.gitlab-ci.yml

stages:
  - lint
  - build
  - test
  - release
  - docs
  - configure
  - deploy

# https://docs.gitlab.com/ee/ci/yaml/workflow.html#switch-between-branch-pipelines-and-merge-request-pipelines
.if-default-branch-refs: &if-default-branch-refs
  if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

.if-tag: &if-tag
  if: '$CI_COMMIT_TAG'

.if-merge-request: &if-merge-request
  if: '$CI_MERGE_REQUEST_IID'

# Workflow
###########
workflow:
  rules:
    - <<: *if-tag
      variables:
        # Override the IMAGE_SHA variable on tag pipelines to avoid both the default
        # branch pipeline and tag pipeline overriding each other's images arbitrarily when
        # they are both running at the same time on master.
        IMAGE_SHA: ${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}
    - <<: *if-default-branch-refs
    - <<: *if-merge-request

include:
  - project: "labs/salt-automation"
    file:
      - "/gitlab-ci-templates/common/rules.v1.yml"
      - "/gitlab-ci-templates/common/saltbert.v1.yml"
      - "/gitlab-ci-templates/common/docker-build-meta.v2.yml"
      - "/gitlab-ci-templates/common/docker-release-meta.v1.yml"
      - "/gitlab-ci-templates/common/config-updater-meta.v1.yml"
      - "/gitlab-ci-templates/common/conventional-commits-meta.v1.yml"
      - "/gitlab-ci-templates/common/conventional-commits-changelog-meta.v1.yml"

.releaserc:
  before_script:
    - |
      cat <<EOF > .releaserc.yaml
      branches:
        - master
      tagFormat: "\${version}-rc1"
      plugins:
        - - "@semantic-release/commit-analyzer"
          - preset: angular
            releaseRules:
              - type: chore
                scope: deps-dev
                release: patch
              - type: chore
                scope: deps
                release: patch
              - type: build
                scope: deps-dev
                release: patch
              - type: build
                scope: deps
                release: patch
        - "@semantic-release/release-notes-generator"
        - "@semantic-release/changelog"
        - - "@semantic-release/gitlab"
          - assets:
              - path: CHANGELOG.md
                label: Changelog
      EOF


variables:
  KANIKO_VERSION: v1.15.0-debug
  RELEASE_REGISTRY: docker.io
  RELEASE_REGISTRY_IMAGE: index.docker.io/magentaaps/esani-pantportal

  IMAGE_SHA: ${CI_REGISTRY_IMAGE}/esani-pantportal:${CI_COMMIT_SHA}
  IMAGE_TAG: magentaaps/esani-pantportal:${CI_COMMIT_TAG}

  ER_IMAGE_SHA: ${CI_REGISTRY_IMAGE}/esani-pantportal-er:${CI_COMMIT_SHA}
  ER_IMAGE_TAG: magentaaps/esani-pantportal-er:${CI_COMMIT_TAG}

  VERSION: PIPELINE

# Lint stage
#############
.lint-default: &lint-default
  stage: lint
  needs: []
  image: python:3.11
  
Lint Commits:
  extends: .lint:commits
  variables:
    CONFIG: '{ extends: [''@commitlint/config-conventional''], ignores: [(message) => message.includes(''suggestion(s)'')], }'


Lint Python:
  <<: *lint-default
  before_script:
    - pip3 install flake8
    - pip3 install black==24.1.1
    - pip3 install isort==5.12.0
  script:
    - flake8 --max-line-length 88 --exclude=migrations,project --extend-ignore E226,E203,W503 esani_pantportal/
    - black --check --diff --exclude=migrations esani_pantportal/
    - isort -c --diff --profile black --skip migrations esani_pantportal/


Lint Dockerfiles:
  <<: *lint-default
  image: hadolint/hadolint:latest-debian
  before_script:
    - apt-get -y update
    - apt-get -y install --no-install-recommends git
  script:
    - git ls-files --exclude='Dockerfile*' --ignored | xargs --max-lines=1 hadolint

Lint REUSE compliance:
  extends: .lint-default
  image:
    name: fsfe/reuse:latest
    entrypoint: [""]
  script:
    - reuse lint

# Build stage
#############

# Build EANI-pantportal image
Build ESANI-Pantportal image:
  extends: .build-docker
  variables:
    DOCKERFILE: $CI_PROJECT_DIR/docker/Dockerfile

Build ER image:
  extends: .build-docker
  variables:
    DOCKERFILE: $CI_PROJECT_DIR/docker/Dockerfile_er
    CI_IMAGE: $ER_IMAGE_SHA

# Test stage
#############
.test-default: &test-default
  stage: test
  dependencies: []
  services:
    - name: postgres:16
      alias: pantportal-db
  variables:
    # Simulate development environment while running tests so we use mockup data
    DJANGO_SECRET_KEY: e$s6@0(hs5ja79-&!l7vt^onoe4h^*bv_e4hj&wt5^8*&x76-$
    DJANGO_TIMEZONE: Europe/Copenhagen
    POSTGRES_USER: pantportal
    POSTGRES_PASSWORD: pantportal
    POSTGRES_DB: pantportal
    POSTGRES_HOST: pantportal-db
    ENVIRONMENT: development
    DISABLE_METRICS: 'True'
    DJANGO_LANGUAGE_COOKIE_DOMAIN: localhost
    REST_DOMAIN: http://mocked_api/
    BYPASS_2FA: 'True'


.test-pantportal: &test-pantportal
  <<: *test-default
  needs: ["Build ESANI-Pantportal image"]
  image: ${IMAGE_SHA}


Pantportal test:
  <<: *test-pantportal
  script:
    - cd /app
    - python manage.py collectstatic
    - coverage run manage.py test --parallel 4
    - coverage combine
    - coverage report --show-missing --fail-under=100
    - coverage xml
  coverage: '/^TOTAL.+?(\d+\%)$/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: /app/coverage.xml


Django check:
  <<: *test-pantportal
  script:
    - cd /app
    - python3 manage.py check esani_pantportal

Mypy:
  <<: *test-pantportal
  script:
    - cd /app
    - mypy --config mypy.ini esani_pantportal/

# Release stage
#############

.release:
  stage: release
  image: alpine
  needs: ["Pantportal test"]
  variables:
    GIT_STRATEGY: none # We do not need the source code
  dependencies: []
  before_script:
    - apk add skopeo

Release ESANI-Pantportal image:
  extends:
    - .rules:semver-all
    - .release
  script:
    - skopeo copy
      --src-creds=${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD}
      --dest-creds=${RELEASE_REGISTRY_USER}:${RELEASE_REGISTRY_PASSWORD}
      "docker://${IMAGE_SHA}"
      "docker://${IMAGE_TAG}"

Release ER image:
  extends:
    - .rules:semver-all
    - .release
  needs:
    ["Build ER image"]
  script:
    - skopeo copy
      --src-creds=${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD}
      --dest-creds=${RELEASE_REGISTRY_USER}:${RELEASE_REGISTRY_PASSWORD}
      "docker://${ER_IMAGE_SHA}"
      "docker://${ER_IMAGE_TAG}"

Release Semantic commit:
  extends: .release:semantic-commit

Release Generate changelog:
  extends: .release:generate-changelog

Docs Export changelog:
  extends:
    - .rules:semver-all
    - .docs:export-changelog
  variables:
    CHANGELOG_EXTRA_FLAGS: "--merge-prerelease"

# Configure stage
#################

Configure Test:
  stage: configure
  extends:
    - .rules:semver-all
    - .config:endpoint-with-tag
  needs: ["Release ESANI-Pantportal image"]
  variables:
    ENDPOINT: esani_pantportal/salt/update-test

Configure Prod:
  stage: configure
  extends:
    - .rules:semver-core
    - .config:endpoint-with-tag
  needs: ["Release ESANI-Pantportal image"]
  variables:
    ENDPOINT: esani_pantportal/salt/update-production

# Deploy stage
##############

Deploy to Test:
  stage: deploy
  extends:
    - .saltbert
  needs: ["Configure Test"]
  variables:
    SALTBERT_ORCHESTRATION: groenland.esani_pantportal.service-test
    SALTBERT_URL: https://saltmaster.groenland.magentahosted.dk
  rules:
    # Matches <version core> from SemVer 2.0.0 BNF grammar. Ex. 2.3.4, but not 2.3.4-rc
    - if: $CI_COMMIT_TAG =~ /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/
      when: manual
    # Matches all of SemVer 2.0.0
    - if: $CI_COMMIT_TAG =~ /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/
  environment:
    name: test
    url: "https://test.pant.gl"

Deploy to Prod:
  stage: deploy
  extends:
    - .rules:semver-core
    - .saltbert
  needs: ["Configure Prod"]
  variables:
    SALTBERT_ORCHESTRATION: groenland.esani_pantportal.service-prod
    SALTBERT_URL: https://saltmaster.groenland.magentahosted.dk
  when: manual
  environment:
    name: production
    url: "https://pant.gl"