clear old assets, new ci/cd flow

.github/workflows/ci.yml

@@ -1,246 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main, develop]
-  pull_request:
-    branches: [main]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  NODE_VERSION: "20"
-  PNPM_VERSION: "9"
-
-jobs:
-  lint:
-    name: Lint
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: "pnpm"
-      - uses: pnpm/action-setup@v4
-        with:
-          version: ${{ env.PNPM_VERSION }}
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Run linter
-        run: pnpm lint
-
-  typecheck:
-    name: Type Check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: "pnpm"
-      - uses: pnpm/action-setup@v4
-        with:
-          version: ${{ env.PNPM_VERSION }}
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build all packages
-        run: pnpm build
-
-  test:
-    name: Test Suite
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:16-alpine
-        env:
-          POSTGRES_DB: kordant
-          POSTGRES_USER: kordant
-          POSTGRES_PASSWORD: kordant_dev
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U kordant"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 5
-      redis:
-        image: redis:7-alpine
-        ports:
-          - 6379:6379
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 5
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: "pnpm"
-      - uses: pnpm/action-setup@v4
-        with:
-          version: ${{ env.PNPM_VERSION }}
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Run tests
-        run: pnpm test
-        env:
-          DATABASE_URL: "postgresql://kordant:kordant_dev@localhost:5432/kordant"
-          REDIS_URL: "redis://localhost:6379"
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          file: ./coverage/lcov.info
-          flags: unittests
-          name: kordant-coverage
-          fail_on_empty: false
-
-  docker-build:
-    name: Docker Build
-    runs-on: ubuntu-latest
-    needs: [lint, typecheck, test]
-    steps:
-      - uses: actions/checkout@v4
-      - name: Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Build Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: false
-          tags: kordant:${{ github.sha }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-  security-scan:
-    name: Security Scan
-    runs-on: ubuntu-latest
-    needs: [lint]
-    steps:
-      - uses: actions/checkout@v4
-      - name: Run pnpm audit
-        run: pnpm audit --prod
-      - name: Trivy filesystem scan
-        uses: aquasecurity/trivy-action@master
-        with:
-          scan-type: fs
-          scan-ref: "."
-          format: table
-          exit-code: 1
-          ignore-unfixed: true
-          severity: CRITICAL,HIGH
-
-  terraform-plan:
-    name: Terraform Plan
-    runs-on: ubuntu-latest
-    needs: [lint]
-    if: github.event_name == 'pull_request'
-    steps:
-      - uses: actions/checkout@v4
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
-      - name: Terraform Format
-        working-directory: infra
-        run: terraform fmt -check -diff
-      - name: Terraform Init
-        working-directory: infra
-        run: terraform init
-      - name: Terraform Validate
-        working-directory: infra
-        run: terraform validate
-      - name: Terraform Plan
-        working-directory: infra
-        run: terraform plan -var-file=environments/staging/terraform.tfvars.example -no-color
-        env:
-          TF_VAR_hibp_api_key: ${{ secrets.HIBP_API_KEY }}
-          TF_VAR_resend_api_key: ${{ secrets.RESEND_API_KEY }}
-
-  load-test:
-    name: Load Test
-    runs-on: ubuntu-latest
-    needs: [lint, typecheck, test, docker-build]
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    environment: staging
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install k6
-        run: |
-          K6_VERSION="v0.50.0"
-          K6_URL="https://github.com/grafana/k6/releases/download/${K6_VERSION}/k6-linux-amd64.tar.gz"
-          K6_SHA256="d950a2408d0be2dc81aef397a7c984a1d84271d7ae94ff7a47d08371904f0800"
-          curl -sSL "${K6_URL}" -o k6.tar.gz
-          echo "${K6_SHA256}  k6.tar.gz" | sha256sum --check --strict -
-          tar xzf k6.tar.gz
-          sudo mv k6 /usr/local/bin/
-          k6 version
-
-      - name: Validate required secrets
-        run: |
-          if [ -z "$API_TOKEN" ]; then
-            echo "❌ LOAD_TEST_API_TOKEN secret is not set"
-            exit 1
-          fi
-
-      - name: Run combined load tests
-        run: |
-          chmod +x scripts/load-test/run-all.sh
-          ./scripts/load-test/run-all.sh
-        env:
-          LOAD_TEST_BASE_URL: ${{ secrets.LOAD_TEST_BASE_URL || 'http://localhost:3000' }}
-          API_TOKEN: ${{ secrets.LOAD_TEST_API_TOKEN }}
-          TARGET_RPS: ${{ vars.LOAD_TEST_TARGET_RPS || '500' }}
-          DURATION: ${{ vars.LOAD_TEST_DURATION || '300s' }}
-          K6_CLOUD_TOKEN: ${{ secrets.K6_CLOUD_TOKEN || '' }}
-          K6_CLOUD_PROJECT_ID: ${{ vars.K6_CLOUD_PROJECT_ID || '' }}
-
-      - name: Upload load test report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: load-test-report-${{ github.sha }}
-          path: scripts/load-test/reports/
-          retention-days: 30
-
-      - name: Check P99 thresholds
-        if: always()
-        run: |
-          if [ -f scripts/load-test/reports/threshold-results.json ]; then
-            FAILURES=$(jq -r '[.services | to_entries[] | select(.value.exitCode != 0) | .key] | join(", ")' scripts/load-test/reports/threshold-results.json 2>/dev/null || echo "")
-            if [ -n "$FAILURES" ] && [ "$FAILURES" != "" ]; then
-              echo "❌ Load test failures: $FAILURES"
-              exit 1
-            else
-              echo "✅ All load tests passed"
-            fi
-          else
-            echo "⚠️ No threshold results file found"
-            exit 1
-          fi
-
-      - name: Validate auto-scaling
-        if: always()
-        run: |
-          SUMMARY_FILE=$(ls scripts/load-test/reports/*-summary-*.json 2>/dev/null | head -1)
-          if [ -n "$SUMMARY_FILE" ]; then
-            MAX_VUS=$(jq -r '.metrics.vus.max // 0' "$SUMMARY_FILE")
-            TARGET_VUS=20
-            if [ "$(echo "$MAX_VUS >= $TARGET_VUS" | bc -l)" -eq 1 ]; then
-              echo "✅ Auto-scaling validated: max VUs ($MAX_VUS) >= target ($TARGET_VUS)"
-            else
-              echo "⚠️ Auto-scaling below target: max VUs ($MAX_VUS) < target ($TARGET_VUS)"
-            fi
-          else
-            echo "⚠️ No summary file for auto-scaling validation"
-          fi

.github/workflows/deploy.yml

@@ -1,242 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches: [main]
-  release:
-    types: [published]
-
-concurrency:
-  group: deploy-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  NODE_VERSION: "20"
-  PNPM_VERSION: "9"
-
-jobs:
-  detect-environment:
-    name: Detect Environment
-    runs-on: ubuntu-latest
-    outputs:
-      environment: ${{ steps.detect.outputs.environment }}
-      tag: ${{ steps.tag.outputs.tag }}
-    steps:
-      - name: Detect deployment target
-        id: detect
-        run: |
-          if [ "${{ github.event_name }}" = "release" ]; then
-            echo "environment=production" >> $GITHUB_OUTPUT
-          else
-            echo "environment=staging" >> $GITHUB_OUTPUT
-          fi
-      - name: Calculate tag
-        id: tag
-        run: |
-          if [ "${{ steps.detect.outputs.environment }}" = "production" ]; then
-            echo "tag=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
-          else
-            echo "tag=${{ github.sha }}" >> $GITHUB_OUTPUT
-          fi
-
-  terraform-apply:
-    name: Terraform Apply
-    runs-on: ubuntu-latest
-    needs: detect-environment
-    environment: ${{ needs.detect-environment.outputs.environment }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
-        with:
-          terraform_version: "~> 1.5"
-      - name: Terraform Init
-        working-directory: infra/environments/${{ needs.detect-environment.outputs.environment }}
-        run: terraform init -backend-config="bucket=kordant-${{ needs.detect-environment.outputs.environment }}-terraform-state"
-      - name: Terraform Plan
-        id: plan
-        working-directory: infra/environments/${{ needs.detect-environment.outputs.environment }}
-        run: |
-          terraform plan \
-            -var="hibp_api_key=${{ secrets.HIBP_API_KEY }}" \
-            -var="resend_api_key=${{ secrets.RESEND_API_KEY }}" \
-            -var="sentry_dsn=${{ secrets.SENTRY_DSN }}" \
-            -var="datadog_api_key=${{ secrets.DATADOG_API_KEY }}" \
-            -no-color | tee /tmp/terraform-plan.out
-      - name: Terraform Apply
-        working-directory: infra/environments/${{ needs.detect-environment.outputs.environment }}
-        run: |
-          terraform apply -auto-approve \
-            -var="hibp_api_key=${{ secrets.HIBP_API_KEY }}" \
-            -var="resend_api_key=${{ secrets.RESEND_API_KEY }}" \
-            -var="sentry_dsn=${{ secrets.SENTRY_DSN }}" \
-            -var="datadog_api_key=${{ secrets.DATADOG_API_KEY }}"
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: us-east-1
-
-  build-and-push:
-    name: Build and Push Docker Images
-    runs-on: ubuntu-latest
-    needs: [detect-environment]
-    environment: ${{ needs.detect-environment.outputs.environment }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: api
-            dockerfile: packages/api/Dockerfile
-          - name: darkwatch
-            dockerfile: services/darkwatch/Dockerfile
-          - name: spamshield
-            dockerfile: services/spamshield/Dockerfile
-          - name: voiceprint
-            dockerfile: services/voiceprint/Dockerfile
-    steps:
-      - uses: actions/checkout@v4
-      - name: Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Login to Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Calculate image tag
-        id: tag
-        run: echo "tag=${{ needs.detect-environment.outputs.tag }}" >> $GITHUB_OUTPUT
-      - name: Build and push ${{ matrix.name }}
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ${{ matrix.dockerfile }}
-          push: true
-          tags: |
-            ghcr.io/${{ github.repository_owner }}/kordant-${{ matrix.name }}:${{ steps.tag.outputs.tag }}
-            ghcr.io/${{ github.repository_owner }}/kordant-${{ matrix.name }}:latest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-  deploy-ecs:
-    name: Deploy to ECS
-    runs-on: ubuntu-latest
-    needs: [detect-environment, terraform-apply, build-and-push]
-    environment: ${{ needs.detect-environment.outputs.environment }}
-    strategy:
-      fail-fast: false
-      matrix:
-        service: [api, darkwatch, spamshield, voiceprint]
-    steps:
-      - uses: actions/checkout@v4
-      - name: Configure AWS
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
-      - name: Update ECS Service
-        run: |
-          IMAGE="ghcr.io/${{ github.repository_owner }}/kordant-${{ matrix.service }}:${{ needs.detect-environment.outputs.tag }}"
-          CLUSTER="kordant-${{ needs.detect-environment.outputs.environment }}"
-          SERVICE="${{ matrix.service }}"
-
-          TASK_DEF=$(aws ecs describe-task-definition \
-            --task-definition "${CLUSTER}-${SERVICE}" \
-            --query 'taskDefinition' --output json)
-
-          NEW_TASK_DEF=$(echo "$TASK_DEF" | jq \
-            --arg image "$IMAGE" \
-            '.containerDefinitions[0].image = $image')
-
-          NEW_TASK_DEF_ARN=$(echo "$NEW_TASK_DEF" | \
-            aws ecs register-task-definition \
-            --family "${CLUSTER}-${SERVICE}" \
-            --cli-input-json - \
-            --query 'taskDefinition.taskDefinitionArn' --output text)
-
-          aws ecs update-service \
-            --cluster "$CLUSTER" \
-            --service "${CLUSTER}-${SERVICE}" \
-            --task-definition "$NEW_TASK_DEF_ARN" \
-            --force-new-deployment
-
-          echo "Deployed $IMAGE to $SERVICE"
-
-  health-check:
-    name: Post-Deploy Health Check
-    runs-on: ubuntu-latest
-    needs: [detect-environment, deploy-ecs]
-    environment: ${{ needs.detect-environment.outputs.environment }}
-    steps:
-      - name: Configure AWS
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
-      - name: Wait for deployment
-        run: sleep 30
-      - name: Health Check
-        id: health
-        run: |
-          ENV="${{ needs.detect-environment.outputs.environment }}"
-          CLUSTER="kordant-${ENV}"
-
-          ALB_DNS=$(aws elbv2 describe-load-balancers \
-            --query "LoadBalancers[?contains(LoadBalancerName, '${CLUSTER}-alb')].DNSName" \
-            --output text)
-
-          if [ -z "$ALB_DNS" ]; then
-            echo "Health check failed: ALB DNS not found"
-            exit 1
-          fi
-
-          echo "ALB DNS: $ALB_DNS"
-
-          FAILED=0
-          for service in api darkwatch spamshield voiceprint; do
-            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-              "https://${ALB_DNS}/health" || true)
-
-            if [ "$HTTP_CODE" = "200" ]; then
-              echo "Health check passed: $service"
-            else
-              echo "Health check failed: $service (HTTP $HTTP_CODE)"
-              FAILED=1
-            fi
-          done
-
-          if [ "$FAILED" -eq 1 ]; then
-            exit 1
-          fi
-
-  rollback:
-    name: Rollback on Failure
-    runs-on: ubuntu-latest
-    needs: [detect-environment, deploy-ecs, health-check]
-    environment: ${{ needs.detect-environment.outputs.environment }}
-    if: failure() && needs.health-check.result == 'failure'
-    strategy:
-      fail-fast: false
-      matrix:
-        service: [api, darkwatch, spamshield, voiceprint]
-    steps:
-      - name: Configure AWS
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
-      - name: Rollback ECS Service
-        run: |
-          CLUSTER="kordant-${{ needs.detect-environment.outputs.environment }}"
-          SERVICE="${{ matrix.service }}"
-
-          aws ecs update-service \
-            --cluster "$CLUSTER" \
-            --service "${CLUSTER}-${SERVICE}" \
-            --rollback \
-            --no-cli-auto-prompt
-
-          echo "Rolled back $SERVICE"

.github/workflows/load-test.yml

@@ -1,105 +0,0 @@
-name: Load Test
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch:
-    inputs:
-      target_rps:
-        description: 'Target requests per second'
-        required: false
-        default: '500'
-      duration:
-        description: 'Test duration'
-        required: false
-        default: '300s'
-      service:
-        description: 'Service to test (all, api, darkwatch, spamshield, voiceprint)'
-        required: false
-        default: 'all'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  NODE_VERSION: "20"
-
-jobs:
-  load-test:
-    name: Load Test (${{ github.event.inputs.service || 'all' }})
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    environment: staging
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install k6
-        run: |
-          K6_VERSION="v0.50.0"
-          K6_URL="https://github.com/grafana/k6/releases/download/${K6_VERSION}/k6-linux-amd64.tar.gz"
-          K6_SHA256="d950a2408d0be2dc81aef397a7c984a1d84271d7ae94ff7a47d08371904f0800"
-          curl -sSL "${K6_URL}" -o k6.tar.gz
-          echo "${K6_SHA256}  k6.tar.gz" | sha256sum --check --strict -
-          tar xzf k6.tar.gz
-          sudo mv k6 /usr/local/bin/
-          k6 version
-
-      - name: Validate required secrets
-        run: |
-          if [ -z "$API_TOKEN" ]; then
-            echo "❌ LOAD_TEST_API_TOKEN secret is not set"
-            exit 1
-          fi
-
-      - name: Run load tests
-        run: |
-          chmod +x scripts/load-test/run-all.sh
-          ./scripts/load-test/run-all.sh ${{ github.event.inputs.service || 'all' }}
-        env:
-          LOAD_TEST_BASE_URL: ${{ secrets.LOAD_TEST_BASE_URL || 'http://localhost:3000' }}
-          API_TOKEN: ${{ secrets.LOAD_TEST_API_TOKEN }}
-          TARGET_RPS: ${{ github.event.inputs.target_rps || '500' }}
-          DURATION: ${{ github.event.inputs.duration || '300s' }}
-          K6_CLOUD_TOKEN: ${{ secrets.K6_CLOUD_TOKEN || '' }}
-          K6_CLOUD_PROJECT_ID: ${{ vars.K6_CLOUD_PROJECT_ID || '' }}
-
-      - name: Upload load test report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: load-test-report-${{ github.sha }}
-          path: scripts/load-test/reports/
-          retention-days: 30
-
-      - name: Check P99 thresholds
-        if: always()
-        run: |
-          if [ -f scripts/load-test/reports/threshold-results.json ]; then
-            FAILURES=$(jq -r '[.services | to_entries[] | select(.value.exitCode != 0) | .key] | join(", ")' scripts/load-test/reports/threshold-results.json 2>/dev/null || echo "")
-            if [ -n "$FAILURES" ] && [ "$FAILURES" != "" ]; then
-              echo "❌ Load test failures: $FAILURES"
-              exit 1
-            else
-              echo "✅ All load tests passed"
-            fi
-          else
-            echo "⚠️ No threshold results file found"
-            exit 1
-          fi
-
-      - name: Validate auto-scaling
-        if: always()
-        run: |
-          SUMMARY_FILE=$(ls scripts/load-test/reports/*-summary-*.json 2>/dev/null | head -1)
-          if [ -n "$SUMMARY_FILE" ]; then
-            MAX_VUS=$(jq -r '.metrics.vus.max // 0' "$SUMMARY_FILE")
-            TARGET_VUS=20
-            if [ "$(echo "$MAX_VUS >= $TARGET_VUS" | bc -l)" -eq 1 ]; then
-              echo "✅ Auto-scaling validated: max VUs ($MAX_VUS) >= target ($TARGET_VUS)"
-            else
-              echo "⚠️ Auto-scaling below target: max VUs ($MAX_VUS) < target ($TARGET_VUS)"
-            fi
-          else
-            echo "⚠️ No summary file for auto-scaling validation"
-          fi