azure-pipelines.yml

trigger:
  - main

variables:
  azureContainerRegistry: "acrshrinet82prod.azurecr.io"
  backendImage: "chat-backend"
  frontendImage: "chat-frontend"
  tag: "$(Build.BuildId)"
  azureServiceConnection: "Azure-DevSecOps-Connection"

stages:
  # -------------------------------------------------------------------------
  # STAGE 1: SECURITY GATES
  # -------------------------------------------------------------------------
  - stage: SecurityGates
    displayName: "Stage 1: Security Gates"
    jobs:
      - job: SecretScan
        displayName: "Secret Scan (Gitleaks)"
        pool:
          name: "VMSS-Pool"
        steps:
          - script: |
              wget -q https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz
              tar -xzf gitleaks_8.18.2_linux_x64.tar.gz
              sudo mv gitleaks /usr/local/bin/
              gitleaks detect --source . -v --config .gitleaks.toml --report-format json --report-path gitleaks-report.json || true
              gitleaks detect --source . -v --config .gitleaks.toml
            displayName: "Run Gitleaks"

          - task: PublishBuildArtifacts@1
            displayName: "Publish Gitleaks Report"
            condition: always()
            inputs:
              pathToPublish: "gitleaks-report.json"
              artifactName: "security-artifacts"

      - job: IaCScan
        displayName: "IaC Scan (Checkov)"
        pool:
          name: "VMSS-Pool"
        steps:
          - script: |
              for i in {1..10}; do
                if sudo apt-get update && sudo apt-get install -y python3-pip; then break; fi
                sleep 10
              done
              pip3 install checkov
              export PATH=$HOME/.local/bin:$PATH
              SKIP_CHECKS="CKV_K8S_8,CKV_K8S_9,CKV_K8S_14,CKV_K8S_21,CKV_K8S_22,CKV_K8S_38,CKV_K8S_40,CKV_K8S_43,CKV2_K8S_6"
              checkov -d k8s/ --framework kubernetes --skip-check $SKIP_CHECKS -o json > checkov-report.json || true
              checkov -d k8s/ --framework kubernetes --skip-check $SKIP_CHECKS
            displayName: "Run Checkov"

          - task: PublishBuildArtifacts@1
            displayName: "Publish Checkov Report"
            condition: always()
            inputs:
              pathToPublish: "checkov-report.json"
              artifactName: "security-artifacts"

  # -------------------------------------------------------------------------
  # STAGE 2: APP QUALITY
  # -------------------------------------------------------------------------
  - stage: AppQuality
    displayName: "Stage 2: App Quality"
    dependsOn: SecurityGates
    jobs:
      - job: BackendTests
        displayName: "Backend Tests"
        pool:
          name: "VMSS-Pool"
        steps:
          - script: |
              cd backend
              pip3 install -r requirements.txt
              pip3 install pytest
              # Add tests when available
              echo "Backend tests placeholder"
            displayName: "Run Backend Tests"

      - job: FrontendTests
        displayName: "Frontend Tests"
        pool:
          name: "VMSS-Pool"
        steps:
          - script: |
              # Install Node.js
              curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash -
              for i in {1..10}; do
                if sudo apt-get install -y nodejs; then break; fi
                sleep 10
              done
              node --version
              npm --version
            displayName: "Install Node.js"

          - script: |
              cd frontend
              npm install
              npx vite build
            displayName: "Build Frontend"

  # -------------------------------------------------------------------------
  # STAGE 3: BUILD FACTORY
  # -------------------------------------------------------------------------
  - stage: BuildFactory
    displayName: "Stage 3: Build Factory"
    dependsOn: AppQuality
    jobs:
      - job: BuildBackend
        displayName: "Build Backend Image"
        pool:
          name: "VMSS-Pool"
        steps:
          - script: |
              for i in {1..10}; do
                if sudo apt-get update && sudo apt-get install -y azure-cli; then break; fi
                sleep 10
              done
            displayName: "Ensure Azure CLI"

          - task: AzureCLI@2
            displayName: "Build and Push Backend"
            inputs:
              azureSubscription: $(azureServiceConnection)
              scriptType: bash
              scriptLocation: inlineScript
              inlineScript: |
                az acr login --name acrshrinet82prod
                docker build -t $(azureContainerRegistry)/$(backendImage):$(tag) backend/
                docker tag $(azureContainerRegistry)/$(backendImage):$(tag) $(azureContainerRegistry)/$(backendImage):latest
                docker push $(azureContainerRegistry)/$(backendImage):$(tag)
                docker push $(azureContainerRegistry)/$(backendImage):latest

          - script: |
              curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin
              trivy image --exit-code 1 --severity CRITICAL $(azureContainerRegistry)/$(backendImage):$(tag)
            displayName: "Trivy Scan Backend"

          - script: |
              trivy image --format cyclonedx -o backend-sbom.json $(azureContainerRegistry)/$(backendImage):$(tag)
            displayName: "Generate Backend SBOM"

          - task: PublishBuildArtifacts@1
            displayName: "Publish Backend SBOM"
            inputs:
              pathToPublish: "backend-sbom.json"
              artifactName: "security-artifacts"

      - job: BuildFrontend
        displayName: "Build Frontend Image"
        pool:
          name: "VMSS-Pool"
        steps:
          - script: |
              for i in {1..10}; do
                if sudo apt-get update && sudo apt-get install -y azure-cli; then break; fi
                sleep 10
              done
            displayName: "Ensure Azure CLI"

          - task: AzureCLI@2
            displayName: "Build and Push Frontend"
            inputs:
              azureSubscription: $(azureServiceConnection)
              scriptType: bash
              scriptLocation: inlineScript
              inlineScript: |
                az acr login --name acrshrinet82prod
                docker build -t $(azureContainerRegistry)/$(frontendImage):$(tag) frontend/
                docker tag $(azureContainerRegistry)/$(frontendImage):$(tag) $(azureContainerRegistry)/$(frontendImage):latest
                docker push $(azureContainerRegistry)/$(frontendImage):$(tag)
                docker push $(azureContainerRegistry)/$(frontendImage):latest

          - script: |
              curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin
              trivy image --exit-code 1 --severity CRITICAL $(azureContainerRegistry)/$(frontendImage):$(tag)
            displayName: "Trivy Scan Frontend"

          - script: |
              trivy image --format cyclonedx -o frontend-sbom.json $(azureContainerRegistry)/$(frontendImage):$(tag)
            displayName: "Generate Frontend SBOM"

          - task: PublishBuildArtifacts@1
            displayName: "Publish Frontend SBOM"
            inputs:
              pathToPublish: "frontend-sbom.json"
              artifactName: "security-artifacts"

  # -------------------------------------------------------------------------
  # STAGE 4: DELIVERY
  # -------------------------------------------------------------------------
  - stage: Delivery
    displayName: "Stage 4: Delivery"
    dependsOn: BuildFactory
    jobs:
      - deployment: Deploy
        displayName: "Deploy to AKS"
        environment: "production"
        pool:
          name: "VMSS-Pool"
        strategy:
          runOnce:
            deploy:
              steps:
                - checkout: self

                - script: |
                    for i in {1..10}; do
                      if sudo apt-get update && sudo apt-get install -y unzip; then break; fi
                      sleep 10
                    done
                    wget -q https://github.com/Azure/kubelogin/releases/download/v0.0.30/kubelogin-linux-amd64.zip
                    unzip -o kubelogin-linux-amd64.zip
                    sudo mv bin/linux_amd64/kubelogin /usr/local/bin/
                  displayName: "Install Kubelogin"

                - task: AzureCLI@2
                  displayName: "Setup AKS Access"
                  inputs:
                    azureSubscription: $(azureServiceConnection)
                    scriptType: bash
                    scriptLocation: inlineScript
                    inlineScript: |
                      az aks get-credentials -g rg-devsecops-prod -n aks-devsecops-prod --overwrite-existing
                      kubelogin convert-kubeconfig -l azurecli

                - task: KubernetesManifest@1
                  displayName: "Deploy Redis"
                  inputs:
                    action: deploy
                    connectionType: azureResourceManager
                    azureSubscriptionConnection: $(azureServiceConnection)
                    azureResourceGroup: "rg-devsecops-prod"
                    kubernetesCluster: "aks-devsecops-prod"
                    manifests: k8s/redis.yaml

                - task: KubernetesManifest@1
                  displayName: "Deploy Backend"
                  inputs:
                    action: deploy
                    connectionType: azureResourceManager
                    azureSubscriptionConnection: $(azureServiceConnection)
                    azureResourceGroup: "rg-devsecops-prod"
                    kubernetesCluster: "aks-devsecops-prod"
                    manifests: k8s/backend.yaml
                    containers: "$(azureContainerRegistry)/$(backendImage):$(tag)"

                - task: KubernetesManifest@1
                  displayName: "Deploy Frontend"
                  inputs:
                    action: deploy
                    connectionType: azureResourceManager
                    azureSubscriptionConnection: $(azureServiceConnection)
                    azureResourceGroup: "rg-devsecops-prod"
                    kubernetesCluster: "aks-devsecops-prod"
                    manifests: k8s/frontend.yaml
                    containers: "$(azureContainerRegistry)/$(frontendImage):$(tag)"

  # -------------------------------------------------------------------------
  # STAGE 5: VERIFICATION
  # -------------------------------------------------------------------------
  - stage: Verification
    displayName: "Stage 5: Live Verification"
    dependsOn: Delivery
    jobs:
      - job: SmokeTest
        displayName: "Smoke Test"
        pool:
          name: "VMSS-Pool"
        steps:
          - script: |
              for i in {1..10}; do
                if sudo apt-get update && sudo apt-get install -y azure-cli; then break; fi
                sleep 10
              done
              sudo curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
              sudo install kubectl /usr/local/bin/kubectl
            displayName: "Ensure CLI Tools"

          - task: AzureCLI@2
            displayName: "Verify Deployments"
            inputs:
              azureSubscription: $(azureServiceConnection)
              scriptType: bash
              scriptLocation: inlineScript
              inlineScript: |
                az aks get-credentials -g rg-devsecops-prod -n aks-devsecops-prod
                kubelogin convert-kubeconfig -l azurecli

                echo "Checking Redis..."
                kubectl rollout status statefulset/redis --timeout=120s

                echo "Checking Backend..."
                kubectl rollout status deployment/chat-backend --timeout=120s

                echo "Checking Frontend..."
                kubectl rollout status deployment/chat-frontend --timeout=120s

                echo "All pods:"
                kubectl get pods

                echo "Frontend LoadBalancer IP:"
                kubectl get svc chat-frontend -o jsonpath='{.status.loadBalancer.ingress[0].ip}'

      - job: DAST
        displayName: "DAST (OWASP ZAP)"
        dependsOn: SmokeTest
        pool:
          name: "VMSS-Pool"
        steps:
          - script: |
              for i in {1..10}; do
                if sudo apt-get update && sudo apt-get install -y azure-cli unzip; then break; fi
                sleep 10
              done
              sudo curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
              sudo install kubectl /usr/local/bin/kubectl
              wget -q https://github.com/Azure/kubelogin/releases/download/v0.0.30/kubelogin-linux-amd64.zip
              unzip -o kubelogin-linux-amd64.zip
              sudo mv bin/linux_amd64/kubelogin /usr/local/bin/
            displayName: "Install CLI Tools"

          - task: AzureCLI@2
            displayName: "Run OWASP ZAP"
            inputs:
              azureSubscription: $(azureServiceConnection)
              scriptType: bash
              scriptLocation: inlineScript
              inlineScript: |
                az aks get-credentials -g rg-devsecops-prod -n aks-devsecops-prod
                kubelogin convert-kubeconfig -l azurecli

                # Get frontend IP
                FRONTEND_IP=$(kubectl get svc chat-frontend -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
                echo "Target: http://$FRONTEND_IP"

                # Create work directory for ZAP
                mkdir -p zap-work
                chmod 777 zap-work

                # Run OWASP ZAP baseline scan
                docker run --rm -v $(pwd)/zap-work:/zap/wrk:rw \
                  ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
                  -t http://$FRONTEND_IP \
                  -r zap_report.html \
                  -I || true

                # Copy report to accessible location
                cp zap-work/zap_report.html . || echo "ZAP report not found"

          - task: PublishBuildArtifacts@1
            displayName: "Publish ZAP Report"
            condition: always()
            inputs:
              pathToPublish: "zap-work/zap_report.html"
              artifactName: "security-artifacts"