06 - CI/CD Guardrails - Quality Gates e Policy Enforcement

# .github/workflows/ai-code-quality.yml
name: AI Code Quality Pipeline

on:
  pull_request:
    branches: [main, develop]

jobs:
  # L2: Controlli rapidi sulla PR
  quick-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Secret Detection
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified

      - name: Lint and Format Check
        run: |
          pip install ruff
          ruff check src/ --output-format=github
          ruff format src/ --check

      - name: Unit Tests with Coverage
        run: |
          pytest tests/ --cov=src --cov-report=xml \
                 --cov-fail-under=75

  # L3: Analisi approfondita
  deep-analysis:
    needs: quick-checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: SonarQube Analysis
        uses: sonarsource/sonarqube-scan-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

      - name: Quality Gate Check
        uses: sonarsource/sonarqube-quality-gate-action@master
        timeout-minutes: 5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      - name: Dependency Security Scan
        uses: snyk/actions/python@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: SAST with Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/python
            p/security-audit
            p/owasp-top-ten
      

// Quality Gate "AI Code Strict" - Configurazione SonarQube
{
  "name": "AI Code Strict",
  "conditions": [
    {
      "metric": "new_coverage",
      "op": "LT",
      "error": "75",
      "warning": "80"
    },
    {
      "metric": "new_duplicated_lines_density",
      "op": "GT",
      "error": "5",
      "warning": "3"
    },
    {
      "metric": "new_maintainability_rating",
      "op": "GT",
      "error": "1"
    },
    {
      "metric": "new_reliability_rating",
      "op": "GT",
      "error": "1"
    },
    {
      "metric": "new_security_rating",
      "op": "GT",
      "error": "1"
    },
    {
      "metric": "new_security_hotspots_reviewed",
      "op": "LT",
      "error": "100"
    },
    {
      "metric": "new_cognitive_complexity",
      "op": "GT",
      "error": "10"
    }
  ]
}
      

# Policy OPA per qualità del codice AI (Rego language)
# policies/ai_code_quality.rego

package ai_code_quality

# Regola: blocca merge se la coverage e sotto la soglia
deny[msg] {
    input.coverage.new_code < 75
    msg := sprintf("Coverage insufficiente: %v%% (minimo 75%%)",
                   [input.coverage.new_code])
}

# Regola: blocca merge se ci sono vulnerabilità critiche
deny[msg] {
    vuln := input.security.vulnerabilities[_]
    vuln.severity == "CRITICAL"
    msg := sprintf("Vulnerabilità critica: %s (CWE-%s)",
                   [vuln.description, vuln.cwe])
}

# Regola: blocca merge se la complessità cognitiva è troppo alta
deny[msg] {
    func := input.complexity.functions[_]
    func.cognitive_complexity > 15
    msg := sprintf("Complessità cognitiva troppo alta in %s: %v (max 15)",
                   [func.name, func.cognitive_complexity])
}

# Regola: blocca merge se ci sono secrets hardcoded
deny[msg] {
    secret := input.secrets[_]
    msg := sprintf("Secret hardcoded trovato: %s alla riga %v",
                   [secret.type, secret.line])
}

# Regola: warning se la duplicazione è sopra soglia
warn[msg] {
    input.duplication.new_code > 3
    msg := sprintf("Duplicazione al %v%% (soglia warning: 3%%)",
                   [input.duplication.new_code])
}

# Decisione finale
allow {
    count(deny) == 0
}
      

# Sistema di feedback per quality gate failure
class QualityGateFeedback:
    """Genera feedback actionable per quality gate failures"""

    def generate_pr_comment(self, gate_results):
        """Genera un commento PR con dettagli del fallimento"""
        sections = []

        if gate_results["coverage"]["failed"]:
            sections.append(self._coverage_feedback(gate_results["coverage"]))

        if gate_results["security"]["failed"]:
            sections.append(self._security_feedback(gate_results["security"]))

        if gate_results["complexity"]["failed"]:
            sections.append(self._complexity_feedback(gate_results["complexity"]))

        return {
            "title": "Quality Gate: FAILED",
            "summary": f"{len(sections)} problemi da risolvere prima del merge",
            "sections": sections,
            "auto_suggestions": self._generate_fix_suggestions(gate_results)
        }

    def _coverage_feedback(self, coverage_data):
        return {
            "title": "Coverage Insufficiente",
            "current": f"{coverage_data['actual']}%",
            "required": f"{coverage_data['threshold']}%",
            "uncovered_files": coverage_data["uncovered_files"],
            "action": "Aggiungi test per i file elencati sopra, "
                      "concentrandoti sui percorsi di errore e casi limite"
        }

    def _generate_fix_suggestions(self, results):
        """Genera suggerimenti automatici di fix"""
        suggestions = []
        for issue in results.get("issues", []):
            if issue["type"] == "hardcoded_secret":
                suggestions.append(
                    f"Riga {issue['line']}: sostituisci con "
                    f"os.getenv('{issue['suggested_env_var']}')"
                )
            elif issue["type"] == "high_complexity":
                suggestions.append(
                    f"Funzione {issue['function']}: "
                    f"decomponila in funzioni più piccole"
                )
        return suggestions