.gitlab-ci.yml

include:
  - project: "devops/gitlab/ci-templates/deploy"
    file: ".hashicorp_vault.yml"
  - project: "devops/gitlab/ci-templates/ruby"
    ref: "sans-dind"
    file:
      - ".rspec.yml"
      - ".rubocop.yml"
  - project: "devops/gitlab/ci-templates/docker"
    ref: "1.0.0"
    file:
      - ".amend_manifests.yml"
      - ".build_and_push_docker_images.yml"
      - ".copy_docker_images.yml"
      - ".remove_tmp_registry.yml"
  - project: "devops/gitlab/ci-templates/sast"
    ref: "master"
    file:
      - ".trivy_container_scanning.yml"
  - template: "Workflows/MergeRequest-Pipelines.gitlab-ci.yml"

stages:
  - build_and_push:tmp_base_image
  - build_and_push:tmp_dev_image
  - amend_tmp_base_dev_images
  - test
  - build_and_push:tmp_prod_image
  - amend_prod_image
  - sast
  - copy_docker_images
  - remove_tmp_registry
  - deploy

# -- Start - build and push base image
build_and_push_base_app_image:
  stage: build_and_push:tmp_base_image
  extends:
    - .build_and_push_docker_images
  parallel:
    matrix:
      - RUNNER: build-arm
        DOCKER_BUILD_PLATFORM: "linux/arm64"
      - RUNNER: build
        DOCKER_BUILD_PLATFORM: "linux/amd64"
  variables:
    DOCKER_BUILD_CONTEXT: "rails_app/"
    DOCKER_TARGET: "base"
    DOCKERFILE_PATH: "rails_app/"
    IMAGE_TAGS: "${CI_COMMIT_TAG} ${CI_COMMIT_REF_SLUG} ${CI_COMMIT_SHA} ${CI_COMMIT_SHORT_SHA} ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}"
    REGISTRY_REPOSITORY: "${CI_PIPELINE_ID}"
  tags:
    - ${RUNNER}
# -- End - build and push base image

# -- Start - build, push temp dev image
build_and_push_dev_app_image:
  stage: build_and_push:tmp_dev_image
  extends:
    - .build_and_push_docker_images
  parallel:
    matrix:
      - RUNNER: build-arm
        DOCKER_BUILD_PLATFORM: "linux/arm64"
      - RUNNER: build
        DOCKER_BUILD_PLATFORM: "linux/amd64"
  variables:
    DOCKER_BUILD_ARGS: "--build-arg RAILS_ENV=development"
    DOCKER_BUILD_CONTEXT: "rails_app/"
    DOCKER_TARGET: "development"
    DOCKERFILE_PATH: "rails_app/"
    IMAGE_TAGS: "${CI_COMMIT_TAG} ${CI_COMMIT_REF_SLUG} ${CI_COMMIT_SHA} ${CI_COMMIT_SHORT_SHA} ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}"
    REGISTRY_REPOSITORY: "${CI_PIPELINE_ID}"
  needs:
    - build_and_push_base_app_image
  tags:
    - ${RUNNER}

amend_tmp_base_dev_images:
  stage: amend_tmp_base_dev_images
  extends:
    - .amend_manifests
  needs:
    - build_and_push_base_app_image
    - build_and_push_dev_app_image
  variables:
    REGISTRY_REPOSITORY: "${CI_PIPELINE_ID}"
  tags:
    - build
# -- End - build, push temp dev image

# -- Start - test dev image
rspec_app_test:
  stage: test
  image: ${CI_REGISTRY_IMAGE}/${CI_PIPELINE_ID}:${CI_COMMIT_SHORT_SHA}-development
  services:
    - name: browserless/chrome:latest
      alias: chrome
      variables:
        CONNECTION_TIMEOUT: 600000
    - name: gitlab.library.upenn.edu/dld/digital-repository/fits-servlet:main
      alias: fits
    - name: minio/minio:latest
      alias: minio
      command: [ "minio", "server", "/data" ]
      variables:
        MINIO_ROOT_USER: "minioadmin"
        MINIO_ROOT_PASSWORD: "minioadmin"
    - name: postgres:14
      variables:
        POSTGRES_DB: "apotheca_test"
        POSTGRES_PASSWORD: "rspec_test"
        POSTGRES_USER: "rspec_test"
    - name: bitnami/solr:9.3.0
      alias: solr
      variables:
        SOLR_CLOUD_BOOTSTRAP: "yes"
        SOLR_ENABLE_AUTHENTICATION: "yes"
        SOLR_HOST: "solr"
        SOLR_JAVA_MEM: "-Xms4g -Xmx4g"
        SOLR_MODE: "solrcloud"
        SOLR_OPTS: "-Dsolr.disableConfigSetsCreateAuthChecks=true"
        ZK_CREATE_CHROOT: "true"
    - name: clamav/clamav:1.1
      alias: clamav
  extends:
    - .rspec
  variables:
    APP_URL: "apotheca.test.com"
    CHROME_URL: "http://chrome:3000"
    DATABASE_NAME: "apotheca_test"
    DATABASE_PASSWORD: "rspec_test"
    DATABASE_USER: "rspec_test"
    FF_NETWORK_PER_BUILD: "true"
    FITS_URL: "http://fits:8080/fits"
    MINIO_URL: "http://minio:9000"
    RAILS_ENV: "test"
    RAILS_SYSTEM_TESTING_SCREENSHOT_HTML: "1"
    SOLR_TEST_URL: "http://solr:8983/solr/apotheca-test"
  script:
    - apt-get update && apt-get -y install zip
    - cd ${CI_PROJECT_DIR}/rails_app/
    - bundle add rspec_junit_formatter
    - bundle exec rake db:migrate
    - bundle exec rake apotheca:create_buckets
    - >
      for ((i = 0; i <= 9; i += 1)); do
        curl --silent "http://solr:8983/api/" "-H" "'Content-type:application/json'" && break
        echo "Waiting for solr api to be ready"
        sleep "30s"
      done
    - (cd ./solr/conf && zip -r - *) > configset.zip
    - curl -X POST --user "admin:Bitnami" --header "Content-Type:application/octet-stream" --data-binary @configset.zip "http://solr:8983/solr/admin/configs?action=UPLOAD&name=apotheca"
    - curl -v --user "admin:Bitnami" "http://solr:8983/solr/admin/collections?action=CREATE&name=apotheca-test&collection.configName=apotheca&numShards=1"
    - bundle exec rspec --format progress --format RspecJunitFormatter --out rspec.xml
  needs:
    - amend_tmp_base_dev_images
  coverage: '/\(\d+.\d+\%\) covered/'
  artifacts:
    paths:
      - rails_app/tmp/coverage/index.html
      - rails_app/tmp/capybara
      - rails_app/rspec.xml
    expire_in: 1 week
    reports:
      junit: rails_app/rspec.xml
  rules:
    - if: $DISABLE_RSPEC_TEST == "true"
      when: never
    - exists:
        - rails_app/spec/**.rb
        - rails_app/spec/**/**.rb
  tags:
    - build

rubocop_app_test:
  stage: test
  image: ${CI_REGISTRY_IMAGE}/${CI_PIPELINE_ID}:${CI_COMMIT_SHORT_SHA}-development
  needs:
    - amend_tmp_base_dev_images
  extends:
    - .rubocop
  before_script:
    - cd ${CI_PROJECT_DIR}/rails_app/
  rules:
    - if: $DISABLE_RUBOCOP == "true"
      when: never
    - exists:
        - rails_app/.rubocop.yml
  tags:
    - build
# -- End - test dev image

# -- Start - build and push temp prod image
build_and_push_prod_app_image:
  stage: build_and_push:tmp_prod_image
  extends:
    - .build_and_push_docker_images
  parallel:
    matrix:
      - RUNNER: build-arm
        DOCKER_BUILD_PLATFORM: "linux/arm64"
      - RUNNER: build
        DOCKER_BUILD_PLATFORM: "linux/amd64"
  variables:
    DOCKER_BUILD_ARGS: "--build-arg RAILS_ENV=production"
    DOCKER_BUILD_CONTEXT: "rails_app/"
    DOCKER_TARGET: "production"
    DOCKERFILE_PATH: "rails_app/"
    IMAGE_TAGS: "${CI_COMMIT_TAG} ${CI_COMMIT_REF_SLUG} ${CI_COMMIT_SHA} ${CI_COMMIT_SHORT_SHA} ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}"
    REGISTRY_REPOSITORY: "${CI_PIPELINE_ID}"
  needs:
    - rspec_app_test
    - rubocop_app_test
  tags:
    - ${RUNNER}

amend_prod_image:
  stage: amend_prod_image
  extends:
    - .amend_manifests
  needs:
    - build_and_push_prod_app_image
  variables:
    DOCKER_TARGET: "production"
    REGISTRY_REPOSITORY: "${CI_PIPELINE_ID}"
    TAG_WITH_DOCKER_TARGET: "false"
  tags:
    - build
# -- End - build and push temp prod image

# -- Start - SAST images
trivy_app_container_scanning:
  stage: sast
  extends:
    - .trivy_container_scanning
  before_script:
    - apk add --no-cache docker
    - docker login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}
  after_script:
    - docker logout ${CI_REGISTRY}
  needs:
    - amend_prod_image
  variables:
    CI_IMAGE_NAME: ${CI_REGISTRY_IMAGE}/${CI_PIPELINE_ID}:${CI_COMMIT_SHORT_SHA}
  allow_failure: true
  tags:
    - build
# -- End - SAST images

# -- Start - Copy app docker images
copy_app_docker_images:
  stage: copy_docker_images
  variables:
    ORIGINAL_REGISTRY_REPOSITORY: "${CI_PIPELINE_ID}"
  needs:
    - trivy_app_container_scanning
  extends:
    - .copy_docker_images
  tags:
    - build
# -- End - Copy app docker images

# -- Start - remove tmp registry repository
remove_tmp_registry:
  stage: remove_tmp_registry
  extends:
    - .remove_tmp_registry
  rules:
    - when: always
  needs:
    - copy_app_docker_images
  allow_failure: true
  tags:
    - build
# -- End - remove tmp registry repository

# Deploy staging
deploy_staging:
  stage: deploy
  extends:
    - .deploy
  variables:
    IMAGE_TAG: ${CI_COMMIT_SHORT_SHA}
  environment:
    name: staging
    url: https://apotheca-staging.library.upenn.edu
  needs:
    - copy_app_docker_images
  only:
    - main
  tags:
    - deploy

#Deploy production
deploy_production:
  stage: deploy
  extends:
    - .deploy
  variables:
    IMAGE_TAG: ${CI_COMMIT_TAG}
  environment:
    name: production
    url: https://apotheca.library.upenn.edu
  needs:
    - copy_app_docker_images
  rules:
    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+(\.[a-zA-Z0-9]+)?$/
  tags:
    - deploy
#-- End - deployment