.gitlab-ci.yml

stages:
  - lint
  - build
  - test
  - release
  - docs
  - configure
  - deploy

# https://docs.gitlab.com/ee/ci/yaml/workflow.html#switch-between-branch-pipelines-and-merge-request-pipelines
.if-default-branch-refs: &if-default-branch-refs
  if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

.if-tag: &if-tag
  if: '$CI_COMMIT_TAG'

.if-merge-request: &if-merge-request
  if: '$CI_MERGE_REQUEST_IID'


# Workflow
###########
workflow:
  rules:
    - <<: *if-tag
      variables:
        # Override the IMAGE_SHA variable on tag pipelines to avoid both the default
        # branch pipeline and tag pipeline overriding each other's images arbitrarily when
        # they are both running at the same time on master.
        IMAGE_SHA: ${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}
    - <<: *if-default-branch-refs
    - <<: *if-merge-request


include:
  - project: 'labs/salt-automation'
    file:
      - '/gitlab-ci-templates/common/rules.v1.yml'
      - '/gitlab-ci-templates/common/saltbert.v1.yml'
      - '/gitlab-ci-templates/common/docker-build-meta.v2.yml'
      - '/gitlab-ci-templates/common/docker-release-meta.v1.yml'
      - '/gitlab-ci-templates/common/config-updater-meta.v1.yml'
      - "/gitlab-ci-templates/common/conventional-commits-meta.v1.yml"
      - "/gitlab-ci-templates/common/conventional-commits-changelog-meta.v1.yml"


.releaserc:
  before_script:
    - |
      cat <<EOF > .releaserc.yaml
      branches:
        - master
      tagFormat: "\${version}-rc1"
      plugins:
        - - "@semantic-release/commit-analyzer"
          - preset: angular
            releaseRules:
              - type: chore
                scope: deps-dev
                release: patch
              - type: chore
                scope: deps
                release: patch
              - type: build
                scope: deps-dev
                release: patch
              - type: build
                scope: deps
                release: patch
        - "@semantic-release/release-notes-generator"
        - "@semantic-release/changelog"
        - - "@semantic-release/gitlab"
          - assets:
              - path: CHANGELOG.md
                label: Changelog
      EOF
      

variables:
  # Project variables
  RELEASE_REGISTRY: docker.io
  RELEASE_REGISTRY_IMAGE: index.docker.io/magentaaps/kas

  KAS_IMAGE_SHA: ${CI_REGISTRY_IMAGE}/kas:${CI_COMMIT_SHA}
  KAS_IMAGE_DEV: magentaaps/kas:dev
  KAS_IMAGE_TAG: magentaaps/kas:${CI_COMMIT_TAG}

  SELF_IMAGE_SHA: ${CI_REGISTRY_IMAGE}/self:${CI_COMMIT_SHA}
  SELF_IMAGE_DEV: magentaaps/kas-self:dev-self
  SELF_IMAGE_TAG: magentaaps/kas-self:${CI_COMMIT_TAG}

  ER_IMAGE_SHA: ${CI_REGISTRY_IMAGE}/er:${CI_COMMIT_SHA}
  ER_IMAGE_DEV: magentaaps/kas-er:dev
  ER_IMAGE_TAG: magentaaps/kas-er:${CI_COMMIT_TAG}

  VERSION: PIPELINE


# Lint stage
#############
.lint-default: &lint-default
  stage: lint
  needs: []
  image: python:3.8

Lint Commits:
  extends: .lint:commits
  variables:
    CONFIG: '{ extends: [''@commitlint/config-conventional''], ignores: [(message) => message.includes(''suggestion(s)'')], }'

Lint Python:
  <<: *lint-default
  before_script:
    - pip3 install flake8==7.1.0
    - pip3 install black==24.4.1
    - pip3 install isort==5.12.0
    #- pip3 install -r django/requirements.txt
  script:
    - flake8 --max-line-length 88 --exclude=tests,migrations,reportgeneration --extend-ignore E226,E203 kas/
    - flake8 --max-line-length 88 --exclude=tests,migrations --extend-ignore E226,E203 selvbetjening/
    - black --check --diff --exclude=migrations kas/
    - black --check --diff --exclude=migrations selvbetjening/
    - isort -c --diff -l 88 --skip migrations kas/
    - isort -c --diff -l 88 --skip migrations selvbetjening/

Lint Dockerfiles:
  <<: *lint-default
  image: hadolint/hadolint:latest-debian
  before_script:
    - apt-get -y update
    - apt-get -y install --no-install-recommends git
  script:
    - git ls-files --exclude='Dockerfile*' --ignored | xargs --max-lines=1 hadolint

Lint REUSE compliance:
  extends: .lint-default
  image:
    name: fsfe/reuse:latest
    entrypoint: [""]
  script:
    - reuse lint


# Build stage
#############
Build KAS image:
  extends: .build-docker
  variables:
    CI_IMAGE: ${KAS_IMAGE_SHA}
    DOCKERFILE: $CI_PROJECT_DIR/docker/Dockerfile.kas

Build Selvbetjening image:
  extends: .build-docker
  variables:
    CI_IMAGE: ${SELF_IMAGE_SHA}
    DOCKERFILE: $CI_PROJECT_DIR/docker/Dockerfile.selvbetjening

Build ER image:
  extends: .build-docker
  variables:
    CI_IMAGE: ${ER_IMAGE_SHA}
    DOCKERFILE: $CI_PROJECT_DIR/docker/Dockerfile.er


# Test stage
############
.test-default: &test-default
  stage: test
  dependencies: []

.test-admin: &test-admin
  <<: *test-default
  needs: ["Build KAS image"]
  image: ${KAS_IMAGE_SHA}
  services:
    - name: postgres:13
      alias: kas-db
  variables:
    DJANGO_SECRET_KEY: e$s6@0(hs5ja79-&!l7vt^onoe4h^*bv_e4hj&wt5^8*&x76-$
    DJANGO_TIMEZONE: Europe/Copenhagen
    DJANGO_ADMIN_GROUP: admins
    POSTGRES_USER: kas
    POSTGRES_PASSWORD: kas
    POSTGRES_DB: kas
    POSTGRES_HOST: kas-db
    HOST_DOMAIN: http://localhost
    REST_HOST: http://kas:8000
    REST_TOKEN: 1799c88d-10e6-489d-8fe9-adeb2fd8a36f
    SELVBETJENING_REPRESENTATION_START: http://kas-selvbetjening:8080/represent-start/
    SELVBETJENING_REPRESENTATION_STOP: http://kas-selvbetjening:8000/represent-stop/
    SELVBETJENING_REPRESENTATION_TOKEN_MAX_AGE: 60
    EBOKS_DISPATCH_BULK_SIZE: 100
    EBOKS_MOCK: 'True'
    # No access to the eskat database, so give it dummy environment variables
    ESKAT_HOST: ""
    ESKAT_PORT: ""
    ESKAT_DB: ""
    ESKAT_USER: ""
    ESKAT_PASSWORD: ""
    GENERATE_DB_DOCUMENTATION: "false"

    # No fiddling with sftp server during testing
    TENQ_HOST: ""
    TENQ_PORT: 22
    TENQ_USER: ""
    TENQ_PASSWORD: ""
    TENQ_KNOWN_HOSTS: ""
    TENQ_PROJECT_ID: "KAS"
    TENQ_PROD_PATH: ""
    TENQ_TEST_PATH: ""
    # Simulate development environment while running tests so we use mockup data
    ENVIRONMENT: development
    DISABLE_METRICS: 'True'

Admin Unittest:
  <<: *test-admin
  script:
    - cd /app
    - coverage run manage.py test --parallel 4
    - coverage combine
    - coverage report --show-missing --fail-under=72
    - coverage xml
  coverage: '/^TOTAL.+?(\d+\%)$/'
  artifacts:
    reports:
      coverage_report:
          coverage_format: cobertura
          path: /app/coverage.xml

Admin Django check:
  <<: *test-admin
  script:
    - cd /app
    - python manage.py check kas eskat prisme worker


.test-selvbetjening: &test-selvbetjening
  <<: *test-default
  needs: ["Build Selvbetjening image"]
  image: ${SELF_IMAGE_SHA}
  services:
    - name: postgres:13
      alias: kas-db
  variables:
    DJANGO_SECRET_KEY: e$s6@0(hs5ja79-&!l7vt^onoe4h^*bv_e4hj&wt5^8*&x76-$
    DJANGO_TIMEZONE: Europe/Copenhagen
    POSTGRES_USER: kas
    POSTGRES_PASSWORD: kas
    POSTGRES_DB: selvbetjening
    POSTGRES_HOST: kas-db
    DJANGO_LANGUAGE_COOKIE_DOMAIN: localhost
    REST_HOST: http://kas:8000
    REST_TOKEN: 1799c88d-10e6-489d-8fe9-adeb2fd8a36f
    KAS_REPRESENTATION_STOP: http://kas:8000/represent-stop
    CLOSE_AT_MONTH: 5
    CLOSE_AT_DATE: 6
    SAML_ENABLED: "true"
    SAML_SP_ENTITY_ID: http://localhost:8040/saml/metadata/
    SAML_SP_LOGIN_CALLBACK_URI: http://localhost:8040/login/callback
    SAML_SP_LOGOUT_CALLBACK_URI: http://localhost:8040/logout/callback/
    SAML_SP_CERTIFICATE: /ssl/sp/selfsigned.crt
    SAML_SP_KEY: /ssl/sp/selfsigned.key
    SAML_IDP_ENTITY_ID: http://localhost:8080/simplesaml/saml2/idp/metadata.php
    SAML_IDP_LOGIN_URI: http://localhost:8080/simplesaml/saml2/idp/SSOService.php
    SAML_IDP_LOGOUT_URI: http://localhost:8080/simplesaml/saml2/idp/SingleLogoutService.php
    SAML_IDP_CERTIFICATE: /ssl/idp/selfsigned.crt
    SAML_IDP_METADATA: http://localhost:8080/simplesaml/saml2/idp/metadata.php
    SAML_CONTACT_TECHNICAL_NAME: Tester
    SAML_CONTACT_TECHNICAL_EMAIL: test@example.com
    SAML_CONTACT_SUPPORT_NAME: Tester
    SAML_CONTACT_SUPPORT_EMAIL: test@example.com
    SKIP_IDP_METADATA: "true"

Selvbetjening Unittest:
  <<: *test-selvbetjening
  script:
    - cd /app
    - coverage run manage.py test --parallel 4
    - coverage combine   
    - coverage report --show-missing --fail-under=25
    - coverage xml
  coverage: '/^TOTAL.+?(\d+\%)$/'
  artifacts:
    reports:
      coverage_report:
          coverage_format: cobertura
          path: /app/coverage.xml

Selvbetjening Django check:
  <<: *test-selvbetjening
  script:
    - cd /app
    - python manage.py check selvbetjening


# Release stage
###############

.release:
  stage: release
  image: alpine
  variables:
    GIT_STRATEGY: none # We do not need the source code
  dependencies: []
  before_script:
    # install skopeo
    - apk add skopeo

Release Admin image:
  # Releases both stable and RC releases.
  extends:
    - .rules:semver-all
    - .release
  needs: ["Admin Unittest"]
  script:
    - skopeo copy
      --src-creds=${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD}
      --dest-creds=${RELEASE_REGISTRY_USER}:${RELEASE_REGISTRY_PASSWORD}
      "docker://${KAS_IMAGE_SHA}"
      "docker://${KAS_IMAGE_TAG}"

Release Selvbetjening image:
  extends:
    - .rules:semver-all
    - .release
  needs: ["Selvbetjening Unittest"]
  script:
    - skopeo copy
      --src-creds=${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD}
      --dest-creds=${RELEASE_REGISTRY_USER}:${RELEASE_REGISTRY_PASSWORD}
      "docker://${SELF_IMAGE_SHA}"
      "docker://${SELF_IMAGE_TAG}"

Release ER image:
  extends:
    - .rules:semver-all
    - .release
  needs: ["Admin Unittest"]
  script:
    - skopeo copy
      --src-creds=${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD}
      --dest-creds=${RELEASE_REGISTRY_USER}:${RELEASE_REGISTRY_PASSWORD}
      "docker://${ER_IMAGE_SHA}"
      "docker://${ER_IMAGE_TAG}"

Release Semantic commit:
  extends: .release:semantic-commit

Release Generate changelog:
  extends: .release:generate-changelog

Docs Export changelog:
  extends:
    - .rules:semver-all
    - .docs:export-changelog
  variables:
    CHANGELOG_EXTRA_FLAGS: "--merge-prerelease"


# Configure stage
#################

Configure Test:
  stage: configure
  extends:
    - .rules:semver-all
    - .config:endpoint-with-tag
  needs: ["Release Admin image", "Release Selvbetjening image"]
  variables:
    # Matches routing in config-updater/config_updater/kas/main.py in salt repo
    ENDPOINT: kas/salt/update-test

Configure Production:
  stage: configure
  extends:
    - .rules:semver-core
    - .config:endpoint-with-tag
  needs: ["Release Admin image", "Release Selvbetjening image"]
  variables:
    # Matches routing in config-updater/config_updater/kas/main.py in salt repo
    ENDPOINT: kas/salt/update-production

# Deploy stage
##############

Deploy to Staging:
  stage: deploy
  extends:
    - .rules:semver-all
    - .saltbert
  needs: ["Release Admin image", "Release Selvbetjening image", "Release ER image", "Configure Test"]
  variables:
    SALTBERT_ORCHESTRATION: groenland.kas.service-test
    SALTBERT_URL: https://saltmaster.groenland.magentahosted.dk
  environment:
    name: test
    url: "https://test.kas.aka.nanoq.gl"

Deploy to Production:
  stage: deploy
  extends:
    - .rules:semver-core
    - .saltbert
  needs: ["Release Admin image", "Release Selvbetjening image", "Configure Production"]
  variables:
    SALTBERT_ORCHESTRATION: groenland.kas.service-prod
    SALTBERT_URL: https://saltmaster.groenland.magentahosted.dk
  when: manual
  environment:
    name: production
    url: "https://kas.aka.nanoq.gl"