Pipeline CI/CD — NutriCore API

# .github/workflows/nutricore-pipeline.yml
name: NutriCore Production Pipeline
on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build & push to GCR
        run: |
          IMAGE=gcr.io/nutricore/${{ github.sha }}
          docker build -t $IMAGE .
          docker push $IMAGE

  test:
    needs: build
    strategy:
      matrix:
        job: [pytest, bandit, trivy]
    steps:
      - name: Run ${{ matrix.job }}

  deploy-production:
    needs: integration-test
    environment:
      name: production  # ← gate manual aqui
    steps:
      - name: Canary deploy
        run: kubectl argo rollouts set image \
               nutricore-api *=gcr.io/nutricore/$SHA

apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: nutricore-success-rate
spec:
  metrics:
  - name: error-rate
    interval: 60s
    successCondition: "result[0] >= 0.98"
    failureCondition: "result[0] < 0.98"
    inconclusiveLimit: 2  # falla rapido
    provider:
      prometheus:
        address: http://prometheus:9090
        query: |
          sum(rate(http_requests_total
            {status!~"5..",job="nutricore"}[2m]))
          / sum(rate(http_requests_total
            {job="nutricore"}[2m]))
  - name: p99-latency
    interval: 60s
    failureCondition: "result[0] > 800"
    provider:
      prometheus:
        query: histogram_quantile(0.99,
            rate(http_duration_ms_bucket[2m]))