ci.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

permissions:
  contents: read
  security-events: write

jobs:
  powershell-analysis:
    name: PowerShell Script Analysis
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Install PowerShell
      shell: bash
      run: |
        sudo apt-get update
        sudo apt-get install -y wget apt-transport-https software-properties-common
        wget -q https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb
        sudo dpkg -i packages-microsoft-prod.deb
        sudo apt-get update
        sudo apt-get install -y powershell
        
    - name: Install PSScriptAnalyzer
      shell: pwsh
      run: |
        Install-Module -Name PSScriptAnalyzer -Force -Scope CurrentUser
        
    - name: Run PSScriptAnalyzer
      shell: pwsh
      run: |
        $results = Invoke-ScriptAnalyzer -Path ./scripts/ -Recurse -ReportSummary -Severity Warning,Error
        if ($results) {
          $results | Format-Table
          Write-Output "PSScriptAnalyzer found issues. Please review and fix them."
          exit 1
        } else {
          Write-Output "✅ No PSScriptAnalyzer issues found."
        }

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Run security scan
      shell: bash
      run: |
        echo "🔍 Scanning for sensitive data..."
        
        # Check for actual hardcoded credentials (not just keywords)
        if grep -r -E "(password|secret|key|token)\s*[:=]\s*['\"][a-zA-Z0-9]{8,}['\"]" --include="*.ps1" --include="*.md" . | grep -v -E "(example|placeholder|template|sample|test|YOUR_|EXAMPLE_)" | grep -q .; then
          echo "❌ Hardcoded credentials detected!"
          exit 1
        else
          echo "✅ No hardcoded credentials found."
        fi
        
        # Check for real sensitive file patterns
        if find . -name "*.key" -o -name "*.pem" -o -name ".env" | grep -q .; then
          echo "❌ Sensitive files detected!"
          exit 1
        else
          echo "✅ No sensitive files found."
        fi

  documentation-check:
    name: Documentation Check
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Check documentation
      shell: bash
      run: |
        echo "📚 Checking documentation completeness..."
        
        # Check if README exists and has required sections
        if [ ! -f "README.md" ]; then
          echo "❌ README.md is missing!"
          exit 1
        fi
        
        # Check for required sections in README
        required_sections=("Overview" "Quick Start" "Usage Guide")
        for section in "${required_sections[@]}"; do
          if ! grep -q "$section" README.md; then
            echo "❌ Missing required section: $section"
            exit 1
          fi
        done
        
        echo "✅ Documentation check passed."

  powershell-syntax:
    name: PowerShell Syntax Check
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Install PowerShell
      shell: bash
      run: |
        sudo apt-get update
        sudo apt-get install -y wget apt-transport-https software-properties-common
        wget -q https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb
        sudo dpkg -i packages-microsoft-prod.deb
        sudo apt-get update
        sudo apt-get install -y powershell
        
    - name: Syntax validation
      shell: pwsh
      run: |
        $scriptFiles = Get-ChildItem -Path ./scripts/ -Filter "*.ps1" -Recurse
        $syntaxErrors = 0
        
        foreach ($file in $scriptFiles) {
          Write-Output "Checking syntax: $($file.Name)"
          $errors = $null
          $null = [System.Management.Automation.PSParser]::Tokenize((Get-Content $file.FullName -Raw), [ref]$errors)
          
          if ($errors) {
            Write-Output "❌ Syntax errors in $($file.Name):"
            $errors | ForEach-Object { Write-Output "  - $($_.Message)" }
            $syntaxErrors++
          } else {
            Write-Output "✅ $($file.Name) syntax OK"
          }
        }
        
        if ($syntaxErrors -gt 0) {
          Write-Output "❌ Found syntax errors in $syntaxErrors file(s)."
          exit 1
        } else {
          Write-Output "✅ All PowerShell scripts have valid syntax."
        }