BOC v1.0: RS256 auth, Ledger integration, Prometheus metrics, CI/CD, backup

.github/workflows/ci-cd.yml

@@ -0,0 +1,150 @@
+name: BOC CI/CD
+
+on:
+  push:
+    branches: [main, develop]
+    paths:
+      - 'backend/**'
+      - 'web-v2/**'
+      - '.github/workflows/**'
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: boc_test
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+      
+      redis:
+        image: redis:7
+        ports:
+          - 6379:6379
+    
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+      
+      - name: Test Backend
+        working-directory: ./backend
+        env:
+          DB_URL: postgres://postgres:postgres@localhost:5432/boc_test?sslmode=disable
+          JWT_SECRET: test-secret-2026
+        run: |
+          go test ./... -v -race -coverprofile=coverage.out
+          go tool cover -func=coverage.out | grep total
+      
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      
+      - name: Test Frontend
+        working-directory: ./web-v2
+        run: |
+          npm ci
+          npm run build
+  
+  security:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    needs: test
+    
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      
+      - name: Gosec Security Scanner
+        uses: securego/gosec@master
+        with:
+          args: '-fmt sarif -out results.sarif ./backend/...'
+      
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+  
+  build:
+    name: Build & Push
+    runs-on: ubuntu-latest
+    needs: [test, security]
+    if: github.ref == 'refs/heads/main'
+    
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      
+      - name: Build Backend Image
+        working-directory: ./backend
+        run: |
+          docker build -t boc-api:${{ github.sha }} .
+          docker tag boc-api:${{ github.sha }} boc-api:latest
+      
+      - name: Build Frontend Image
+        working-directory: ./web-v2
+        run: |
+          docker build -t boc-portal:${{ github.sha }} .
+          docker tag boc-portal:${{ github.sha }} boc-portal:latest
+  
+  deploy-staging:
+    name: Deploy to Staging
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.ref == 'refs/heads/develop'
+    environment:
+      name: staging
+      url: https://boc-staging.aamos.systems
+    
+    steps:
+      - name: Deploy to Staging
+        run: |
+          echo "Deploying to staging..."
+          # ssh staging-server "cd /opt/boc && ./deploy.sh"
+  
+  deploy-production:
+    name: Deploy to Production
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.ref == 'refs/heads/main'
+    environment:
+      name: production
+      url: https://boc.aamos.systems
+    
+    steps:
+      - name: Deploy to Production
+        run: |
+          echo "Deploying to production..."
+          # ssh production-server "cd /opt/boc && ./deploy.sh"
+      
+      - name: Smoke Test
+        run: |
+          sleep 10
+          curl -sf https://boc.aamos.systems/health || exit 1
+          curl -sf https://boc.aamos.systems/api/v1/health || exit 1
+      
+      - name: Rollback on Failure
+        if: failure()
+        run: |
+          echo "Deployment failed, rolling back..."
+          # ssh production-server "cd /opt/boc && ./rollback.sh"