name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci
      - run: npm run lint
      - run: npm run type-check

  test:
    runs-on: ubuntu-latest
    needs: lint
    services:
      postgres:
        image: postgres:16
        env: { POSTGRES_DB: fleet_test, POSTGRES_USER: test, POSTGRES_PASSWORD: test }
        ports: ['5432:5432']
      redis:
        image: redis:7
        ports: ['6379:6379']
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npm run test:unit
      - run: npm run test:e2e

  security:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - run: npm audit --audit-level=high
      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: p/typescript

  deploy:
    runs-on: ubuntu-latest
    needs: [test, security]
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t fleet-api:${{ github.sha }} .
      - name: Deploy ke production
        run: |
          ssh deploy@${{ secrets.SERVER_IP }} << 'EOF'
            cd /var/www/fleet-api
            git pull origin main
            npm ci --production
            npm run build
            pm2 restart fleet-api
          EOF

// Semgrep menangkap pola-pola ini:

// ❌ Vulnerability SQL Injection
const query = `SELECT * FROM users WHERE id = '${userId}'`;

// ✅ Aman — parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
await pool.query(query, [userId]);

// ❌ Hardcoded secret
const API_KEY = 'sk_live_abc123secret';

// ✅ Aman — gunakan environment variable
const API_KEY = process.env.API_KEY;

# Stage 1: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Stage 2: Production (image lebih kecil)
FROM node:20-alpine AS production
WORKDIR /app
COPY package*.json ./
RUN npm ci --production && npm cache clean --force
COPY --from=builder /app/dist ./dist

# Security: Jangan jalankan sebagai root
RUN addgroup -g 1001 appgroup && adduser -S -u 1001 -G appgroup appuser
USER appuser

EXPOSE 3001
CMD ["node", "dist/main.js"]

@Controller('health')
export class HealthController {
  @Get()
  async check() {
    return this.health.check([
      () => this.db.pingCheck('database'),
      () => this.redis.pingCheck('redis'),
    ]);
  }
}

// Gunakan log JSON terstruktur — bukan console.log
this.logger.log({
  event: 'delivery_created',
  deliveryId: delivery.id,
  vehicleId: delivery.vehicleId,
  timestamp: new Date().toISOString(),
});