ci.yml

# CI GitHub Actions - miroir du pipeline Azure DevOps.
#
# Le workload MAUI n'est pas installe sur ubuntu-latest : on cible le back-end
# via FactoryTrack.Server.slnf. Un job separe compile MAUI sur windows-latest.

name: CI

on:
  push:
    branches: [main, master, 'feature/**', 'fix/**']
  pull_request:
    branches: [main, master]

env:
  DOTNET_CLI_TELEMETRY_OPTOUT: '1'
  DOTNET_NOLOGO: '1'
  BUILD_CONFIGURATION: 'Release'

jobs:

  backend:
    name: Back-end (.NET, Sonar, Trivy)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout complet (Sonar blame)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Installer .NET SDK 9
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '9.0.x'

      - name: Cache NuGet
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
          restore-keys: nuget-${{ runner.os }}-

      - name: Installer JDK 17 (requis par SonarCloud scanner)
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Installer dotnet-sonarscanner
        run: dotnet tool install --global dotnet-sonarscanner

      - name: SonarCloud begin
        # Skip si le secret est absent (ex: PR depuis fork ou setup initial pas fait).
        if: env.SONAR_TOKEN != ''
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          dotnet sonarscanner begin \
            /k:"${{ vars.SONAR_PROJECT_KEY }}" \
            /o:"${{ vars.SONAR_ORGANIZATION }}" \
            /d:sonar.token="$SONAR_TOKEN" \
            /d:sonar.host.url="https://sonarcloud.io" \
            /d:sonar.exclusions="src/FactoryTrack.Mobile/**,**/obj/**,**/bin/**,db/init/**" \
            /d:sonar.coverage.exclusions="tests/**,src/FactoryTrack.Simulator/**,src/FactoryTrack.Mobile/**,**/Program.cs,**/MauiProgram.cs,**/InjectionDependances.cs,**/Configurations/**,**/Entites/**,**/Dtos/**,**/Enums/**,**/Options/**,**/NomsHub.cs,**/Interfaces/**,**/Depots/DepotReferentiel.cs,**/Hubs/**,**/ServiceSurveillanceSilence.cs,**/ServiceSurveillanceZones.cs,**/ServiceSurveillancePeriodique.cs,**/PublicateurSignalR.cs" \
            /d:sonar.cs.opencover.reportsPaths="**/*.opencover.xml" \
            /d:sonar.cs.vstest.reportsPaths="**/TestResults/*.trx"

      - name: dotnet restore
        run: dotnet restore FactoryTrack.Server.slnf

      - name: dotnet build (Release)
        run: dotnet build FactoryTrack.Server.slnf --configuration $BUILD_CONFIGURATION --no-restore

      - name: Tests + couverture (OpenCover)
        run: |
          for projet in tests/FactoryTrack.UnitTests tests/FactoryTrack.IntegrationTests; do
            nom=$(basename "$projet")
            dotnet test "$projet/$nom.csproj" \
              --configuration $BUILD_CONFIGURATION \
              --no-build \
              --logger "trx;LogFileName=${nom}.trx" \
              -p:CollectCoverage=true \
              -p:CoverletOutputFormat=opencover \
              -p:CoverletOutput="${{ github.workspace }}/coverage/${nom}.opencover.xml"
          done

      - name: Publier les resultats de tests
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: '**/TestResults/*.trx'

      - name: Publier la couverture
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: coverage/*.opencover.xml

      - name: SonarCloud end
        if: env.SONAR_TOKEN != ''
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: dotnet sonarscanner end /d:sonar.token="$SONAR_TOKEN"

      - name: Audit securite dependances
        run: |
          set -euo pipefail
          SORTIE=$(dotnet list FactoryTrack.Server.slnf package --vulnerable --include-transitive 2>&1 || true)
          echo "$SORTIE"
          if echo "$SORTIE" | grep -qE '>[[:space:]]+[A-Za-z0-9\.]+[[:space:]]'; then
            echo "::error::Dependances vulnerables detectees."
            exit 1
          fi

  mobile:
    name: MAUI Windows
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '9.0.x'

      - name: Installer workloads MAUI
        run: dotnet workload install maui-android maui-windows

      - name: Build MAUI (Windows)
        run: dotnet build src/FactoryTrack.Mobile/FactoryTrack.Mobile.csproj -f net9.0-windows10.0.19041.0 --configuration ${{ env.BUILD_CONFIGURATION }}

  docker:
    name: Build & scan images Docker
    runs-on: ubuntu-latest
    needs: backend
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')

    steps:
      - uses: actions/checkout@v4

      - name: docker compose build
        run: docker compose build api ingestion simulateur

      # Installation de Trivy par binaire epingle + verification sha256 : evite
      # l'execution d'un script telecharge et le bug de dependance vers
      # aquasecurity/setup-trivy@v0.2.1 (tag inexistant) qui casse trivy-action
      # a partir de la v0.28.
      - name: Installer Trivy
        env:
          TRIVY_VERSION: '0.74.0'
          TRIVY_SHA256: '2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a'
        run: |
          set -euo pipefail
          curl -sSfL --proto '=https' --tlsv1.2 -o trivy.tar.gz \
            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
          echo "${TRIVY_SHA256}  trivy.tar.gz" | sha256sum -c -
          tar -xzf trivy.tar.gz trivy
          sudo mv trivy /usr/local/bin/trivy
          trivy --version

      - name: Trivy - scan des images (HIGH/CRITICAL bloquant)
        run: |
          set -euo pipefail
          for image in factorytrack-api factorytrack-ingestion factorytrack-simulateur; do
            echo "::group::Scan $image"
            trivy image \
              --severity HIGH,CRITICAL \
              --exit-code 1 \
              --ignore-unfixed \
              --no-progress \
              "$image"
            echo "::endgroup::"
          done