.drone.yml

# -----------------------------------------------------------------------------
# SETTINGS
# -----------------------------------------------------------------------------

# Drone matrix: Additional ENV vars for substitution - http://docs.drone.io/matrix-builds/
# Will be evaluated BEFORE the YAML is parsed, ONLY strings allowed, NO substitutions ${XXX} here.

matrix:
  include:
    - BUILD_ENV: all
      # The name of the k8s namespaces that these pipelines will target.
      # K8S_DEPLOY_NS_DEV:
      # K8S_DEPLOY_NS_STAGING:
      # K8S_DEPLOY_NS_PRODUCTION:

# YAML Configuration anchors - https://learnxinyminutes.com/docs/yaml/
# Will be evaluated WHILE the YAML is parsed, any valid yaml allowed, substitutions ${XXX} allowed.

alias:
  # The image will be tagged with this, pushed to gcr and referenced with this key in the k8s deployment
  - &IMAGE_DEPLOY_TAG ${DRONE_COMMIT_SHA}

  # The image name, defaults to lowercase repo name <owner>/<project>, e.g. aw/aaa-cab-kubernetes-test
  - &IMAGE_DEPLOY_NAME ${DRONE_REPO,,}

  # The intermediate builder image name
  - &IMAGE_BUILDER_ID ${DRONE_REPO,,}-builder:${DRONE_COMMIT_SHA}

  # The full uniquely tagged app image name
  - &IMAGE_DEPLOY_ID ${DRONE_REPO,,}:${DRONE_COMMIT_SHA}

  #   # Defines which branches will trigger a docker image push our Google Cloud Registry (tags are always published)
  #   - &GCR_PUBLISH_BRANCHES [dev, staging, master]

  #   # Docker registry publish default settings
  #   - &GCR_REGISTRY_SETTINGS
  #     image: plugins/gcr
  #     repo: a3cloud-192413/${DRONE_REPO,,}
  #     registry: eu.gcr.io
  #     secrets:
  #       - source: AAA_GCR_SERVICE_ACCOUNT_JSON
  #         target: google_credentials
  #     # local short-time-cache: don't cleanup any image layers after pushing
  #     purge: false
  #     # force compress of docker build context
  #     compress: true
  #     volumes: # mount needed to push the already build container
  #       - /var/run/docker.sock:/var/run/docker.sock

  #   # Deployment default settings
  #   - &K8S_DEPLOY_SETTINGS
  #     image: eu.gcr.io/a3cloud-192413/aw/aaa-drone-kubernetes:latest
  #     pull: true
  #     secrets:
  #     - source: AAA_K8S_SERVER
  #       target: KUBERNETES_SERVER
  #     - source: AAA_K8S_SERVICE_ACCOUNT_CRT
  #       target: KUBERNETES_CERT
  #     - source: AAA_K8S_SERVICE_ACCOUNT_TOKEN
  #       target: KUBERNETES_TOKEN
  #     - source: AAA_GCR_SERVICE_ACCOUNT_JSON
  #       target: GCR_SERVICE_ACCOUNT
  #     deployment: app
  #     repo: eu.gcr.io/a3cloud-192413/${DRONE_REPO,,}
  #     container: [app]
  #     tag: *IMAGE_DEPLOY_TAG
  #     gcr_service_account_email: drone-ci-a3cloud@a3cloud-192413.iam.gserviceaccount.com
  #     mgmt_repo: https://git.allaboutapps.at/scm/aw/a3cloud-mgmt.git
  #     mgmt_git_email: infrastructure+drone@allaboutapps.at

  # ENV variables for executing within the test env (similar to the env in docker-compose.yml)
  - &TEST_ENV
    CI: ${CI}

    # required: env for main working database, service
    # default for sql-migrate (target development) and psql cli tool
    PGDATABASE: &PGDATABASE "development"
    PGUSER: &PGUSER "dbuser"
    PGPASSWORD: &PGPASSWORD "dbpass"
    PGHOST: &PGHOST "postgres"
    PGPORT: &PGPORT "5432"
    PGSSLMODE: &PGSSLMODE "disable"

    # optional: env for sql-boiler (ability to generate models out of a "spec" database)
    # sql-boiler should operate on a "spec" database only
    PSQL_DBNAME: "spec"
    PSQL_USER: *PGUSER
    PSQL_PASS: *PGPASSWORD
    PSQL_HOST: *PGHOST
    PSQL_PORT: *PGPORT
    PSQL_SSLMODE: *PGSSLMODE

    # required for drone: project root directory, used for relative path resolution (e.g. fixtures)
    PROJECT_ROOT_DIR: /app

    # docker run related.
    SERVER_MANAGEMENT_SECRET: "mgmt-secret"

  # Which build events should trigger the main pipeline (defaults to all)
  - &BUILD_EVENTS [push, pull_request, tag]

  # Pipeline merge helper: only execute if build event received
  - &WHEN_BUILD_EVENT
    when:
      event: *BUILD_EVENTS

# The actual pipeline building our product
pipeline:
  # ---------------------------------------------------------------------------
  # BUILD
  # ---------------------------------------------------------------------------

  "database connection":
    group: build
    image: postgres:12.4-alpine # should be the same version as used in .drone.yml, .github/workflows, Dockerfile and live
    commands:
      # wait for postgres service to become available
      - |
        until psql -U $PGUSER -d $PGDATABASE -h postgres \
         -c "SELECT 1;" >/dev/null 2>&1; do sleep 1; done
      # query the database
      - |
        psql -U $PGUSER -d $PGDATABASE -h postgres \
          -c "SELECT name, setting FROM pg_settings;"
    environment: *TEST_ENV
    <<: *WHEN_BUILD_EVENT

  "docker build (target builder)":
    group: build
    image: docker:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      IMAGE_TAG: *IMAGE_BUILDER_ID
    commands:
      - "docker build --target builder --compress -t $${IMAGE_TAG} ."
    <<: *WHEN_BUILD_EVENT

  "docker build (target app)":
    group: build-app
    image: docker:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      IMAGE_TAG: *IMAGE_DEPLOY_ID
    commands:
      - "docker build --target app --compress -t $${IMAGE_TAG} ."
    <<: *WHEN_BUILD_EVENT

  # ---------------------------------------------------------------------------
  # CHECK
  # ---------------------------------------------------------------------------

  "trivy scan":
    group: pre-test
    image: aquasec/trivy:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /server/drone/trivy-cache:/root/.cache/
    environment:
      IMAGE_TAG: *IMAGE_DEPLOY_ID
    commands:
      # Print report
      - "trivy image --exit-code 0 --no-progress $${IMAGE_TAG}"
      # Fail on severity HIGH and CRITICAL
      - "trivy image --exit-code 1 --severity HIGH,CRITICAL --no-progress --ignore-unfixed $${IMAGE_TAG}"
    <<: *WHEN_BUILD_EVENT

  "build & diff":
    group: pre-test
    image: *IMAGE_BUILDER_ID
    commands:
      - cd $PROJECT_ROOT_DIR # reuse go build cache from Dockerfile builder stage
      - make tidy
      - make build
      - /bin/cp -Rf $PROJECT_ROOT_DIR/* $DRONE_WORKSPACE # switch back to drone workspace ...
      - cd $DRONE_WORKSPACE
      - "git diff --exit-code" # ... for git diffing (otherwise not possible as .git is .dockerignored)
    environment: *TEST_ENV
    <<: *WHEN_BUILD_EVENT

  "info":
    group: test
    image: *IMAGE_BUILDER_ID
    commands:
      - cd $PROJECT_ROOT_DIR # reuse go build cache from Dockerfile builder stage
      - make info
    environment: *TEST_ENV
    <<: *WHEN_BUILD_EVENT

  "test":
    group: test
    image: *IMAGE_BUILDER_ID
    commands:
      - cd $PROJECT_ROOT_DIR # reuse go build cache from Dockerfile builder stage
      - make test
    environment: *TEST_ENV
    <<: *WHEN_BUILD_EVENT

  "git-compare-go-starter":
    group: test
    image: *IMAGE_BUILDER_ID
    commands:
      - make git-compare-go-starter
    environment: *TEST_ENV
    <<: *WHEN_BUILD_EVENT

  "swagger-codegen-cli":
    group: test
    # https://github.com/swagger-api/swagger-codegen/blob/master/modules/swagger-codegen-cli/Dockerfile
    image: swaggerapi/swagger-codegen-cli
    commands:
      # run the main swagger.yml validation.
      - "java -jar /opt/swagger-codegen-cli/swagger-codegen-cli.jar validate -i ./api/swagger.yml"
    <<: *WHEN_BUILD_EVENT

  "binary: deps":
    group: test
    image: *IMAGE_BUILDER_ID
    commands:
      - cd $PROJECT_ROOT_DIR
      - make get-embedded-modules-count
      - make get-embedded-modules
    environment: *TEST_ENV
    <<: *WHEN_BUILD_EVENT

  "binary: licenses":
    group: test
    image: *IMAGE_BUILDER_ID
    commands:
      - cd $PROJECT_ROOT_DIR
      - make get-licenses
    environment: *TEST_ENV
    secrets: ["GITHUB_TOKEN"] # TOKEN required by license check.
    <<: *WHEN_BUILD_EVENT

  "docker run (target app)":
    group: test
    image: docker:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      <<: *TEST_ENV
      IMAGE_TAG: *IMAGE_DEPLOY_ID
    commands:
      # Note: NO network related tests are possible here, dnd can just
      # run sibling containers. We have no possibility to connect them
      # into the drone user defined per build docker network!
      # https://github.com/drone-plugins/drone-docker/issues/193
      # https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-docker-for-ci/
      - (env | grep "=" | grep -v -e "DRONE=" -e "DRONE_" -e "CI_" -e "CI=" -e "HOME=" -e "HOSTNAME=" -e "SHELL=" -e "PWD=" -e "PATH=") > .hostenv
      - cat .hostenv
      - "docker run --env-file .hostenv $${IMAGE_TAG} help"
      - "docker run --env-file .hostenv $${IMAGE_TAG} env"
    <<: *WHEN_BUILD_EVENT

  # ---------------------------------------------------------------------------
  # PUBLISH
  # ---------------------------------------------------------------------------

#   # Built a allowed branch? Push to cloud registry
#   "publish ${DRONE_BRANCH}_${DRONE_COMMIT_SHA:0:10}":
#     group: publish
#     <<: *GCR_REGISTRY_SETTINGS
#     tags:
#       - build_${DRONE_BUILD_NUMBER}
#       - ${DRONE_BRANCH/\//-}_${DRONE_COMMIT_SHA:0:10}
#       - *IMAGE_DEPLOY_TAG
#       - latest
#       - ${DRONE_BRANCH/\//-}
#       - '${DRONE_COMMIT_SHA:0:10}'
#     when:
#       branch: *GCR_PUBLISH_BRANCHES
#       event: *BUILD_EVENTS

#   # Built a tag? Push to cloud registry
#   "publish tag_${DRONE_COMMIT_SHA:0:10}":
#     group: publish
#     <<: *GCR_REGISTRY_SETTINGS
#     tags:
#       - build_${DRONE_BUILD_NUMBER}
#       - tag_${DRONE_COMMIT_SHA:0:10}
#       - *IMAGE_DEPLOY_TAG
#       - latest
#       - ${DRONE_TAG}
#       - ${DRONE_COMMIT_SHA:0:10}
#     when:
#       event: tag

# ---------------------------------------------------------------------------
# DEPLOYMENT
# ---------------------------------------------------------------------------

#   # autodeploy dev if it hits the branch
#   "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_DEV} (auto)":
#     <<: *K8S_DEPLOY_SETTINGS
#     namespace: ${K8S_DEPLOY_NS_DEV}
#     mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_DEV}/app.deployment.yaml
#     when:
#       event: *BUILD_EVENTS
#       branch: [dev]

#   # promote dev through "drone deploy <repo> <build> dev"
#   "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_DEV} (promote)":
#     <<: *K8S_DEPLOY_SETTINGS
#     namespace: ${K8S_DEPLOY_NS_DEV}
#     mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_DEV}/app.deployment.yaml
#     when:
#       environment: dev
#       event: deployment

#   # autodeploy staging if it hits the branch
#   "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_STAGING} (auto)":
#     <<: *K8S_DEPLOY_SETTINGS
#     namespace: ${K8S_DEPLOY_NS_STAGING}
#     mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_STAGING}/app.deployment.yaml
#     when:
#       event: *BUILD_EVENTS
#       branch: [staging]

#   # promote staging through "drone deploy <repo> <build> staging"
#   "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_STAGING} (promote)":
#     <<: *K8S_DEPLOY_SETTINGS
#     namespace: ${K8S_DEPLOY_NS_STAGING}
#     mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_STAGING}/app.deployment.yaml
#     when:
#       environment: staging
#       event: deployment

#   # promote production through "drone deploy <repo> <build> production"
#   "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_PRODUCTION} (promote)":
#     <<: *K8S_DEPLOY_SETTINGS
#     namespace: ${K8S_DEPLOY_NS_PRODUCTION}
#     mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_PRODUCTION}/app.deployment.yaml
#     when:
#       environment: production
#       event: deployment

# ---------------------------------------------------------------------------
# DEPLOYMENT go-starter
# Purpose: go-starter drone specific publish and deployment steps
# NOTE: you do not need to uncomment them for our customer projects
# These steps won't be executed unless we work in the main "AW/go-starter" repo
# ---------------------------------------------------------------------------

  "go-starter publish ${DRONE_BRANCH}_${DRONE_COMMIT_SHA:0:10}":
    group: go-starter-publish
    image: plugins/gcr
    repo: a3cloud-192413/${DRONE_REPO,,}
    registry: eu.gcr.io
    secrets:
      - source: AAA_GCR_SERVICE_ACCOUNT_JSON
        target: google_credentials
    # local short-time-cache: don't cleanup any image layers after pushing
    purge: false
    # force compress of docker build context
    compress: true
    volumes: # mount needed to push the already build container
      - /var/run/docker.sock:/var/run/docker.sock
    tags:
      - build_${DRONE_BUILD_NUMBER}
      - ${DRONE_BRANCH/\//-}_${DRONE_COMMIT_SHA:0:10}
      - *IMAGE_DEPLOY_TAG
      - latest
      - ${DRONE_BRANCH/\//-}
      - '${DRONE_COMMIT_SHA:0:10}'
    when:
      repo: AW/go-starter
      branch: [master, mr/a3cloud, mr/liveness-probing]
      event: [push, pull_request, tag]

  "go-starter deploy ${DRONE_COMMIT_SHA:0:10} to allaboutapps-go-starter-dev (auto)":
    group: go-starter-deploy
    image: eu.gcr.io/a3cloud-192413/aw/aaa-drone-kubernetes:latest
    pull: true
    secrets:
    - source: AAA_K8S_SERVER
      target: KUBERNETES_SERVER
    - source: AAA_K8S_SERVICE_ACCOUNT_CRT
      target: KUBERNETES_CERT
    - source: AAA_K8S_SERVICE_ACCOUNT_TOKEN
      target: KUBERNETES_TOKEN
    - source: AAA_GCR_SERVICE_ACCOUNT_JSON
      target: GCR_SERVICE_ACCOUNT
    deployment: app
    repo: eu.gcr.io/a3cloud-192413/${DRONE_REPO,,}
    container: [app]
    tag: *IMAGE_DEPLOY_TAG
    gcr_service_account_email: drone-ci-a3cloud@a3cloud-192413.iam.gserviceaccount.com
    mgmt_repo: https://git.allaboutapps.at/scm/aw/a3cloud-mgmt.git
    mgmt_git_email: infrastructure+drone@allaboutapps.at
    namespace: allaboutapps-go-starter-dev
    mgmt_deployment_yaml: namespaces/allaboutapps-go-starter-dev/app.deployment.yaml
    when:
      repo: AW/go-starter
      branch: [master, mr/a3cloud, mr/liveness-probing]
      event: [push, pull_request, tag]

# Long living services where the startup order does not matter (otherwise use detach: true)
services:
  # ---------------------------------------------------------------------------
  # SERVICES
  # ---------------------------------------------------------------------------

  "env":
    image: alpine
    commands:
      - "env | sort"

  "postgres":
    image: postgres:12.4-alpine # should be the same version as used in .drone.yml, .github/workflows, Dockerfile and live
    environment:
      POSTGRES_DB: *PGDATABASE
      POSTGRES_USER: *PGUSER
      POSTGRES_PASSWORD: *PGPASSWORD
      # ATTENTION
      # fsync=off, synchronous_commit=off and full_page_writes=off
      # gives us a major speed up during local development and testing (~30%),
      # however you should NEVER use these settings in PRODUCTION unless
      # you want to have CORRUPTED data.
      # DO NOT COPY/PASTE THIS BLINDLY.
      # YOU HAVE BEEN WARNED.
      # Apply some performance improvements to pg as these guarantees are not needed while running integration tests
    command: "-c 'shared_buffers=128MB' -c 'fsync=off' -c 'synchronous_commit=off' -c 'full_page_writes=off' -c 'max_connections=100' -c 'client_min_messages=warning'"
    <<: *WHEN_BUILD_EVENT

  "integresql":
    image: allaboutapps/integresql:latest
    environment:
      PGHOST: *PGHOST
      PGUSER: *PGUSER
      PGPASSWORD: *PGPASSWORD
    <<: *WHEN_BUILD_EVENT

  "mailhog":
    image: mailhog/mailhog
    <<: *WHEN_BUILD_EVENT