.pipeline.yml

include:
  - project: "devops/gitlab/ci-templates/deploy"
    file: ".hashicorp_vault.yml"
  - project: "devops/gitlab/ci-templates/docker"
    ref: "1.0.0"
    file:
      - ".amend_manifests.yml"
      - ".build_and_push_docker_images.yml"
      - ".copy_docker_images.yml"
      - ".remove_tmp_registry.yml"
  - project: "devops/gitlab/ci-templates/general"
    file:
      - ".install_hashicorp_vault.yml"
      - ".vault_jwt_auth.yml"
  - project: "devops/gitlab/ci-templates/ruby"
    ref: "sans-dind"
    file: 
      - ".rspec.yml"
      - ".rubocop.yml"
  - project: "devops/gitlab/ci-templates/sast"
    ref: "master"
    file:
      - ".trivy_container_scanning.yml"

workflow:
  rules:
  - when: always

stages:
  - build_and_push:tmp_base_image
  - build_and_push:tmp_dev_image
  - amend_tmp_base_dev_images
  - test
  - build_and_push:tmp_prod_image
  - amend_prod_image
  - sast
  - copy_docker_images
  - remove_tmp_registry
  - deploy

# -- Start - build and push base image
build_and_push_base_app_image:
  stage: build_and_push:tmp_base_image
  extends:
    - .build_and_push_docker_images
  parallel:
    matrix:
      - RUNNER: build-arm
        DOCKER_BUILD_PLATFORM: "linux/arm64"
      - RUNNER: build
        DOCKER_BUILD_PLATFORM: "linux/amd64"
  before_script:
    - !reference [.install_hashicorp_vault, before_script]
    - !reference [.vault_jwt_auth, before_script]
    - docker login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}
    - export SIDEKIQ_PRO_CREDENTIALS="$(vault kv get -field=credentials ${VAULT_SIDEKIQ_ENDPOINT})"
  variables:
    DOCKER_BUILD_CONTEXT: "rails_app/"
    DOCKER_BUILD_SECRETS: "--secret id=sidekiq_pro_credentials,env=SIDEKIQ_PRO_CREDENTIALS"
    DOCKER_TARGET: "base"
    DOCKERFILE_PATH: "rails_app/"
    JWT_ROLE: "sidekiq_pro_ro"
    REGISTRY_REPOSITORY: "${CI_PIPELINE_ID}"
  tags:
    - ${RUNNER}
# -- End - build and push base image

# -- Start - build, push temp dev image
build_and_push_dev_app_image:
  stage: build_and_push:tmp_dev_image
  extends:
    - .build_and_push_docker_images
  parallel:
    matrix:
      - RUNNER: build-arm
        DOCKER_BUILD_PLATFORM: "linux/arm64"
      - RUNNER: build
        DOCKER_BUILD_PLATFORM: "linux/amd64"
  before_script:
    - !reference [.install_hashicorp_vault, before_script]
    - !reference [.vault_jwt_auth, before_script]
    - docker login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}
    - export SIDEKIQ_PRO_CREDENTIALS="$(vault kv get -field=credentials ${VAULT_SIDEKIQ_ENDPOINT})"
  variables:
    DOCKER_BUILD_ARGS: "--build-arg RAILS_ENV=development"
    DOCKER_BUILD_CONTEXT: "rails_app/"
    DOCKER_BUILD_SECRETS: "--secret id=sidekiq_pro_credentials,env=SIDEKIQ_PRO_CREDENTIALS"
    DOCKER_TARGET: "development"
    DOCKERFILE_PATH: "rails_app/"
    JWT_ROLE: "sidekiq_pro_ro"
    REGISTRY_REPOSITORY: "${CI_PIPELINE_ID}"
  needs:
    - build_and_push_base_app_image
  tags:
    - ${RUNNER}
# -- End - build, push temp dev image

amend_tmp_base_dev_images:
  stage: amend_tmp_base_dev_images
  extends:
    - .amend_manifests
  needs:
    - build_and_push_base_app_image
    - build_and_push_dev_app_image
  variables:
    REGISTRY_REPOSITORY: "${CI_PIPELINE_ID}"
  tags:
    - build

# -- Start - test dev image
rspec_app_test:
  stage: test
  image: ${CI_REGISTRY_IMAGE}/${CI_PIPELINE_ID}:${CI_COMMIT_SHORT_SHA}-development
  services:
    - name: browserless/chrome:latest
      alias: chrome
    - name: postgres:14
      variables:
        POSTGRES_DB: "${DATABASE_NAME}"
        POSTGRES_PASSWORD: "${DATABASE_PASSWORD}"
        POSTGRES_USER: "${DATABASE_USER}"
    - name: bitnami/solr:9.3.0
      alias: solr
      command:
        - /bin/bash
        - -c
        - |
          source /opt/bitnami/scripts/libsolr.sh;solr_start_bg &&
          /opt/bitnami/solr/bin/solr auth enable -type basicAuth -credentials ${SOLR_ADMIN_USERNAME}:${SOLR_ADMIN_PASSWORD} -z 127.0.0.1:9983 &&
          /opt/bitnami/solr/bin/solr zk upconfig -n finding-aid-discovery -d ${CI_PROJECT_DIR}/rails_app/solr/conf/ -z 127.0.0.1:9983 &&
          /opt/bitnami/solr/bin/solr create_collection -c finding-aid-discovery-test -n finding-aid-discovery &&
          source /opt/bitnami/scripts/libsolr.sh;solr_stop &&
          /opt/bitnami/scripts/solr/run.sh
      variables:
        SOLR_CLOUD_BOOTSTRAP: "yes"
        SOLR_HOST: "solr"
        SOLR_JAVA_MEM: "-Xms4g -Xmx4g"
        SOLR_MODE: "solrcloud"
        SOLR_ENABLE_AUTHENTICATION: "yes"
        SOLR_AUTHENTICATION_OPTS: "-Dbasicauth=${SOLR_ADMIN_USERNAME}:${SOLR_ADMIN_PASSWORD}"
        SOLR_AUTH_TYPE: "basic"
  extends:
    - .rspec
  variables:
    CHROME_URL: "http://chrome:3000"
    CONNECTION_TIMEOUT: -1
    DATABASE_NAME: "finding_aid_discovery"
    DATABASE_PASSWORD: "rspec_test"
    DATABASE_USER: "rspec_test"
    FF_NETWORK_PER_BUILD: "true"
    FINDING_AID_DISCOVERY_URL: "findingaids.test.com"
    RAILS_ENV: "test"
    RAILS_SYSTEM_TESTING_SCREENSHOT_HTML: "1"
    SOLR_ADMIN_USERNAME: admin
    SOLR_ADMIN_PASSWORD: password
    SOLR_TEST_URL: "http://${SOLR_ADMIN_USERNAME}:${SOLR_ADMIN_PASSWORD}@solr:8983/solr/finding-aid-discovery-test"
  script:
    - cd ${CI_PROJECT_DIR}/rails_app/
    - bundle add rspec_junit_formatter
    - bundle exec rake db:reset
    - i=0
    - >
      while [ $i -le 9 ]; do
        i=$((i+1))
        curl --silent --user ${SOLR_ADMIN_USERNAME}:${SOLR_ADMIN_PASSWORD} "http://solr:8983/api/" "-H" "'Content-type:application/json'" && break
        echo "Waiting for solr api to be ready"
        sleep "30s"
      done
    - bundle exec rspec --format progress --format RspecJunitFormatter --out rspec.xml
  needs:
    - amend_tmp_base_dev_images
  coverage: '/\(\d+.\d+\%\) covered/'
  artifacts:
    paths:
      - rails_app/tmp/coverage/index.html
      - rails_app/tmp/capybara
      - rails_app/rspec.xml
    expire_in: 1 week
    reports:
      junit: rails_app/rspec.xml
  rules:
    - if: $DISABLE_RSPEC_TEST == "true"
      when: never
    - exists:
        - rails_app/spec/**.rb
        - rails_app/spec/**/**.rb
  tags:
    - build

rubocop_app_test:
  stage: test
  image: ${CI_REGISTRY_IMAGE}/${CI_PIPELINE_ID}:${CI_COMMIT_SHORT_SHA}-development
  needs:
    - amend_tmp_base_dev_images
  extends:
    - .rubocop
  before_script:
    - cd rails_app/
  rules:
    - if: $DISABLE_RUBOCOP == "true"
      when: never
    - exists:
        - rails_app/.rubocop.yml
  tags:
    - build
# -- End - test dev image

# -- Start - build and push temp prod image
build_and_push_prod_app_image:
  stage: build_and_push:tmp_prod_image
  extends:
    - .build_and_push_docker_images
  parallel:
    matrix:
      - RUNNER: build-arm
        DOCKER_BUILD_PLATFORM: "linux/arm64"
      - RUNNER: build
        DOCKER_BUILD_PLATFORM: "linux/amd64"
  before_script:
    - !reference [.install_hashicorp_vault, before_script]
    - !reference [.vault_jwt_auth, before_script]
    - docker login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}
    - export SIDEKIQ_PRO_CREDENTIALS="$(vault kv get -field=credentials ${VAULT_SIDEKIQ_ENDPOINT})"
  variables:
    DOCKER_BUILD_ARGS: "--build-arg RAILS_ENV=production"
    DOCKER_BUILD_CONTEXT: "rails_app/"
    DOCKER_BUILD_SECRETS: "--secret id=sidekiq_pro_credentials,env=SIDEKIQ_PRO_CREDENTIALS"
    DOCKER_TARGET: "production"
    DOCKERFILE_PATH: "rails_app/"
    JWT_ROLE: "sidekiq_pro_ro"
    REGISTRY_REPOSITORY: "${CI_PIPELINE_ID}"
  needs:
    - rspec_app_test
    - rubocop_app_test
  tags:
    - ${RUNNER}
# -- End - build and push temp prod image

amend_prod_image:
  stage: amend_prod_image
  extends:
    - .amend_manifests
  needs:
    - build_and_push_prod_app_image
  variables:
    DOCKER_TARGET: "production"
    REGISTRY_REPOSITORY: "${CI_PIPELINE_ID}"
    TAG_WITH_DOCKER_TARGET: "false"
  tags:
    - build

# -- Start - SAST images
# Test application image
trivy_app_container_scanning:
  stage: sast
  extends:
    - .trivy_container_scanning
  before_script:
    - apk add --no-cache docker
    - docker login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}
  after_script:
    - docker logout ${CI_REGISTRY}
  needs:
    - amend_prod_image
  variables:
    CI_IMAGE_NAME: ${CI_REGISTRY_IMAGE}/${CI_PIPELINE_ID}:${CI_COMMIT_SHORT_SHA}
  tags:
    - build

# -- Start - Copy app docker images
copy_app_docker_images:
  stage: copy_docker_images
  variables:
    ORIGINAL_REGISTRY_REPOSITORY: "${CI_PIPELINE_ID}"
  needs:
    - trivy_app_container_scanning
  extends:
    - .copy_docker_images
  tags:
    - build
# -- End - Copy app docker images

# -- Start - remove tmp registry repository
remove_tmp_registry:
  stage: remove_tmp_registry
  extends:
    - .remove_tmp_registry
  rules:
    - when: always
  needs:
    - copy_app_docker_images
  allow_failure: true
  tags:
    - build
# -- End - remove tmp registry repository

# Deploy staging
deploy_staging:
  stage: deploy
  extends:
    - .deploy
  variables:
    IMAGE_TAG: ${CI_COMMIT_SHORT_SHA}
  environment:
    name: staging
    url: https://pacscl-staging.library.upenn.edu/
  needs:
    - copy_app_docker_images
  only:
    - main
  tags:
    - deploy

# Deploy production
deploy_production:
  stage: deploy
  extends:
    - .deploy
  variables:
    IMAGE_TAG: ${CI_COMMIT_SHORT_SHA}
  environment:
    name: production
    url: https://findingaids.library.upenn.edu/
  needs:
    - copy_app_docker_images
  rules:
    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+(\.[a-zA-Z0-9]+)?$/
  tags:
    - deploy
# -- End - deployment