.gitlab-ci.yml

image: ${DEVOPS_REGISTRY}usgs/centos:latest

cache:
  paths:
    # cache pip installed dependencies, see PIP_CACHE_DIR variable below
    - .cache/pip

stages:
  - test
  - integration
  - scan
  - deploy

variables:
  CI_REGISTRY: ${CODE_REGISTRY}
  CI_REGISTRY_IMAGE: ${CODE_REGISTRY_IMAGE}
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
  TRIVY_VERSION: "0.11.0"
  # docker variables
  DOCKER_DRIVER: overlay2
  FROM_IMAGE: ${CODE_REGISTRY}/devops/images/usgs/centos:7
  # environment variables
  APP_NAME: geomag-algorithms
  DATA_HOST: "cwbpub.cr.usgs.gov"
  DATA_PORT: "2060"
  DATA_TYPE: "edge"

## --------------------------------------------------
# Templates
## --------------------------------------------------

.adjust_image_names:
  before_script:
    - IMAGE_NAME=usgs/${APP_NAME}:${CI_COMMIT_REF_SLUG}
    - IMAGE_NAME=${IMAGE_NAME/:master/:latest}
    - INTERNAL_IMAGE_NAME=${CI_REGISTRY_IMAGE}/${IMAGE_NAME}
    - STACK_NAME=${APP_NAME}

.build_docker_image:
  cache: {}
  extends:
    - .adjust_image_names
  image: docker:19.03-git
  only:
    - master@ghsc/geomag/geomag-algorithms
    - production@ghsc/geomag/geomag-algorithms
    - tags@ghsc/geomag/geomag-algorithms
  script:
    - docker build
      --pull
      --build-arg FROM_IMAGE=${FROM_IMAGE}
      --build-arg GIT_BRANCH_NAME=${CI_COMMIT_REF_NAME}
      --build-arg GIT_COMMIT_SHA=${CI_COMMIT_SHA}
      --tag local/${IMAGE_NAME} .

    - docker tag local/${IMAGE_NAME} ${IMAGE_NAME}
    - docker push ${IMAGE_NAME}
    - docker image rm ${IMAGE_NAME}

    - docker tag local/${IMAGE_NAME} ${INTERNAL_IMAGE_NAME}
    - docker push ${INTERNAL_IMAGE_NAME}
    - docker image rm ${INTERNAL_IMAGE_NAME}
  services:
    - docker:19.03-dind
  stage: integration
  tags:
    - build

.check_code:
  image: ${DEVOPS_REGISTRY}usgs/conda:latest
  script:
    - export PYTHON_VERSION=${PYTHON_VERSION:-3.8}
    - scripts/ci_check_code.sh
  artifacts:
    paths:
      - cov.xml
    reports:
      junit: cov.xml
  stage: test
  tags:
    - development

.deploy:
  cache: {}
  extends:
    - .adjust_image_names
  image: ${CODE_REGISTRY}/ghsc/hazdev/cloud-formation/hazdev-build-runner:latest
  script:
    - git clone ${GENERIC_SWARM_DEPLOY_REPO} generic-deploy
    - cp -v
      generic-deploy/default.config.sh
      generic-deploy/default.funcs.sh
      generic-deploy/deploy.sh
      scripts/.

    - export APP_NAME=${APP_NAME}
    - export IMAGE_NAME=${IMAGE_NAME}
    - export REGISTRY=${CI_REGISTRY_IMAGE}
    - export STACK_NAME=${APP_NAME}
    - ./scripts/deploy.sh
  stage: deploy
  tags:
    - deploy
    - swarm

.deploy-library:
  cache: {}
  image: "docker:stable-git"
  script:
    - PREFIX_LENGTH=${#REQUIRED_PREFIX};
    - if [[ "${APP_DEPLOY_DIR:0:${PREFIX_LENGTH}}" != "${REQUIRED_PREFIX}" ]]; then
        echo "APP_DEPLOY_DIR does not contain correct path";
        exit 255;
      fi
    - if [ ! -d "${APP_DEPLOY_DIR}" ]; then
        cd "$(dirname "${APP_DEPLOY_DIR}")";
        git clone "${CI_REPOSITORY_URL}" "$(basename "${APP_DEPLOY_DIR}")";
      fi
    - cd "${APP_DEPLOY_DIR}";
    - git checkout "${CI_COMMIT_REF_NAME}" || git checkout -b "${CI_COMMIT_REF_NAME}";
    - git pull --ff-only "${CI_REPOSITORY_URL}" "${CI_COMMIT_REF_NAME}";
  stage: deploy
  tags:
    - deploy
    - swarm
  variables:
    APP_DEPLOY_DIR: '/geomag/geomag-algorithms'
    REQUIRED_PREFIX: '/geomag'

.staging:
  only:
    - master@ghsc/geomag/geomag-algorithms
    - tags@ghsc/geomag/geomag-algorithms

.production:
  except:
    - ^.*beta.*$
    - ^.*-rc.*$
  only:
    - tags@ghsc/geomag/geomag-algorithms
    - production@ghsc/geomag/geomag-algorithms
  when: manual

## --------------------------------------------------
# Test Stage
## --------------------------------------------------

Check Python 3.6:
  extends:
    - .check_code
  script:
    - export PYTHON_VERSION=3.6
    - scripts/ci_check_code.sh

Check Python 3.7:
  extends:
    - .check_code
  script:
    - export PYTHON_VERSION=3.7
    - scripts/ci_check_code.sh

Check Python 3.8:
  extends:
    - .check_code
  script:
    - export PYTHON_VERSION=3.8
    - scripts/ci_check_code.sh

## --------------------------------------------------
# Integration Stage
## --------------------------------------------------

Build Docker Image:
  extends:
    - .build_docker_image
  variables:
    APP_NAME: geomag-algorithms

## --------------------------------------------------
# Scanning Stage (e.g. OWASP ZAP etc...)
## --------------------------------------------------

Scan Docker Image:
  cache: {}
  extends:
    - .adjust_image_names
  image: docker:19.03-git
  only:
    - master@ghsc/geomag/geomag-algorithms
    - production@ghsc/geomag/geomag-algorithms
    - tags@ghsc/geomag/geomag-algorithms
  script:
    # install trivy
    - wget https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
    - tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
    # run trivy
    - ./trivy image --no-progress --exit-code 1 --severity HIGH,CRITICAL ${INTERNAL_IMAGE_NAME}
  services:
    - docker:19.03-dind
  stage: scan
  tags:
    - build

## --------------------------------------------------
# Deploy Stage
## --------------------------------------------------

Mage01 Library:
  extends:
    - .deploy-library
    - .staging
  tags:
    - deploy
    - swarm
    - mage01
  variables:
    APP_NAME: geomag-algorithms

Mage01 Web Service:
  extends:
    - .deploy
    - .staging
  tags:
    - deploy
    - swarm
    - mage01
  variables:
    APP_NAME: geomag-algorithms

Mage02 Library:
  extends:
    - .deploy-library
    - .production
  tags:
    - deploy
    - swarm
    - mage02
  variables:
    APP_NAME: geomag-algorithms

Mage02 Web Service:
  extends:
    - .deploy
    - .production
  tags:
    - deploy
    - swarm
    - mage02
  variables:
    APP_NAME: geomag-algorithms

Production01 Web Service:
  extends:
    - .deploy
    - .production
  tags:
    - deploy
    - swarm
    - production01
  variables:
    APP_NAME: geomag-algorithms

Production02 Web Service:
  extends:
    - .deploy
    - .production
  tags:
    - deploy
    - swarm
    - production02
  variables:
    APP_NAME: geomag-algorithms

Staging01 Web Service:
  extends:
    - .deploy
    - .staging
  tags:
    - deploy
    - swarm
    - staging01
  variables:
    APP_NAME: geomag-algorithms

Staging02 Web Service:
  extends:
    - .deploy
    - .staging
  tags:
    - deploy
    - swarm
    - staging02
  variables:
    APP_NAME: geomag-algorithms