GitHub Actions: CI/CD profissional do zero

# .github/workflows/ci.yml — o menor workflow útil
name: CI

on:
  pull_request:
  push:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
      - run: npm ci
      - run: npm test -- --ci
      - run: npm run build

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20, cache: 'npm' }
      - run: npm ci
      - run: npm run lint

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20, cache: 'npm' }
      - run: npm ci
      - run: npm test -- --coverage
      - uses: actions/upload-artifact@v4
        with: { name: coverage, path: coverage/ }

  build:
    needs: [lint, test]          # só roda se lint E test passarem
    runs-on: ubuntu-latest
    outputs:
      image: ${{ steps.meta.outputs.image }}
    steps:
      - uses: actions/checkout@v4
      - id: meta
        run: echo "image=ghcr.io/${{ github.repository }}:${{ github.sha }}" >> "$GITHUB_OUTPUT"
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v6
        with:
          push: true
          tags: ${{ steps.meta.outputs.image }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy-staging:
    needs: build
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: staging         # ativa gate de aprovação se configurado
    steps:
      - run: echo "Deploying ${{ needs.build.outputs.image }}"

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false           # não derruba os outros se um falhar
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        node: [18, 20, 22]
        include:
          - os: ubuntu-latest
            node: 20
            coverage: true       # só essa combinação sobe coverage
        exclude:
          - os: windows-latest
            node: 18              # não suportamos essa combinação
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: ${{ matrix.node }} }
      - run: npm ci
      - run: npm test
      - if: matrix.coverage
        uses: codecov/codecov-action@v4

# OIDC para AWS (zero static keys)
permissions:
  id-token: write          # <<< necessário pra emitir o JWT OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-deployer
          role-session-name: gha-${{ github.run_id }}
          aws-region: us-east-1
      - run: aws s3 sync ./dist s3://meu-bucket --delete

- name: Cache node_modules
  uses: actions/cache@v4
  with:
    path: |
      ~/.npm
      node_modules
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-node-

# Melhor ainda: use o cache embutido do setup-node (atrás é actions/cache)
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'     # detecta package-lock.json e cacheia ~/.npm

# org/.github/.github/workflows/build-and-push.yml  (o "definido")
on:
  workflow_call:
    inputs:
      image-name:
        required: true
        type: string
      platforms:
        default: 'linux/amd64'
        type: string
    secrets:
      REGISTRY_TOKEN:
        required: true

jobs:
  build-push:
    runs-on: ubuntu-latest
    permissions: { contents: read, packages: write }
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/build-push-action@v6
        with:
          push: true
          tags: ${{ inputs.image-name }}:${{ github.sha }}
          platforms: ${{ inputs.platforms }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

# no repo que consome:
jobs:
  build:
    uses: minha-org/.github/.github/workflows/build-and-push.yml@v1
    with:
      image-name: ghcr.io/minha-org/minha-api
      platforms: 'linux/amd64,linux/arm64'
    secrets:
      REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  deploy-prod:
    needs: deploy-staging
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://app.meusite.com    # aparece na UI
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::111:role/prod-deployer
          aws-region: us-east-1
      - run: ./scripts/deploy.sh prod

name: Release

on:
  push:
    branches: [main]

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    steps:
      - uses: googleapis/release-please-action@v4
        id: rp
        with:
          release-type: node        # lê commits convencionais e cria PR de release
    outputs:
      release_created: ${{ steps.rp.outputs.release_created }}
      tag_name: ${{ steps.rp.outputs.tag_name }}

  build-and-publish:
    needs: release-please
    if: needs.release-please.outputs.release_created == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20, registry-url: 'https://registry.npmjs.org' }
      - run: npm ci
      - run: npm run build
      - run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

name: Deploy

on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  build:
    uses: ./.github/workflows/build-and-push.yml
    with:
      image-name: ghcr.io/me/api
    secrets: inherit

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::111:role/eks-deployer
          aws-region: us-east-1

      - name: Setup kubectl + kubeconfig
        run: |
          aws eks update-kubeconfig --name prod-cluster --region us-east-1
          kubectl version --client

      - name: Apply manifests com image atualizada
        run: |
          cd k8s/
          kustomize edit set image api=ghcr.io/me/api:${{ github.sha }}
          kubectl apply -k .
          kubectl rollout status deploy/api --timeout=5m

      - name: Smoke test
        run: |
          ENDPOINT=$(kubectl get ing api -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
          curl -fsS "https://$ENDPOINT/health" || exit 1

permissions:
  contents: read     # default mínimo

jobs:
  release:
    permissions:
      contents: write         # cria tag/release
      id-token: write         # OIDC
      packages: write         # publica no GHCR
      # nada mais