.gitlab-ci.yml

stages:
  - lint
  - build
  - test
  - coverage
  - release
  - docs
  - configure
  - deploy

# https://docs.gitlab.com/ee/ci/yaml/workflow.html#switch-between-branch-pipelines-and-merge-request-pipelines
.if-default-branch-refs: &if-default-branch-refs
  if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

.if-tag: &if-tag
  if: '$CI_COMMIT_TAG'

.if-merge-request: &if-merge-request
  if: '$CI_MERGE_REQUEST_IID'

# Workflow
###########
workflow:
  rules:
    - <<: *if-tag
      variables:
        # Override the IMAGE_SHA variable on tag pipelines to avoid both the default
        # branch pipeline and tag pipeline overriding each other's images arbitrarily when
        # they are both running at the same time on master.
        IMAGE_SHA: ${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}
    - <<: *if-default-branch-refs
    - <<: *if-merge-request


include:
  - project: 'labs/salt-automation'
    file:
      - '/gitlab-ci-templates/common/rules.v1.yml'
      - '/gitlab-ci-templates/common/saltbert.v1.yml'
      - '/gitlab-ci-templates/common/docker-build-meta.v2.yml'
      - '/gitlab-ci-templates/common/docker-release-meta.v1.yml'
      - '/gitlab-ci-templates/common/config-updater-meta.v1.yml'
      - "/gitlab-ci-templates/common/conventional-commits-meta.v1.yml"
      - "/gitlab-ci-templates/common/conventional-commits-changelog-meta.v1.yml"

.releaserc:
  before_script:
    - |
      cat <<EOF > .releaserc.yaml
      branches:
        - master
      preset: angular
      tagFormat: "\${version}-rc1"
      plugins:
        - local: "/gitlab-ci-templates/common/docker-build-meta.v2.yml"
        - "@semantic-release/commit-analyzer"
        - "@semantic-release/release-notes-generator"
        - "@semantic-release/changelog"
        - "@semantic-release/gitlab"
        - assets:
            - path: CHANGELOG.md
              label: Changelog
      analyzeCommits:
        releaseRules:
          - type: chore
            scope: deps-dev
            release: patch
          - type: chore
            scope: deps
            release: patch
          - type: build
            scope: deps-dev
            release: patch
          - type: build
            scope: deps
            release: patch
      EOF


variables:
  # Project variables
  RELEASE_REGISTRY: docker.io
  RELEASE_REGISTRY_IMAGE: index.docker.io/magentaaps/toldbehandling

  REST_IMAGE_SHA: ${CI_REGISTRY_IMAGE}/toldbehandling-rest:${CI_COMMIT_SHA}
  REST_IMAGE_TAG: magentaaps/toldbehandling-rest:${CI_COMMIT_TAG}

  UI_IMAGE_SHA: ${CI_REGISTRY_IMAGE}/toldbehandling-ui:${CI_COMMIT_SHA}
  UI_IMAGE_TAG: magentaaps/toldbehandling-ui:${CI_COMMIT_TAG}

  ADMIN_IMAGE_SHA: ${CI_REGISTRY_IMAGE}/toldbehandling-admin:${CI_COMMIT_SHA}
  ADMIN_IMAGE_TAG: magentaaps/toldbehandling-admin:${CI_COMMIT_TAG}

  ER_IMAGE_SHA: ${CI_REGISTRY_IMAGE}/toldbehandling-er:${CI_COMMIT_SHA}
  ER_IMAGE_TAG: magentaaps/toldbehandling-er:${CI_COMMIT_TAG}

  VERSION: PIPELINE


# Lint stage
#############
.lint-default: &lint-default
  stage: lint
  needs: [ ]
  image: python:3.11

Lint Commits:
  extends: .lint:commits
  variables:
    CONFIG: '{ extends: [''@commitlint/config-conventional''], ignores: [(message) => message.includes(''suggestion(s)'')], }'


Lint Python:
  <<: *lint-default
  before_script:
    - pip3 install flake8
    - pip3 install black==24.4.1
    - pip3 install isort==5.12.0
    #- pip3 install -r django/requirements.txt
  script:
    - flake8 --max-line-length 88 --exclude=migrations,tests.py,settings.py --extend-ignore E226,E203 rest/ --
    - flake8 --max-line-length 88 --exclude=migrations,tests.py,settings.py --extend-ignore E226,E203 ui/
    - flake8 --max-line-length 88 --extend-ignore E226,E203 told-common/
    - black --check --diff --exclude=migrations rest/
    - black --check --diff --exclude=migrations ui/
    - black --check --diff --exclude=migrations told-common/
    - isort -c --profile black --diff --skip migrations rest/
    - isort -c --profile black --diff --skip migrations admin/
    - isort -c --profile black --diff --skip migrations told-common/
    - isort -c --profile black --diff --skip migrations ui/


Lint Dockerfiles:
  <<: *lint-default
  image: hadolint/hadolint:latest-debian
  before_script:
    - apt-get -y update
    - apt-get -y install --no-install-recommends git
  script:
    - git ls-files --exclude='Dockerfile*' --ignored | xargs --max-lines=1 hadolint

Lint REUSE compliance:
  extends: .lint-default
  image:
    name: fsfe/reuse:latest
    entrypoint: [ "" ]
  script:
    - reuse lint

Lint Javascript:
  extends: .lint-default
  image: registry.gitlab.com/pipeline-components/eslint:latest
  script:
    - sh -c "cp .eslint/package.json package.json && npm install @eslint/js && eslint --config .eslint/eslint.config.js --color --stats told-common/told_common/static/toldbehandling/js/*.js || rm package.json"


# Build stage
#############


Build REST image:
  extends: .build-docker
  variables:
    CI_IMAGE: ${REST_IMAGE_SHA}
    DOCKERFILE: $CI_PROJECT_DIR/docker/Dockerfile_rest

Build UI image:
  extends: .build-docker
  variables:
    CI_IMAGE: ${UI_IMAGE_SHA}
    DOCKERFILE: $CI_PROJECT_DIR/docker/Dockerfile_ui

Build Admin image:
  extends: .build-docker
  variables:
    CI_IMAGE: ${ADMIN_IMAGE_SHA}
    DOCKERFILE: $CI_PROJECT_DIR/docker/Dockerfile_admin

Build ER image:
  extends: .build-docker
  variables:
    CI_IMAGE: ${ER_IMAGE_SHA}
    DOCKERFILE: $CI_PROJECT_DIR/docker/Dockerfile_er


# Test stage
############
.test-default: &test-default
  stage: test
  dependencies: [ ]
  services:
    - name: postgres:13
      alias: toldbehandling-db
    - name: memcached
      alias: toldbehandling-cache
  variables:
    # Simulate development environment while running tests so we use mockup data
    KANIKO_VERSION: v1.6.0-debug
    DJANGO_SECRET_KEY: e$s6@0(hs5ja79-&!l7vt^onoe4h^*bv_e4hj&wt5^8*&x76-$
    DJANGO_TIMEZONE: Europe/Copenhagen
    HOST_DOMAIN: http://localhost
    POSTGRES_USER: toldbehandling
    POSTGRES_PASSWORD: toldbehandling
    POSTGRES_DB: toldbehandling
    POSTGRES_HOST: toldbehandling-db
    ENVIRONMENT: development
    DISABLE_METRICS: 'True'
    DJANGO_LANGUAGE_COOKIE_DOMAIN: localhost
    REST_DOMAIN: http://toldbehandling-rest:7000
    CACHE_ENDPOINT: toldbehandling-cache:11211
    SAML_SP_ENTITY_ID: http://localhost:8000/saml/metadata/
    SAML_SP_LOGIN_CALLBACK_URI: http://localhost:8000/login/callback/
    SAML_SP_LOGOUT_CALLBACK_URI: http://localhost:8000/logout/callback/
    SAML_SP_KEY: /ssl/sp/selfsigned.key
    SAML_SP_CERTIFICATE: /ssl/sp/selfsigned.crt
    SAML_IDP_ENTITY_ID: http://localhost:8080/simplesaml/saml2/idp/metadata.php
    SAML_IDP_LOGIN_URI: http://localhost:8080/simplesaml/saml2/idp/SSOService.php
    SAML_IDP_LOGOUT_URI: http://localhost:8080/simplesaml/saml2/idp/SingleLogoutService.php
    SAML_IDP_CERTIFICATE: /ssl/idp/selfsigned.crt
    SAML_IDP_METADATA: http://localhost:8080/simplesaml/saml2/idp/metadata.php
    SAML_CONTACT_TECHNICAL_NAME: Tester
    SAML_CONTACT_TECHNICAL_EMAIL: test@example.com
    SAML_CONTACT_SUPPORT_NAME: Tester
    SAML_CONTACT_SUPPORT_EMAIL: test@example.com
    SESSION_EXPIRE_SECONDS: 3600
    LOGIN_PROVIDER_CLASS: django_mitid_auth.saml.oiosaml.OIOSaml
    LOGIN_BYPASS_ENABLED: 'False'
    MITID_TEST_ENABLED: 'True'
    LANGUAGE_COOKIE_DOMAIN: localhost
    EBOKS_MOCK: 'True'
    SYSTEM_USER_PASSWORD: system

  before_script:
    - mkdir "${CI_PROJECT_DIR}/coverage_output"
  artifacts:
    when: always
    paths:
      - "coverage_output/*"
    expire_in: 1 day

.test-rest: &test-rest
  <<: *test-default
  needs: [ "Build REST image" ]
  image: ${REST_IMAGE_SHA}

.test-ui: &test-ui
  <<: *test-default
  needs: [ "Build UI image" ]
  image: ${UI_IMAGE_SHA}

.test-admin: &test-admin
  <<: *test-default
  needs: [ "Build Admin image" ]
  image: ${ADMIN_IMAGE_SHA}

Unittest REST:
  <<: *test-rest
  script:
    - cd /app
    - coverage run manage.py test
    - coverage report --show-missing --fail-under=100
    - mv .coverage "${CI_PROJECT_DIR}/coverage_output/.coverage.${CI_JOB_ID}"
    - cp -r ./sats ./common ./forsendelse ./anmeldelse ./aktør ./common ./otp ./payment ./metrics ./project "${CI_PROJECT_DIR}/coverage_output/"


Unittest UI:
  <<: *test-ui
  script:
    - cd /app
    - cp -r ./told-common/told_common .
    - coverage run manage.py test --parallel 4
    - coverage combine
    - coverage report --show-missing
    - mv .coverage "${CI_PROJECT_DIR}/coverage_output/.coverage.${CI_JOB_ID}"
    - cp -r ./ui "${CI_PROJECT_DIR}/coverage_output/"

Unittest Admin:
  <<: *test-admin
  script:
    - cd /app
    - cp -r ./told-common/told_common .
    - coverage run manage.py test --parallel 4
    - coverage combine
    - coverage report --show-missing
    - mv .coverage "${CI_PROJECT_DIR}/coverage_output/.coverage.${CI_JOB_ID}"
    - cp -r ./admin ./told_common ./told_twofactor "${CI_PROJECT_DIR}/coverage_output/"
    - cp .coveragerc "${CI_PROJECT_DIR}/coverage_output/"

Mypy REST:
  <<: *test-rest
  script:
    - cd /app
    - mypy --config mypy.ini ./

Mypy UI:
  <<: *test-ui
  script:
    - cd /app
    - cp -r ./told-common/told_common .
    - mypy --config mypy.ini ui/

Mypy Admin:
  <<: *test-admin
  script:
    - cd /app
    - cp -r ./told-common/told_common .
    - mypy --config mypy.ini admin/

Django check REST:
  <<: *test-rest
  script:
    - cd /app
    - python manage.py check aktør anmeldelse forsendelse sats common

Django check UI:
  <<: *test-ui
  script:
    - cd /app
    - python manage.py check ui

Django check Admin:
  <<: *test-admin
  script:
    - cd /app
    - python manage.py check admin


.coverage-default: &coverage-default
  stage: coverage
  needs: [ "Unittest REST", "Unittest Admin", "Unittest UI" ]
  image: ${ADMIN_IMAGE_SHA}

Check coverage:
  <<: *coverage-default
  before_script:
    - cd "${CI_PROJECT_DIR}/coverage_output/"
    - coverage combine
  script:
    - coverage report -i --show-missing --fail-under=90
    - coverage xml
  coverage: '/^TOTAL.+?(\d+\%)$/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: "${CI_PROJECT_DIR}/coverage_output/coverage.xml"


# Release stage
###############

.release-toldbehandling:
  stage: release
  image: alpine
  variables:
    GIT_STRATEGY: none # We do not need the source code
  dependencies: [ ]
  before_script:
    # install skopeo
    - apk add skopeo

Release REST image:
  # Releases both stable and RC releases.
  extends:
    - .rules:semver-all
    - .release-toldbehandling
  needs:
    [ "Build REST image", "Unittest REST", "Django check REST" ]
  script:
    - skopeo copy
      --src-creds=${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD}
      --dest-creds=${RELEASE_REGISTRY_USER}:${RELEASE_REGISTRY_PASSWORD}
      "docker://${REST_IMAGE_SHA}"
      "docker://${REST_IMAGE_TAG}"

Release UI image:
  # Releases both stable and RC releases.
  extends:
    - .rules:semver-all
    - .release-toldbehandling
  needs:
    [ "Build UI image", "Unittest UI", "Django check UI" ]
  script:
    - skopeo copy
      --src-creds=${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD}
      --dest-creds=${RELEASE_REGISTRY_USER}:${RELEASE_REGISTRY_PASSWORD}
      "docker://${UI_IMAGE_SHA}"
      "docker://${UI_IMAGE_TAG}"

Release ER image:
  extends:
    - .rules:semver-all
    - .release-toldbehandling
  needs:
    [ "Build ER image" ]
  script:
    - skopeo copy
      --src-creds=${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD}
      --dest-creds=${RELEASE_REGISTRY_USER}:${RELEASE_REGISTRY_PASSWORD}
      "docker://${ER_IMAGE_SHA}"
      "docker://${ER_IMAGE_TAG}"

Release Admin image:
  extends:
    - .rules:semver-all
    - .release-toldbehandling
  needs:
    [ "Build Admin image" ]
  script:
    - skopeo copy
      --src-creds=${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD}
      --dest-creds=${RELEASE_REGISTRY_USER}:${RELEASE_REGISTRY_PASSWORD}
      "docker://${ADMIN_IMAGE_SHA}"
      "docker://${ADMIN_IMAGE_TAG}"


Release Semantic commit:
  extends: .release:semantic-commit

Release Generate changelog:
  extends: .release:generate-changelog

Docs Export changelog:
  extends:
    - .rules:semver-all
    - .docs:export-changelog
  variables:
    CHANGELOG_EXTRA_FLAGS: "--merge-prerelease"


# Configure stage
#################

Configure Test:
  stage: configure
  extends:
    - .rules:semver-all
    - .config:endpoint-with-tag
  needs: [ "Release REST image", "Release UI image", "Release ER image", "Release Admin image" ]
  variables:
    ENDPOINT: toldbehandling/salt/update-test

Configure Production:
  stage: configure
  extends:
    - .rules:semver-core
    - .config:endpoint-with-tag
  needs: [ "Release REST image", "Release UI image", "Release ER image", "Release Admin image" ]
  variables:
    ENDPOINT: toldbehandling/salt/update-production

# Deploy stage
##############

Deploy to Test:
  stage: deploy
  extends:
    - .rules:semver-all
    - .saltbert
  needs: [ "Configure Test" ]
  variables:
    SALTBERT_ORCHESTRATION: groenland.toldbehandling.service-test
    SALTBERT_URL: https://saltmaster.groenland.magentahosted.dk
  rules:
    # Matches <version core> from SemVer 2.0.0 BNF grammar. Ex. 2.3.4, but not 2.3.4-rc
    - if: $CI_COMMIT_TAG =~ /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/
      when: manual
    # Matches all of SemVer 2.0.0
    - if: $CI_COMMIT_TAG =~ /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/
  environment:
    name: test
    url: "https://test.akitsuut.nanoq.gl"

Deploy to Production:
  stage: deploy
  extends:
    - .rules:semver-core
    - .saltbert
  needs: [ "Configure Production" ]
  variables:
    SALTBERT_ORCHESTRATION: groenland.toldbehandling.service-prod
    SALTBERT_URL: https://saltmaster.groenland.magentahosted.dk
  when: manual
  environment:
    name: production
    url: "https://akitsuut.nanoq.gl"