/app.yml) prend la racine decision.librodrome.org.
# Ce workflow attend le produit : si le produit échoue, la maquette ne bouge pas.
# Le nom de projet compose reste lpk-decision-main : mêmes volumes, aucune donnée perdue.
when:
  - branch: main
    event: push

depends_on:
  - app

steps:

  - name: security-check
    image: alpine:3.20
    commands:
      - |
        if [ -f .env ]; then
          echo "ERREUR: .env ne doit pas etre commite dans le depot"
          exit 1
        fi
      - 'grep -q "^\.env$" .gitignore || (echo "ERREUR: .env manquant dans .gitignore" && exit 1)'
      - echo "Security check OK"

  - name: test-backend
    image: python:3.11-slim
    commands:
      - cd maquette/backend
      - pip install --no-cache-dir -r requirements.txt
      - pytest app/tests/ -v --tb=short

  - name: test-frontend
    image: node:20-slim
    commands:
      # git requis : dépendance @yvv/nuxt-base en git+https (node:20-slim n'a pas git)
      - apt-get update && apt-get install -y --no-install-recommends git ca-certificates
      - cd maquette/frontend
      - npm ci
      - npm run build

  # NOTE: volumes + pas de from_secret : compatible
  - name: build-backend
    image: docker:27-cli
    depends_on:
      - test-backend
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    commands:
      - docker build -t libredecision-backend:latest -f maquette/docker/backend.Dockerfile --target production maquette
      - echo "Image backend construite"

  # NOTE: volumes + pas de from_secret : compatible
  - name: build-frontend
    image: docker:27-cli
    depends_on:
      - test-frontend
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    commands:
      - docker build -t libredecision-frontend:latest -f maquette/docker/frontend.Dockerfile --target production maquette
      - echo "Image frontend construite"

  # NOTE: volumes + pas de from_secret : compatible
  - name: sbom-generate
    image: alpine:3.20
    depends_on:
      - build-backend
      - build-frontend
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    commands:
      - apk add --no-cache curl
      # Version épinglée : ce conteneur a le socket Docker, il n'exécute pas « main » de syft.
      - curl -sSfL https://raw.githubusercontent.com/anchore/syft/v1.55.0/install.sh | sh -s -- -b /usr/local/bin v1.55.0
      - mkdir -p .reports
      # spec 1.5 épinglée : syft « latest » émet plus récent que ce que le trivy du runner décode
      - syft libredecision-backend:latest -o cyclonedx-json@1.5 --file .reports/sbom-backend.cyclonedx.json
      - syft libredecision-frontend:latest -o cyclonedx-json@1.5 --file .reports/sbom-frontend.cyclonedx.json
      - echo "SBOM generes"

  # NOTE: volumes + pas de from_secret : compatible
  - name: sbom-scan
    image: aquasec/trivy:latest
    depends_on:
      - sbom-generate
    volumes:
      - /home/syoul/trivy-cache:/root/.cache/trivy
    commands:
      - trivy sbom --format json --output .reports/trivy-backend.json .reports/sbom-backend.cyclonedx.json
      - trivy sbom --format json --output .reports/trivy-frontend.json .reports/sbom-frontend.cyclonedx.json
      - echo "Scan CVE termine"

  # NOTE: from_secret + pas de volumes : compatible
  # failure: ignore — la publication vers Dependency-Track est de la télémétrie :
  # elle ne doit pas bloquer le déploiement quand DTrack est éteint ou le secret
  # dtrack_domain absent (le scan trivy, lui, reste bloquant). Vu en panne le 12/08.
  - name: sbom-publish
    image: alpine/curl:latest
    failure: ignore
    depends_on:
      - sbom-scan
    environment:
      DTRACK_TOKEN:
        from_secret: dependency_track_token
      DTRACK_DOMAIN:
        from_secret: dtrack_domain
    commands:
      - |
        VERSION=$(date +%Y-%m-%d)-$(echo "$CI_COMMIT_SHA" | cut -c1-8)
        for COMPONENT in backend frontend; do
          HTTP=$(curl -s -o /tmp/dtrack-resp.txt -w "%{http_code}" -X POST "https://$DTRACK_DOMAIN/api/v1/bom" \
            -H "X-Api-Key: $DTRACK_TOKEN" \
            -F "autoCreate=true" \
            -F "projectName=libredecision-$COMPONENT" \
            -F "projectVersion=$VERSION" \
            -F "bom=@.reports/sbom-$COMPONENT.cyclonedx.json")
          echo "HTTP $HTTP ($COMPONENT) : $(cat /tmp/dtrack-resp.txt)"
          [ "$HTTP" -ge 200 ] && [ "$HTTP" -lt 300 ] || exit 1
        done

  # NOTE: from_secret + pas de volumes : compatible
  - name: write-env
    image: alpine:3.20
    depends_on:
      - sbom-publish
    environment:
      POSTGRES_PASSWORD:
        from_secret: postgres_password
      SECRET_KEY:
        from_secret: secret_key
    commands:
      - echo "APP_DOMAIN=maquette.decision.librodrome.org" > .env.deploy
      - echo "POSTGRES_PASSWORD=$POSTGRES_PASSWORD" >> .env.deploy
      - echo "SECRET_KEY=$SECRET_KEY" >> .env.deploy
      - OWNER=$(echo "$CI_REPO_OWNER" | tr 'A-Z' 'a-z') && REPO=$(echo "$CI_REPO_NAME" | tr 'A-Z' 'a-z') && BRANCH=$(echo "$CI_COMMIT_BRANCH" | tr 'A-Z/' 'a-z-') && echo "COMPOSE_PROJECT_NAME=$OWNER-$REPO-$BRANCH" >> .env.deploy
      - echo ".env.deploy cree ($(wc -c < .env.deploy) octets)"

  - name: test-env
    image: alpine:3.20
    depends_on:
      - write-env
    commands:
      - |
        [ -f .env.deploy ] || { echo "FAIL: .env.deploy introuvable"; exit 1; }
        echo "PASS: .env.deploy present"
      - |
        VAL=$(grep '^COMPOSE_PROJECT_NAME=' .env.deploy | cut -d= -f2)
        [ -z "$VAL" ] && echo "FAIL: COMPOSE_PROJECT_NAME vide" && exit 1
        echo "PASS: COMPOSE_PROJECT_NAME = $VAL"
      - |
        VAL=$(grep '^APP_DOMAIN=' .env.deploy | cut -d= -f2)
        [ -z "$VAL" ] && echo "FAIL: APP_DOMAIN vide" && exit 1
        echo "PASS: APP_DOMAIN = $VAL"

  # NOTE: volumes + pas de from_secret : compatible
  # Fabio/Traefik routing géré via labels du docker-compose.yml
  - name: deploy
    image: docker:27-cli
    depends_on:
      - test-env
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /opt/libredecision:/opt/libredecision
    commands:
      - cp .env.deploy /opt/libredecision/.env
      - chmod 600 /opt/libredecision/.env
      - cp maquette/docker/docker-compose.yml /opt/libredecision/docker-compose.yml
      # Arreter avant le challenge ACME : libere le webroot pour sonic-acme-1
      # L'org forge a ete renommee (EHV -> LPK) : le nom de projet compose a change,
      # on arrete donc aussi l'ancienne stack (ehv-decision-main-*) pour eviter la
      # double inscription fabio et le trafic partage v1/v2.
      - docker ps -q --filter "name=decision-main" | xargs -r docker stop
      - cd /opt/libredecision && docker compose stop
      - |
        DOMAIN=$(grep '^APP_DOMAIN=' /opt/libredecision/.env | cut -d= -f2)
        ACME_EXIT=0
        docker exec sonic-acme-1 /app/acme.sh \
          --home /etc/acme.sh \
          --issue -d "$DOMAIN" \
          --webroot /usr/share/nginx/html \
          --server letsencrypt \
          --accountemail support+acme@asycn.io || ACME_EXIT=$?
        if [ "$ACME_EXIT" -eq 0 ] || [ "$ACME_EXIT" -eq 2 ]; then
          docker exec sonic-acme-1 cp /etc/acme.sh/$DOMAIN/fullchain.cer /host/certs/$DOMAIN-cert.pem
          docker exec sonic-acme-1 cp /etc/acme.sh/$DOMAIN/$DOMAIN.key /host/certs/$DOMAIN-key.pem
          echo "TLS OK (acme exit $ACME_EXIT)"
        elif docker exec sonic-acme-1 test -f "/host/certs/$DOMAIN-cert.pem"; then
          echo "AVERTISSEMENT: emission ACME en echec (exit $ACME_EXIT) - certificat existant conserve"
          echo "  Cause vue le 12/08 : challenge HTTP-01 invalide en IPv6 (AAAA present mais webroot"
          echo "  non servi en v6) - corriger frontal/DNS avant l'expiration du certificat."
        else
          echo "ERREUR: acme.sh a echoue (exit $ACME_EXIT) et aucun certificat existant pour $DOMAIN"
          exit 1
        fi
      # Images construites localement dans la pipeline : pas de docker compose pull
      - cd /opt/libredecision && docker compose up -d --remove-orphans
      - cd /opt/libredecision && docker compose ps

  # Vérification que les containers sont running
  - name: test-deploy
    image: docker:27-cli
    depends_on:
      - deploy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /opt/libredecision:/opt/libredecision
    commands:
      - |
        PROJECT=$(grep '^COMPOSE_PROJECT_NAME=' /opt/libredecision/.env | cut -d= -f2)
        for SVC in backend frontend; do
          STATUS=$(docker inspect --format '{{.State.Status}}' "$PROJECT-$SVC" 2>/dev/null || echo "absent")
          echo "$PROJECT-$SVC : $STATUS"
          [ "$STATUS" = "running" ] || { echo "FAIL: $PROJECT-$SVC non running"; exit 1; }
        done
        echo "PASS: tous les containers running"

  - name: seed
    image: docker:27-cli
    depends_on:
      - test-deploy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /opt/libredecision:/opt/libredecision
    commands:
      - |
        PROJECT=$(grep '^COMPOSE_PROJECT_NAME=' /opt/libredecision/.env | cut -d= -f2)
        docker exec "$PROJECT-backend" python seed.py
        echo "Seed terminée"

  - name: healthcheck
    image: alpine:3.20
    depends_on:
      - seed
    commands:
      - apk add --no-cache --quiet curl
      - |
        SITE=$(grep '^APP_DOMAIN=' .env.deploy | cut -d= -f2)
        TARGET="https://$SITE"
        echo "Healthcheck $TARGET..."
        MAX=60
        i=0
        until [ $i -ge $MAX ]; do
          CODE=$(curl -sSo /dev/null -w "%{http_code}" "$TARGET" 2>/dev/null)
          echo "Tentative $((i+1))/$MAX - HTTP $CODE"
          if [ "$CODE" = "200" ] || [ "$CODE" = "301" ] || [ "$CODE" = "302" ]; then
            echo "PASS: app repond sur $TARGET"
            exit 0
          fi
          i=$((i+1))
          sleep 10
        done
        echo "FAIL: app ne repond pas apres 10 minutes"
        exit 1

  - name: notify-failure
    image: alpine:3.20
    commands:
      - 'echo "ECHEC pipeline #$CI_PIPELINE_NUMBER sur $CI_COMMIT_BRANCH ($CI_COMMIT_SHA)"'
    when:
      - status: failure