.gitlab-ci.yml

include:
  - template: Security/SAST.gitlab-ci.yml
  - project: platform/promotion
    file: "ci/container.yml"
  - project: platform/promotion
    file: "ci/helm.yml"

stages: # List of stages for jobs, and their order of execution.
  - "📡 prepare"
  - "🧪 static-test"
  - "🧪 security-test"
  - "🚧 build-chart"
  - "🚧 override-chart dev"
  - "🚧 override-chart test"
  - "🚀 deploy"
  - "🧪 integration-test"

variables:
  UPSTREAM_PROJECT_DIR: "."
  UPSTREAM_KANIKO: "true"
  UPSTREAM_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
  HELM_CHART_DIR: "./chart"
  HELM_RELEASE_NAME: "gamechanger-web-source"
  DOCKERFILE_PATH: "./Dockerfile.prod"
  HELM_UPGRADE_EXTRA_ARGS: >-
    --set image.tag=${CI_COMMIT_SHA}-oci
    --set appVersion=${BUILD_VERSION}
  AUTO_DEVOPS_BUILD_IMAGE_EXTRA_ARGS: >-
    --build-arg=BASE_IMAGE=${IRONBANK_NODEJS18}
    --build-arg=NPM_AUTH_TOKEN=${NPM_AUTH_TOKEN}
    --build-arg=APP_UID=1001
    --build-arg=APP_GID=1001
    --reproducible
  DEPLOY_TO_PERSONAL:
    description: "Optional: SKIP most validation steps and deploy to dev cluster at personal url for testing?"
    value: "false"
  SONAR_SCAN_IMAGE: "092912502985.dkr.ecr.us-east-1.amazonaws.com/docker.io/sonarsource/sonar-scanner-cli:latest"
  CYPRESS_IMAGE: "092912502985.dkr.ecr.us-east-1.amazonaws.com/docker.io/cypress/browsers:node18.6.0-chrome105-ff104"

cache: &global_cache
  untracked: true
  key:
    files:
      - backend/yarn.lock
      - frontend/yarn.lock
  paths:
    - frontend/node_modules
    - backend/node_modules
    - .yarn-cache
  policy: pull

.setup-github-npm:
  before_script: # Setups the npm vars
    - npm config set "@dod-advana:registry"="https://npm.pkg.github.com"
    - npm config set "//npm.pkg.github.com/:_authToken"="${NPM_AUTH_TOKEN}"
    - npm config set legacy-peer-deps true

prepare-node-modules-job: # Prepares the frontend node modules for the next jobs
  image: ${IRONBANK_NODEJS18}
  stage: "📡 prepare"
  cache:
    <<: *global_cache
    policy: pull-push
  extends: .setup-github-npm
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - |
      if [[ -d frontend/node_modules ]]; then
        exit 0
      fi
    - cd frontend
    - echo 'yarn-offline-mirror "../.yarn-cache/"' >> .yarnrc
    - echo 'yarn-offline-mirror-pruning true' >> .yarnrc
    - yarn install --cache-folder ../.yarn-cache --no-progress --network-timeout 600000
    - cd ../backend
    - echo 'yarn-offline-mirror "../.yarn-cache/"' >> .yarnrc
    - echo 'yarn-offline-mirror-pruning true' >> .yarnrc
    - yarn install --cache-folder ../.yarn-cache --no-progress

sast:
  stage: "🧪 static-test"
  cache: []
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - echo "This works"

nodejs-scan-sast:
  stage: "🧪 static-test"
  cache: []
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

semgrep-sast:
  stage: "🧪 static-test"
  cache: []
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

unit-backend-test-job: # Job for the unit tests
  image: ${IRONBANK_NODEJS18}
  stage: "🧪 static-test"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - cd backend && npm run test:gitlab
  artifacts:
    paths:
      - backend/coverage/lcov.info
      - backend/junit.xml
    when: always
    reports:
      junit:
        - backend/junit.xml
      coverage_report:
        coverage_format: cobertura
        path: backend/coverage/cobertura-coverage.xml

lint-test-job: # lint-job
  image: ${IRONBANK_NODEJS18}
  stage: "🧪 static-test"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - cd backend && npx eslint --max-warnings 0 -c .eslintrc.json --ext .js -f json -o eslintReport.json node_app
    - cd ../frontend && npx eslint --max-warnings 0 -c .eslintrc.json --ext .js -f json -o eslintReport.json src
  artifacts:
    paths:
      - backend/eslintReport.json
      - frontend/eslintReport.json

sonar_scan-job: # Run code through sonar scanner
  stage: "🧪 security-test"
  image:
    name: ${SONAR_SCAN_IMAGE}
    entrypoint: [""]
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  cache:
    key: "${CI_JOB_NAME}"
    paths:
      - .sonar/cache
  artifacts:
    paths:
      - "public"
  variables:
    REPOSITORY: "${CI_PROJECT_PATH}"
    SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"
    SONAR_HOST_EXTERNAL_URL: "${SONAR_HOST_EXTERNAL_URL}"
    SONAR_HOST_URL: "${SONAR_HOST_URL}"
    SONAR_TOKEN: "${SONAR_TOKEN}"
    PROJECTURL: "${CI_REPOSITORY_URL}"
    PROJECTNAME: "advana/gamechanger/gamechanger-web-source"
    PROJECTKEY: "${SONAR_PROJECT_KEY}"
    CODEQUALITY_REPORT_ARTIFACT: "sonarqube-report.html"
    GIT_DEPTH: "0"
  script:
    - |
      sonar-scanner \
        -Dsonar.qualitygate.wait=true \
        -Dsonar.exclusions=backend/node_app/sql/* \
        -Dsonar.javascript.lcov.reportPaths=backend/coverage/lcov.info \
        -Dsonar.junit.reportPaths=backend/junit.xml \
        -Dsonar.eslint.reportPaths=backend/eslintReport.json,frontend/eslintReport.json \
        -Dsonar.language=js \
        -Dsonar.projectName="${PROJECTNAME}" \
        -Dsonar.projectKey="${PROJECTKEY}" \
        -Dsonar.links.ci="${PROJECTURL}/pipelines" \
        -Dsonar.links.issue="${PROJECTURL}/issues" \
        -Dsonar.analysis.mode="publish" \
        -Dsonar.projectBaseDir=. \
        -Dsonar.sources=frontend/src,backend/node_app
      mkdir -p public
      <<-EOF cat > "public/${CODEQUALITY_REPORT_ARTIFACT}"
      <html>
      <head>
      <meta http-equiv="refresh" content="0; url=${SONAR_HOST_EXTERNAL_URL}/dashboard?id=${PROJECTKEY}" />
      </head>
      </html>
      EOF

chart-publish:
  cache: []
  stage: "🚧 build-chart"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "main"
    - if: $DEPLOY_TO_PERSONAL != "false"
  extends: ".helm-publish"
  variables:
    CHART: "${PLATFORM_PROMOTION_CHART}"
    CHART_ARTIFACT_TYPE: "application/vnd.cncf.helm.config.v1+json"

dev-overrides:
  cache: []
  stage: "🚧 override-chart dev"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      variables:
        VALUES_FILE: "ingress.dev.values.yaml"
    - if: $DEPLOY_TO_PERSONAL != "false"
      variables:
        VALUES_FILE: "ingress.dev.values.yaml"
    - if: $CI_COMMIT_BRANCH == "main"
      variables:
        VALUES_FILE: "dev.values.yaml"
  extends:
    - ".helm-overrides"
  # TODO: temporarily pull values from library branch for refactored chart's values
  script:
    - |
      git clone -b library https://dev:${GITLAB_TOKEN}@gitlab.advana.boozallencsn.com/advana/gamechanger/gamechanger-ci-cd.git
      mv gamechanger-ci-cd/${VALUES_FILE} "${HELM_UPGRADE_VALUES_FILE}"
      rm -rf gamechanger-ci-cd

test-overrides:
  cache: []
  stage: "🚧 override-chart test"
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      variables:
        VALUES_FILE: "test.values.yaml"
  extends:
    - ".helm-overrides"
  script:
    - |
      git clone https://dev:${GITLAB_TOKEN}@gitlab.advana.boozallencsn.com/advana/gamechanger/gamechanger-ci-cd.git
      mv gamechanger-ci-cd/${VALUES_FILE} "${HELM_UPGRADE_VALUES_FILE}"
      rm -rf gamechanger-ci-cd

trigger:
  stage: "🚀 deploy"
  extends: ".helm-deploy-trigger"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      variables:
        UPSTREAM_COMMIT_BRANCH: ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}
        NO_TEST: "true"
        ENVIRONMENT: "dev"
        UPSTREAM_DEPLOYER_JOB_NAME: "dev-overrides"
        HELM_RELEASE_NAME: ${GITLAB_USER_LOGIN}-gc
        KUBE_NAMESPACE: "${HELM_RELEASE_NAME}"
        DEV_URL: "https://${HELM_RELEASE_NAME}.dev.advana.us"
        HELM_UPGRADE_EXTRA_ARGS: >-
          --set image.tag=${CI_COMMIT_SHA}-oci
          --set appVersion=${BUILD_VERSION}
          --set ingress.enabled=true
          --set global.appName=${HELM_RELEASE_NAME}
          --set deployment.web.container.gamechanger-web.env.REACT_APP_BACKEND_URL=${DEV_URL}
          --set deployment.web.container.gamechanger-web.env.REACT_APP_USER_TOKEN_ENDPOINT=${DEV_URL}/api/auth/token
          --set deployment.web.container.gamechanger-web.env.REACT_APP_LOGIN_ROUTE=${DEV_URL}/login
          --set deployment.web.container.gamechanger-web.env.APPROVED_API_CALLERS=${DEV_URL}
    - if: $DEPLOY_TO_PERSONAL != "false"
      variables:
        UPSTREAM_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
        NO_TEST: "true"
        ENVIRONMENT: "dev"
        UPSTREAM_DEPLOYER_JOB_NAME: "dev-overrides"
        HELM_RELEASE_NAME: ${GITLAB_USER_LOGIN}-gc
        KUBE_NAMESPACE: "${HELM_RELEASE_NAME}"
        DEV_URL: "https://${HELM_RELEASE_NAME}.dev.advana.us"
        HELM_UPGRADE_EXTRA_ARGS: >-
          --set image.tag=${CI_COMMIT_SHA}-oci
          --set appVersion=${BUILD_VERSION}
          --set ingress.enabled=true
          --set global.appName=${HELM_RELEASE_NAME}
          --set deployment.web.container.gamechanger-web.env.REACT_APP_BACKEND_URL=${DEV_URL}
          --set deployment.web.container.gamechanger-web.env.REACT_APP_USER_TOKEN_ENDPOINT=${DEV_URL}/api/auth/token
          --set deployment.web.container.gamechanger-web.env.REACT_APP_LOGIN_ROUTE=${DEV_URL}/login
          --set deployment.web.container.gamechanger-web.env.APPROVED_API_CALLERS=${DEV_URL}
    - if: $CI_COMMIT_BRANCH == "main"
  # trigger:
  #   strategy: "depend"
  #   project: "platform/promotion"

integration-testing-cypress-job: # Start the integration testing
  image: ${CYPRESS_IMAGE}
  stage: "🧪 integration-test"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  variables:
    HELM_RELEASE_NAME: ${GITLAB_USER_LOGIN}-gc
    DEV_URL: "https://${HELM_RELEASE_NAME}.dev.advana.us"
    CYPRESS_BASE_URL: "${DEV_URL}"
    CYPRESS_API_URL: "${DEV_URL}"
    CYPRESS_SSL_CLIENT_S_DN_CN: "${CYPRESS_CLIENT_S_DN_CN}"
    CYPRESS_SSL_CLIENT_CERTIFICATE: "${CYPRESS_CLIENT_CERTIFICATE}"
  script:
    - cd frontend
    - npx cypress install
    - yarn cy:test
  after_script:
    - |
      echo "Cypress tests finished"
      cd frontend
      yarn report:merge
      yarn report:send
  artifacts:
    when: always
    expire_in: 1 days
    paths:
      - frontend/results.json
      - frontend/cypress/screenshots
      - frontend/cypress/videos
  allow_failure: true # Just until we get the tests working fully. It's hit or miss on what passes and what doesn't.