config.yml

version: 2.1

workflows:
  path_to_live:
    jobs:
      # Common tasks
      - use-my-lpa/lint_terraform:
          name: lint_terraform
          filters: { branches: { ignore: [master] } }

      - use-my-lpa/docker_build_front_app:
          name: app_front_build
      - use-my-lpa/docker_build_front_web:
          name: web_front_build

      - use-my-lpa/docker_build_api_app:
          name: app_api_build
      - use-my-lpa/docker_build_api_web:
          name: web_api_build
      - use-my-lpa/docker_build_pdf:
          name: pdf_build

      - use-my-lpa/codecov_php-unit_upload:
          name: codecov_upload
          requires: [app_front_build, app_api_build, web_api_build]

      # Provision and test development
      - use-my-lpa/apply_shared_terraform:
          name: dev_apply_shared_terraform
          filters: { branches: { ignore: [master] } }
          requires: [lint_terraform]

      - use-my-lpa/apply_environment_terraform:
          name: dev_apply_environment_terraform
          filters: { branches: { ignore: [master] } }
          requires:
            [
              dev_apply_shared_terraform,
              app_front_build,
              web_front_build,
              web_api_build,
              app_api_build,
            ]

      - use-my-lpa/seed_database:
          name: dev_seed_database
          filters: { branches: { ignore: [master] } }
          requires: [dev_apply_environment_terraform]

      - use-my-lpa/run_behave_suite:
          name: dev_run_behave_tests
          filters: { branches: { ignore: [master] } }
          requires: [dev_seed_database]

      - slack_notify_domain:
          name: post_environment_domains
          filters: { branches: { ignore: [master] } }
          requires: [dev_run_behave_tests]

      - hold-for-destruction:
          name: hold_env_for_destruction
          type: approval
          filters: { branches: { ignore: [master] } }
          requires: [dev_run_behave_tests]

      - use-my-lpa/destroy_dev_environment:
          name: dev_destroy_environment
          filters: { branches: { ignore: [master] } }
          requires: [hold_env_for_destruction]

      # Provision and test preproduction
      - use-my-lpa/apply_shared_terraform:
          name: preprod_apply_shared_terraform
          workspace: preproduction
          filters: { branches: { only: [master] } }

      - use-my-lpa/apply_environment_terraform:
          name: preprod_apply_environment_terraform
          workspace: preproduction
          filters: { branches: { only: [master] } }
          requires:
            [
              preprod_apply_shared_terraform,
              app_front_build,
              web_front_build,
              web_api_build,
              app_api_build,
            ]

      - use-my-lpa/seed_database:
          name: preprod_seed_database
          #workspace: preproduction   # Not needed as the target account is within the config file.
          filters: { branches: { only: [master] } }
          requires: [preprod_apply_environment_terraform]

      - use-my-lpa/run_behave_suite:
          name: preprod_run_behave_tests
          workspace: preproduction
          filters: { branches: { only: [master] } }
          requires: [preprod_seed_database]

      # Provision and test production
      - use-my-lpa/apply_shared_terraform:
          name: production_apply_shared_terraform
          workspace: production
          filters: { branches: { only: [master] } }
          requires: [preprod_run_behave_tests]
      - use-my-lpa/apply_environment_terraform:
          name: production_apply_environment_terraform
          workspace: production
          filters: { branches: { only: [master] } }
          requires:
            [
              production_apply_shared_terraform,
              app_front_build,
              web_front_build,
              web_api_build,
              app_api_build,
            ]

      - use-my-lpa/run_healthcheck_test:
          name: prod_run_healthcheck_test
          filters: { branches: { only: [master] } }
          requires: [production_apply_environment_terraform]

      - slack_notify_production_release:
          name: post_production_release_message
          filters: { branches: { only: [master] } }
          requires: [prod_run_healthcheck_test]

orbs:
  slack: circleci/slack@3.3.0
  use-my-lpa:
    commands:
      install_aws_cli:
        steps:
          - run:
              name: Install AWS CLI
              command: sudo pip3 install awscli --upgrade
      install_webdriver:
        steps:
          - run:
              name: Install WebDriver
              command: |
                wget https://github.com/mozilla/geckodriver/releases/download/v0.23.0/geckodriver-v0.23.0-linux64.tar.gz
                sudo sh -c 'tar -x geckodriver -zf geckodriver-v0.23.0-linux64.tar.gz -O > /usr/bin/geckodriver'
                sudo chmod +x /usr/bin/geckodriver
                rm geckodriver-v0.23.0-linux64.tar.gz
      ecr_login:
        steps:
          - run:
              name: Login to ECR
              command: |
                temp_role=$(aws sts assume-role --role-arn arn:aws:iam::311462405659:role/opg-use-an-lpa-ci --role-session-name ci)
                export AWS_ACCESS_KEY_ID=$(echo $temp_role | jq .Credentials.AccessKeyId | xargs)
                export AWS_SECRET_ACCESS_KEY=$(echo $temp_role | jq .Credentials.SecretAccessKey | xargs)
                export AWS_SESSION_TOKEN=$(echo $temp_role | jq .Credentials.SessionToken | xargs)
                eval $(aws ecr get-login --no-include-email --region=eu-west-1)

    executors:
      python:
        docker: [image: circleci/python]
      python-browsers:
        docker: [image: circleci/python:3.6-stretch-browsers]
      terraform:
        docker: [image: hashicorp/terraform:0.12.8]

    jobs:
      #----------------------------------------------------
      # Front Services (Actor & Viewer)

      docker_build_front_app:
        #
        # Build Docker container for Front App
        #   and runs the Unit Tests.
        #
        executor: python
        parameters:
          container_repo_url:
            type: string
            default: 311462405659.dkr.ecr.eu-west-1.amazonaws.com/use_an_lpa/front_app
        steps:
          - checkout
          - install_aws_cli
          - setup_remote_docker:
              version: 18.06.0-ce
              docker_layer_caching: false
          - run:
              name: Build
              command: |
                docker build --file service-front/docker/app/Dockerfile --tag front-app:latest .
          - run:
              name: Run unit tests
              command: |
                docker run -d --name tests front-app:latest
                docker exec tests docker-php-ext-enable xdebug
                docker exec tests /app/vendor/bin/phpunit
          - run:
              name: Fetch test results
              command: |
                mkdir -p build/service-front
                docker cp tests:/app/build/reports build/service-front/phpunit
              when: always
          - store_test_results:
              path: build/service-front/
          - store_artifacts:
              path: build/service-front/
          - persist_to_workspace:
              root: build
              paths:
                - service-front/
              when: always
          - ecr_login
          - run:
              name: Push container
              command: |
                export SHORT_HASH=${CIRCLE_SHA1:0:7} >> $BASH_ENV

                docker tag front-app:latest << parameters.container_repo_url >>:latest
                docker tag front-app:latest << parameters.container_repo_url >>:$CIRCLE_BRANCH-$SHORT_HASH

                if [ "${CIRCLE_BRANCH}" == "master" ]; then
                  # We want all of the tags pushed
                  docker push << parameters.container_repo_url >>
                else
                  docker push << parameters.container_repo_url >>:$CIRCLE_BRANCH-$SHORT_HASH
                fi

      docker_build_front_web:
        #
        # Build Docker container for Front Web
        #
        executor: python
        parameters:
          container_repo_url:
            type: string
            default: 311462405659.dkr.ecr.eu-west-1.amazonaws.com/use_an_lpa/front_web
        steps:
          - checkout
          - install_aws_cli
          - setup_remote_docker:
              version: 18.06.0-ce
              docker_layer_caching: false
          - run:
              name: Build
              command: |
                docker build --file service-front/docker/web/Dockerfile --tag front-web:latest .
          - ecr_login
          - run:
              name: Push container
              command: |
                export SHORT_HASH=${CIRCLE_SHA1:0:7} >> $BASH_ENV

                docker tag front-web:latest << parameters.container_repo_url >>:latest
                docker tag front-web:latest << parameters.container_repo_url >>:$CIRCLE_BRANCH-$SHORT_HASH

                if [ "${CIRCLE_BRANCH}" == "master" ]; then
                  # We want all of the tags pushed
                  docker push << parameters.container_repo_url >>
                else
                  docker push << parameters.container_repo_url >>:$CIRCLE_BRANCH-$SHORT_HASH
                fi

      #----------------------------------------------------
      # API Service

      docker_build_api_app:
        #
        # Build Docker container for API App
        #   and runs the Unit Tests.
        #
        executor: python
        parameters:
          container_repo_url:
            type: string
            default: 311462405659.dkr.ecr.eu-west-1.amazonaws.com/use_an_lpa/api_app
        steps:
          - checkout
          - install_aws_cli
          - setup_remote_docker:
              version: 18.06.0-ce
              docker_layer_caching: false
          - run:
              name: Build
              command: |
                docker build --file service-api/docker/app/Dockerfile --tag api-app:latest .
          - run:
              name: Run unit tests
              command: |
                docker run -d --name tests api-app:latest
                docker exec tests docker-php-ext-enable xdebug
                docker exec tests /app/vendor/bin/phpunit
          - run:
              name: Fetch test results
              command: |
                mkdir -p build/service-api
                docker cp tests:/app/build/reports build/service-api/phpunit
              when: always
          - store_test_results:
              path: build/service-api/
          - store_artifacts:
              path: build/service-api/
          - persist_to_workspace:
              root: build
              paths:
                - service-api/
              when: always
          - ecr_login
          - run:
              name: Push container
              command: |
                export SHORT_HASH=${CIRCLE_SHA1:0:7} >> $BASH_ENV

                docker tag api-app:latest << parameters.container_repo_url >>:latest
                docker tag api-app:latest << parameters.container_repo_url >>:$CIRCLE_BRANCH-$SHORT_HASH

                if [ "${CIRCLE_BRANCH}" == "master" ]; then
                  # We want all of the tags pushed
                  docker push << parameters.container_repo_url >>
                else
                  docker push << parameters.container_repo_url >>:$CIRCLE_BRANCH-$SHORT_HASH
                fi

      docker_build_api_web:
        #
        # Build Docker container for API Web
        #
        executor: python
        parameters:
          container_repo_url:
            type: string
            default: 311462405659.dkr.ecr.eu-west-1.amazonaws.com/use_an_lpa/api_web
        steps:
          - checkout
          - install_aws_cli
          - setup_remote_docker:
              version: 18.06.0-ce
              docker_layer_caching: false
          - run:
              name: Build
              command: |
                docker build --file service-api/docker/web/Dockerfile --tag api-web:latest .
          - ecr_login
          - run:
              name: Push container
              command: |
                export SHORT_HASH=${CIRCLE_SHA1:0:7} >> $BASH_ENV

                docker tag api-web:latest << parameters.container_repo_url >>:latest
                docker tag api-web:latest << parameters.container_repo_url >>:$CIRCLE_BRANCH-$SHORT_HASH

                if [ "${CIRCLE_BRANCH}" == "master" ]; then
                  # We want all of the tags pushed
                  docker push << parameters.container_repo_url >>
                else
                  docker push << parameters.container_repo_url >>:$CIRCLE_BRANCH-$SHORT_HASH
                fi

      docker_build_pdf:
        #
        # Build Docker container for PDF Generator
        #   and runs the Unit Tests.
        #
        executor: python
        parameters:
          container_repo_url:
            type: string
            default: 311462405659.dkr.ecr.eu-west-1.amazonaws.com/use_an_lpa/pdf
        steps:
          - checkout
          - install_aws_cli
          - setup_remote_docker:
              version: 18.06.0-ce
              docker_layer_caching: false
          - run:
              name: Build
              command: |
                docker build --file pdf/docker/app/Dockerfile --tag pdf:latest .
          - ecr_login
          - run:
              name: Push container
              command: |
                export SHORT_HASH=${CIRCLE_SHA1:0:7} >> $BASH_ENV

                docker tag pdf:latest << parameters.container_repo_url >>:latest
                docker tag pdf:latest << parameters.container_repo_url >>:$CIRCLE_BRANCH-$SHORT_HASH

                if [ "${CIRCLE_BRANCH}" == "master" ]; then
                  # We want all of the tags pushed
                  docker push << parameters.container_repo_url >>
                else
                  docker push << parameters.container_repo_url >>:$CIRCLE_BRANCH-$SHORT_HASH
                fi

      # Code Coverage

      codecov_php-unit_upload:
        #
        # Upload all php-unit test results
        #   to Codecov.
        #
        executor: python
        steps:
          - checkout
          - attach_workspace:
              at: build
          - run:
              name: Upload to Codecov
              command: bash <(curl -s https://codecov.io/bash) -t $CODECOV_TOKEN || echo 'Codecov upload failed'
      #----------------------------------------------------
      # Terraform

      lint_terraform:
        #
        # Lint the Terraform
        #
        executor: terraform
        parameters:
          workspace:
            description: Terraform workspace name
            type: string
            default: "${CIRCLE_PULL_REQUEST##*/}-${CIRCLE_BRANCH//[-_]/}"
          container_version:
            description: Container version
            type: string
            default: ${CIRCLE_BRANCH}-${CIRCLE_BUILD_NUM}
        steps:
          - checkout
          - run:
              name: Lint Shared Terraform
              command: |
                terraform --version
                cd ~/project/terraform/account
                terraform init -lock-timeout=300s
                export TF_WORKSPACE=development >> $BASH_ENV
                echo $TF_WORKSPACE
                terraform validate
          - run:
              name: Lint Environment Terraform
              command: |
                ENV_NAME=<<parameters.workspace>>
                export SHORT_HASH=${CIRCLE_SHA1:0:7} >> $BASH_ENV
                echo $SHORT_HASH
                cd ~/project/terraform/environment
                terraform init -lock-timeout=300s
                export TF_WORKSPACE=${ENV_NAME:0:13} >> $BASH_ENV
                echo $TF_WORKSPACE
                terraform validate -var container_version=$CIRCLE_BRANCH-$SHORT_HASH

      apply_shared_terraform:
        #
        # Apply the shared terraform configuration. This:
        #   - Updates the shared infrastructure;
        #
        executor: terraform
        parameters:
          workspace:
            description: Terraform workspace name
            type: string
            default: development
        environment:
          TF_WORKSPACE: "<<parameters.workspace>>"
        steps:
          - checkout
          - run:
              name: Apply Shared Terraform
              command: |
                cd ~/project/terraform/account
                terraform init -lock-timeout=300s
                terraform apply -lock-timeout=300s --auto-approve
      apply_environment_terraform:
        #
        # Apply the environment terraform configuration. This:
        #   - Updates per environment infrastructure; and
        #   - Triggers a deploy of the updated container (if changed)
        #
        executor: terraform
        parameters:
          workspace:
            description: Terraform workspace name
            type: string
            default: "${CIRCLE_PULL_REQUEST##*/}-${CIRCLE_BRANCH//[-_]/}"
        steps:
          - checkout
          - run:
              name: Apply Environment Terraform
              command: |
                ENV_NAME=<<parameters.workspace>>
                export SHORT_HASH=${CIRCLE_SHA1:0:7} >> $BASH_ENV
                echo $SHORT_HASH
                cd ~/project/terraform/environment
                terraform init -lock-timeout=300s
                export TF_WORKSPACE=${ENV_NAME:0:13} >> $BASH_ENV
                echo $TF_WORKSPACE
                terraform apply -lock-timeout=300s --auto-approve -var container_version=$CIRCLE_BRANCH-$SHORT_HASH
                mv cluster_config.json /tmp/
          - persist_to_workspace:
              root: /tmp
              paths:
                - cluster_config.json

      destroy_dev_environment:
        #
        # Destroys a development environment after testing and approval
        #
        executor: terraform
        parameters:
          workspace:
            description: Terraform workspace name
            type: string
            default: "${CIRCLE_PULL_REQUEST##*/}-${CIRCLE_BRANCH//[-_]/}"
        steps:
          - checkout
          - run:
              name: Destroy Development Environment
              command: |
                ENV_NAME=<<parameters.workspace>>
                export TF_WORKSPACE=${ENV_NAME:0:13} >> $BASH_ENV
                echo $TF_WORKSPACE
                if [ "${CIRCLE_BRANCH}" != "master" ]; then
                  cd ~/project/terraform/environment
                  terraform init -lock-timeout=300s
                  export TF_WORKSPACE=${ENV_NAME:0:13} >> $BASH_ENV
                  echo $TF_WORKSPACE
                  terraform destroy -lock-timeout=300s -auto-approve
                fi

      #----------------------------------------------------
      # Seeding

      seed_database:
        #
        # Seed database with test data
        #
        executor: python
        steps:
          - checkout
          - attach_workspace:
              at: /tmp
          - run:
              name: Seed DynamoDB
              command: |
                sudo pip3 install boto3
                export AWS_ACCOUNT_ID=$(cat /tmp/cluster_config.json | jq .account_id | xargs)
                export DYNAMODB_TABLE_ACTOR_CODES=$(cat /tmp/cluster_config.json | jq .actor_lpa_codes_table | xargs)
                export DYNAMODB_TABLE_VIEWER_CODES=$(cat /tmp/cluster_config.json | jq .viewer_codes_table | xargs)
                python service-api/seeding/dynamodb.py

      #----------------------------------------------------
      # Tests

      run_behave_suite:
        #
        # Run the full set of functional tests
        #
        executor: python-browsers
        parameters:
          workspace:
            description: Terraform workspace name
            type: string
            default: "${CIRCLE_PULL_REQUEST##*/}-${CIRCLE_BRANCH//[-_]/}"
        steps:
          - checkout
          - install_webdriver
          - attach_workspace:
              at: /tmp
          - run:
              name: Wait for new tasks in services to be running
              command: |
                sudo pip3 install boto3 -q
                python pipeline_scripts/aws_ecs_task.py /tmp/cluster_config.json
          - run:
              name: Install Behave
              command: sudo pip3 install behave selenium --upgrade
          - run:
              name: Allow CircleCI ingress to environment
              command: |
                ENV_NAME=<<parameters.workspace>>
                export TF_WORKSPACE=${ENV_NAME:0:13} >> $BASH_ENV
                echo $TF_WORKSPACE
                if [ "${TF_WORKSPACE}" != "production" ]; then
                  python pipeline_scripts/ci_ingress.py /tmp/cluster_config.json --add
                fi

          - run:
              name: Run suite
              command: |
                ENV_NAME=<<parameters.workspace>>
                export TF_WORKSPACE=${ENV_NAME:0:13} >> $BASH_ENV
                echo $TF_WORKSPACE
                export SHORT_HASH=${CIRCLE_SHA1:0:7} >> $BASH_ENV
                echo $SHORT_HASH
                behave -v --logging-level DEBUG
          - store_artifacts:
              path: features/failed_scenarios_screenshots
          - run:
              name: Remove CircleCI ingress to environment
              command: |
                ENV_NAME=<<parameters.workspace>>
                export TF_WORKSPACE=${ENV_NAME:0:13} >> $BASH_ENV
                echo $TF_WORKSPACE
                python pipeline_scripts/ci_ingress.py /tmp/cluster_config.json
              when: always

      run_healthcheck_test:
        #
        # Checks the health check is returning 200
        #
        executor: python
        steps:
          - checkout
          - install_webdriver
          - attach_workspace:
              at: /tmp
          - run:
              name: Wait for new tasks in services to be running
              command: |
                sudo pip3 install boto3
                python pipeline_scripts/aws_ecs_task.py /tmp/cluster_config.json
          - run:
              name: Run test
              command: |
                viewer_fqdn=$(cat /tmp/cluster_config.json | jq .viewer_fqdn | xargs)
                viewer_response=$(curl --write-out %{http_code} --silent --output /dev/null https://$viewer_fqdn/healthcheck)
                [[ $viewer_response == 200 ]] || (echo "Error with viewer health check. HTTP status: ${viewer_response}" && exit 1)

                actor_fqdn=$(cat /tmp/cluster_config.json | jq .actor_fqdn | xargs)
                # TODO Add for actor when endpoint exists.
jobs:
  slack_notify_domain:
    docker:
      - image: circleci/python
    steps:
      - checkout
      - attach_workspace:
          at: /tmp
      - run:
          name: Get URLs
          command: |
            echo 'export VIEW_DOMAIN="$(jq -r .viewer_fqdn /tmp/cluster_config.json)"' >> $BASH_ENV
            echo 'export USE_DOMAIN="$(jq -r .actor_fqdn /tmp/cluster_config.json)"' >> $BASH_ENV
      - slack/notify:
          title: "Use a Lasting Power of Attorney Development Environment Ready"
          message: "User: $CIRCLE_USERNAME \nview url: https://$VIEW_DOMAIN \nuse url: https://$USE_DOMAIN"
  slack_notify_production_release:
    docker:
      - image: circleci/python
    steps:
      - checkout
      - attach_workspace:
          at: /tmp
      - run:
          name: Get URLs
          command: |
            echo 'export VIEW_DOMAIN="$(jq -r .viewer_fqdn /tmp/cluster_config.json)"' >> $BASH_ENV
            echo 'export USE_DOMAIN="$(jq -r .actor_fqdn /tmp/cluster_config.json)"' >> $BASH_ENV
      - slack/notify:
          title: "Use a Lasting Power of Attorney Production Release Successful"
          message: "User: $CIRCLE_USERNAME \nview url: https://$VIEW_DOMAIN \nuse url: https://$USE_DOMAIN"
          webhook: ${PROD_RELEASE_SLACK_WEBHOOK}