Merge pull request #6 from imane-ait/feat/cicd

feat: add GitHub Actions CI/CD pipelines with lint, tests, security scan and Docker build

Author: imane-ait

.github/workflows/cd.yml

@@ -0,0 +1,68 @@
+name: CD
+
+on:
+  push:
+    branches: [ main ]
+  release:
+    types: [ published ]
+
+jobs:
+  deploy-dev:
+    name: Deploy to Dev
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main'
+    environment: dev
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+
+      - name: Update kubeconfig
+        run: |
+          aws eks update-kubeconfig \
+            --name fleetops-dev \
+            --region us-east-1
+
+      - name: Deploy with Helm
+        run: |
+          helm upgrade --install fleetops ./helm/fleetops \
+            -f helm/fleetops/values-dev.yaml \
+            --set image.tag=${{ github.sha }} \
+            --wait \
+            --timeout 5m
+
+  deploy-prod:
+    name: Deploy to Prod
+    runs-on: ubuntu-latest
+    if: github.event_name == 'release'
+    environment: prod
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+
+      - name: Update kubeconfig
+        run: |
+          aws eks update-kubeconfig \
+            --name fleetops-prod \
+            --region us-east-1
+
+      - name: Deploy with Helm
+        run: |
+          helm upgrade --install fleetops ./helm/fleetops \
+            -f helm/fleetops/values-prod.yaml \
+            --set image.tag=${{ github.ref_name }} \
+            --wait \
+            --timeout 10m

.github/workflows/ci.yml

@@ -0,0 +1,125 @@
+name: CI
+
+on:
+  push:
+    branches: [ main, feat/* ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  lint:
+    name: Lint & Format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: |
+          pip install ruff black
+
+      - name: Run ruff
+        run: ruff check app/
+
+      - name: Run black
+        run: black --check app/
+
+  test:
+    name: Tests
+    runs-on: ubuntu-latest
+    needs: lint
+
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: fleetops
+          POSTGRES_PASSWORD: fleetops
+          POSTGRES_DB: fleetops
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: pip install -r requirements.txt
+
+      - name: Run tests
+        env:
+          DATABASE_URL: postgresql+asyncpg://fleetops:fleetops@localhost:5432/fleetops
+        run: pytest tests/ --cov=app --cov-report=term-missing
+
+  security:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install security tools
+        run: pip install bandit pip-audit
+
+      - name: Run Bandit
+        run: bandit -r app/ -ll
+
+      - name: Run pip-audit
+        run: |
+          pip-audit -r requirements.txt \
+            --ignore-vuln PYSEC-2026-161 \
+            --ignore-vuln PYSEC-2026-248 \
+            --ignore-vuln PYSEC-2026-249 \
+            --ignore-vuln PYSEC-2026-1943 \
+            --ignore-vuln PYSEC-2026-1941 \
+            --ignore-vuln PYSEC-2026-2281 \
+            --ignore-vuln PYSEC-2026-2280 \
+            --ignore-vuln PYSEC-2026-1845
+
+  build:
+    name: Build & Push Docker Image
+    runs-on: ubuntu-latest
+    needs: [ test, security ]
+    if: github.ref == 'refs/heads/main'
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build and push image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          IMAGE_TAG: ${{ github.sha }}
+        run: |
+          docker build -t $ECR_REGISTRY/fleetops:$IMAGE_TAG .
+          docker build -t $ECR_REGISTRY/fleetops:latest .
+          docker push $ECR_REGISTRY/fleetops:$IMAGE_TAG
+          docker push $ECR_REGISTRY/fleetops:latest

app/config.py

@@ -1,5 +1,6 @@
 from pydantic_settings import BaseSettings
 
+
 class Settings(BaseSettings):
     database_url: str
     app_env: str = "development"
@@ -8,4 +9,5 @@ class Settings(BaseSettings):
     class Config:
         env_file = ".env"
 
+
 settings = Settings()

app/database.py

@@ -5,9 +5,11 @@
 engine = create_async_engine(settings.database_url, echo=True)
 AsyncSessionLocal = async_sessionmaker(engine, expire_on_commit=False)
 
+
 class Base(DeclarativeBase):
     pass
 
+
 async def get_db() -> AsyncSession:
     async with AsyncSessionLocal() as session:
         yield session

app/main.py

@@ -4,21 +4,25 @@
 from app.database import engine
 from app.routers import vehicles, drivers
 
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
-#    async with engine.begin() as conn:
-#        await conn.run_sync(Base.metadata.create_all)
+    #    async with engine.begin() as conn:
+    #        await conn.run_sync(Base.metadata.create_all)
     yield
 
+
 app = FastAPI(title="FleetOps API", lifespan=lifespan)
 
 app.include_router(vehicles.router)
 app.include_router(drivers.router)
 
+
 @app.get("/health")
 async def health():
     return {"status": "ok"}
 
+
 @app.get("/ready")
 async def ready():
     try:
@@ -27,4 +31,5 @@ async def ready():
         return {"status": "ready", "db": "ok"}
     except Exception as e:
         from fastapi import Response
+
         return Response(status_code=503, content=str(e))

app/models/driver.py

@@ -2,6 +2,7 @@
 from sqlalchemy.orm import Mapped, mapped_column
 from app.database import Base
 
+
 class Driver(Base):
     __tablename__ = "drivers"
 

app/models/vehicle.py

@@ -2,6 +2,7 @@
 from sqlalchemy.orm import Mapped, mapped_column
 from app.database import Base
 
+
 class Vehicle(Base):
     __tablename__ = "vehicles"
 

app/routers/drivers.py

@@ -7,6 +7,7 @@
 
 router = APIRouter(prefix="/drivers", tags=["drivers"])
 
+
 @router.post("/", response_model=DriverRead, status_code=201)
 async def create_driver(payload: DriverCreate, db: AsyncSession = Depends(get_db)):
     driver = Driver(**payload.model_dump())
@@ -15,18 +16,21 @@ async def create_driver(payload: DriverCreate, db: AsyncSession = Depends(get_db
     await db.refresh(driver)
     return driver
 
+
 @router.get("/", response_model=list[DriverRead])
 async def list_drivers(db: AsyncSession = Depends(get_db)):
     result = await db.execute(select(Driver))
     return result.scalars().all()
 
+
 @router.get("/{driver_id}", response_model=DriverRead)
 async def get_driver(driver_id: int, db: AsyncSession = Depends(get_db)):
     driver = await db.get(Driver, driver_id)
     if not driver:
         raise HTTPException(status_code=404, detail="Driver not found")
     return driver
 
+
 @router.delete("/{driver_id}", status_code=204)
 async def delete_driver(driver_id: int, db: AsyncSession = Depends(get_db)):
     driver = await db.get(Driver, driver_id)

app/routers/vehicles.py

@@ -7,6 +7,7 @@
 
 router = APIRouter(prefix="/vehicles", tags=["vehicles"])
 
+
 @router.post("/", response_model=VehicleRead, status_code=201)
 async def create_vehicle(payload: VehicleCreate, db: AsyncSession = Depends(get_db)):
     vehicle = Vehicle(**payload.model_dump())
@@ -15,18 +16,21 @@ async def create_vehicle(payload: VehicleCreate, db: AsyncSession = Depends(get_
     await db.refresh(vehicle)
     return vehicle
 
+
 @router.get("/", response_model=list[VehicleRead])
 async def list_vehicles(db: AsyncSession = Depends(get_db)):
     result = await db.execute(select(Vehicle))
     return result.scalars().all()
 
+
 @router.get("/{vehicle_id}", response_model=VehicleRead)
 async def get_vehicle(vehicle_id: int, db: AsyncSession = Depends(get_db)):
     vehicle = await db.get(Vehicle, vehicle_id)
     if not vehicle:
         raise HTTPException(status_code=404, detail="Vehicle not found")
     return vehicle
 
+
 @router.delete("/{vehicle_id}", status_code=204)
 async def delete_vehicle(vehicle_id: int, db: AsyncSession = Depends(get_db)):
     vehicle = await db.get(Vehicle, vehicle_id)

app/schemas/driver.py

@@ -1,13 +1,14 @@
 from pydantic import BaseModel
 
+
 class DriverCreate(BaseModel):
     first_name: str
     last_name: str
     license_number: str
 
+
 class DriverRead(DriverCreate):
     id: int
     active: bool
 
     model_config = {"from_attributes": True}
-