ci.yml

name: CI

on:
  push:
    branches: [main, develop, 'feature/**', 'bugfix/**']
  pull_request:
    branches: [main, develop]
  workflow_dispatch:

permissions:
  contents: read
  security-events: write

jobs:
  validate:
    name: Validate Configuration
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Validate Docker Compose files
        run: |
          for f in docker/docker-compose.*.yml; do
            echo "Validating: $f"
            docker compose -f "$f" config --no-interpolate -q
          done

      - name: ShellCheck — lab test scripts
        run: |
          sudo apt-get install -y shellcheck -qq
          shellcheck --severity=error tests/labs/*.sh

      - name: Validate module manifest
        run: |
          python3 -c "
          import sys, re
          with open('it-stack-iredmail.yml') as f:
              content = f.read()
          required = ['module:', 'version:', 'phase:', 'category:', 'ports:']
          missing = [k for k in required if k not in content]
          if missing:
              print('Missing fields:', missing); sys.exit(1)
          print('Manifest valid')
          "

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: validate
    steps:
      - uses: actions/checkout@v4

      - name: Trivy — scan Dockerfile
        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: config
          scan-ref: .
          exit-code: '0'
          severity: CRITICAL,HIGH

      - name: Trivy — SARIF output
        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: config
          scan-ref: .
          format: sarif
          output: trivy-results.sarif

      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy-results.sarif

  lab-01-smoke:
    name: Lab 01 — iRedMail standalone (SMTP, IMAP, webmail, Postfix, Dovecot)
    runs-on: ubuntu-latest
    needs: validate
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4

      - name: Install tools
        run: sudo apt-get install -y curl netcat-openbsd

      - name: Validate standalone compose
        run: |
          docker compose -f docker/docker-compose.standalone.yml config -q
          echo "Standalone compose valid"

      - name: Start standalone stack
        run: docker compose -f docker/docker-compose.standalone.yml up -d

      - name: Wait for iRedMail webmail
        run: timeout 300 bash -c 'until curl -sf http://localhost:9080/ | grep -qi "roundcube\|webmail\|login"; do sleep 10; done'

      - name: Run Lab 09-01 test script
        run: bash tests/labs/test-lab-09-01.sh

      - name: Collect logs on failure
        if: failure()
        run: docker compose -f docker/docker-compose.standalone.yml logs

      - name: Cleanup
        if: always()
        run: docker compose -f docker/docker-compose.standalone.yml down -v

  lab-02-smoke:
    name: Lab 02 — iRedMail LAN (OpenLDAP, mailhog, SMTP/IMAP)
    runs-on: ubuntu-latest
    needs: validate
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4

      - name: Install tools
        run: sudo apt-get install -y curl netcat-openbsd ldap-utils

      - name: Validate LAN compose
        run: docker compose -f docker/docker-compose.lan.yml config -q && echo "LAN compose valid"

      - name: Start LAN stack
        run: docker compose -f docker/docker-compose.lan.yml up -d

      - name: Wait for OpenLDAP
        run: timeout 60 bash -c 'until timeout 3 bash -c "echo > /dev/tcp/localhost/389" 2>/dev/null; do sleep 2; done'

      - name: Wait for iRedMail webmail
        run: timeout 360 bash -c 'until curl -sf http://localhost:9080/ | grep -qi "roundcube\\|webmail\\|login"; do sleep 10; done'

      - name: Run Lab 09-02 test script
        run: bash tests/labs/test-lab-09-02.sh

      - name: Collect logs on failure
        if: failure()
        run: docker compose -f docker/docker-compose.lan.yml logs

      - name: Cleanup
        if: always()
        run: docker compose -f docker/docker-compose.lan.yml down -v

  lab-03-smoke:
    name: Lab 03 - iRedMail Advanced (DKIM, resource limits, STARTTLS)
    runs-on: ubuntu-latest
    needs: validate
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: Install tools
        run: sudo apt-get install -y curl netcat-openbsd ldap-utils
      - name: Validate advanced compose
        run: docker compose -f docker/docker-compose.advanced.yml config -q && echo "Advanced compose valid"
      - name: Start advanced stack
        run: docker compose -f docker/docker-compose.advanced.yml up -d
      - name: Wait for OpenLDAP
        run: timeout 60 bash -c 'until timeout 3 bash -c "echo > /dev/tcp/localhost/389" 2>/dev/null; do sleep 2; done'
      - name: Wait for iRedMail
        run: timeout 360 bash -c 'until curl -sf http://localhost:9080/mail/ | grep -qi "roundcube\|webmail\|login"; do sleep 10; done'
      - name: Run Lab 09-03 test script
        run: bash tests/labs/test-lab-09-03.sh
      - name: Collect logs on failure
        if: failure()
        run: docker compose -f docker/docker-compose.advanced.yml logs
      - name: Cleanup
        if: always()
        run: docker compose -f docker/docker-compose.advanced.yml down -v
  lab-04-smoke:
    name: Lab 04 — iRedMail SSO Integration (Keycloak LDAP federation)
    runs-on: ubuntu-latest
    needs: validate
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: Install tools
        run: sudo apt-get install -y curl netcat-openbsd ldap-utils
      - name: Validate SSO compose
        run: docker compose -f docker/docker-compose.sso.yml config -q && echo "SSO compose valid"
      - name: Start SSO stack
        run: docker compose -f docker/docker-compose.sso.yml up -d
      - name: Wait for OpenLDAP
        run: timeout 60 bash -c 'until timeout 3 bash -c "echo > /dev/tcp/localhost/389" 2>/dev/null; do sleep 2; done'
      - name: Wait for Keycloak
        run: timeout 120 bash -c 'until curl -sf http://localhost:8087/health/ready | grep -q UP; do sleep 5; done'
      - name: Wait for iRedMail
        run: timeout 360 bash -c 'until curl -sf http://localhost:9080/ | grep -qi "roundcube"; do sleep 10; done'
      - name: Run Lab 09-04 test script
        run: bash tests/labs/test-lab-09-04.sh
      - name: Collect logs on failure
        if: failure()
        run: docker compose -f docker/docker-compose.sso.yml logs
      - name: Cleanup
        if: always()
        run: docker compose -f docker/docker-compose.sso.yml down -v
  lab-05-smoke:
    name: Lab 05 -- iRedMail Advanced Integration (LDAP + Keycloak federation)
    runs-on: ubuntu-latest
    needs: validate
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: Install tools
        run: sudo apt-get install -y curl ldap-utils
      - name: Validate integration compose
        run: docker compose -f docker/docker-compose.integration.yml config -q && echo "Integration compose valid"
      - name: Start integration stack
        run: docker compose -f docker/docker-compose.integration.yml up -d
      - name: Wait for Keycloak
        run: timeout 180 bash -c 'until curl -sf http://localhost:8108/health/ready | grep -q UP; do sleep 5; done'
      - name: Wait for OpenLDAP
        run: timeout 120 bash -c 'until docker exec iredmail-int-ldap ldapsearch -x -H ldap://localhost -b dc=lab,dc=local -D cn=admin,dc=lab,dc=local -w LdapAdmin05! > /dev/null 2>&1; do sleep 5; done'
      - name: Wait for iRedMail
        run: timeout 360 bash -c 'until curl -sf http://localhost:9180/ > /dev/null 2>&1; do sleep 15; done'
      - name: Run Lab 09-05 test script
        run: bash tests/labs/test-lab-09-05.sh --no-cleanup
      - name: Collect logs on failure
        if: failure()
        run: docker compose -f docker/docker-compose.integration.yml logs
      - name: Cleanup
        if: always()
        run: docker compose -f docker/docker-compose.integration.yml down -v

  lab-06-smoke:
    name: Lab 06 -- iRedMail Production Deployment (resource limits + email stack)
    runs-on: ubuntu-latest
    needs: validate
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: Install tools
        run: sudo apt-get install -y curl ldap-utils
      - name: Validate production compose
        run: docker compose -f docker/docker-compose.production.yml config -q && echo "Production compose valid"
      - name: Start production stack
        run: docker compose -f docker/docker-compose.production.yml up -d
      - name: Wait for Keycloak
        run: timeout 240 bash -c 'until curl -sf http://localhost:8208/health/ready | grep -q UP; do sleep 5; done'
      - name: Wait for OpenLDAP
        run: timeout 120 bash -c 'until docker exec iredmail-prod-ldap ldapsearch -x -H ldap://localhost -b dc=lab,dc=local -D cn=admin,dc=lab,dc=local -w LdapProd06! > /dev/null 2>&1; do sleep 5; done'
      - name: Wait for iRedMail
        run: timeout 360 bash -c 'until docker inspect iredmail-prod-app --format "{{.State.Health.Status}}" | grep -q healthy; do sleep 10; done'
      - name: Run Lab 09-06 test script
        run: bash tests/labs/test-lab-09-06.sh --no-cleanup
      - name: Collect logs on failure
        if: failure()
        run: docker compose -f docker/docker-compose.production.yml logs
      - name: Cleanup
        if: always()
        run: docker compose -f docker/docker-compose.production.yml down -v