name: pipeline

# Partie 4 : le pipeline ML est rejoue automatiquement a chaque Pull Request
# vers la branche principale (Q4.1). Autres declencheurs possibles (Q4.4) :
# push sur main, tag de release, planification (schedule/cron), declenchement
# manuel (workflow_dispatch).
on:
  pull_request:
    branches: [main]

jobs:
  train-and-register:
    runs-on: docker
    # Le runner (mode docker, reseau mlops-net) lance le job dans ce conteneur.
    # On y monte en lecture seule les donnees source du fil rouge et le magasin
    # de certificats du host (pour faire confiance a la CA interne ENI MLOps).
    container:
      image: node:20-bookworm
      volumes:
        - /data/modelling:/data/modelling:ro
        - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
    steps:
      - name: Recuperation du code
        uses: actions/checkout@v4

      - name: Installation de Python et des dependances
        run: |
          apt-get update
          apt-get install -y --no-install-recommends python3-venv
          python3 -m venv .venv
          .venv/bin/pip install --upgrade pip
          .venv/bin/pip install -r requirements.txt

      - name: Execution du pipeline (split -> train --register -> promote)
        run: .venv/bin/python pipeline.py
        env:
          # Serveur MLflow (basic auth) : URLs HTTPS via Caddy, resolues sur mlops-net.
          MLFLOW_TRACKING_URI: ${{ secrets.MLFLOW_TRACKING_URI }}
          MLFLOW_TRACKING_USERNAME: ${{ secrets.MLFLOW_TRACKING_USERNAME }}
          MLFLOW_TRACKING_PASSWORD: ${{ secrets.MLFLOW_TRACKING_PASSWORD }}
          MLFLOW_EXPERIMENT_NAME: ${{ secrets.MLFLOW_EXPERIMENT_NAME }}
          # Artefacts sur S3 Garage (log_model).
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          MLFLOW_S3_ENDPOINT_URL: ${{ secrets.MLFLOW_S3_ENDPOINT_URL }}
          # CA interne ENI MLOps (requests/boto3 n'utilisent pas le store systeme par defaut).
          REQUESTS_CA_BUNDLE: /etc/ssl/certs/ca-certificates.crt
          AWS_CA_BUNDLE: /etc/ssl/certs/ca-certificates.crt
          # Import du package lab depuis la racine du depot.
          PYTHONPATH: ${{ github.workspace }}