pipeline-production.yml

---
#@ load("funcs.lib.yml", "slack_hook")
#@ load("@ytt:data", "data")
#@ load("@ytt:template", "template")

#!  JOBS

jobs:
  - name: set-pipeline
    plan:
      - get: src
        resource: src-((deploy-env))-tagged
        params: { depth: 1 }
        trigger: true
      - get: pipeline-tasks
      - get: general-task
      - task: init
        image: general-task
        file: pipeline-tasks/tasks/init.yml
        params:
          PIPELINE_YML: src/ci/pipeline-production.yml
      - set_pipeline: build-container
        file: compiled/set-pipeline.yml
        instance_vars:
          deploy-env: ((deploy-env))

  - name: test-((deploy-env))
    plan:
      - get: src
        resource: src-((deploy-env))-tagged
        trigger: true
        params: { depth: 1 }
        passed: [set-pipeline]
      - get: python
      - task: test
        image: python
        file: src/ci/partials/test.yml

    on_failure: #@ slack_hook("failure", "tests")

  - name: deploy-((deploy-env))
    plan:
      - get: src
        resource: src-((deploy-env))-tagged
        trigger: true
        params: { depth: 1 }
        passed: [test-((deploy-env)), audit-dependencies]
      - get: general-task
      - get: oci-build-task
      - task: build
        privileged: true
        image: oci-build-task
        file: src/ci/partials/build.yml
      - put: image-repository
        params:
          image: image/image.tar
      - task: deploy
        image: general-task
        file: src/ci/partials/deploy.yml
        params:
          _: #@ template.replace(data.values.env_cf)
          CF_APP_NAME: pages-build-container-((deploy-env))
          CF_MANIFEST: .cloudgov/manifest.yml
          CF_VARS_FILE: .cloudgov/vars/pages-((deploy-env)).yml
          IMAGE_REPOSITORY: ../image-repository/repository
          IMAGE_TAG: pages-((deploy-env))
          CF_DOCKER_USERNAME: ((ecr-aws-key))
          CF_DOCKER_PASSWORD: ((ecr-aws-secret))

    on_success: #@ slack_hook("success", "deployment")
    on_failure: #@ slack_hook("failure", "deployment")

  - name: audit-dependencies
    plan:
      - get: src
        resource: src-((deploy-env))-tagged
        trigger: true
        passed: [set-pipeline]

      - get: python
      - task: pip-audit
        image: python
        file: src/ci/partials/audit.yml

    on_failure: #@ slack_hook("failure", "dependency audit")
    on_success: #@ slack_hook("success", "dependency audit")

  - name: release
    plan:
      - get: src
        resource: src-((deploy-env))-tagged
        params: { depth: 1 }
        trigger: true
        passed: [deploy-((deploy-env))]
      -  #@ template.replace(data.values.release_steps)

#!  RESOURCES

resources:
  - name: src-((deploy-env))-tagged
    type: git
    icon: github
    source:
      uri: ((git-base-url))/((build-container-repository-path))
      branch: main
      commit_verification_keys: ((cloud-gov-pages-gpg-keys))
      tag_filter: 0.*.*
      fetch_tags: true

  - name: image-repository
    type: registry-image
    source:
      aws_access_key_id: ((ecr-aws-key))
      aws_secret_access_key: ((ecr-aws-secret))
      repository: pages-build-container
      aws_region: us-gov-west-1
      tag: pages-((deploy-env))

  - name: pages-release
    type: github-release
    source:
      owner: cloud-gov
      repository: pages-build-container
      access_token: ((gh-access-token))

  - name: slack
  - name: pipeline-tasks
  - name: python
  - name: general-task
  - name: oci-build-task

#!  RESOURCE TYPES

resource_types:
  - name: git
  - name: slack-notification
  - name: pull-request
  - name: registry-image
  - name: github-release