-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy path.gitlab-ci.yml
325 lines (284 loc) · 8.78 KB
/
.gitlab-ci.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
# SPDX-FileCopyrightText: 2024 Magenta ApS <[email protected]>
#
# SPDX-License-Identifier: MPL-2.0
stages:
- lint
- build
- test
- coverage
- release
- docs
- configure
- deploy
# https://docs.gitlab.com/ee/ci/yaml/workflow.html#switch-between-branch-pipelines-and-merge-request-pipelines
.if-default-branch-refs: &if-default-branch-refs
if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
.if-tag: &if-tag
if: '$CI_COMMIT_TAG'
.if-merge-request: &if-merge-request
if: '$CI_MERGE_REQUEST_IID'
# Workflow
###########
workflow:
rules:
- <<: *if-tag
variables:
# Override the IMAGE_SHA variable on tag pipelines to avoid both the default
# branch pipeline and tag pipeline overriding each other's images arbitrarily when
# they are both running at the same time on master.
IMAGE_SHA: ${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}
- <<: *if-default-branch-refs
- <<: *if-merge-request
include:
- project: 'labs/salt-automation'
file:
- '/gitlab-ci-templates/common/rules.v1.yml'
- '/gitlab-ci-templates/common/saltbert.v1.yml'
- '/gitlab-ci-templates/common/docker-build.v1.yml'
- '/gitlab-ci-templates/common/docker-release-meta.v1.yml'
- '/gitlab-ci-templates/common/config-updater-meta.v1.yml'
- "/gitlab-ci-templates/common/conventional-commits-meta.v1.yml"
- "/gitlab-ci-templates/common/conventional-commits-changelog-meta.v1.yml"
.releaserc:
before_script:
- |
cat <<EOF > .releaserc.yaml
branches:
- master
tagFormat: "\${version}-rc1"
plugins:
- - "@semantic-release/commit-analyzer"
- preset: angular
releaseRules:
- type: chore
scope: deps-dev
release: patch
- type: chore
scope: deps
release: patch
- type: build
scope: deps-dev
release: patch
- type: build
scope: deps
release: patch
- "@semantic-release/release-notes-generator"
- "@semantic-release/changelog"
- - "@semantic-release/gitlab"
- assets:
- path: CHANGELOG.md
label: Changelog
EOF
variables:
# Project variables
RELEASE_REGISTRY: docker.io
RELEASE_REGISTRY_IMAGE: index.docker.io/magentaaps/beskaeftigelsesfradrag
IMAGE_SHA: ${CI_REGISTRY_IMAGE}/beskaeftigelsesfradrag:${CI_COMMIT_SHA}
IMAGE_TAG: magentaaps/beskaeftigelsesfradrag:${CI_COMMIT_TAG}
VERSION: PIPELINE
DOCKERFILE: $CI_PROJECT_DIR/docker/Dockerfile
# Lint stage
#############
.lint-default: &lint-default
stage: lint
needs: []
image: python:3.12
Lint Commits:
extends: .lint:commits
variables:
CONFIG: '{ extends: [''@commitlint/config-conventional''], ignores: [(message) => message.includes(''suggestion(s)'')], }'
Lint Python:
<<: *lint-default
before_script:
- pip3 install flake8
- pip3 install flake8-absolute-import
- pip3 install black==24.4.1
- pip3 install isort==5.13.2
#- pip3 install -r django/requirements.txt
script:
- flake8 --max-line-length 88 --exclude=migrations,settings --extend-ignore E226,E203 suila/ --
- black --check --diff --exclude=migrations suila/
- isort -c --profile black --diff --skip migrations suila/
Lint Dockerfiles:
<<: *lint-default
image: hadolint/hadolint:latest-debian
before_script:
- apt-get -y update
- apt-get -y install --no-install-recommends git
script:
- git ls-files --exclude='Dockerfile*' --ignored | xargs --max-lines=1 hadolint
Lint REUSE compliance:
extends: .lint-default
image:
name: fsfe/reuse:latest
entrypoint: [""]
script:
- reuse lint
# Test stage
############
.test-default: &test-default
stage: test
dependencies: []
needs: [ "Build" ]
services:
- name: postgres:16
alias: suila-db
variables:
# Simulate development environment while running tests so we use mockup data
DJANGO_SECRET_KEY: e$s6@0(hs5ja79-&!l7vt^onoe4h^*bv_e4hj&wt5^8*&x76-$
DJANGO_TIMEZONE: Europe/Copenhagen
HOST_DOMAIN: http://localhost
POSTGRES_USER: suila
POSTGRES_PASSWORD: suila
POSTGRES_DB: suila
POSTGRES_HOST: suila-db
ENVIRONMENT: development
SAML_SP_ENTITY_ID: http://localhost:8000/saml/metadata/
SAML_SP_LOGIN_CALLBACK_URI: http://localhost:8000/login/callback/
SAML_SP_LOGOUT_CALLBACK_URI: http://localhost:8000/logout/callback/
SAML_SP_KEY: /ssl/sp/selfsigned.key
SAML_SP_CERTIFICATE: /ssl/sp/selfsigned.crt
SAML_IDP_ENTITY_ID: http://localhost:8080/simplesaml/saml2/idp/metadata.php
SAML_IDP_LOGIN_URI: http://localhost:8080/simplesaml/saml2/idp/SSOService.php
SAML_IDP_LOGOUT_URI: http://localhost:8080/simplesaml/saml2/idp/SingleLogoutService.php
SAML_IDP_CERTIFICATE: /ssl/idp/selfsigned.crt
SAML_IDP_METADATA: http://localhost:8080/simplesaml/saml2/idp/metadata.php
SAML_CONTACT_TECHNICAL_NAME: Tester
SAML_CONTACT_TECHNICAL_EMAIL: [email protected]
SAML_CONTACT_SUPPORT_NAME: Tester
SAML_CONTACT_SUPPORT_EMAIL: [email protected]
SESSION_EXPIRE_SECONDS: 3600
PRISME_HOST: localhost
PRISME_PORT: 22
PRISME_USER: besk
PRISME_PASSWORD: verysecret
PRISME_PROD_PATH: prod
PRISME_TEST_PATH: test
PRISME_USER_NUMBER: 0900
PRISME_MACHINE_ID: 4321
PRISME_POSTING_STATUS_FOLDER: posting_status
PRISME_B_TAX_FOLDER: btax
BYPASS_2FA: 'True'
EBOKS_CLIENT_CERT: /ssl/eboks/client.crt
EBOKS_CLIENT_KEY: /ssl/eboks/client.key
EBOKS_HOST_VERIFY: ""
EBOKS_CLIENT_ID: 99
EBOKS_SYSTEM_ID: 3994
EBOKS_HOST: https://eboxtest.nanoq.gl
image: ${IMAGE_SHA}
before_script:
- mkdir "${CI_PROJECT_DIR}/coverage_output"
artifacts:
when: always
paths:
- "coverage_output/*"
expire_in: 1 day
Unittest:
<<: *test-default
script:
- cd /app
- echo "CI_PROJECT_DIR = ${CI_PROJECT_DIR}"
- echo "${PWD}"
- ls -al
- coverage run manage.py test
- coverage combine
- coverage report --show-missing --fail-under=100
- coverage xml
coverage: '/^TOTAL.+?(\d+\%)$/'
artifacts:
reports:
coverage_report:
coverage_format: cobertura
path: /app/coverage.xml
Mypy:
<<: *test-default
script:
- cd /app
- mypy --config mypy.ini ./
Django check:
<<: *test-default
script:
- cd /app
- python manage.py check suila
# Release stage
###############
Release image:
stage: release
image: alpine
variables:
GIT_STRATEGY: none # We do not need the source code
dependencies: []
before_script:
# install skopeo
- apk add skopeo
# Releases both stable and RC releases.
extends:
- .rules:semver-all
needs:
["Build", "Unittest", "Django check", "Mypy"]
script:
- skopeo copy
--src-creds=${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD}
--dest-creds=${RELEASE_REGISTRY_USER}:${RELEASE_REGISTRY_PASSWORD}
"docker://${IMAGE_SHA}"
"docker://${IMAGE_TAG}"
Release Semantic commit:
extends: .release:semantic-commit
Release Generate changelog:
extends: .release:generate-changelog
Docs Export changelog:
extends:
- .rules:semver-all
- .docs:export-changelog
variables:
CHANGELOG_EXTRA_FLAGS: "--merge-prerelease"
# Configure stage
#################
Configure Test:
stage: configure
extends:
- .rules:semver-all
- .config:endpoint-with-tag
needs: ["Release image"]
variables:
ENDPOINT: beskaeftigelsesfradrag/salt/update-test
Configure Production:
stage: configure
extends:
- .rules:semver-core
- .config:endpoint-with-tag
needs: ["Release image"]
variables:
ENDPOINT: beskaeftigelsesfradrag/salt/update-production
# Deploy stage
##############
Deploy to Test:
stage: deploy
extends:
- .rules:semver-all
- .saltbert
needs: [ "Configure Test" ]
variables:
SALTBERT_ORCHESTRATION: groenland.beskaeftigelsesfradrag.service-test
SALTBERT_URL: https://saltmaster.groenland.magentahosted.dk
rules:
# Matches <version core> from SemVer 2.0.0 BNF grammar. Ex. 2.3.4, but not 2.3.4-rc
- if: $CI_COMMIT_TAG =~ /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/
when: manual # Deploy only prod versions manually
# Matches all of SemVer 2.0.0
- if: $CI_COMMIT_TAG =~ /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/
# Deploy rc-versions automatically
environment:
name: test
Deploy to Production:
stage: deploy
extends:
- .rules:semver-core
- .saltbert
needs: [ "Configure Production" ]
variables:
SALTBERT_ORCHESTRATION: groenland.beskaeftigelsesfradrag.service-prod
SALTBERT_URL: https://saltmaster.groenland.magentahosted.dk
when: manual
environment:
name: production