first commit

q3-cicd/workflow.yml

@@ -0,0 +1,158 @@
+name: CI/CD - Build, Push, Deploy (Ghaymah)
+
+# يعمل تلقائيًا عند الدفع لفرع main، أو يدويًا لأي فرع/بيئة عبر workflow_dispatch
+on:
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: "وسم اختياري إضافي للصورة (افتراضيًا: git SHA)"
+        required: false
+        default: ""
+
+# صلاحيات أقل ما يمكن (least privilege)
+permissions:
+  contents: read
+  packages: write
+
+env:
+  # عنوان سجل الحاويات الخاص بغيمة - عدّله حسب مشروعك
+  GHAYMAH_REGISTRY: registry.ghaymah.systems
+  GHAYMAH_NAMESPACE: my-team
+  IMAGE_NAME: sample-api
+
+jobs:
+  # ---------------------------------------------------------------------
+  # 1) بناء الصورة واختبارها ورفعها إلى Ghaymah Container Registry
+  # ---------------------------------------------------------------------
+  build-and-push:
+    name: Build & Push Image
+    runs-on: ubuntu-latest
+    outputs:
+      image_ref: ${{ steps.vars.outputs.image_ref }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set image tag variables
+        id: vars
+        run: |
+          SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
+          TAG="${{ github.event.inputs.image_tag }}"
+          if [ -z "$TAG" ]; then TAG="$SHORT_SHA"; fi
+          IMAGE_REF="${GHAYMAH_REGISTRY}/${GHAYMAH_NAMESPACE}/${IMAGE_NAME}:${TAG}"
+          echo "image_ref=${IMAGE_REF}" >> "$GITHUB_OUTPUT"
+          echo "Building: ${IMAGE_REF}"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # تسجيل الدخول إلى سجل حاويات غيمة عبر بيانات اعتماد مخزّنة كـ GitHub Secrets
+      - name: Log in to Ghaymah Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GHAYMAH_REGISTRY }}
+          username: ${{ secrets.GHAYMAH_REGISTRY_USER }}
+          password: ${{ secrets.GHAYMAH_REGISTRY_TOKEN }}
+
+      - name: Build image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          load: true
+          tags: |
+            ${{ steps.vars.outputs.image_ref }}
+            ${{ env.GHAYMAH_REGISTRY }}/${{ env.GHAYMAH_NAMESPACE }}/${{ env.IMAGE_NAME }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # اختبار سريع للتأكد أن /health يستجيب قبل الرفع للسجل (بوابة جودة أساسية)
+      - name: Smoke test the built image
+        run: |
+          docker run -d --name smoke -p 8080:8080 ${{ steps.vars.outputs.image_ref }}
+          for i in $(seq 1 10); do
+            if curl -sf http://localhost:8080/health; then echo "Health check passed"; break; fi
+            echo "Waiting for app to start... ($i/10)"; sleep 2
+          done
+          curl -sf http://localhost:8080/health || (docker logs smoke && exit 1)
+          docker stop smoke
+
+      - name: Push image to Ghaymah Registry
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ steps.vars.outputs.image_ref }}
+            ${{ env.GHAYMAH_REGISTRY }}/${{ env.GHAYMAH_NAMESPACE }}/${{ env.IMAGE_NAME }}:latest
+
+  # ---------------------------------------------------------------------
+  # 2) نشر تلقائي على STAGING فور نجاح البناء - بدون موافقة يدوية
+  # ---------------------------------------------------------------------
+  deploy-staging:
+    name: Deploy to Staging
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    environment:
+      name: staging
+      url: https://sample-api-staging.ghaymah.systems
+    steps:
+      - name: Install Ghaymah CLI
+        run: |
+          curl -fsSL https://cli.ghaymah.systems/install.sh | sh
+          ghaymah --version
+
+      - name: Authenticate Ghaymah CLI
+        run: ghaymah auth login --token "${{ secrets.GHAYMAH_API_TOKEN }}"
+
+      - name: Deploy image to staging service
+        run: |
+          ghaymah deploy \
+            --service sample-api-staging \
+            --image "${{ needs.build-and-push.outputs.image_ref }}" \
+            --env staging \
+            --wait
+
+      - name: Verify staging health
+        run: |
+          curl -sf https://sample-api-staging.ghaymah.systems/health
+
+  # ---------------------------------------------------------------------
+  # 3) نشر على PRODUCTION - يتطلب موافقة يدوية (Manual Approval)
+  #    الموافقة تُنفَّذ عبر GitHub Environment "production" المحمي بمراجعين
+  #    مطلوبين (Required Reviewers) من إعدادات المستودع، وليس بكود مخصص.
+  # ---------------------------------------------------------------------
+  deploy-production:
+    name: Deploy to Production (Manual Approval Required)
+    needs: [build-and-push, deploy-staging]
+    runs-on: ubuntu-latest
+    environment:
+      name: production   # <-- هذا السطر يفعّل بوابة الموافقة اليدوية المضبوطة في إعدادات المستودع
+      url: https://sample-api.ghaymah.systems
+    steps:
+      - name: Install Ghaymah CLI
+        run: |
+          curl -fsSL https://cli.ghaymah.systems/install.sh | sh
+          ghaymah --version
+
+      - name: Authenticate Ghaymah CLI
+        run: ghaymah auth login --token "${{ secrets.GHAYMAH_API_TOKEN }}"
+
+      - name: Deploy image to production service
+        run: |
+          ghaymah deploy \
+            --service sample-api-production \
+            --image "${{ needs.build-and-push.outputs.image_ref }}" \
+            --env production \
+            --strategy rolling \
+            --wait
+
+      - name: Verify production health
+        run: |
+          curl -sf https://sample-api.ghaymah.systems/health
+
+      - name: Post-deploy smoke check on /metrics
+        run: |
+          curl -sf https://sample-api.ghaymah.systems/metrics