Changessss

.github/workflows/01-ci.yml

@@ -1,20 +1,25 @@
 name: 01 - CI
 
 on:
-  # Trigger the workflow on push to main branch
+
   push:
     branches:
       - main
+
+
+  pull_request:
+    branches:
+      - main
 
-  # Manual trigger for the workflow
+
   workflow_dispatch:
 
 
 jobs:
 
-  # =========================================================
+
   # Backend Tests
-  # =========================================================
+
   backend-test:
     name: Test ${{ matrix.service }}
     runs-on: ubuntu-latest
@@ -102,16 +107,55 @@ jobs:
           pytest -v
 
 
-  # =========================================================
+
+  # Terraform Infrastructure Validation and Plan
+
+  terraform:
+    name: Terraform Validate and Plan
+    runs-on: ubuntu-latest
+
+    needs:
+      - backend-test
+
+    steps:
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Initialize Terraform
+        working-directory: terraform
+        run: terraform init -input=false
+
+      - name: Validate Terraform
+        working-directory: terraform
+        run: terraform validate
+
+      - name: Login to Azure for Terraform plan
+        if: github.event_name != 'pull_request'
+        uses: azure/login@v2
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: Plan Terraform changes
+        if: github.event_name != 'pull_request'
+        working-directory: terraform
+        run: terraform plan -input=false -var-file=terraform.tfvars
+
+
+
   # Build and Push Docker Images
-  # =========================================================
+
   build-and-push:
     name: Build and Push ${{ matrix.image }}
     runs-on: ubuntu-latest
 
     # All backend tests must pass before this job starts
     needs:
       - backend-test
+      - terraform
 
     # Build and push when code is pushed to main or manually triggered
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
@@ -160,6 +204,17 @@ jobs:
             -t ${{ vars.ACR_LOGIN_SERVER }}/${{ matrix.image }}:${{ github.sha }} \
             ./${{ matrix.service }}
 
+      - name: Scan image with Docker Scout
+        continue-on-error: true
+        uses: docker/scout-action@v1
+        with:
+          command: cves
+          image: ${{ vars.ACR_LOGIN_SERVER }}/${{ matrix.image }}:${{ github.sha }}
+          only-severities: critical,high
+          dockerhub-user: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }}
+          exit-code: false
+
       - name: Push Docker image with commit SHA
         run: |
           docker push \

.github/workflows/02-deploy-staging.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   deploy-staging:
-    name: Deploy to Staging
+    name: Deploy frontend to App Service staging slot
     runs-on: ubuntu-latest
 
     if: >
@@ -20,132 +20,51 @@ jobs:
     environment:
       name: staging
 
+    env:
+      APP_SERVICE_NAME: koalatech-week08-webapp-226035073
+      RESOURCE_GROUP: koalatech-week08-rg
+      SLOT_NAME: staging
+      ACR_NAME: koalatech8acr226035073
+      ACR_LOGIN_SERVER: koalatech8acr226035073.azurecr.io
+      IMAGE_TAG: ${{ github.event.workflow_run.head_sha }}
+      IMAGE_NAME: koalatech-frontend
+
     steps:
       - name: Checkout tested commit
         uses: actions/checkout@v4
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
 
       - name: Login to Azure
-        uses: azure/login@v3
+        uses: azure/login@v2
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
 
-      - name: Get AKS credentials
-        run: |
-          az aks get-credentials \
-            --resource-group ${{ vars.AKS_RESOURCE_GROUP }} \
-            --name ${{ vars.AKS_CLUSTER_NAME }} \
-            --overwrite-existing
-
-      - name: Create staging namespace
-        run: |
-          kubectl create namespace staging \
-            --dry-run=client \
-            -o yaml | kubectl apply -f -
-
-      - name: Create PostgreSQL secret
-        run: |
-          kubectl create secret generic postgres-secret \
-            --namespace staging \
-            --from-literal=POSTGRES_USER="${{ secrets.POSTGRES_USER }}" \
-            --from-literal=POSTGRES_PASSWORD="${{ secrets.POSTGRES_PASSWORD }}" \
-            --dry-run=client \
-            -o yaml | kubectl apply -f -
-
-      - name: Create application secret
+      - name: Configure App Service staging image
         run: |
-          kubectl create secret generic application-secret \
-            --namespace staging \
-            --from-literal=POSTGRES_USER="${{ secrets.POSTGRES_USER }}" \
-            --from-literal=POSTGRES_PASSWORD="${{ secrets.POSTGRES_PASSWORD }}" \
-            --from-literal=JWT_SECRET_KEY="${{ secrets.JWT_SECRET_KEY }}" \
-            --from-literal=DEFAULT_ADMIN_USERNAME="${{ secrets.DEFAULT_ADMIN_USERNAME }}" \
-            --from-literal=DEFAULT_ADMIN_EMAIL="${{ secrets.DEFAULT_ADMIN_EMAIL }}" \
-            --from-literal=DEFAULT_ADMIN_PASSWORD="${{ secrets.DEFAULT_ADMIN_PASSWORD }}" \
-            --from-literal=AZURE_STORAGE_CONNECTION_STRING="${{ secrets.AZURE_STORAGE_CONNECTION_STRING }}" \
-            --dry-run=client \
-            -o yaml | kubectl apply -f -
+          SUBSCRIPTION_ID=$(az account show --query id --output tsv)
+          IMAGE_REF="${ACR_LOGIN_SERVER}/${IMAGE_NAME}:${IMAGE_TAG}"
+          SITE_CONFIG_URL="https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Web/sites/${APP_SERVICE_NAME}/slots/${SLOT_NAME}/config/web?api-version=2022-03-01"
 
-      - name: Apply Kubernetes manifests
-        run: |
-          kubectl apply \
-            -f kubernetes/staging/
+          echo "Deploying ${IMAGE_REF} to slot ${SLOT_NAME}"
 
-      - name: Update frontend image
-        run: |
-          kubectl set image deployment/frontend \
-            frontend=${{ vars.ACR_LOGIN_SERVER }}/koalatech-frontend:${{ github.event.workflow_run.head_sha }} \
-            -n staging
-
-      - name: Update user-service image
-        run: |
-          kubectl set image deployment/user-service \
-            user-service=${{ vars.ACR_LOGIN_SERVER }}/koalatech-user-service:${{ github.event.workflow_run.head_sha }} \
-            -n staging
-
-      - name: Update student-service image
-        run: |
-          kubectl set image deployment/student-service \
-            student-service=${{ vars.ACR_LOGIN_SERVER }}/koalatech-student-service:${{ github.event.workflow_run.head_sha }} \
-            -n staging
-
-      - name: Update lecturer-service image
-        run: |
-          kubectl set image deployment/lecturer-service \
-            lecturer-service=${{ vars.ACR_LOGIN_SERVER }}/koalatech-lecturer-service:${{ github.event.workflow_run.head_sha }} \
-            -n staging
-
-      - name: Update course-service image
-        run: |
-          kubectl set image deployment/course-service \
-            course-service=${{ vars.ACR_LOGIN_SERVER }}/koalatech-course-service:${{ github.event.workflow_run.head_sha }} \
-            -n staging
-
-      - name: Update enrollment-service image
-        run: |
-          kubectl set image deployment/enrollment-service \
-            enrollment-service=${{ vars.ACR_LOGIN_SERVER }}/koalatech-enrollment-service:${{ github.event.workflow_run.head_sha }} \
-            -n staging
-
-      - name: Wait for frontend rollout
-        run: |
-          kubectl rollout status deployment/frontend \
-            -n staging \
-            --timeout=300s
-
-      - name: Wait for user-service rollout
-        run: |
-          kubectl rollout status deployment/user-service \
-            -n staging \
-            --timeout=300s
-
-      - name: Wait for student-service rollout
-        run: |
-          kubectl rollout status deployment/student-service \
-            -n staging \
-            --timeout=300s
-
-      - name: Wait for lecturer-service rollout
-        run: |
-          kubectl rollout status deployment/lecturer-service \
-            -n staging \
-            --timeout=300s
-
-      - name: Wait for course-service rollout
-        run: |
-          kubectl rollout status deployment/course-service \
-            -n staging \
-            --timeout=300s
+          az rest \
+            --method put \
+            --url "$SITE_CONFIG_URL" \
+            --body "{\"properties\":{\"linuxFxVersion\":\"DOCKER|${IMAGE_REF}\"}}"
 
-      - name: Wait for enrollment-service rollout
+      - name: Restart staging slot
         run: |
-          kubectl rollout status deployment/enrollment-service \
-            -n staging \
-            --timeout=300s
+          az webapp restart \
+            --name "$APP_SERVICE_NAME" \
+            --resource-group "$RESOURCE_GROUP" \
+            --slot "$SLOT_NAME"
 
-      - name: Show staging resources
+      - name: Show App Service staging status
         run: |
-          kubectl get pods -n staging
-          kubectl get services -n staging
-          kubectl get pvc -n staging
+          az webapp show \
+            --name "$APP_SERVICE_NAME" \
+            --resource-group "$RESOURCE_GROUP" \
+            --slot "$SLOT_NAME" \
+            --query '{name:name, state:state, defaultHostName:defaultHostName, slot:slotSwapStatus}' \
+            -o table

.github/workflows/03-staging-test.yml

@@ -20,44 +20,56 @@ jobs:
     environment:
       name: staging
 
+    env:
+      APP_SERVICE_NAME: koalatech-week08-webapp-226035073
+      RESOURCE_GROUP: koalatech-week08-rg
+      SLOT_NAME: staging
+
     steps:
       - name: Login to Azure
-        uses: azure/login@v3
+        uses: azure/login@v2
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
 
-      - name: Get AKS credentials
+      - name: Get staging hostname
+        id: staging
         run: |
-          az aks get-credentials \
-            --resource-group ${{ vars.AKS_RESOURCE_GROUP }} \
-            --name ${{ vars.AKS_CLUSTER_NAME }} \
-            --overwrite-existing
+          STAGING_HOSTNAME=$(az webapp show \
+            --name "$APP_SERVICE_NAME" \
+            --resource-group "$RESOURCE_GROUP" \
+            --slot "$SLOT_NAME" \
+            --query defaultHostName \
+            --output tsv)
 
-      - name: Wait for staging frontend IP
-        run: |
-          for i in {1..30}; do
+          if [ -z "$STAGING_HOSTNAME" ]; then
+            echo "Staging hostname not available."
+            exit 1
+          fi
 
-            FRONTEND_IP=$(kubectl get service frontend \
-              -n staging \
-              -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
+          echo "STAGING_HOSTNAME=$STAGING_HOSTNAME" >> "$GITHUB_ENV"
+
+      - name: Wait for staging app to respond
+        run: |
+          echo "Checking https://${STAGING_HOSTNAME}"
 
-            if [ -n "$FRONTEND_IP" ]; then
-              echo "FRONTEND_IP=$FRONTEND_IP" >> "$GITHUB_ENV"
+          for i in {1..30}; do
+            if curl \
+              --fail \
+              --silent \
+              --show-error \
+              --location \
+              --connect-timeout 10 \
+              --max-time 30 \
+              "https://${STAGING_HOSTNAME}" \
+              > /tmp/staging-response.html 2>/dev/null; then
+              echo "Staging app responded successfully."
+              grep -Eiq "<html|<!doctype html|KoalaTech|Login" /tmp/staging-response.html || true
               exit 0
             fi
 
-            echo "Waiting for staging frontend IP..."
-
+            echo "Waiting for staging app to become ready... attempt ${i}/30"
             sleep 10
           done
 
-          echo "Unable to find staging frontend IP."
-          exit 1
-
-      - name: Test frontend
-        run: |
-          curl \
-            --fail \
-            --retry 10 \
-            --retry-delay 5 \
-            http://${{ env.FRONTEND_IP }}
+          echo "Staging app did not respond successfully within the timeout."
+          exit 1