.gitlab-ci-base-template.yml

image: docker.anders.fi/anders/ci-configuration:v3

stages:
  - build
  - test
  - post-test
  - review-service
  - review
  - staging
  - production
  - cleanup_review

variables:
  # Default usernames and passwords for postgres setups
  # Note: These are the credentials that will be used for testing
  DATABASE_USER: user
  DATABASE_PASSWORD: testing-password

  # Which version of Postgres that will be installed for testing
  # and for preview environments
  POSTGRES_VERSION_TAG: "9.6"

  # Which version of MySQL should be used if enabled
  MYSQL_VERSION_TAG: "5.7"

  # Default name for the database
  DATABASE_DB: "$CI_ENVIRONMENT_SLUG"

  # Default place to store service artifacts
  SERVICE_ARTIFACT_FOLDER: "service_artifacts"
  BUILD_ARTIFACT_FOLDER: "build_artifacts"

  # Default PodSecurity label
  K8S_POD_SECURITY: baseline

  # Kolga branch used in the pipeline
  KOLGA_BRANCH: "v3"

.build:
  services:
    - docker:24.0.5-dind
  stage: build
  script:
    - devops create_images
  only:
    - merge_requests
    - master
    - main
    - qa
    - /^r-[\d]+$/
  except:
    variables:
      - $BUILD_DISABLED
  artifacts:
    paths:
      - $BUILD_ARTIFACT_FOLDER/
    expire_in: 3 days
  interruptible: true
  retry:
    max: 2
    when:
      - runner_system_failure

.docker-image-scan:
  stage: test
  image: aquasec/trivy
  script:
    - trivy image --clear-cache
    - trivy image --no-progress --exit-code 1 --severity HIGH ${DEVELOPMENT_IMAGE}
  variables:
    TRIVY_USERNAME: ${CI_REGISTRY_USER}
    TRIVY_PASSWORD: ${CI_REGISTRY_PASSWORD}
  only:
    - merge_requests
    - master
    - main
    - qa
    - /^r-[\d]+$/

.sonarqube:
  stage: post-test
  image: sonarsource/sonar-scanner-cli:latest
  variables:
    SONAR_PROJECT_BASE_DIR: $CI_PROJECT_DIR
    SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"
    GIT_DEPTH: 0
  script:
    - sonar-scanner
  cache:
    key: "${CI_JOB_NAME}"
    paths:
      - .sonar/cache
  allow_failure: true
  only:
    - merge_requests
    - master
    - main
    - /^r-[\d]+$/
    - v3
  except:
    variables:
      - $SONARQUBE_DISABLED

.test:
  services:
    - docker:24.0.5-dind
  stage: test
  script:
    - set_env_from_devops docker_test_image BUILT_DOCKER_TEST_IMAGE
    - devops test_setup
    - make test
  only:
    - merge_requests
    - master
    - main
    - qa
  except:
    variables:
      - $TEST_DISABLED
  interruptible: true
  retry:
    max: 2
    when:
      - runner_system_failure

.light-test:
  stage: test
  tags:
    - light
  only:
    - merge_requests
    - master
    - main
    - qa
  except:
    variables:
      - $TEST_DISABLED
  interruptible: true
  retry:
    max: 2
    when:
      - runner_system_failure

.review-service:
  stage: review-service
  variables:
    DEFAULT_TRACK: review
    TRACK: review
  environment:
    name: qa/r/${CI_COMMIT_REF_SLUG}
    on_stop: stop_review
    auto_stop_in: 2 weeks
  artifacts:
    paths:
      - $SERVICE_ARTIFACT_FOLDER/
    expire_in: 3 days
  only:
    refs:
      - merge_requests
    kubernetes: active
  except:
    variables:
      - $REVIEW_DISABLED
  interruptible: true

.review-no-env:
  stage: review
  script:
    - devops deploy_application
  variables:
    K8S_INGRESS_PREVENT_ROBOTS: 1
    TRACK: review
    VAULT_PROJECT_SECRET_NAME: $CI_PROJECT_NAME/$TRACK
  only:
    refs:
      - merge_requests
    kubernetes: active
  except:
    refs:
      - master
      - main
    variables:
      - $REVIEW_DISABLED
  interruptible: true

.review:
  extends: .review-no-env
  environment:
    name: qa/r/${CI_COMMIT_REF_SLUG}
    url: https://$CI_PROJECT_PATH_SLUG-$CI_ENVIRONMENT_SLUG.$KUBE_INGRESS_BASE_DOMAIN
    on_stop: stop_review
    auto_stop_in: 2 weeks

.review-cleanup:
  variables:
    GIT_STRATEGY: none
    TRACK: review
  environment:
    name: qa/r/${CI_COMMIT_REF_SLUG}
    action: stop
  stage: cleanup_review
  dependencies: []
  script:
    - devops review_cleanup
  only:
    refs:
      - merge_requests
    kubernetes: active
  except:
    refs:
      - master
      - main
    variables:
      - $REVIEW_DISABLED
  interruptible: true

.cleanup_review:
  extends: .review-cleanup
  allow_failure: false
  when: on_failure

.stop_review:
  extends: .review-cleanup
  allow_failure: true
  when: manual

.staging:
  stage: staging
  script:
    - devops deploy_application
  environment:
    name: qa/staging
    url: https://$CI_PROJECT_PATH_SLUG-qa.$KUBE_INGRESS_BASE_DOMAIN
    kubernetes:
      namespace: $K8S_STAGING_NAMESPACE
  variables:
    K8S_INGRESS_PREVENT_ROBOTS: 1
    TRACK: staging
    VAULT_PROJECT_SECRET_NAME: $CI_PROJECT_NAME/$TRACK
  only:
    refs:
      - master
      - main
    kubernetes: active
  except:
    variables:
      - $STAGING_DISABLED
  interruptible: false

.production:
  stage: production
  script:
    - devops deploy_application
  environment:
    name: production
    url: https://$CI_PROJECT_PATH_SLUG.$KUBE_INGRESS_BASE_DOMAIN
    kubernetes:
      namespace: $K8S_STABLE_NAMESPACE
  variables:
    TRACK: stable
    VAULT_PROJECT_SECRET_NAME: $CI_PROJECT_NAME/$TRACK
  only:
    refs:
      - /^r-[\d]+$/
    kubernetes: active
  except:
    refs:
      # This will prevent branches with name ^r-[\d]+
      - branches
    variables:
      - $PRODUCTION_DISABLED
  interruptible: false

before_script:
  - git config --global url."https://gitlab-ci-token:${CI_JOB_TOKEN}@git.anders.fi/".insteadOf "git@git.anders.fi:"
  - git clone --single-branch --branch ${KOLGA_BRANCH} git@git.anders.fi:anders/ci-configuration.git /tmp/devops/ci-configuration
  - export PATH="$PATH:/tmp/devops/ci-configuration"
  - source /tmp/devops/ci-configuration/utils/shell_utils.sh
  - set_docker_host