.gitlab-ci.yml

include:
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/Container-Scanning.gitlab-ci.yml

stages:
  - test and build
  - prepare
  - scan
  - review
  - deploy:staging
  - qa
  - deploy:canary
  - deploy:production
  - cleanup

variables:
  CYPRESS_INSTALL_BINARY: "0" # Speeds up the install process
  npm_config_cache: '$CI_PROJECT_DIR/.npm'
  CYPRESS_CACHE_FOLDER: '$CI_PROJECT_DIR/cache/Cypress'
  FF_USE_FASTZIP: "1"

cache:
  key:
    files:
      - package.json
    prefix: ${CI_JOB_NAME}
  paths:
    - node_modules/

test:
  image: cypress/browsers:latest
  stage: test and build
  script:
    - npm install -g npm@7
    - npm i
    - NODE_OPTIONS=--max_old_space_size=4096
    - npm run test -- --no-watch --no-progress --browsers=ChromeHeadlessCI
  except:
    variables:
      - $CI_NIGHTLY_TESTS == "true"

lint:
  stage: test and build
  image: minds/ci-front:18
  script:
    - npm i -g prettier@"~3.2.5"
    - prettier --check "src/**/*.ts"
    - prettier --check "src/**/*.scss"
    - prettier --check "src/**/*.html"
  except:
    variables:
      - $CI_NIGHTLY_TESTS == "true"

############
# QA Stage #
############
.cypress_tests: &cypress_tests
  image: cypress/browsers:node18.12.0-chrome107
  stage: qa
  variables:
    CYPRESS_INSTALL_BINARY: "7.4.0"
  script:
    - >
      if [ "$CI_BUILD_REF_NAME" == "master" ]; then
        export E2E_DOMAIN=https://www.minds.com
        export PRODUCTION=true
      else
        export E2E_DOMAIN=https://$CI_COMMIT_REF_SLUG.$KUBE_INGRESS_BASE_DOMAIN
        export PRODUCTION=false
      fi
    - export CYPRESS_baseUrl=$E2E_DOMAIN
    - echo "Preparing E2E tests for $CI_BUILD_REF_NAME running against $E2E_DOMAIN with user $CYPRESS_username"
    - git clone --branch=master https://$CI_REGISTRY_USER:${CI_REGISTRY_PASSWORD}@gitlab.com/minds/cypress-tests.git
    - echo "Checking if branch exists..."
    - BRANCH_EXISTS=$(git ls-remote --heads https://www.gitlab.com/minds/cypress-tests $CI_BUILD_REF_NAME | wc -l)
    - cd ./cypress-tests
    - if [ $BRANCH_EXISTS == "1" ] ; then
    -    echo "Matching branch exists, checking out $CI_BUILD_REF_NAME..."
    -    git checkout $CI_BUILD_REF_NAME 2>/dev/null
    - fi;
    - npm i
    - echo "Running Cypress"
    - >
      ./node_modules/.bin/cypress run --browser chrome
      --parallel
      --record
      --ci-build-id $CI_PIPELINE_ID
      --group "minds-e2e"
      --key $CYPRESS_RECORD_ID
      --config baseUrl=$E2E_DOMAIN
      --env shared_key=$CYPRESS_bypass_key,production=$PRODUCTION
  artifacts:
    when: always
    paths:
      - cypress/screenshots
      - cypress/videos
  cache:
    paths:
      - .npm
      - cache/Cypress

# qa:sandbox:
#   parallel: 2
#   except:
#     refs:
#       - /^master$/
#       - feat/1732-block-refactor
#     variables:
#       - $CI_NIGHTLY_TESTS == "true"
#   <<: *cypress_tests

.playwright_tests: &playwright_tests
  image: mcr.microsoft.com/playwright:v1.27.0-focal
  stage: qa
  script:
    - >
      if [ "$CI_COMMIT_REF_NAME" == "master" ]; then
        export E2E_DOMAIN=https://www.minds.com
      else
        export E2E_DOMAIN=https://$CI_COMMIT_REF_SLUG.$KUBE_INGRESS_BASE_DOMAIN
      fi
    - export BYPASS_SIGNING_KEY=$BYPASS_SIGNING_KEY
    - sh ./e2e/test/setup_and_run.sh
  artifacts:
    when: always
    paths:
      - e2e/test/error-screenshots
      - e2e/test/error-screenshots/videos
  cache:
    paths:
      - .npm
      - cache/Cypress

qa:e2e:
  except:
    refs:
      - /^master$/
      - feat/1732-block-refactor
    variables:
      - $CI_NIGHTLY_TESTS == "true"
  <<: *playwright_tests

qa:nightly:
  allow_failure: true
  only:
    refs:
      - /^master$/
    variables:
      - $CI_NIGHTLY_TESTS == "true"
  <<: *playwright_tests

# qa:production:
#   parallel: 1
#   allow_failure: true
#   only:
#     - /^master$/
#   <<: *cypress_tests

# qa:manual:
#   stage: qa
#   script:
#     - echo "Manually approved"
#   when: manual
#   only:
#     refs:
#       - master
#       - production
#       - test/gitlab-ci
#   except:
#     variables:
#       - $CI_NIGHTLY_TESTS == "true"
#   allow_failure: true

###############
# Build Stage #
###############

build:review:
  stage: test and build
  image: minds/ci-front:18
  before_script:
    - sed -ri "s|'VERSION'|'$CI_PIPELINE_ID'|" src/environments/environment.prod.ts
  script:
    - npm i && npm install -g gulp-cli
    - sh build/ng-bundles.sh
    - sh build/ng-remove-locale-assets.sh # Remove assets from locales
  artifacts:
    name: '$CI_COMMIT_REF_SLUG'
    paths:
      - dist
  except:
    refs:
      - master
      # - test/gitlab-ci
    variables:
      - $CI_NIGHTLY_TESTS == "true"
  tags:
    - angular

build:production:bundles:
  stage: test and build
  image: minds/ci-front:18
  before_script:
    - sed -ri "s|'VERSION'|'$CI_PIPELINE_ID'|" src/environments/environment.prod.ts
  script:
    - npm i && npm install -g gulp-cli
    - sh build/ng-bundles.sh
    - sh build/ng-remove-locale-assets.sh # Remove assets from locales
  artifacts:
    name: '$CI_COMMIT_REF_SLUG'
    paths:
      - dist/browser
      - dist/server
      - dist/embed
      - dist/storybook
  only:
    refs:
      - master
      - test/gitlab-ci
  except:
    variables:
      - $CI_NIGHTLY_TESTS == "true"
  tags:
    - angular

#################
# Prepare Stage #
#################

.sentry_prepare: &sentry_prepare
  stage: prepare
  image: getsentry/sentry-cli:2.31.0
  script:
    - echo "Create a new release $CI_PIPELINE_ID"
    - sentry-cli releases new $CI_PIPELINE_ID
    - sentry-cli releases set-commits --auto $CI_PIPELINE_ID
    - sentry-cli releases files $CI_PIPELINE_ID upload-sourcemaps $CI_PROJECT_DIR/dist/browser -x .js -x .map --validate --url-prefix $SOURCEMAP_PREFIX
    - sentry-cli releases finalize $CI_PIPELINE_ID
    - echo "Finalized release for $CI_PIPELINE_ID"

prepare:review:
  stage: prepare
  image:
    name: gcr.io/kaniko-project/executor:v1.14.0-debug
    entrypoint: [""]
  script:
    - /kaniko/executor
      --context "${CI_PROJECT_DIR}/dist"
      --dockerfile "${CI_PROJECT_DIR}/containers/server/Dockerfile"
      --destination "${CI_REGISTRY_IMAGE}/server:$CI_PIPELINE_ID"
  dependencies:
    - build:review
  except:
    refs:
      - master
      # - test/gitlab-ci
    variables:
      - $CI_NIGHTLY_TESTS == "true"

prepare:review:sentry:
  <<: *sentry_prepare
  variables:
    SOURCEMAP_PREFIX: '~/browser'
  except:
    refs:
      - master
      # - test/gitlab-ci
    variables:
      - $CI_NIGHTLY_TESTS == "true"
  dependencies:
    - build:review

prepare:production:
  stage: prepare
  image:
    name: gcr.io/kaniko-project/executor:v1.14.0-debug
    entrypoint: [""]
  script:
    - /kaniko/executor
      --context "${CI_PROJECT_DIR}/dist"
      --dockerfile "${CI_PROJECT_DIR}/containers/server/Dockerfile"
      --destination "${CI_REGISTRY_IMAGE}/server:$CI_PIPELINE_ID"
  only:
    refs:
      - master
      - test/gitlab-ci
  except:
    variables:
      - $CI_NIGHTLY_TESTS == "true"
  dependencies:
    - build:production:bundles

prepare:production:sentry:
  <<: *sentry_prepare
  variables:
    SOURCEMAP_PREFIX: '~/front/dist/browser'
  only:
    refs:
      - master
      - test/gitlab-ci
  except:
    variables:
      - $CI_NIGHTLY_TESTS == "true"
  dependencies:
    - build:production:bundles

##############
# Scan Stage #
##############

container_scanning:
  stage: scan
  variables:
    CS_IMAGE: $CI_REGISTRY_IMAGE/server:$CI_PIPELINE_ID

dependency_scanning:
  stage: scan

################
# Review Stage #
################

.oci_prepare: &oci_prepare
  - mkdir ~/.oci
  - cp $OCI_CONFIG ~/.oci/config
  - cp $OCI_KEY /tmp/oci-key.pem
  - export OCI_CLI_SUPPRESS_FILE_PERMISSIONS_WARNING=True
  - | 
    oci ce cluster create-kubeconfig \
      --cluster-id $OKE_CLUSTER_ID \
      --file $KUBECONFIG \
      --region us-ashburn-1 \
      --token-version 2.0.0  \
      --kube-endpoint PUBLIC_ENDPOINT

.cleanup_review: &cleanup_review
  image: minds/ci:latest
  script:
    - *oci_prepare
    - helm -n default del $CI_COMMIT_REF_SLUG
  environment:
    name: review/$CI_COMMIT_REF_NAME
    url: https://$CI_COMMIT_REF_SLUG.$KUBE_INGRESS_BASE_DOMAIN
    action: stop
  variables:
    GIT_STRATEGY: none
  except:
    refs:
      - master
      # - test/gitlab-ci
    variables:
      - $CI_NIGHTLY_TESTS == "true"

review:start:
  stage: review
  image: minds/ci:latest
  script:
    - *oci_prepare
    # Download repo, use same branch name if exists
    - HELM_GIT_REPO=https://$CI_REGISTRY_USER:${CI_REGISTRY_PASSWORD}@gitlab.com/minds/helm-charts.git
    - git clone --branch=master $HELM_GIT_REPO
    - BRANCH_EXISTS=$(git ls-remote --heads $HELM_GIT_REPO $CI_BUILD_REF_NAME | wc -l)
    - cd ./helm-charts
    - if [ $BRANCH_EXISTS == "1" ] ; then
    -    echo "Matching branch exists, checking out $CI_BUILD_REF_NAME..."
    -    git checkout $CI_BUILD_REF_NAME 2>/dev/null
    - fi;
    #
    - "helm upgrade \
      --install \
      --namespace default \
      --reuse-values \
      --values ./minds/values-sandbox-oke.yaml
      --set front.image.repository=$CI_REGISTRY_IMAGE/server \
      --set-string front.image.tag=$CI_PIPELINE_ID \
      --set domain=$CI_COMMIT_REF_SLUG.$KUBE_INGRESS_BASE_DOMAIN
      --set cdn_domain=$CI_COMMIT_REF_SLUG.$KUBE_INGRESS_BASE_DOMAIN
      --set siteUrl=https://$CI_COMMIT_REF_SLUG.$KUBE_INGRESS_BASE_DOMAIN/
      --set-string environments.sandbox.routingCookie=false
      --timeout 800s \
      --wait \
      $CI_COMMIT_REF_SLUG \
      ./minds"
    # Update sentry
    - sentry-cli releases deploys $CI_PIPELINE_ID new -e review-$CI_COMMIT_REF_SLUG
  environment:
    name: review/$CI_COMMIT_REF_NAME
    url: https://$CI_COMMIT_REF_SLUG.$KUBE_INGRESS_BASE_DOMAIN
    on_stop: review:stop
  except:
    refs:
      - master
      # - test/gitlab-ci
    variables:
      - $CI_NIGHTLY_TESTS == "true"

review:stop:
  <<: *cleanup_review
  stage: review
  when: manual
  except:
    refs:
      - master
    variables:
      - $CI_NIGHTLY_TESTS == "true"

################
# Deploy Stage #
################

.deploy: &deploy
  image: minds/ci:latest
  script:
    ## Sync assets with CDN
    - aws s3 sync dist $S3_REPOSITORY_URL/$IMAGE_LABEL --cache-control max-age=31536000 --exact-timestamps
    ## Update docker server container
    - crane auth login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - crane tag $CI_REGISTRY_IMAGE/server:$CI_PIPELINE_ID $IMAGE_LABEL
    # OKE Deploy
    - *oci_prepare
    - kubectl -n default rollout restart deployment minds-front-$IMAGE_LABEL
    ## Update sentry
    - sentry-cli releases deploys $CI_PIPELINE_ID new -e $IMAGE_LABEL
  dependencies:
    - build:production:bundles

staging:fpm:
  <<: *deploy
  after_script:
    - crane tag $CI_REGISTRY_IMAGE/server:$CI_PIPELINE_ID latest
  stage: deploy:staging
  variables:
    IMAGE_LABEL: 'staging'
  environment:
    name: staging
    url: https://www.minds.com # requires staging cookie
  only:
    refs:
      - master
      - test/gitlab-ci
  except:
    variables:
      - $CI_NIGHTLY_TESTS == "true"

deploy:canary:
  <<: *deploy
  stage: deploy:canary
  variables:
    IMAGE_LABEL: 'canary'
  environment:
    name: canary
    url: https://www.minds.com/?canary=1 # requires canary cookie
  when: manual
  allow_failure: true
  only:
    refs:
      - master
      - test/gitlab-ci
  except:
    variables:
      - $CI_NIGHTLY_TESTS == "true"

deploy:production:
  <<: *deploy
  stage: deploy:production
  variables:
    IMAGE_LABEL: 'production'
  environment:
    name: production
    url: https://www.minds.com
  when: manual
  only:
    refs:
      - master
      - test/gitlab-ci
  except:
    variables:
      - $CI_NIGHTLY_TESTS == "true"

#################
# Cleanup stage #
#################

cleanup:review: # We stop the review site after the e2e tests have run
  <<: *cleanup_review
  stage: cleanup
  when: manual
  except:
    refs:
      - master
    variables:
      - $CI_NIGHTLY_TESTS == "true"