name: Quote Bot CI/CD Pipeline

on:
  push:
    branches:
      - main

jobs:
  check-syntax:
    name: check 
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Syntax Check
        run: |
          pip install pyflakes
          pyflakes src/

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run OWASP Noir
        id: noir
        uses: owasp-noir/noir@v1.1.0
        with:
          base_path: 'src'
      - name: Display results
        run: echo '${{ steps.noir.outputs.endpoints }}' | jq .
      - name: Run Bandit (Python SAST)
        run: |
          pip install bandit
          bandit -r src/

  build-and-push:
    name: Build and push to Docker Hub
    needs: [security-scan, check-syntax]
    runs-on: ubuntu-latest
    steps:
      - name: Скачиваем код бота
        uses: actions/checkout@v4

      - name: Логинимся в Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_LOGIN }}
          password: ${{ secrets.DOCKER_TOKEN }}

      - name: Сборка и пуш Docker образа
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: leor156/quote-bot:latest
    
  #terraform infrastructure-check and infrastructure-deployment:
    #name: check infrastructure
    #needs: [build-and-push]
    #runs-on: ubuntu-latest
    #steps:
      #- uses: actions/checkout@v4
      #- name: Terraform init
        #run: terraform init
      #- name: Terraform plan
        #run: terraform plan
      #- name: Terraform apply
        #run: terraform apply -auto-approve

  deploy:
    name: Deploy to VPS via Ansible
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - name: Скачиваем код репозитория (чтобы получить файл deploy.yml)
        uses: actions/checkout@v4

      - name: Запускаем Ansible плейбук
        uses: dawidd6/action-ansible-playbook@v2
        with:
          playbook: auto-deployment/A_deploy.yml
          key: ${{ secrets.SERVER_SSH_KEY }}
          options: |
            -i ${{ secrets.SERVER_HOST }},
            -u ${{ secrets.SERVER_USER }}
            --extra-vars "TOKEN=${{ secrets.TG_TOKEN_QUOTE }} ADMIN_IDS=${{ secrets.ADMIN_ID_TG }}"

      - name: Notifier
        uses: ethyaan/tgate-action@v1.0.0
        if: always()
        with:
          token: ${{ secrets.TG_TOKEN_ALERT }}
          to: ${{ secrets.ADMIN_ID_TG }}
          thread_id: ${{ secrets.threadid }}
          disable_web_page_preview: false
          disable_notification: false