.drone.yml

# Copyright (c) 2022 SIGHUP s.r.l All rights reserved.
# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE file.

name: license
kind: pipeline
type: docker

steps:
  - name: check
    image: docker.io/library/golang:1.17.3
    pull: always
    commands:
      - go get -u github.com/google/addlicense
      - addlicense -c "SIGHUP s.r.l" -v -l bsd -check -ignore 'chart/**' .
trigger:
  ref:
    exclude:
      - refs/tags/gatekeeper-policy-manager-*

---
name: policeman
kind: pipeline
type: docker

depends_on:
  - license

steps:
  - name: lint
    image: quay.io/sighup/policeman
    pull: always
    environment:
      FILTER_REGEX_EXCLUDE: (app/static-content/semantic.min.css|chart/|tests/e2e/)
      # Identifies false positives like missing 'selector'.
      # Doing this is valid for Kustomize patches
      VALIDATE_KUBERNETES_KUBEVAL: "false"
      # Some duplicated code is intended.
      VALIDATE_JSCPD: "false"
      TYPESCRIPT_DEFAULT_STYLE: "prettier"
    depends_on:
      - clone

  - name: render
    image: quay.io/sighup/e2e-testing:1.1.0_0.2.2_2.16.1_1.9.4_1.22.0_3.8.7_2.4.1
    pull: always
    depends_on:
      - clone
    commands:
      - kustomize build . > gpm.yml

  - name: check-deprecated-apis
    image: us-docker.pkg.dev/fairwinds-ops/oss/pluto:v5
    pull: always
    depends_on:
      - render
    commands:
      # we use --ignore-deprecations because we don't want the CI to fail when the API has not been removed yet.
      - /pluto detect gpm.yml --ignore-deprecations --target-versions=k8s=v1.29.0

trigger:
  ref:
    exclude:
      - refs/tags/gatekeeper-policy-manager-*

---
name: build
kind: pipeline
type: docker

depends_on:
  - policeman

trigger:
  ref:
    include:
      - refs/tags/**
      - refs/heads/**
    exclude:
      - refs/tags/gatekeeper-policy-manager-*

steps:
  - name: build
    image: docker:dind
    pull: always
    environment:
      CONTAINER_IMAGE_NAME: gatekeeper-policy-manager
      CONTAINER_IMAGE_TAG: test-${DRONE_BUILD_NUMBER}
      DOCKERFILE: Dockerfile
      BUILD_CONTEXT: "."
    volumes:
      - name: dockerconfig
        path: /root/.docker/config.json
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - docker build
        --pull=true
        --rm=true
        -f $${DOCKERFILE}
        -t $${CONTAINER_IMAGE_NAME}:$${CONTAINER_IMAGE_TAG}
        $${BUILD_CONTEXT}

volumes:
  - name: dockerconfig
    host:
      path: /root/.docker/config.json
  - name: dockersock
    host:
      path: /var/run/docker.sock

---
name: e2e
kind: pipeline
type: docker

depends_on:
  - build

trigger:
  ref:
    include:
      - refs/tags/**
      - refs/heads/main
      - refs/heads/snyk-**
      - refs/heads/dependabot/**
    exclude:
      - refs/tags/gatekeeper-policy-manager-*

steps:
  - name: kind
    image: docker:dind
    pull: always
    environment:
      KIND_VERSION: v0.20.0
      CLUSTER_VERSION: v1.29.0
      LOAD_IMAGE: gatekeeper-policy-manager:test-${DRONE_BUILD_NUMBER}
      CLUSTER_NAME: ${DRONE_REPO_NAME}-${DRONE_BUILD_NUMBER}
    volumes:
      - name: dockerconfig
        path: /root/.docker/config.json
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - wget -qO /usr/local/bin/kind "https://kind.sigs.k8s.io/dl/$${KIND_VERSION}/kind-$(uname)-amd64"
      - wget -qO /usr/local/bin/kubectl "https://storage.googleapis.com/kubernetes-release/release/$${CLUSTER_VERSION}/bin/linux/amd64/kubectl"
      - chmod +x /usr/local/bin/kind /usr/local/bin/kubectl
      - kind create cluster --name $${CLUSTER_NAME} --image registry.sighup.io/fury/kindest/node:$${CLUSTER_VERSION}
      - kind load docker-image $${LOAD_IMAGE} --name $${CLUSTER_NAME}
      - kind get kubeconfig --name $${CLUSTER_NAME} > kubeconfig.yml

  - name: tests
    image: quay.io/sighup/e2e-testing:1.1.0_0.7.0_3.1.1_1.9.4_1.24.1_3.8.7_4.21.1
    pull: always
    network_mode: host
    environment:
      LOAD_IMAGE: gatekeeper-policy-manager:test-${DRONE_BUILD_NUMBER}
    commands:
      - export KUBECONFIG=$PWD/kubeconfig.yml
      - cd tests
      - kustomize edit set image quay.io/sighup/gatekeeper-policy-manager=$${LOAD_IMAGE}
      - cd -
      - bats -t tests/tests.sh

  - name: gpm-port-forward
    image: quay.io/sighup/e2e-testing:1.1.0_0.7.0_3.1.1_1.9.4_1.24.1_3.8.7_4.21.1
    pull: always
    network_mode: host
    detach: true
    commands:
      - export KUBECONFIG=$PWD/kubeconfig.yml
      - kubectl port-forward svc/gatekeeper-policy-manager 8080:80 -n gatekeeper-system

  - name: ui-tests
    image: mcr.microsoft.com/playwright:v1.30.0-focal
    pull: always
    network_mode: host
    commands:
      - cd tests/e2e && yarn install && yarn test

  - name: echo-diff-images
    image: mcr.microsoft.com/playwright:v1.30.0-focal
    commands:
      - for f in tests/e2e/test-results/*/*diff.png; do echo $f; base64 -w 0 $f; echo; done;
      - "echo 'Use base64 to decode the images and see the diff'"
    when:
      status:
        - failure

  - name: kind-destroy
    image: docker:dind
    pull: always
    environment:
      KIND_VERSION: v0.17.0
      CLUSTER_NAME: ${DRONE_REPO_NAME}-${DRONE_BUILD_NUMBER}
    volumes:
      - name: dockerconfig
        path: /root/.docker/config.json
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - wget -qO /usr/local/bin/kind "https://kind.sigs.k8s.io/dl/$${KIND_VERSION}/kind-$(uname)-amd64"
      - chmod +x /usr/local/bin/kind
      - kind delete cluster --name $${CLUSTER_NAME}
      - rm kubeconfig.yml
    when:
      status:
        - success
        - failure

volumes:
  - name: dockerconfig
    host:
      path: /root/.docker/config.json
  - name: dockersock
    host:
      path: /var/run/docker.sock

---
name: release
kind: pipeline
type: docker

depends_on:
  - license
  - policeman
  - e2e

trigger:
  ref:
    include:
      - refs/tags/**
      - refs/heads/**
    exclude:
      - refs/heads/dependabot/**
      - refs/heads/snyk-**
      - refs/tags/gatekeeper-policy-manager-*

steps:
  - name: prepare-tar-gz
    image: alpine:latest
    pull: always
    depends_on: [clone]
    commands:
      - tar -zcvf gatekeeper-policy-manager-${DRONE_TAG}.tar.gz manifests/ kustomization.yaml LICENSE README.md
    when:
      ref:
        include:
          - refs/tags/**

  - name: prepare-release-notes
    image: quay.io/sighup/fury-release-notes-plugin:3.7_2.8.4
    pull: always
    depends_on: [clone]
    settings:
      release_notes_file_path: release-notes.md
    when:
      ref:
        include:
          - refs/tags/**
        exclude:
          - refs/tags/gatekeeper-policy-manager-*  # Exclude helm chart releases

  - name: registry-sha
    image: docker:dind
    pull: always
    depends_on: [clone]
    environment:
      username:
        from_secret: quay_username
      password:
        from_secret: quay_password
      registry: quay.io
      repo: quay.io/sighup/gatekeeper-policy-manager
      container_image_name: gatekeeper-policy-manager
      container_image_tag: test-${DRONE_BUILD_NUMBER}
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - docker login $${registry} -u $${username} -p $${password}
      - docker tag $${container_image_name}:$${container_image_tag} $${repo}:unstable
      - "docker tag $${container_image_name}:$${container_image_tag} $${repo}:${DRONE_COMMIT_SHA}"
      - docker push $${repo}:unstable
      - "docker push $${repo}:${DRONE_COMMIT_SHA}"
      - docker rmi $${container_image_name}:$${container_image_tag}
    when:
      event:
        - push

  - name: registry-tag
    image: docker:dind
    pull: always
    depends_on: [clone]
    environment:
      username:
        from_secret: quay_username
      password:
        from_secret: quay_password
      registry: quay.io
      repo: quay.io/sighup/gatekeeper-policy-manager
      container_image_name: gatekeeper-policy-manager
      container_image_tag: test-${DRONE_BUILD_NUMBER}
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - docker login $${registry} -u $${username} -p $${password}
      - docker tag $${container_image_name}:$${container_image_tag} $${repo}:latest
      - "docker tag $${container_image_name}:$${container_image_tag} $${repo}:${DRONE_TAG}"
      - docker push $${repo}:latest
      - "docker push $${repo}:${DRONE_TAG}"
      - docker rmi $${container_image_name}:$${container_image_tag}
    when:
      event:
        - tag

  - name: publish-prerelease
    image: plugins/github-release
    pull: always
    depends_on:
      - prepare-tar-gz
      - prepare-release-notes
      - registry-tag
    settings:
      api_key:
        from_secret: c3p0
      file_exists: overwrite
      files:
        - gatekeeper-policy-manager-${DRONE_TAG}.tar.gz
      prerelease: true
      overwrite: true
      title: "Release Candidate ${DRONE_TAG}"
      note: release-notes.md
      checksum:
        - md5
        - sha256
    when:
      ref:
        include:
          - refs/tags/v**-rc**

  - name: publish-stable
    image: plugins/github-release
    pull: always
    depends_on:
      - prepare-tar-gz
      - prepare-release-notes
      - registry-tag
    settings:
      api_key:
        from_secret: c3p0
      file_exists: overwrite
      files:
        - gatekeeper-policy-manager-${DRONE_TAG}.tar.gz
      prerelease: false
      overwrite: true
      title: "Release ${DRONE_TAG}"
      note: release-notes.md
      checksum:
        - md5
        - sha256
    when:
      ref:
        exclude:
          - refs/tags/v**-rc**
        include:
          - refs/tags/v**

volumes:
  - name: dockersock
    host:
      path: /var/run/docker.sock

---
name: release-helm-chart
kind: pipeline
type: docker

depends_on:
  - "release"

trigger:
  ref:
    include:
      # Trigger the Helm Chart Releaser only when tagging
      - refs/tags/**
    exclude:
      # These kind of tags are generated by `cr` in this pipeline
      # we exclude them to avoid a loop.
      - refs/tags/gatekeeper-policy-manager-*

steps:
  # We need to manually fetch the gh-pages branch because Drone by default
  # only checksout the current branch with a minimal depth
  # see: https://docs.drone.io/pipeline/docker/syntax/cloning/
  - name: fetch-gh-pages-branch
    image: alpine/git
    commands:
      - git fetch origin gh-pages

  # We use GitHub Pages as Helm Repository and `cr` (Chart Releaser)
  # to help us publish the chart.
  - name: chart-releaser
    image: quay.io/helmpack/chart-releaser:v1.4.0
    environment:
      CR_OWNER: sighupio
      CR_GIT_REPO: gatekeeper-policy-manager
      CR_TOKEN:
        from_secret: c3p0
    commands:
      # For some reason we need to manually create the folder each time
      # see: https://github.com/helm/chart-releaser/issues/187
      - mkdir -p .cr-index
      # Package the chart into a tar.gz
      - cr package ./chart
      # Upload the tar.gz to a GitHub release
      - cr upload --skip-existing
      # Update the index.yaml and push it to GitHub Pages
      - cr index --push