name: CI Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          pip install -r requirements.txt
          pip install pytest pytest-cov

      - name: Run tests
        run: pytest tests/ -v --cov=app --cov-report=xml

      - name: Upload coverage
        uses: codecov/codecov-action@v4

name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  claude-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get PR diff
        id: diff
        run: |
          git diff origin/main...HEAD > pr_diff.txt
          echo "diff_size=$(wc -c < pr_diff.txt)" >> $GITHUB_OUTPUT

      - name: Claude AI Review
        if: steps.diff.outputs.diff_size < 50000
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          pip install anthropic
          python - <<'EOF'
          import anthropic
          import os

          with open("pr_diff.txt") as f:
              diff = f.read()

          client = anthropic.Anthropic()
          message = client.messages.create(
              model="claude-sonnet-4-6",
              max_tokens=2000,
              messages=[{
                  "role": "user",
                  "content": f"""Review this code diff for a Pakistani business application.
          Check for:
          1. Security issues (hardcoded secrets, SQL injection, path traversal)
          2. Logic bugs that could affect Pakistani payment flows (JazzCash, EasyPaisa)
          3. Missing error handling
          4. Performance issues
          5. Any breaking changes to existing API contracts

          Diff:
          {diff[:10000]}

          Respond with: APPROVED, NEEDS_CHANGES, or CRITICAL_ISSUES, followed by specific line-by-line feedback."""
              }]
          )
          print(message.content[0].text)
          EOF

      - name: Post Review Comment
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            // Post the Claude review as a PR comment
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '## AI Code Review\n' + process.env.REVIEW_OUTPUT
            });

name: Deploy to Production

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    needs: test  # Only deploy if tests pass

    steps:
      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.VPS_HOST }}          # Your Contabo/DigitalOcean IP
          username: ${{ secrets.VPS_USER }}
          key: ${{ secrets.VPS_SSH_KEY }}
          script: |
            cd /opt/myapp
            git pull origin main
            pip install -r requirements.txt
            # Zero-downtime restart with systemd
            sudo systemctl reload myapp
            # Health check — fail the deployment if app doesn't respond
            sleep 3
            curl -f http://localhost:8000/health || (echo "HEALTH CHECK FAILED" && exit 1)