.gitlab-ci.yml

include:
  - template: Auto-DevOps.gitlab-ci.yml

###################################
##   Global Workflow Variables   ##
###################################
variables:
  IMAGE_TAG_RELEASE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: "/certs"
  DOCKER_HOST: tcp://docker:2376
  DOCKER_TLS_VERIFY: 1
  DOCKER_CERT_PATH: "/certs/client"
  GIT_DEPTH: "5"
  THEME_DIRECTORY: "docroot/themes/custom/NAMEOFTHEME"
  TEST_DISABLED: "true"
  CODE_QUALITY_DISABLED: "true"
  LICENSE_MANAGEMENT_DISABLED: "true"
  BROWSER_PERFORMANCE_DISABLED: "true"
  LOAD_PERFORMANCE_DISABLED: "true"
  SAST_DISABLED: "true"
  SECRET_DETECTION_DISABLED: "true"
  DEPENDENCY_SCANNING_DISABLED: "true"
  CONTAINER_SCANNING_DISABLED: "true"
  DAST_DISABLED: "true"
  CODE_INTELLIGENCE_DISABLED: "true"
  POSTGRES_ENABLED: "false"

.base:
  # See https://gitlab.com/gitlab-org/cluster-integration/cluster-applications/
  image: "registry.gitlab.com/gitlab-org/cluster-integration/cluster-applications:v2.0.0"
  before_script:
    - chmod 400 "$KUBECONFIG"   # Workaround for https://gitlab.com/gitlab-org/gitlab/-/issues/327912
    - gl-use-kube-context

#########################
##   Workflow Stages   ##
#########################
stages:
  - prepare
  - lint
  - build
  - test
  - deploy  # dummy stage to follow the template guidelines
  - review
  - dast
  - staging
  - canary
  - production
  - incremental rollout 10%
  - incremental rollout 25%
  - incremental rollout 50%
  - incremental rollout 100%
  - performance
  - cleanup

#################
##   Anchors   ##
#################
.before_script:
  before_script: &before_script
    - until docker info; do sleep 1; done
    - echo "$DOCKER_REGISTRY_PASSWORD" | docker login -u "$DOCKER_REGISTRY_USER" --password-stdin
    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY

.composer-cache:
  cache: &composer_cache
    key: $CI_COMMIT_REF_SLUG
    paths:
      - vendor/
    policy: pull-push

.node-cache:
  cache: &node_cache
    key: $CI_COMMIT_REF_SLUG
    paths:
      - $THEME_DIRECTORY/node_modules/
    policy: pull-push


#####################
##   Preparation   ##
#####################
php-prepare:
  image: fabean/pipeline-server:php8.2-node18
  stage: prepare
  tags:
    - kubernetes
    - cluster
  script:
    - composer install
  cache:
    - <<: *composer_cache
      policy: pull-push
  rules:
    - if: '$BUILD_DISABLED'
      when: never
    - if: '$AUTO_DEVOPS_PLATFORM_TARGET == "EC2"'
      when: never
    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'

node-prepare:
  image: node:18-alpine
  stage: prepare
  tags:
    - kubernetes
    - cluster
  script:
    - cd $THEME_DIRECTORY
    - yarn install
  cache:
    - <<: *node_cache
      policy: pull-push
  rules:
    - if: '$BUILD_DISABLED'
      when: never
    - if: '$AUTO_DEVOPS_PLATFORM_TARGET == "EC2"'
      when: never
    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'


##############################
##   Drupal Rector Checks   ##
##############################
drupal-rector-theme:
  image: fabean/pipeline-server:php8.2-node18
  services:
    - docker:dind
  stage: lint
  tags:
    - kubernetes
    - cluster
  script:
    - composer install
    - vendor/bin/rector process ./docroot/themes/custom/  --dry-run
  cache:
    - <<: *composer_cache
  rules:
    - if: '$BUILD_DISABLED'
      when: never
    - if: '$AUTO_DEVOPS_PLATFORM_TARGET == "EC2"'
      when: never
    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'
      needs: ["php-prepare"]

drupal-rector-modules:
  image: fabean/pipeline-server:php8.2-node18
  stage: lint
  tags:
    - kubernetes
    - cluster
  script:
    - composer install
    - vendor/bin/rector process ./docroot/modules/custom/  --dry-run
  cache:
    - <<: *composer_cache
  rules:
    - if: '$BUILD_DISABLED'
      when: never
    - if: '$AUTO_DEVOPS_PLATFORM_TARGET == "EC2"'
      when: never
    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'
      needs: ["php-prepare"]


######################
##   Code Linting   ##
######################
php-lint:
  image: fabean/pipeline-server:php8.2-node18
  stage: lint
  tags:
    - kubernetes
    - cluster
  script:
    - composer install
    - vendor/bin/phpcs --standard=Drupal --extensions=php,module,inc,install,test,profile,theme,md,yml --ignore=node_modules,bower_components,vendor,dist ./docroot/modules/custom/
  cache:
    - <<: *composer_cache
  rules:
    - if: '$BUILD_DISABLED'
      when: never
    - if: '$AUTO_DEVOPS_PLATFORM_TARGET == "EC2"'
      when: never
    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'
      needs: ["php-prepare"]

php-lint-theme:
  image: fabean/pipeline-server:php8.2-node18
  stage: lint
  tags:
    - kubernetes
    - cluster
  script:
    - composer install
    - vendor/bin/phpcs --standard=Drupal --extensions=php,module,inc,install,test,profile,theme,md,yml --ignore=node_modules,bower_components,vendor,dist ./docroot/themes/custom/
  cache:
    - <<: *composer_cache
  rules:
    - if: '$BUILD_DISABLED'
      when: never
    - if: '$AUTO_DEVOPS_PLATFORM_TARGET == "EC2"'
      when: never
    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'
      needs: ["php-prepare"]

theme-lint-frontend:
  image: fabean/pipeline-server:php8.2-node18
  stage: lint
  tags:
    - kubernetes
    - cluster
  script:
    - cd $THEME_DIRECTORY
    - npm install -g yarn
    - yarn install
    - yarn lint
  cache:
    - <<: *node_cache
  rules:
    - if: '$BUILD_DISABLED'
      when: never
    - if: '$AUTO_DEVOPS_PLATFORM_TARGET == "EC2"'
      when: never
    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'
      needs: ["node-prepare"]

##############################
##   Auto DevOps Pipeline   ##
##############################
.auto-deploy:
  image: "registry.gitlab.com/gitlab-org/cluster-integration/auto-deploy-image:latest"
  tags:
    - kubernetes
    - cluster
  before_script:
    - helm repo add --username gitlab-ci-token --password $CI_JOB_TOKEN koality-charts $CI_API_V4_URL/projects/632/packages/helm/stable


build:
  variables:
    DOCKER_TLS_CERTDIR: "/certs"
  tags:
    - kubernetes
    - cluster
  before_script: *before_script
  cache:
    - <<: *node_cache
    - <<: *composer_cache
  rules:
    - if: '$BUILD_DISABLED'
      when: never
    - if: '$AUTO_DEVOPS_PLATFORM_TARGET == "EC2"'
      when: never
    - if: '$CI_COMMIT_BRANCH || $CI_COMMIT_TAG'
      needs: ["php-lint", "php-lint-theme", drupal-rector-theme, "drupal-rector-modules", "theme-lint-frontend"]

build-cron:
  extends: build
  script:
    - |
      if [[ -z "$CI_COMMIT_TAG" ]]; then
        export CI_APPLICATION_REPOSITORY=${CI_APPLICATION_REPOSITORY:-$CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG}/cron
        export CI_APPLICATION_TAG=${CI_APPLICATION_TAG:-$CI_COMMIT_SHA}
      else
        export CI_APPLICATION_REPOSITORY=${CI_APPLICATION_REPOSITORY:-$CI_REGISTRY_IMAGE}/cron
        export CI_APPLICATION_TAG=${CI_APPLICATION_TAG:-$CI_COMMIT_TAG}
      fi
    - /build/build.sh
  rules:
    - if: '$BUILD_DISABLED'
      when: never
    - if: '$AUTO_DEVOPS_PLATFORM_TARGET == "EC2"'
      when: never
    - if: '$CI_COMMIT_BRANCH || $CI_COMMIT_TAG'
      needs: ["php-lint", "php-lint-theme", drupal-rector-theme, "drupal-rector-modules", "theme-lint-frontend"]

review:
  extends: .auto-deploy
  stage: review
  tags:
    - kubernetes
    - cluster
  script:
    - auto-deploy check_kube_domain
    - auto-deploy download_chart
    - auto-deploy use_kube_context
    - auto-deploy ensure_namespace
    - auto-deploy initialize_tiller
    - auto-deploy create_secret
    - auto-deploy deploy
    - auto-deploy persist_environment_url
  environment:
    name: review/$CI_COMMIT_REF_NAME
    url: http://$CI_PROJECT_ID-$CI_ENVIRONMENT_SLUG.$KUBE_INGRESS_BASE_DOMAIN
    on_stop: stop_review
    auto_stop_in: '1 week'
  artifacts:
    paths: [environment_url.txt, tiller.log]
    when: always
  rules:
    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
      when: never
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: never
    - if: '$REVIEW_DISABLED'
      when: never
    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'
      when: manual
      needs: ["build", "build-cron"]

stop review:
  extends: .auto-deploy
  stage: cleanup
  tags:
    - kubernetes
    - cluster
  variables:
    GIT_STRATEGY: none
  script:
    - auto-deploy use_kube_context
    - auto-deploy initialize_tiller
    - auto-deploy delete
  environment:
    name: review/$CI_COMMIT_REF_NAME
    action: stop
  allow_failure: true
  rules:
    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
      when: never
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: never
    - if: '$REVIEW_DISABLED'
      when: never
    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'
      when: manual
      needs: ["review"]

staging:
  rules:
    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
      when: never
    - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
      when: never
    - if: '$STAGING_ENABLED'
      needs: ["build", "build-cron"]