labFusion/.gitea/workflows/api-gateway.yml

name: API Gateway (Java Spring Boot)

on:
  push:
    paths:
      - 'services/api-gateway/**'
      - '.gitea/workflows/api-gateway.yml'
  pull_request:
    paths:
      - 'services/api-gateway/**'

env:
  REGISTRY: gitea.example.com
  IMAGE_PREFIX: labfusion
  SERVICE_NAME: api-gateway

jobs:
  test:
    runs-on: [self-hosted, heavy, java]
    defaults:
      run:
        working-directory: ./services/api-gateway
    
    strategy:
      matrix:
        java-version: [17, 21]
        
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Set up JDK ${{ matrix.java-version }}
      uses: actions/setup-java@v4
      with:
        java-version: ${{ matrix.java-version }}
        distribution: 'temurin'
        cache: maven
        
    - name: Verify Maven installation
      run: ./mvnw --version
        
    - name: Cache Maven dependencies
      uses: actions/cache@v4
      with:
        path: ~/.m2
        key: ${{ runner.os }}-m2-${{ matrix.java-version }}-${{ hashFiles('**/pom.xml') }}
        restore-keys: |
          ${{ runner.os }}-m2-${{ matrix.java-version }}-
          ${{ runner.os }}-m2-
        
    - name: Validate POM
      run: ./mvnw validate
        
    - name: Compile code
      run: ./mvnw compile
      
    - name: Run unit tests
      run: ./mvnw test
      
    - name: Generate test report
      uses: dorny/test-reporter@v1
      if: success() || failure()
      with:
        name: Maven Tests (Java ${{ matrix.java-version }})
        path: services/api-gateway/target/surefire-reports/*.xml
        reporter: java-junit
        
    - name: Run code quality checks
      run: |
        ./mvnw spotbugs:check
        ./mvnw checkstyle:check
        ./mvnw pmd:check
        
    - name: Generate code coverage
      run: ./mvnw jacoco:report
      
    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v3
      with:
        file: ./services/api-gateway/target/site/jacoco/jacoco.xml
        flags: api-gateway
        name: api-gateway-coverage

  build:
    runs-on: [self-hosted, heavy, java]
    needs: test
    defaults:
      run:
        working-directory: ./services/api-gateway
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'temurin'
        cache: maven
        
    - name: Verify Maven installation
      run: ./mvnw --version
        
    - name: Cache Maven dependencies
      uses: actions/cache@v4
      with:
        path: ~/.m2
        key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
        restore-keys: ${{ runner.os }}-m2
        
    - name: Build application
      run: ./mvnw clean package -DskipTests
      
    - name: Build Docker image (test only)
      run: docker build -t api-gateway:test .

  security:
    runs-on: [self-hosted, security, scan]
    needs: build
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: api-gateway:test
        format: 'sarif'
        output: 'trivy-results.sarif'
        
    - name: Upload Trivy scan results
      uses: github/codeql-action/upload-sarif@v2
      if: always()
      with:
        sarif_file: 'trivy-results.sarif'