.gitlab-ci.yml

image: ${DEVOPS_REGISTRY}usgs/python:3.9-obspy

stages:
  - init
  - test
  - integration
  - deploy

variables:
  APP_NAME: geomag-algorithms
  DATA_HOST: "edgecwb.usgs.gov"
  DATA_PORT: "2060"
  DATA_TYPE: "edge"
  UPSTREAM_PATH: ghsc/geomag/geomag-algorithms

# Do not run in upstream for merge requests
workflow:
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH

## --------------------------------------------------
# Templates
## --------------------------------------------------

.adjust_image_names:
  before_script:
    - IMAGE_NAME=usgs/${APP_NAME}:${CI_COMMIT_REF_SLUG}
    - IMAGE_NAME=${IMAGE_NAME/:master/:latest}
    - INTERNAL_IMAGE_NAME=${CODE_REGISTRY_IMAGE}/${IMAGE_NAME}
    - STACK_NAME=${APP_NAME}

.deploy:
  extends:
    - .adjust_image_names
  image: "${CODE_REGISTRY}/ghsc/hazdev/container-deploy:latest"
  script:
    - cp -v
      /container-deploy/default.config.sh
      /container-deploy/default.funcs.sh
      /container-deploy/deploy.sh
      scripts/.
    - export APP_NAME=${APP_NAME}
    - export IMAGE_NAME=${IMAGE_NAME}
    - export REGISTRY=${CODE_REGISTRY_IMAGE}
    - export STACK_NAME=${APP_NAME}
    - ./scripts/deploy.sh
  stage: deploy
  tags:
    - deploy
    - swarm
  # these variables are defined in Gitlab, or set in scripts/custom.config.sh
  # variables:
  #   DATABASE_URL
  #   OPENID_CLIENT_ID
  #   OPENID_CLIENT_SECRET
  #   OPENID_METADATA_URL
  #   SECRET_KEY
  #   SECRET_SALT
  #   ADMIN_GROUP
  #   REVIEWER_GROUP

.deploy-library:
  image: "docker:stable-git"
  script:
    - PREFIX_LENGTH=${#REQUIRED_PREFIX};
    - if [[ "${APP_DEPLOY_DIR:0:${PREFIX_LENGTH}}" != "${REQUIRED_PREFIX}" ]]; then
      echo "APP_DEPLOY_DIR does not contain correct path";
      exit 255;
      fi
    - if [ ! -d "${APP_DEPLOY_DIR}" ]; then
      cd "$(dirname "${APP_DEPLOY_DIR}")";
      git clone "${CI_REPOSITORY_URL}" "$(basename "${APP_DEPLOY_DIR}")";
      fi
    - cd "${APP_DEPLOY_DIR}";
    # fetch tags so checkout doesn't create  a branch
    - git fetch --tags;
    # switch to requested tag/branch
    - git checkout "${CI_COMMIT_REF_NAME}" || git checkout -b "${CI_COMMIT_REF_NAME}";
    # pull updates if on a branch
    - |
      if ! git status | grep -q detached ; then
        git pull --ff-only "${CI_REPOSITORY_URL}" "${CI_COMMIT_REF_NAME}";
      fi
  stage: deploy
  tags:
    - deploy
    - swarm
  variables:
    APP_DEPLOY_DIR: "/geomag/geomag-algorithms"
    REQUIRED_PREFIX: "/geomag"

# rules to define which branches should trigger actions
.development-env: &development-env
  if: $CI_PROJECT_PATH != $UPSTREAM_PATH
  variables:
    ENVIRONMENT: development

.staging-env: &staging-env
  if: >
    $CI_PROJECT_PATH == $UPSTREAM_PATH
    && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  variables:
    ENVIRONMENT: staging

.production-env: &production-env
  if: >
    $CI_PROJECT_PATH == $UPSTREAM_PATH
    && ( $CI_COMMIT_BRANCH == 'production' || $CI_COMMIT_TAG)
  variables:
    ENVIRONMENT: production

## --------------------------------------------------
# Init Stage
## --------------------------------------------------

Poetry:
  artifacts:
    paths:
      - poetry.toml
      - .venv
  cache:
    paths:
      # cache pip installed dependencies, see PIP_CACHE_DIR variable below
      - .cache/pip
  script:
    # install into .venv for artifact
    - poetry config virtualenvs.in-project true --local
    - poetry install
    - poetry run safety check
  stage: init
  variables:
    PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"

## --------------------------------------------------
# Test Stage
## --------------------------------------------------

Python Build:
  needs:
    - Poetry
  script:
    - poetry build
  stage: test

Python Lint:
  needs:
    - Poetry
  script:
    - poetry run black --check .
  stage: test

Python Test:
  artifacts:
    reports:
      cobertura: coverage.xml
      junit: junit.xml
  needs:
    - Poetry
  script:
    - poetry run pytest --cov=geomagio --junitxml junit.xml
    - poetry run coverage xml
  stage: test

## --------------------------------------------------
# Integration Stage
## --------------------------------------------------

Build Docker Image:
  extends:
    - .adjust_image_names
  image: ${DEVOPS_REGISTRY}docker:19.03-git
  needs:
    - Python Build
  script:
    - LOCAL_IMAGE="local/${IMAGE_NAME}"
    ## build image
    - docker build
      --pull
      --build-arg FROM_IMAGE=${FROM_IMAGE}
      --build-arg GIT_BRANCH_NAME=${CI_COMMIT_REF_NAME}
      --build-arg GIT_COMMIT_SHA=${CI_COMMIT_SHA}
      --tag "${LOCAL_IMAGE}"
      "."

    ## trivy scan before push
    - wget https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
    - tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
    # fail LOW,MEDIUM vulnerabilities that have a fix available
    - ./trivy image --exit-code 1 --ignore-unfixed --severity LOW,MEDIUM "${LOCAL_IMAGE}";
    # fail HIGH,CRITICAL vulnerabilities
    - ./trivy image --exit-code 1 --severity HIGH,CRITICAL "${LOCAL_IMAGE}";

    ## push image
    - if [ "${CI_PROJECT_PATH}" != "${UPSTREAM_PATH}" ]; then
      echo "Skipping push on non-upstream (${CI_PROJECT_PATH})";
      exit 0;
      fi
    - |
      for IMAGE in "${IMAGE_NAME}" "${INTERNAL_IMAGE_NAME}"; do
        docker tag "${LOCAL_IMAGE}" "${IMAGE}";
        docker push "${IMAGE}";
      done
  services:
    - alias: docker
      name: ${DEVOPS_REGISTRY}docker:19.03-dind
  stage: integration
  tags:
    - build
  variables:
    APP_NAME: geomag-algorithms
    DOCKER_DRIVER: overlay2
    FROM_IMAGE: ${DEVOPS_REGISTRY}usgs/python:3.9-obspy
    TRIVY_VERSION: "0.27.1"

## --------------------------------------------------
# Deploy Stage
## --------------------------------------------------

Staging Library:
  extends:
    - .deploy-library
  rules:
    - <<: *staging-env
      when: on_success
    - <<: *production-env
      when: manual
  tags:
    - deploy
    - swarm
    - mage01

Production Library:
  extends:
    - .deploy-library
  rules:
    - <<: *production-env
      when: manual
  tags:
    - deploy
    - swarm
    - mage02

Web Service Staging:
  extends:
    - .deploy
  parallel:
    matrix:
      - RUNNER:
          - mage01
          - staging01
  rules:
    - <<: *staging-env
      when: on_success
    - <<: *production-env
      when: manual
  tags:
    - deploy
    - swarm
    - "${RUNNER}"

Web Service Production:
  extends:
    - .deploy
  parallel:
    matrix:
      - RUNNER:
          - mage02
          - production01
          - production02
  rules:
    - <<: *production-env
      when: manual
  tags:
    - deploy
    - swarm
    - "${RUNNER}"