.gitlab-ci.yml

stages:
  - install
  - build
  - test
  - publish
  - config_staging
  - deploy_staging
  - post_deploy_staging
  - config_production
  - deploy_production


variables:
  PACKAGE_NAME: mobiville
  VERSION: $CI_COMMIT_SHORT_SHA
  DATABASEDUMP_VERSION: 1.0.0
  IP_TEST: 192.168.4.134
  RECETTE:
    value: "192.168.4.192"
    description: ip for the staging machine
  PRODUCTION:
    value: "51.68.80.218"
    description: ip for the production machine
  DEV_BRANCH:
    value: "develop"
    description: name of the staging branch
  PROD_BRANCH:
    value: "master"
    description: name of the production deployment branch
  FORCE_DEPLOY:
    value: ""
    description: target to do force deploy api, front, config or install
  FORCE_VERSION:
    value: ""
    description: version of the FORCE_DEPLOY target api or front to deploy
  FORCE_INSTALL:
    value: "NO"
    description: production install from scratch mobiville with {name of the branch} to deploy (use for target image)
  RENEW_TLS:
    value: "NO"
    description: replace TLS certificate with "YES"
  a11y_urls: "https://mobiville.pole-emploi.fr https://mobiville.beta.pole-emploi.fr/cities?code_rome=j1501&code_criterion=small-city,mountain&code_region=94&code_city=small-city&code_environment=mountain https://mobiville.beta.pole-emploi.fr/city/2b036-bigorno?code_rome=j1501"


include:
  - template: Security/Secret-Detection.gitlab-ci.yml
    rules:
      - if: '$CI_COMMIT_BRANCH == "develop"' # https://docs.gitlab.com/ee/ci/yaml/index.html#rules-with-include


test:sonar:
  extends: .sonarqube-check
  stage: test
  rules:
    - if: '$CI_COMMIT_BRANCH == $DEV_BRANCH && $FORCE_DEPLOY == ""'
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $FORCE_DEPLOY == ""'

test:lint:
  stage: test
  image: node:16.16.0
  script:
    # installe de yarn
    - (which yarn || npm i -g yarn@1.22.15)
    - cd ./front
    # recupération des dépendances npm
    - yarn install
    - yarn lint
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $FORCE_DEPLOY == ""'

e2e:
  stage: post_deploy_staging
  image: cypress/browsers:node16.14.2-slim-chrome103-ff102
  script:
    # TODO attendre la fin de déploiement en beta
    # installe de yarn
    - (which yarn || npm i -g yarn@1.22.15)
    - cd ./tests
    # recupération des dépendances npm
    - yarn install
    - curl "https://github.com/cucumber/json-formatter/releases/download/v19.0.0/cucumber-json-formatter-linux-amd64" > /usr/local/bin/cucumber-json-formatter
    - chmod +x /usr/local/bin/cucumber-json-formatter
    - sleep 120
    - yarn cypress:run-vanilla
    - yarn generate-multiple-cucumber-html-report
  artifacts:
    when: on_success
    expose_as: 'E2E Reports'
    paths: ['tests/cypress/reports/cucumber-html-report/']
  rules:
    - if: '$CI_COMMIT_BRANCH == $DEV_BRANCH && $FORCE_DEPLOY == ""'


test:a11y:
  extends: .a11y
  stage: test
  rules:
    - if: '$CI_COMMIT_BRANCH == $DEV_BRANCH && $FORCE_DEPLOY == ""'


package 1/2:
  stage: build
  image: node:16.16.0
  script:
    # installe de yarn
    - (which yarn || npm i -g yarn@1.22.15)
    - cd ./front
    # recupération des dépendances npm
    - yarn install
    # on minifie les src ds le livrable dist
    - yarn run build && cp -RT build dist
  artifacts:
    paths:
      - front/dist
    expire_in: 1 week
  rules:
    - if: '($CI_COMMIT_BRANCH == $DEV_BRANCH || $CI_COMMIT_BRANCH == $PROD_BRANCH) && $FORCE_DEPLOY == ""'
      changes:
        - front/**/*
    - if: '$FORCE_DEPLOY == "front" && $FORCE_VERSION == ""'
      when: manual



package 2/2:
  stage: publish
  before_script:
    - apt-get update -qq
    - apt-get install -y -qq curl
  script:
    - cd ./front
    - PUB_BRANCH=${CI_COMMIT_BRANCH//\//_}
    - tar -czvf "${PACKAGE_NAME}-${PUB_BRANCH}.${VERSION}.tar.gz" dist
    - echo "${PACKAGE_NAME}-${PUB_BRANCH}.${VERSION}.tar.gz"
    - 'curl --header "job-token: $CI_JOB_TOKEN" --upload-file ${PACKAGE_NAME}-${PUB_BRANCH}.${VERSION}.tar.gz "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/front/${PUB_BRANCH}/${PACKAGE_NAME}.${PUB_BRANCH}-${VERSION}.tar.gz" --upload-file ${PACKAGE_NAME}-${PUB_BRANCH}.${VERSION}.tar.gz "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/front/${PUB_BRANCH}/${PACKAGE_NAME}.${PUB_BRANCH}-latest.tar.gz"'
  rules:
    - if: '($CI_COMMIT_BRANCH == $DEV_BRANCH || $CI_COMMIT_BRANCH == $PROD_BRANCH) && $FORCE_DEPLOY == ""'
      changes:
        - front/**/*
    - if: '$FORCE_DEPLOY == "front" && $FORCE_VERSION == ""'
      when: manual


publish api image:
  stage: publish
  image:
      name: gcr.io/kaniko-project/executor:debug
      entrypoint: [""]
  script:
    # on construit l'image docker du composant api et on la sauvegarde dans le registry gitlab
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json
    - PUB_BRANCH=${CI_COMMIT_BRANCH//\//_}
    - echo "CI_COMMIT_SHA=$CI_COMMIT_SHA" >> .env
    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/dockerfile_api --destination $CI_REGISTRY_IMAGE:api-${PUB_BRANCH}-${VERSION} --destination $CI_REGISTRY_IMAGE:api-${PUB_BRANCH}-latest
  rules:
    - if: '($CI_COMMIT_BRANCH == $DEV_BRANCH || $CI_COMMIT_BRANCH == $PROD_BRANCH) && $FORCE_DEPLOY == ""'
      changes:
        - api/**/*
    - if: '$FORCE_DEPLOY == "api" && $FORCE_VERSION == ""'
      when: manual


deploy front staging:
  extends: .deploy_front
  stage: deploy_staging
  rules:
    - if: '$CI_COMMIT_BRANCH == $DEV_BRANCH && $FORCE_DEPLOY == ""'
      changes:
        - front/**/*
    - if: '$CI_COMMIT_BRANCH == $DEV_BRANCH && $FORCE_DEPLOY == "api"'
      when: manual
  variables:
    IP_SERVER: $RECETTE
    SSH_PKEY: $SSH_PRIVATE_KEY
  environment:
    name: recette
    url: https://mobiville.beta.pole-emploi.fr


deploy api staging:
  extends: .deploy_api
  stage: deploy_staging
  rules:
    - if: '$CI_COMMIT_BRANCH == $DEV_BRANCH && $FORCE_DEPLOY == ""'
      changes:
        - api/**/*
    - if: '$CI_COMMIT_BRANCH == $DEV_BRANCH && $FORCE_DEPLOY == "api"'
      when: manual
  variables:
    IP_SERVER: $RECETTE
    ENV_TARGET: recette
    SSH_PKEY: $SSH_PRIVATE_KEY
  environment:
    name: recette
    url: https://mobiville.beta.pole-emploi.fr


deploy conf staging:
  extends: .deploy_conf
  stage: config_staging
  rules:
    - if: '$CI_COMMIT_BRANCH == $DEV_BRANCH && $FORCE_DEPLOY == ""'
      changes:
        - nginx/**/*
        - /package.json
        - docker-compose.yml
        - docker-compose.recette.yml
    - if: '$CI_COMMIT_BRANCH == $DEV_BRANCH && $FORCE_DEPLOY == "config"'
      when: manual
  variables:
    IP_SERVER: $RECETTE
    ENV_TARGET: recette
    SSH_PKEY: $SSH_PRIVATE_KEY
  environment:
    name: recette
    url: https://mobiville.beta.pole-emploi.fr


deploy front production:
  extends: .deploy_front
  stage: deploy_production
  rules:
    - if: '$CI_COMMIT_BRANCH == $PROD_BRANCH && $FORCE_DEPLOY == ""'
      changes:
        - front/**/*
      when: manual
    - if: '$CI_COMMIT_BRANCH == $PROD_BRANCH && $FORCE_DEPLOY == "front"'
      when: manual
  variables:
    IP_SERVER: $PRODUCTION
    ENV_TARGET: production
    SSH_PKEY: $SSH_PRIVATE_KEY_PROD
  environment:
    name: production
    url: https://mobiville.beta.pole-emploi.fr


deploy api production:
  extends: .deploy_api
  stage: deploy_production
  rules:
    - if: '$CI_COMMIT_BRANCH == $PROD_BRANCH && $FORCE_DEPLOY == ""'
      changes:
        - api/**/*
      when: manual
    - if: '$CI_COMMIT_BRANCH == $PROD_BRANCH && $FORCE_DEPLOY == "api"'
      when: manual
  variables:
    IP_SERVER: $PRODUCTION
    ENV_TARGET: production
    SSH_PKEY: $SSH_PRIVATE_KEY_PROD
  environment:
    name: production
    url: https://mobiville.beta.pole-emploi.fr


deploy conf production:
  extends: .deploy_conf
  stage: config_production
  rules:
    - if: '$CI_COMMIT_BRANCH == $PROD_BRANCH && $FORCE_DEPLOY == ""'
      changes:
        - nginx/**/*
        - /package.json
        - docker-compose.yml
        - docker-compose.production.yml
      when: manual
    - if: '$CI_COMMIT_BRANCH == $PROD_BRANCH && $FORCE_DEPLOY == "config"'
      when: manual
  variables:
    IP_SERVER: $PRODUCTION
    ENV_TARGET: production
    SSH_PKEY: $SSH_PRIVATE_KEY_PROD
  environment:
    name: production
    url: https://mobiville.beta.pole-emploi.fr


.deploy_api:
  before_script:
    - apt-get update -qq
    - apt-get install -y -qq openssh-client
    # add ssh_private_key in agent store
    - eval $(ssh-agent -s)
    - ssh-add <(echo "$SSH_PKEY")
    - mkdir -p ~/.ssh
  script:
    - ssh -o StrictHostKeyChecking=no gitlab@$IP_SERVER "
                cd $WORKDIR_SERVER &&
                docker login $CI_REGISTRY -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD &&
                VERSION=${FORCE_VERSION:-$VERSION} &&
                PUB_BRANCH=${CI_COMMIT_BRANCH//\//_} &&
                echo \"API_VERSION=\${PUB_BRANCH}-\${VERSION}\" > .api_env &&
                API_VERSION=\"\${PUB_BRANCH}-\${VERSION}\" docker-compose -f docker-compose.yml -f docker-compose.$ENV_TARGET.yml pull &&
                API_VERSION=\"\${PUB_BRANCH}-\${VERSION}\" docker-compose -f docker-compose.yml -f docker-compose.$ENV_TARGET.yml up -d &&
                docker logout $CI_REGISTRY"


.deploy_front:
  before_script:
    - apt-get update -qq
    - apt-get install -y -qq openssh-client
    # add ssh_private_key in agent store
    - eval $(ssh-agent -s)
    - ssh-add <(echo "$SSH_PKEY")
    - mkdir -p ~/.ssh
  script:
    # on livre le livrable dist sur la machine de recette
    - ssh -o StrictHostKeyChecking=no gitlab@$IP_SERVER "mkdir -p $WORKDIR_SERVER/nginx/front"
    - 'ssh -o StrictHostKeyChecking=no gitlab@$IP_SERVER "
                PUB_BRANCH=${CI_COMMIT_BRANCH//\//_} &&
                cd $WORKDIR_SERVER &&
                VERSION=${FORCE_VERSION:-$VERSION} &&
                echo \"PACKAGE_VERSION=\${PUB_BRANCH}-\${VERSION}\" > .package_env &&
                echo \"${PACKAGE_NAME}.\${PUB_BRANCH}-\${VERSION}.tar.gz\" &&
                curl -O --header \"deploy-token: $PACKAGE_REGISTRY_TOKEN\" \"https://${CI_SERVER_HOST}/api/v4/projects/${CI_PROJECT_ID}/packages/generic/front/\${PUB_BRANCH}/${PACKAGE_NAME}.\${PUB_BRANCH}-\${VERSION}.tar.gz\" &&
                  cd $WORKDIR_SERVER/nginx/front && tar -xzvf ../../${PACKAGE_NAME}.\${PUB_BRANCH}-\${VERSION}.tar.gz && find . -ctime +1 -delete
                  "'
#NOTE: docker-compose will update with the "latest" and not with the commit hash
.deploy_conf:
  before_script:
    - apt-get update -qq
    - apt-get install -y -qq openssh-client
    # add ssh_private_key in agent store
    - eval $(ssh-agent -s)
    - ssh-add <(echo "$SSH_PKEY")
    - mkdir -p ~/.ssh
  script:
    - echo -e "ENV_TYPE=$ENV_TARGET\nDATABASE_URL=$DATABASE_URL\nMYSQL_DATABASE=$MYSQL_DATABASE\nMYSQL_USER=$MYSQL_USER\nMYSQL_PASSWORD=$MYSQL_PASSWORD\nEMPLOI_STORE_URL=$EMPLOI_STORE_URL\nENTERPRISE_URL=$ENTERPRISE_URL\nEMPLOI_STORE_ID=$EMPLOI_STORE_ID\nEMPLOI_STORE_SECRET=$EMPLOI_STORE_SECRET\nSENTRY_DSN=$SENTRY_DSN" > .env
    - echo "$htpasswd" > nginx/.htpasswd
    - scp -o StrictHostKeyChecking=no package.json docker-compose.yml docker-compose.$ENV_TARGET.yml .env gitlab@$IP_SERVER:$WORKDIR_SERVER
    - ssh -o StrictHostKeyChecking=no gitlab@$IP_SERVER "mkdir -p $WORKDIR_SERVER/nginx/conf.d"
    - scp -o StrictHostKeyChecking=no nginx/conf.d/$ENV_TARGET.conf gitlab@$IP_SERVER:$WORKDIR_SERVER/nginx/conf.d/$ENV_TARGET.conf
    - scp -o StrictHostKeyChecking=no nginx/.htpasswd gitlab@$IP_SERVER:$WORKDIR_SERVER/nginx/
    - ssh -o StrictHostKeyChecking=no gitlab@$IP_SERVER "
                cd $WORKDIR_SERVER &&
                chmod 640 nginx/.htpasswd &&
                docker login $CI_REGISTRY -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD &&
                VERSION=${FORCE_VERSION:-latest} &&
                PUB_BRANCH=${CI_COMMIT_BRANCH//\//_} &&
                echo \"API_VERSION=\${PUB_BRANCH}-\${VERSION}\" > .api_env &&
                API_VERSION=\"\${PUB_BRANCH}-\${VERSION}\" docker-compose -f docker-compose.yml -f docker-compose.$ENV_TARGET.yml pull &&
                API_VERSION=\"\${PUB_BRANCH}-\${VERSION}\" docker-compose -f docker-compose.yml -f docker-compose.$ENV_TARGET.yml up -d &&
                API_VERSION=\"\${PUB_BRANCH}-\${VERSION}\" docker-compose -f docker-compose.yml -f docker-compose.$ENV_TARGET.yml exec -T nginx bash -c 'nginx -t && nginx -s reload' &&
                docker logout $CI_REGISTRY"


.sonarqube-check:
  image:
    name: sonarsource/sonar-scanner-cli:latest
  variables:
    SONAR_TOKEN: "${SONAR_TOKEN}"
    SONAR_HOST_URL: "https://sonarqube.beta.pole-emploi.fr"
    SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar" # defines the location of the analysis task cache
    GIT_DEPTH: 0 # tells git to fetch all the branches of the project, required by the analysis task
  cache:
    key: ${CI_JOB_NAME}
    paths:
      - .sonar/cache
  stage: test
  script:
    - sonar-scanner -Dsonar.qualitygate.wait=true -Dsonar.projectKey=mobiville
  allow_failure: true

.a11y:
  image: registry.gitlab.com/gitlab-org/ci-cd/accessibility:5.3.0-gitlab.3
  script: /gitlab-accessibility.sh $a11y_urls
  allow_failure: true
  artifacts:
    when: always
    expose_as: 'Accessibility Reports'
    paths: ['reports/']
    reports:
      accessibility: reports/gl-accessibility.json
  rules:
    - if: $a11y_urls


renew production tls:
  stage: install
  before_script:
    - apt-get update -qq
    - apt-get install -y -qq openssh-client
    # add ssh_private_key in agent store
    - eval $(ssh-agent -s)
    - ssh-add <(echo "$SSH_PRIVATE_KEY_PROD")
    - mkdir -p ~/.ssh
  script:
    - echo "$SSL_dhparam_pem" > nginx/ssl/dhparam.pem
    - echo "$SSL_entrust_mobiville_pole_emploi_fr_key_pem" > nginx/ssl/entrust-mobiville.pole-emploi.fr-key.pem
    - echo "$SSL_mobiville_pole_emploi_fr_crt" > nginx/ssl/mobiville.pole-emploi.fr.crt
    - scp -o StrictHostKeyChecking=no -r nginx/ssl gitlab@$PRODUCTION:$WORKDIR_SERVER/nginx/
    - ssh -o StrictHostKeyChecking=no gitlab@$PRODUCTION "
                cd $WORKDIR_SERVER &&
                chmod 640 nginx/ssl/* &&
                docker-compose -f docker-compose.yml -f docker-compose.production.yml exec -T nginx bash -c 'nginx -t && nginx -s reload'"
  rules:
    - if: '$RENEW_TLS == "YES"'
      when: manual
  environment:
    name: production
    url: https://mobiville.beta.pole-emploi.fr

#TODO add init.sh script to initialize/sync database data
#TOFIX mysql_upgrade need to be execute after restauration of db (needed for backup to work properly)
install production:
  stage: install
  before_script:
    - apt-get update -qq
    - apt-get install -y -qq openssh-client
    # add ssh_private_key in agent store
    - eval $(ssh-agent -s)
    - ssh-add <(echo "$SSH_PRIVATE_KEY_PROD")
    - mkdir -p ~/.ssh
  script:
    - ssh -o StrictHostKeyChecking=no gitlab@$PRODUCTION "mkdir $WORKDIR_SERVER"
    - echo -e "DATABASE_URL=$DATABASE_URL\nMYSQL_DATABASE=$MYSQL_DATABASE\nMYSQL_USER=$MYSQL_USER\nMYSQL_PASSWORD=$MYSQL_PASSWORD\nEMPLOI_STORE_URL=$EMPLOI_STORE_URL\nENTERPRISE_URL=$ENTERPRISE_URL\nEMPLOI_STORE_ID=$EMPLOI_STORE_ID\nEMPLOI_STORE_SECRET=$EMPLOI_STORE_SECRET\nSENTRY_DSN=$SENTRY_DSN" > .env
    - mkdir -p nginx/ssl
    - echo "$SSL_dhparam_pem" > nginx/ssl/dhparam.pem
    - echo "$SSL_entrust_mobiville_pole_emploi_fr_key_pem" > nginx/ssl/entrust-mobiville.pole-emploi.fr-key.pem
    - echo "$SSL_mobiville_pole_emploi_fr_crt" > nginx/ssl/mobiville.pole-emploi.fr.crt
    - echo "$htpasswd" > nginx/.htpasswd
    - echo "PACKAGE_VERSION=latest" > .package_env
    - scp -o StrictHostKeyChecking=no package.json docker-compose.yml docker-compose.production.yml .env gitlab@$PRODUCTION:$WORKDIR_SERVER
    - ssh -o StrictHostKeyChecking=no gitlab@$PRODUCTION "mkdir -p $WORKDIR_SERVER/nginx/front && mkdir -p $WORKDIR_SERVER/nginx/conf.d && mkdir -p $WORKDIR_SERVER/backups"
    - scp -o StrictHostKeyChecking=no backups/BACKUP.sh backups/Dockerfile gitlab@$PRODUCTION:$WORKDIR_SERVER/backups
    - scp -o StrictHostKeyChecking=no nginx/conf.d/production.conf gitlab@$PRODUCTION:$WORKDIR_SERVER/nginx/conf.d
    - scp -o StrictHostKeyChecking=no -r nginx/ssl gitlab@$PRODUCTION:$WORKDIR_SERVER/nginx/
    - scp -o StrictHostKeyChecking=no nginx/.htpasswd gitlab@$PRODUCTION:$WORKDIR_SERVER/nginx/
    - 'ssh -o StrictHostKeyChecking=no gitlab@$PRODUCTION "cd $WORKDIR_SERVER && curl -O --header \"deploy-token: $PACKAGE_REGISTRY_TOKEN\" \"https://${CI_SERVER_HOST}/api/v4/projects/${CI_PROJECT_ID}/packages/generic/database/${DATABASEDUMP_VERSION}/database.${DATABASEDUMP_VERSION}.tar.gz\""'
    - ssh -o StrictHostKeyChecking=no gitlab@$PRODUCTION "cd $WORKDIR_SERVER && tar -xzvf database.${DATABASEDUMP_VERSION}.tar.gz"
    - 'ssh -o StrictHostKeyChecking=no gitlab@$PRODUCTION "cd $WORKDIR_SERVER && curl -O --header \"deploy-token: $PACKAGE_REGISTRY_TOKEN\" \"https://${CI_SERVER_HOST}/api/v4/projects/${CI_PROJECT_ID}/packages/generic/front/${PUB_BRANCH_INSTALL}/${PACKAGE_NAME}.${PUB_BRANCH_INSTALL}-latest.tar.gz\""'
    - ssh -o StrictHostKeyChecking=no gitlab@$PRODUCTION "cd $WORKDIR_SERVER/nginx/front && tar -xzvf ../../${PACKAGE_NAME}.${PUB_BRANCH_INSTALL}-latest.tar.gz"
    - ssh -o StrictHostKeyChecking=no gitlab@$PRODUCTION "
                cd $WORKDIR_SERVER &&
                chmod 640 nginx/ssl/* &&
                chmod 640 nginx/.htpasswd &&
                VERSION=${FORCE_VERSION:-$VERSION} &&
                PUB_BRANCH_INSTALL=$PUB_BRANCH_INSTALL &&
                echo \"API_VERSION=\${PUB_BRANCH_INSTALL}-\${VERSION}\" > .api_env &&
                docker login $CI_REGISTRY -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD &&
                API_VERSION=\"\${PUB_BRANCH_INSTALL}-\${VERSION}\" docker-compose -f docker-compose.yml -f docker-compose.${ENV_TARGET:-production}.yml pull &&
                API_VERSION=\"\${PUB_BRANCH_INSTALL}-\${VERSION}\" docker-compose -f docker-compose.yml -f docker-compose.${ENV_TARGET:-production}.yml up -d &&
                docker logout $CI_REGISTRY"
  rules:
    - if: '$FORCE_INSTALL != "NO" && $FORCE_DEPLOY == "install"'
      variables:
        PUB_BRANCH_INSTALL: "${FORCE_INSTALL}"
      when: manual
  environment:
    name: production
    url: https://mobiville.beta.pole-emploi.fr