.gitlab-ci.yml

# https://gitlab.com/gitlab-org/gitlab-foss/blob/master/lib/gitlab/ci/templates/Gradle.gitlab-ci.yml
# This is the Gradle build system for JVM applications
# https://gradle.org/
# https://github.com/gradle/gradle
image: docker-registry.ripe.net/swe/gitlab-ci/gradle-buildenv:gradle8-jdk21

stages:
  - build
  - test
  - qa
  - package
  - review
  - release
  - deploy

include:
  # Run pipeline on main branch, merge requests, tags.
  # this is equivalent to `workflow.rules:` that set this up.
  - template: 'Workflows/MergeRequest-Pipelines.gitlab-ci.yml'
  # Use gitlab security scanning iff it is available.
  - template: Dependency-Scanning.gitlab-ci.yml
  # Mend
  - project: 'swe/gitlab-ci'
    file: '/templates/mend-scanning.yml'
  - project: 'swe/gitlab-ci'
    file: '/templates/mend-generate-badge.yml'
  # Review Apps
  - project: 'rpki/helm-charts'
    file: '/gitlab/review.yml'


# Disable the Gradle daemon for Continuous Integration servers as correctness
# is usually a priority over speed in CI environments. Using a fresh
# runtime for each build is more reliable since the runtime is completely
# isolated from any previous builds.
variables:
  DEBIAN_FRONTEND: noninteractive
  GRADLE_USER_HOME: "${CI_PROJECT_DIR}/.gradle/"
  GRADLE_OPTS: "-Dorg.gradle.caching=true -Dorg.gradle.parallel=true -Dorg.gradle.daemon=false"
  TERM: dumb

  # org.gradle.daemon: should gradle daemon be used?
  # org.gradle.caching: should gradle build cache be used?
  # org.gradle.parallel: run parallelizable tasks in parallel?
  # org.gradle.logging.level=info: logs artifact downloads

# Cache per repository (not shared between forks?).
cache: &global_cache
  key: one-key-for-all
  # In general, only pull the cache. pull-push in the stage that gathers all
  # artifacts.
  policy: pull
  paths:
    - "${CI_PROJECT_DIR}/.gradle/caches"
    - "${CI_PROJECT_DIR}/.gradle/wrappers"

build:
  stage: build
  cache:
    <<: *global_cache
    policy: pull-push
  # Diagram of gradle tasks and their dependencies: https://docs.gradle.org/current/userguide/img/javaPluginTasks.png
  script:
    # build all classes, do not run tests or create jar.
    - gradle clean testClasses
  # Cache the build artifacts in specific paths
  artifacts:
    paths:
      - "build"
    expire_in: 4 weeks

test:
  stage: test
  dependencies:
    - build
  script:
    - gradle check
    - cat build/reports/jacoco/test/html/index.html
  artifacts:
    when: on_failure
    paths:
      - build/reports/
    expire_in: 4 days
    reports:
      junit:
        - build/test-results/test/*.xml

sonarqube:
  stage: qa
  # Use artifacts of test step, which creates coverage reports
  dependencies:
    - test
  variables:
    GIT_DEPTH: 0
  script:
    - gradle -Dsonar.host.url="${SONAR_HOST_URL}" -Dsonar.login="${SONAR_TOKEN}" -Dsonar.projectKey=rpki-monitoring check sonarqube
  allow_failure: true
  rules:
    - if: '$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME =~ /^renovate/'
      when: never
    - if: $CI_MERGE_REQUEST_IID
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH


# All the package stages only require the test job, so whitesource scanning can
# progress in parallel since this takes up to ten minutes.
build:image:
  stage: package
  needs: ["test"]
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - gradle generateGitProperties
    - docker build --label org.label-schema.vcs-ref="$CI_COMMIT_SHORT_SHA" --tag "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" .
    - docker push "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
  rules:
    - if: $CI_MERGE_REQUEST_IID
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - when: manual

release:latest:
  stage: release
  needs: ["build:image"]
  # optional
  allow_failure: true
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker pull $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    - docker tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA $CI_REGISTRY_IMAGE:latest
    - docker push $CI_REGISTRY_IMAGE:latest
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - when: manual

release:tag:
  stage: release
  needs: ["build:image"]
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker pull $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    - docker tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG#rpki-monitoring-}
    - docker push $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG#rpki-monitoring-}
  rules:
    - if: '$CI_COMMIT_TAG =~ /^rpki-monitoring-v\d+\.\d+\.\d+/'

#
# Update a Salt-managed container with a new version of an image.
#
# Deploying a new image for a Salt-managed container requires retagging the new
# image with a fixed tag that matches the tag in pillar configuration
# (e.g. ':latest' or the name of the environment).
#
# Then Salt must apply the 'docker' target on the system with
# `update_containers` set. This will pull the new image, stop the old container
# and start a new one.
#
# The following variables are required as input for this job.
#
# - IMAGE: image to deploy
# - READINESS_URL: URL returning 200 Ok when the container is ready
# - SALT_API_PASSWORD: Password for Salt API
# - SALT_API_URL: URL of the API to control Salt master
# - SALT_API_USERNAME: Username for Salt API
# - TARGET_CONTAINER: name of the container to deploy
# - TARGET_HOST: host system that runs the container
# - TARGET_TAG: tag used on the target host
#
.salt-container-deploy: &salt-container-deploy
  image: docker-registry.ripe.net/swe/gitlab-ci/debian-deployenv
  stage: deploy
  script:
    - if [ -z "${TARGET_CONTAINER}" ]; then echo "set TARGET_CONTAINER"; exit 2; fi
    - if [ -z "${IMAGE}" ]; then echo "set IMAGE"; exit 2; fi
    - if [ -z "${READINESS_URL}" ]; then echo "set READINESS_URL"; exit 2; fi
    - if [ -z "${SALT_API_URL}" ]; then echo "set SALT_API_URL"; exit 2; fi
    - if [ -z "${TARGET_HOST}" ]; then echo "set TARGET_HOST"; exit 2; fi
    - if [ -z "${TARGET_TAG}" ]; then echo "set TARGET_TAG"; exit 2; fi

    - echo "Logging into ${CI_REGISTRY}"
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"

    - echo "Retagging '${IMAGE}' as '${IMAGE/:*/}:${TARGET_TAG}'"
    - docker pull "${IMAGE}"
    - docker tag "${IMAGE}" "${IMAGE/:*/}:${TARGET_TAG}"
    - docker push "${IMAGE/:*/}:${TARGET_TAG}"

    - echo "Logging into salt-api"
    - >
      curl -ik ${SALT_API_URL}/login \
        -c ./cookies.txt \
        -H 'Accept: application/x-yaml' \
        -d username="${SALT_API_USERNAME}" \
        -d password="${SALT_API_PASSWORD}" \
        -d eauth='pam'

    - echo "Updating '${TARGET_CONTAINER}' container via salt on ${TARGET_HOST}"
    - >
      curl -D "/dev/stderr" -k "${SALT_API_URL}" \
        -b ./cookies.txt \
        -H 'Content-type: application/json' -d"
            [{
              \"timeout\": 120,
              \"failhard\": \"True\",
              \"client\": \"local_batch\",
              \"batch-size\": \"25%\",
              \"fun\": \"state.apply\",
              \"tgt_type\": \"glob\",
              \"tgt\": \"${TARGET_HOST}\",
              \"arg\": [\"docker\"],
              \"kwarg\": {
                \"pillar\": {
                  \"update_containers\": true
                }
              }
            }]
            " | jq -R '. as $raw | try fromjson catch $raw'

deploy:prepdev:
  <<: *salt-container-deploy
  needs: ["build:image"]
  variables:
    IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    TARGET_CONTAINER: rpki-monitoring
    READINESS_URL: http://127.0.0.1:9090/actuator/info
    TARGET_HOST: uncore-*.rpki.prepdev.ripe.net
    TARGET_TAG: prepdev
  environment:
    name: prepdev
    url: https://uncore-1.rpki.prepdev.ripe.net:9090/actuator/info
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - when: manual

deploy:production:
  <<: *salt-container-deploy
  needs: ["build:image"]
  variables:
    IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    TARGET_CONTAINER: rpki-monitoring
    READINESS_URL: http://127.0.0.1:9090/actuator/info
    TARGET_HOST: uncore-*.rpki.ripe.net
    TARGET_TAG: production
  environment:
    name: production
    url: https://uncore-1.rpki.prepdev.ripe.net:9090/actuator/info
  rules:
    # Only deploy tags to production (automatically)
    - if: '$CI_COMMIT_TAG =~ /^rpki-monitoring-v\d+\.\d+\.\d+/'

# PAAS deployments
deploy:paas-prepdev:
  <<: *salt-container-deploy
  needs: ["build:image"]
  variables:
    IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    TARGET_CONTAINER: rpki-monitoring
    READINESS_URL: http://127.0.0.1:9090/actuator/info
    TARGET_HOST: monitoring-*.paas.rpki.prepdev.ripe.net
    TARGET_TAG: paas-prepdev
  environment:
    name: paas-prepdev
    url: https://monitoring-1.paas.rpki.prepdev.ripe.net:9090/actuator/info
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - when: manual

deploy:paas-production:
  <<: *salt-container-deploy
  needs: ["build:image"]
  variables:
    IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    TARGET_CONTAINER: rpki-monitoring
    READINESS_URL: http://127.0.0.1:9090/actuator/info
    TARGET_HOST: monitoring-*.paas.rpki.ripe.net
    TARGET_TAG: paas-production
  environment:
    name: paas-production
    url: https://monitoring-1.paas.rpki.ripe.net:9090/actuator/info
  rules:
    # Only deploy tags to production (automatically)
    - if: '$CI_COMMIT_TAG =~ /^rpki-monitoring-v\d+\.\d+\.\d+/'

review:
  # optional
  allow_failure: true
  variables:
    GIT_STRATEGY: none
    RPKI_MONITORING_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
  needs: ["build:image"]