.gitlab-ci.yml

stages:
  - build
  - test
  - push
  - deploy

include:
  - project: 'ULB/it-service/base-images/ci-template'
    ref: 'main'
    file: 'variables.yml'
  - project: 'ULB/it-service/base-images/ci-template'
    ref: 'main'
    file: 'defaults/dind.yml'
  - project: 'ULB/it-service/base-images/ci-template'
    ref: 'main'
    file: 'build/build-container-with-cache.yml'
  - project: 'ULB/it-service/base-images/ci-template'
    ref: 'main'
    file: 'security/security.yml'
  - project: 'ULB/it-service/base-images/ci-template'
    ref: 'main'
    file: 'security/security-container.yml'
  - project: 'ULB/it-service/base-images/ci-template'
    ref: 'main'
    file: 'push/push-container-gitlab.yml'
  - project: 'ULB/it-service/base-images/ci-template'
    ref: 'main'
    file: 'push/push-signed-container-harbor.yml'
  - project: 'ULB/it-service/base-images/ci-template'
    ref: 'main'
    file: 'pipelines/helm-charts.yml'

variables:
  HELM_CHART_NAME: "metadata-extraktor"
  HELM_BUILD_DIR: "$CI_PROJECT_DIR/build"

.default_rules:
  rules:
    - when: always

.default_rules_prod:
  rules:
    - if: $CI_COMMIT_BRANCH != "prod"
      when: never
    - !reference [.default_rules, rules]

test:
  image:
    name: "$CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX/perl:5.36-bullseye"
  script:
    - apt update
    - apt install -y poppler-utils
    - cpanm -nq --installdeps .
    - perl Makefile.PL
    - make test

build-container-with-cache:
  variables:
    CI_DOCKERFILE_PATH: "./"
  rules:
    - !reference [.default_rules, rules]

container_scanning:
  needs:
    - build-container-with-cache
  rules:
    - !reference [.default_rules, rules]

push-container-gitlab:
  needs:
    - test
    - container_scanning
    - kics-iac-sast
    - secret_detection
  rules:
    - !reference [.default_rules, rules]

push-container-harbor:
  needs:
    - test
    - container_scanning
    - kics-iac-sast
    - secret_detection
  rules:
    - !reference [.default_rules, rules]

prepare-for-signing:
  rules:
    - !reference [.default_rules, rules]

sign-container-harbor:
  needs:
    - push-container-harbor
  rules:
    - !reference [.default_rules, rules]

helm build:
  rules:
    - changes:
      - metadata-extraktor/../.

helm push:
  rules:
    - changes:
      - metadata-extraktor/../.

staging dry-run:
  stage: deploy
  needs:
    - sign-container-harbor
    - helm lint
  environment:
    name: staging
    url: https://scdh-services-staging.uni-muenster.de
  variables:
    KUBE_CONTEXT: SCDH/ag-3d/metadata-extraktor:scdh-universe-stage
  rules:
    - !reference [.default_rules, rules]
  before_script:
    - echo "$HARBOR_PASSWORD" | helm registry login "${HARBOR_URL}" --username "${HARBOR_USERNAME}" --password-stdin
    - kubectl config use-context $KUBE_CONTEXT && chmod 0400 $KUBECONFIG
  script:
    - helm dependency update metadata-extraktor
    - helm upgrade --install metadata-extraktor ./metadata-extraktor -n=scdh-universe -f installs/stage-scdh-universe.yaml --set image.imageCredentials.username=$HARBOR_USERNAME --set image.imageCredentials.password=$HARBOR_PASSWORD --dry-run  > /dev/null
  after_script:
    - helm registry logout "${HARBOR_URL}"

staging deploy:
  stage: deploy
  needs:
    - sign-container-harbor
    - helm lint
    - staging dry-run
  environment:
    name: staging
    url: https://scdh-services-staging.uni-muenster.de
  variables:
    KUBE_CONTEXT: SCDH/ag-3d/metadata-extraktor:scdh-universe-stage
  rules:
    - !reference [.default_rules, rules]
  before_script:
    - echo "$HARBOR_PASSWORD" | helm registry login "${HARBOR_URL}" --username "${HARBOR_USERNAME}" --password-stdin
    - kubectl config use-context $KUBE_CONTEXT && chmod 0400 $KUBECONFIG
  script:
    - helm dependency update metadata-extraktor
    - helm upgrade --install metadata-extraktor metadata-extraktor/ -n=scdh-universe -f installs/stage-scdh-universe.yaml --set image.imageCredentials.username=$HARBOR_USERNAME --set image.imageCredentials.password=$HARBOR_PASSWORD > /dev/null
  after_script:
    - helm registry logout "${HARBOR_URL}"

production dry-run:
  stage: deploy
  needs:
    - sign-container-harbor
    - helm lint
  environment:
    name: production
    url: https://ag3d-metadata-extraktor.uni-muenster.de
  variables:
    KUBE_CONTEXT: SCDH/ag-3d/metadata-extraktor:scdh-universe-prod
  rules:
    - !reference [.default_rules_prod, rules]
  before_script:
    - echo "$HARBOR_PASSWORD" | helm registry login "${HARBOR_URL}" --username "${HARBOR_USERNAME}" --password-stdin
    - kubectl config use-context $KUBE_CONTEXT && chmod 0400 $KUBECONFIG
  script:
    - helm dependency update metadata-extraktor
    - helm upgrade --install metadata-extraktor metadata-extraktor/ -n=scdh-universe -f installs/stage-scdh-universe.yaml --set image.imageCredentials.username=$HARBOR_USERNAME --set image.imageCredentials.password=$HARBOR_PASSWORD --dry-run  > /dev/null
  after_script:
    - helm registry logout "${HARBOR_URL}"

production deploy:
  stage: deploy
  needs:
    - sign-container-harbor
    - helm lint
    - production dry-run
  environment:
    name: production
    url: https://ag3d-metadata-extraktor.uni-muenster.de
  variables:
    KUBE_CONTEXT: SCDH/ag-3d/metadata-extraktor:scdh-universe-prod
  rules:
    - !reference [.default_rules_prod, rules]
  before_script:
    - echo "$HARBOR_PASSWORD" | helm registry login "${HARBOR_URL}" --username "${HARBOR_USERNAME}" --password-stdin
    - kubectl config use-context $KUBE_CONTEXT && chmod 0400 $KUBECONFIG
  script:
    - helm dependency update metadata-extraktor
    - helm upgrade --install metadata-extraktor metadata-extraktor/ -n=scdh-universe -f installs/prod-scdh-universe.yaml --set image.imageCredentials.username=$HARBOR_USERNAME --set image.imageCredentials.password=$HARBOR_PASSWORD > /dev/null
  after_script:
    - helm registry logout "${HARBOR_URL}"