# .github/workflows/ci.yml
name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  # ============================================
  # Stage 1: Code Quality
  # ============================================
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - run: npm ci
      - run: npm run lint          # ESLint
      - run: npm run type-check    # TypeScript compiler check
      - run: npm run format:check  # Prettier check

  # ============================================
  # Stage 2: Tests
  # ============================================
  test:
    runs-on: ubuntu-latest
    needs: lint
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: fleet_test
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
        ports:
          - 5432:5432
      redis:
        image: redis:7
        ports:
          - 6379:6379

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - run: npm ci
      - run: npm run test:unit     # Unit tests
      - run: npm run test:e2e      # E2E tests
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/fleet_test
          REDIS_URL: redis://localhost:6379

  # ============================================
  # Stage 3: Security Scanning
  # ============================================
  security:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4

      # Dependency vulnerability scanning
      - run: npm audit --audit-level=high

      # SAST (Static Application Security Testing)
      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/typescript
            p/nodejs
            p/sql-injection

  # ============================================
  # Stage 4: Build & Deploy
  # ============================================
  deploy:
    runs-on: ubuntu-latest
    needs: [test, security]
    if: github.ref == 'refs/heads/main'

    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t fleet-api:${{ github.sha }} .

      - name: Deploy to production
        run: |
          ssh deploy@${{ secrets.SERVER_IP }} << 'EOF'
            cd /var/www/fleet-api
            git pull origin main
            npm ci --production
            npm run build
            pm2 restart fleet-api
          EOF

# Check for known vulnerabilities in dependencies
npm audit

# Fix automatically where possible
npm audit fix

# For production, fail on high/critical
npm audit --audit-level=high

// Semgrep catches these patterns:

// ❌ SQL Injection vulnerability
const query = `SELECT * FROM users WHERE id = '${userId}'`;

// ✅ Safe — parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
await pool.query(query, [userId]);

// ❌ XSS vulnerability
element.innerHTML = userInput;

// ✅ Safe — use textContent
element.textContent = userInput;

// ❌ Hardcoded secrets
const API_KEY = 'sk_live_abc123secret';

// ✅ Safe — use environment variables
const API_KEY = process.env.API_KEY;

# Scan Docker images for OS-level vulnerabilities
- name: Scan Docker image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: fleet-api:${{ github.sha }}
    severity: 'CRITICAL,HIGH'
    exit-code: '1'  # Fail if critical issues found

# Stage 1: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Stage 2: Production (smaller image)
FROM node:20-alpine AS production
WORKDIR /app
COPY package*.json ./
RUN npm ci --production && npm cache clean --force
COPY --from=builder /app/dist ./dist

# Security: Don't run as root
RUN addgroup -g 1001 appgroup && \
    adduser -S -u 1001 -G appgroup appuser
USER appuser

EXPOSE 3001
CMD ["node", "dist/main.js"]

# docker-compose.yml
version: '3.8'

services:
  fleet-api:
    build: ./apps/api
    ports:
      - "3001:3001"
    environment:
      - DATABASE_URL=postgresql://dev:dev@postgres:5432/fleet
      - REDIS_URL=redis://redis:6379
    depends_on:
      - postgres
      - redis

  admin:
    build: ./apps/admin
    ports:
      - "8000:8000"
    environment:
      - DB_HOST=mysql
      - DB_DATABASE=fleet_admin
    depends_on:
      - mysql

  postgres:
    image: postgis/postgis:16-3.4
    environment:
      POSTGRES_DB: fleet
      POSTGRES_USER: dev
      POSTGRES_PASSWORD: dev
    volumes:
      - postgres_data:/var/lib/postgresql/data

  mysql:
    image: mysql:8
    environment:
      MYSQL_DATABASE: fleet_admin
      MYSQL_ROOT_PASSWORD: dev
    volumes:
      - mysql_data:/var/lib/mysql

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"

volumes:
  postgres_data:
  mysql_data:

# /etc/nginx/sites-available/fleet
server {
    listen 80;
    server_name fleet.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name fleet.example.com;

    ssl_certificate /etc/letsencrypt/live/fleet.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/fleet.example.com/privkey.pem;

    # Security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=31536000" always;

    # Rate limiting
    limit_req_zone $binary_remote_addr zone=api:10m rate=30r/s;

    location /api/ {
        limit_req zone=api burst=50 nodelay;
        proxy_pass http://127.0.0.1:3001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /admin/ {
        proxy_pass http://127.0.0.1:8000;
        # Only allow internal IPs
        allow 10.0.0.0/8;
        deny all;
    }
}

// ecosystem.config.js
module.exports = {
  apps: [
    {
      name: 'fleet-api',
      script: 'dist/main.js',
      instances: 'max',      // Use all CPU cores
      exec_mode: 'cluster',  // Cluster mode for load balancing
      env: {
        NODE_ENV: 'production',
        PORT: 3001,
      },
      max_memory_restart: '500M',
      log_date_format: 'YYYY-MM-DD HH:mm:ss',
    },
    {
      name: 'telemetry-service',
      script: 'dist/main.js',
      cwd: './apps/telemetry',
      instances: 2,
      env: {
        NODE_ENV: 'production',
        PORT: 3002,
      },
    },
  ],
};

// src/health/health.controller.ts
@Controller('health')
export class HealthController {
  constructor(
    private health: HealthCheckService,
    private db: TypeOrmHealthIndicator,
    private redis: RedisHealthIndicator,
  ) {}

  @Get()
  async check() {
    return this.health.check([
      () => this.db.pingCheck('database'),
      () => this.redis.pingCheck('redis'),
      () => this.checkDiskSpace(),
      () => this.checkMemoryUsage(),
    ]);
  }
}

// Use structured JSON logs — not console.log
this.logger.log({
  event: 'delivery_created',
  deliveryId: delivery.id,
  vehicleId: delivery.vehicleId,
  driverId: delivery.driverId,
  timestamp: new Date().toISOString(),
});

// This makes logs searchable and filterable
// "Show me all delivery events for vehicle X in the last hour"

## Incident: GPS Data Loss (2026-05-15)

### Timeline
- 14:32 — Alert: Telemetry service stopped processing GPS data
- 14:35 — On-call acknowledged, began investigation
- 14:42 — Root cause found: Redis connection pool exhausted
- 14:45 — Fix applied: Increased connection pool from 10 to 50
- 14:48 — Service recovered, backlog cleared by 14:55

### Root Cause
Redis connection pool was set to 10 (default). Under peak load
(200 trucks × 6 updates/minute = 1200 ops/min), connections
were exhausted faster than they were released.

### Action Items
- [x] Increase Redis connection pool to 50
- [x] Add Redis connection pool monitoring to dashboard
- [ ] Add circuit breaker for Redis operations
- [ ] Load test with 2x expected traffic