# Lab 05 — example GitHub Actions CI/CD with an AI EVAL GATE (K07 §8, K08 §6).
# This is a reference file (not auto-run here). It shows the banking-grade
# pipeline: test -> scan -> EVAL GATE -> build -> deploy with canary + rollback,
# authenticating to Azure via OIDC (NO stored secrets).
name: build-test-deploy
on:
  pull_request:
  push: { branches: [main] }

permissions:
  id-token: write          # OIDC federation to Azure — no stored client secret
  contents: read

jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install -r requirements.txt ruff mypy
      - name: Lint & type-check
        run: { ruff check . && mypy . }
      - name: Unit + integration tests (mocked Azure)
        run: pytest -q
      - name: Build image
        run: docker build -t bank-assistant:${{ github.sha }} .
      - name: Scan image for vulnerabilities
        uses: aquasecurity/trivy-action@master
        with: { image-ref: "bank-assistant:${{ github.sha }}" }
      - name: AI EVAL GATE (groundedness / safety must not regress)
        run: python ../lab-06-eval-guardrails/gate.py    # fails the build on regression

  deploy:
    needs: ci
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: azure/login@v2                # OIDC, no secrets
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
      - name: Push to ACR
        run: az acr build -r ${{ vars.ACR }} -t bank-assistant:${{ github.sha }} .
      - name: Deploy to staging
        run: az containerapp update -n bank-assistant-staging -g rg --image ${{ vars.ACR }}.azurecr.io/bank-assistant:${{ github.sha }}
      - name: Smoke + eval on staging
        run: pytest -q -k smoke
      - name: Canary to prod (10% traffic) then promote
        run: |
          az containerapp ingress traffic set -n bank-assistant -g rg \
            --revision-weight latest=10
          # promote to 100% after health/eval alarms stay green; else roll back.