.drone.yml

# -----------------------------------------------------------------------------
# SETTINGS
# -----------------------------------------------------------------------------

# Drone matrix: Additional ENV vars for substitution - http://docs.drone.io/matrix-builds/
# Will be evaluated BEFORE the YAML is parsed, ONLY strings allowed, NO substitutions ${XXX} here.

matrix:
  include:
    - BUILD_ENV: all
      # The name of the k8s namespaces that these pipelines will target.
      # K8S_DEPLOY_NS_DEV:
      # K8S_DEPLOY_NS_STAGING:
      # K8S_DEPLOY_NS_PRODUCTION:

# YAML Configuration anchors - https://learnxinyminutes.com/docs/yaml/
# Will be evaluated WHILE the YAML is parsed, any valid yaml allowed, substitutions ${XXX} allowed.

alias:
  # The image will be tagged with this, pushed to gcr and referenced with this key in the k8s deployment
  - &IMAGE_DEPLOY_TAG ${DRONE_COMMIT_SHA}

  # The image name, defaults to lowercase repo name <owner>/<project>, e.g. aw/aaa-cab-kubernetes-test
  - &IMAGE_DEPLOY_NAME ${DRONE_REPO,,}

  # The intermediate builder image name
  - &IMAGE_BUILDER_ID ${DRONE_REPO,,}-builder:${DRONE_COMMIT_SHA}

  # The full uniquely tagged app image name
  - &IMAGE_DEPLOY_ID ${DRONE_REPO,,}:${DRONE_COMMIT_SHA}

  # Defines which branches will trigger a docker image push our Google Cloud Registry (tags are always published)
  - &GCR_PUBLISH_BRANCHES [dev, master, aj/pooling-improvements, mr/aj-review]

  # Docker registry publish default settings
  - &GCR_REGISTRY_SETTINGS
    image: plugins/gcr
    repo: a3cloud-192413/${DRONE_REPO,,}
    registry: eu.gcr.io
    secrets:
      - source: AAA_GCR_SERVICE_ACCOUNT_JSON
        target: google_credentials
    # local short-time-cache: don't cleanup any image layers after pushing
    purge: false
    # force compress of docker build context
    compress: true
    volumes: # mount needed to push the already build container
      - /var/run/docker.sock:/var/run/docker.sock

  #   # Deployment default settings
  #   - &K8S_DEPLOY_SETTINGS
  #     image: eu.gcr.io/a3cloud-192413/aw/aaa-drone-kubernetes:latest
  #     pull: true
  #     secrets:
  #     - source: AAA_K8S_SERVER
  #       target: KUBERNETES_SERVER
  #     - source: AAA_K8S_SERVICE_ACCOUNT_CRT
  #       target: KUBERNETES_CERT
  #     - source: AAA_K8S_SERVICE_ACCOUNT_TOKEN
  #       target: KUBERNETES_TOKEN
  #     - source: AAA_GCR_SERVICE_ACCOUNT_JSON
  #       target: GCR_SERVICE_ACCOUNT
  #     deployment: app
  #     repo: eu.gcr.io/a3cloud-192413/${DRONE_REPO,,}
  #     container: [app]
  #     tag: *IMAGE_DEPLOY_TAG
  #     gcr_service_account_email: drone-ci-a3cloud@a3cloud-192413.iam.gserviceaccount.com
  #     mgmt_repo: https://git.allaboutapps.at/scm/aw/a3cloud-mgmt.git
  #     mgmt_git_email: infrastructure+drone@allaboutapps.at

  # ENV variables for executing within the test env (similar to the env in docker-compose.yml)
  - &TEST_ENV
    CI: ${CI}

    # required: env for main working database, service
    # default for sql-migrate (target development) and psql cli tool
    PGDATABASE: &PGDATABASE "development"
    PGUSER: &PGUSER "dbuser"
    PGPASSWORD: &PGPASSWORD "dbpass"
    PGHOST: &PGHOST "postgres"
    PGPORT: &PGPORT "5432"
    PGSSLMODE: &PGSSLMODE "disable"

    # optional: env for sql-boiler (ability to generate models out of a "spec" database)
    # sql-boiler should operate on a "spec" database only
    PSQL_DBNAME: "spec"
    PSQL_USER: *PGUSER
    PSQL_PASS: *PGPASSWORD
    PSQL_HOST: *PGHOST
    PSQL_PORT: *PGPORT
    PSQL_SSLMODE: *PGSSLMODE

    # required for drone: project root directory, used for relative path resolution (e.g. fixtures)
    PROJECT_ROOT_DIR: /app

    # docker run related.
    SERVER_MANAGEMENT_SECRET: "mgmt-secret"

  # Which build events should trigger the main pipeline (defaults to all)
  - &BUILD_EVENTS [push, pull_request, tag]

  # Pipeline merge helper: only execute if build event received
  - &WHEN_BUILD_EVENT
    when:
      event: *BUILD_EVENTS

# The actual pipeline building our product
pipeline:
  # ---------------------------------------------------------------------------
  # BUILD
  # ---------------------------------------------------------------------------

  "database connection":
    group: build
    image: postgres:12.4-alpine # should be the same version as used in .drone.yml, .github/workflows, Dockerfile and live
    commands:
      # wait for postgres service to become available
      - |
        until psql -U $PGUSER -d $PGDATABASE -h postgres \
         -c "SELECT 1;" >/dev/null 2>&1; do sleep 1; done
      # query the database
      - |
        psql -U $PGUSER -d $PGDATABASE -h postgres \
          -c "SELECT name, setting FROM pg_settings;"
    environment: *TEST_ENV
    <<: *WHEN_BUILD_EVENT

  "docker build (target builder)":
    group: build
    image: docker:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      IMAGE_TAG: *IMAGE_BUILDER_ID
    commands:
      - "docker build --target builder --compress -t $${IMAGE_TAG} ."
    <<: *WHEN_BUILD_EVENT

  "docker build (target integresql)":
    group: build-app
    image: docker:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      IMAGE_TAG: *IMAGE_DEPLOY_ID
    commands:
      - "docker build --target integresql --compress -t $${IMAGE_TAG} ."
    <<: *WHEN_BUILD_EVENT

  # ---------------------------------------------------------------------------
  # CHECK
  # ---------------------------------------------------------------------------

  "trivy scan":
    group: pre-test
    image: aquasec/trivy:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /server/drone/trivy-cache:/root/.cache/
    environment:
      IMAGE_TAG: *IMAGE_DEPLOY_ID
    commands:
      # Print report
      - "trivy image --exit-code 0 --no-progress $${IMAGE_TAG}"
      # Fail on severity HIGH and CRITICAL
      - "trivy image --exit-code 1 --severity HIGH,CRITICAL --no-progress --ignore-unfixed $${IMAGE_TAG}"
    <<: *WHEN_BUILD_EVENT

  "build & diff":
    group: pre-test
    image: *IMAGE_BUILDER_ID
    commands:
      - cd $PROJECT_ROOT_DIR # reuse go build cache from Dockerfile builder stage
      - make tidy
      - make build
      - /bin/cp -Rf $PROJECT_ROOT_DIR/* $DRONE_WORKSPACE # switch back to drone workspace ...
      - cd $DRONE_WORKSPACE
      - "git diff --exit-code" # ... for git diffing (otherwise not possible as .git is .dockerignored)
    environment: *TEST_ENV
    <<: *WHEN_BUILD_EVENT

  "info":
    group: test
    image: *IMAGE_BUILDER_ID
    commands:
      - cd $PROJECT_ROOT_DIR # reuse go build cache from Dockerfile builder stage
      - make info
    environment: *TEST_ENV
    <<: *WHEN_BUILD_EVENT

  "test":
    group: test
    image: *IMAGE_BUILDER_ID
    commands:
      - cd $PROJECT_ROOT_DIR # reuse go build cache from Dockerfile builder stage
      - make test
    environment: *TEST_ENV
    <<: *WHEN_BUILD_EVENT

  # "swagger-codegen-cli":
  #   group: test
  #   # https:/swagger-api/swagger-codegen/blob/master/modules/swagger-codegen-cli/Dockerfile
  #   image: swaggerapi/swagger-codegen-cli
  #   commands:
  #     # run the main swagger.yml validation.
  #     - "java -jar /opt/swagger-codegen-cli/swagger-codegen-cli.jar validate -i ./api/swagger.yml"
  #   <<: *WHEN_BUILD_EVENT

  "binary: deps":
    group: test
    image: *IMAGE_BUILDER_ID
    commands:
      - cd $PROJECT_ROOT_DIR
      - make get-embedded-modules-count
      - make get-embedded-modules
    environment: *TEST_ENV
    <<: *WHEN_BUILD_EVENT

  "binary: licenses":
    group: test
    image: *IMAGE_BUILDER_ID
    commands:
      - cd $PROJECT_ROOT_DIR
      - make get-licenses
    environment: *TEST_ENV
    <<: *WHEN_BUILD_EVENT

  # "docker run (target app)":
  #   group: test
  #   image: docker:latest
  #   volumes:
  #     - /var/run/docker.sock:/var/run/docker.sock
  #   environment:
  #     <<: *TEST_ENV
  #     IMAGE_TAG: *IMAGE_DEPLOY_ID
  #   commands:
  #     # Note: NO network related tests are possible here, dnd can just
  #     # run sibling containers. We have no possibility to connect them
  #     # into the drone user defined per build docker network!
  #     # https:/drone-plugins/drone-docker/issues/193
  #     # https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-docker-for-ci/
  #     - (env | grep "^\S*=" | grep -v -e "DRONE=" -e "DRONE_" -e "CI_" -e "CI=" -e "HOME=" -e "HOSTNAME=" -e "SHELL=" -e "PWD=" -e "PATH=") > .hostenv
  #     - cat .hostenv
  #     - "docker run --env-file .hostenv $${IMAGE_TAG} help"
  #     - "docker run --env-file .hostenv $${IMAGE_TAG} -v"
  #     - "docker run --env-file .hostenv $${IMAGE_TAG} env"
  #   <<: *WHEN_BUILD_EVENT

  # ---------------------------------------------------------------------------
  # PUBLISH
  # ---------------------------------------------------------------------------

  # Built a allowed branch? Push to cloud registry
  "publish ${DRONE_BRANCH}_${DRONE_COMMIT_SHA:0:10}":
    group: publish
    <<: *GCR_REGISTRY_SETTINGS
    tags:
      - build_${DRONE_BUILD_NUMBER}
      - ${DRONE_BRANCH/\//-}_${DRONE_COMMIT_SHA:0:10}
      - *IMAGE_DEPLOY_TAG
      - latest
      - ${DRONE_BRANCH/\//-}
      - '${DRONE_COMMIT_SHA:0:10}'
    when:
      branch: *GCR_PUBLISH_BRANCHES
      event: *BUILD_EVENTS

  # Built a tag? Push to cloud registry
  "publish tag_${DRONE_COMMIT_SHA:0:10}":
    group: publish
    <<: *GCR_REGISTRY_SETTINGS
    tags:
      - build_${DRONE_BUILD_NUMBER}
      - tag_${DRONE_COMMIT_SHA:0:10}
      - *IMAGE_DEPLOY_TAG
      - latest
      - ${DRONE_TAG}
      - ${DRONE_COMMIT_SHA:0:10}
    when:
      event: tag

  # ---------------------------------------------------------------------------
  # DEPLOYMENT
  # ---------------------------------------------------------------------------

  #   # autodeploy dev if it hits the branch
  #   "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_DEV} (auto)":
  #     <<: *K8S_DEPLOY_SETTINGS
  #     namespace: ${K8S_DEPLOY_NS_DEV}
  #     mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_DEV}/app.deployment.yaml
  #     when:
  #       event: *BUILD_EVENTS
  #       branch: [dev]

  #   # promote dev through "drone deploy <repo> <build> dev"
  #   "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_DEV} (promote)":
  #     <<: *K8S_DEPLOY_SETTINGS
  #     namespace: ${K8S_DEPLOY_NS_DEV}
  #     mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_DEV}/app.deployment.yaml
  #     when:
  #       environment: dev
  #       event: deployment

  #   # autodeploy staging if it hits the branch
  #   "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_STAGING} (auto)":
  #     <<: *K8S_DEPLOY_SETTINGS
  #     namespace: ${K8S_DEPLOY_NS_STAGING}
  #     mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_STAGING}/app.deployment.yaml
  #     when:
  #       event: *BUILD_EVENTS
  #       branch: [staging]

  #   # promote staging through "drone deploy <repo> <build> staging"
  #   "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_STAGING} (promote)":
  #     <<: *K8S_DEPLOY_SETTINGS
  #     namespace: ${K8S_DEPLOY_NS_STAGING}
  #     mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_STAGING}/app.deployment.yaml
  #     when:
  #       environment: staging
  #       event: deployment

  #   # promote production through "drone deploy <repo> <build> production"
  #   "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_PRODUCTION} (promote)":
  #     <<: *K8S_DEPLOY_SETTINGS
  #     namespace: ${K8S_DEPLOY_NS_PRODUCTION}
  #     mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_PRODUCTION}/app.deployment.yaml
  #     when:
  #       environment: production
  #       event: deployment

# Long living services where the startup order does not matter (otherwise use detach: true)
services:
  # ---------------------------------------------------------------------------
  # SERVICES
  # ---------------------------------------------------------------------------

  "env":
    image: alpine
    commands:
      - "env | sort"

  "postgres":
    image: postgres:12.4-alpine # should be the same version as used in .drone.yml, .github/workflows, Dockerfile and live
    environment:
      POSTGRES_DB: *PGDATABASE
      POSTGRES_USER: *PGUSER
      POSTGRES_PASSWORD: *PGPASSWORD
      # ATTENTION
      # fsync=off, synchronous_commit=off and full_page_writes=off
      # gives us a major speed up during local development and testing (~30%),
      # however you should NEVER use these settings in PRODUCTION unless
      # you want to have CORRUPTED data.
      # DO NOT COPY/PASTE THIS BLINDLY.
      # YOU HAVE BEEN WARNED.
      # Apply some performance improvements to pg as these guarantees are not needed while running integration tests
    command: "-c 'shared_buffers=128MB' -c 'fsync=off' -c 'synchronous_commit=off' -c 'full_page_writes=off' -c 'max_connections=100' -c 'client_min_messages=warning'"
    <<: *WHEN_BUILD_EVENT