.gitlab-ci.yml

---
stages:
  - pre-build
  - test
  - build
  - deploy-beta
  - deploy-staging
  - deploy-production

image: cimg/openjdk:21.0.9-browsers
workflow:
  rules:
    - if: $CI_COMMIT_TAG
      when: always
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: always
    - when: never

# Disable the Gradle daemon for Continuous Integration servers as correctness
# is usually a priority over speed in CI environments. Using a fresh
# runtime for each build is more reliable since the runtime is completely
# isolated from any previous builds.
variables:
  GRADLE_OPTS: "-Dorg.gradle.daemon=false"
  GRADLE_USER_HOME: $CI_PROJECT_DIR/.gradle
  SERVICE_NAME: faidare-cards
  JAR_PATH: "backend/build/libs/faidare.jar"
  GIT_DEPTH: 0
  IMAGE_TAG: $CI_COMMIT_REF_SLUG
  ELASTIC_VERSION: "7.17.6"
  DOCKER_OPTS: "--mtu=1450"

# Gradle cache for all jobs
# cache:
#   key: "$CI_COMMIT_REF_NAME"
#   paths:
#     - ".gradle"

# PRE-BUILD

rotate-project-token:
  # Note: take care of automatic reuse detection which could lead to token revocation if the job is ran twice: https://docs.gitlab.com/api/personal_access_tokens/#automatic-reuse-detection
  # In such case, you have to generate a new token from scratch with scopes [api, self_rotate] and OWNER role: https://forge.inrae.fr/groups/urgi/is/-/settings/access_tokens?page=1
  # Then declare it in group variables with key GROUP_API_TOKEN: https://forge.inrae.fr/groups/urgi/is/-/settings/ci_cd#ci-variables
  stage: pre-build
  resource_group: rotate-group-token                 # évite les rotations concurrentes
  before_script:
    - apt-get update && apt-get install -y jq
  script:
    - |
      set -euo pipefail
      GROUP_ID="216"
      NEXT_EXPIRES_AT="$(date -u -d '+365 days' +%F)"
      echo "Self rotating group access token for group ${GROUP_ID} with expiration on ${NEXT_EXPIRES_AT}..."
      HTTP_RESPONSE="$(
        curl -sS \
          --request POST \
          --header "PRIVATE-TOKEN: ${GROUP_API_TOKEN}" \
          --data "expires_at=${NEXT_EXPIRES_AT}" \
          --url "${CI_API_V4_URL}/groups/${GROUP_ID}/access_tokens/self/rotate"
      )"

      ROTATED_TOKEN_VALUE="$(printf '%s' "${HTTP_RESPONSE}" | jq -r '.token')"
      ROTATED_TOKEN_NAME="$(printf '%s' "${HTTP_RESPONSE}" | jq -r '.name')"
      ACCESS_LEVEL="$(printf '%s' "${HTTP_RESPONSE}" | jq -r '.access_level')"
      EXPIRES_AT="$(printf '%s' "${HTTP_RESPONSE}" | jq -r '.expires_at')"

      if [ -z "${ROTATED_TOKEN_VALUE}" ] || [ "${ROTATED_TOKEN_VALUE}" = "null" ]; then
        echo "ERROR: no field .token in rotating HTTP response:"
        echo "${HTTP_RESPONSE}" | jq 'del(.token)'
        exit 1
      fi

      echo "Token rotated successfully. Name='${ROTATED_TOKEN_NAME}', access_level=${ACCESS_LEVEL}, expires_at='${EXPIRES_AT}'."

      set +e
      HTTP="$(curl -sS -w '%{http_code}' -o /tmp/put_body \
        --request PUT \
        --header "PRIVATE-TOKEN: ${ROTATED_TOKEN_VALUE}" \
        --url "${CI_API_V4_URL}/groups/${GROUP_ID}/variables/GROUP_API_TOKEN" \
        --form "value=${ROTATED_TOKEN_VALUE}" \
        --form "masked=true" \
        --form "raw=true")"
      set -e

      if [ "${HTTP}" = "200" ] || [ "${HTTP}" = "201" ]; then
        echo "Group variable GROUP_API_TOKEN updated for future pipelines."
      else
        echo "WARN: unable to update GROUP_API_TOKEN (HTTP=${HTTP}). Likely insufficient access_level."
      fi

      # Propagation au pipeline courant via dotenv
      {
        echo "ROTATED_TOKEN=${ROTATED_TOKEN_VALUE}"
        echo "ROTATED_TOKEN_EXPIRES_AT=${EXPIRES_AT}"
      } > rotated.env
  artifacts:
    reports:
      dotenv: rotated.env
    expire_in: 1 hour
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  tags:
    - openstack
  retry: 0

build-loader-docker-image:
  image: ${CI_REGISTRY}/${CI_PROJECT_NAMESPACE}/docker-rare/docker-git:latest
  stage: pre-build
  services:
    - docker:29.2.0-dind
  script:
    # build the image
    - docker build -t ${CI_REGISTRY}/${CI_PROJECT_NAMESPACE}/docker-rare/faidare-loader:${IMAGE_TAG} .
    - docker build -t ${CI_REGISTRY}/${CI_PROJECT_NAMESPACE}/docker-rare/faidare-loader:latest .
    # Login before pushing the image
    - docker login ${CI_REGISTRY} -u whatever -p $ROTATED_TOKEN
    # push the built image
    - docker push ${CI_REGISTRY}/${CI_PROJECT_NAMESPACE}/docker-rare/faidare-loader:${IMAGE_TAG}
    # only push latest tag on master branch
    - if [ "${CI_DEFAULT_BRANCH}" == "${CI_COMMIT_REF_SLUG}" ] ; then docker push ${CI_REGISTRY}/${CI_PROJECT_NAMESPACE}/docker-rare/faidare-loader:latest ; fi;
  rules:
    - changes:
        - Dockerfile
        - scripts/*
        - backend/src/main/resources/fr/inrae/urgi/faidare/repository/es/setup/index/*_mapping.json
        - backend/src/main/resources/fr/inrae/urgi/faidare/repository/es/setup/index/settings.json
        - .gitlab-ci.yml
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  needs:
    - job: rotate-project-token
  tags:
    - openstack

# TESTS
test-and-sonarqube:
  # image: circleci/openjdk:11-jdk-browsers
  stage: test
  tags:
    - openstack
  # the backend tests need an elasticsearch instance
  services:
    # even if that would be ideal
    # we can't just launch the service with just elasticsearch:6.3.1
    # because we need to pass some variables, but they are passed to _all_ containers
    # so they fail the start of other docker images like urgi/docker-browsers
    # the only solution is to override the entrypoint of the service and pass the arguments manually
    - name: docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION}
      alias: elasticsearch
      # discovery.type=single-node
      # single-node is necessary to start in development mode
      # so there will be no bootstrap checks that would fail on CI
      # especially the error regarding
      # `max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]`
      command: [ "bin/elasticsearch", "-Ediscovery.type=single-node" ]
  variables:
    # GRADLE_OPTS: "-Xms512m -Xmx8192m -XX:MaxMetaspaceSize=8192m -Dorg.gradle.daemon=false"
    # SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"  # Defines the location of the analysis task cache
    # GIT_DEPTH: "0"  # Tells git to fetch all the branches of the project, required by the analysis task
    ES_JAVA_OPTS: "-Xms2g -Xmx2g"
    ES_HOST: "elasticsearch"  # Set the Elasticsearch host
    ES_PORT: "9200"  # Set the Elasticsearch port
    JSON_DIR: "./data/test/"  # Directory containing JSON files for bulk loading
  script:
    - apt-get update && apt-get install -y parallel jq
    # Wait for Elasticsearch to be ready to receive requests
    - echo "Waiting for Elasticsearch to start..."
    #- until curl -s "http://${ES_HOST}:${ES_PORT}"| grep "You Know, for Search" > /dev/null; do sleep 1; done  # Polling until Elasticsearch is available
    - until curl -s "http://${ES_HOST}:${ES_PORT}/_cluster/health?wait_for_status=green&timeout=60s"; do sleep 1; done
    - curl -X GET "http://${ES_HOST}:${ES_PORT}/_cat/shards?v"
    - echo "Elasticsearch is up and running."  # Confirmation message when Elasticsearch is ready
    - echo "Listing JSON directory contents:"
    - ls -la "${JSON_DIR}"  # List files in the JSON directory
    - echo "${JSON_DIR}"
    # Launch the data loading script
    - ./scripts/harvest.sh -jsonDir "${JSON_DIR}" -es_host "${ES_HOST}" -es_port "${ES_PORT}" -env "dev" -type "all" </dev/null
    - curl -X GET "http://${ES_HOST}:${ES_PORT}/_cat/indices?v"
    - curl -X GET "http://${ES_HOST}:${ES_PORT}/_aliases"
    - echo "Trying to access Elasticsearch logs..."
    - curl -s "http://${ES_HOST}:${ES_PORT}/_cluster/health?pretty"
    # Launch tests
    - ./gradlew clean check
    - ./gradlew test jacocoTestReport -s sonar
  artifacts:
    reports:
      junit:
        - ./backend/build/test-results/test/TEST-*.xml
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  interruptible: true
  allow_failure: false

# BUILD
build:
  tags:
    - openstack
  stage: build
  script:
    - ./gradlew assemble
  # cache:
  #   key: "${CI_COMMIT_REF_NAME}"
  #   policy: pull
  #   paths:
  #     - ".gradle"
  artifacts:
    paths:
      - "$JAR_PATH"
    expire_in: 1 week
  rules:
    - if: $CI_COMMIT_MESSAGE =~ /SKIP_DEPLOY/i
      when: never
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  interruptible: true

restart-config-server-openstack:
  tags:
    - openstack
  variables:
    SERVER_IP: ${SERVER_IP_OPENSTACK_DEV}
    SERVER_USER: ${SERVER_USER_OPENSTACK}
  stage: build
  script:
    - apt-get update && apt-get install -y openssh-client
    - eval $(ssh-agent -s)
    - ssh-add <(echo "${SSH_PRIVATE_KEY}")
    - ssh -o StrictHostKeyChecking=no ${SERVER_USER}@${SERVER_IP} 'echo "Successfully connected on $(hostname)"'
    - ssh ${SERVER_USER}@${SERVER_IP} "sudo systemctl restart bootapp@config-server"
    - eval $(ssh-agent -k)
  allow_failure: true
  rules:
    - if: $CI_COMMIT_MESSAGE =~ /SKIP_DEPLOY/i
      when: never
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

# DEPLOY
.deploy-to-vm:
  # Hidden job which serves as template for executed jobs below.
  # See https://docs.gitlab.com/ee/ci/yaml/#anchors
  tags:
    - openstack
  retry: 2
  script:
    - apt-get update && apt-get install -y openssh-client
    ## SSH initialization
    - eval $(ssh-agent -s)
    - ssh-add <(echo "${SSH_PRIVATE_KEY}")
    - ssh -o StrictHostKeyChecking=no ${SERVER_USER}@${SERVER_IP} 'echo "Successfully connected on $(hostname)"'
    # Copy jar
    - scp ${JAR_PATH} ${SERVER_USER}@${SERVER_IP}:/tmp/${SERVICE_NAME}-${ENV}.jar
    - ssh ${SERVER_USER}@${SERVER_IP} "sudo mv /tmp/${SERVICE_NAME}-${ENV}.jar /opt/bootapp/ ; sudo chown -R bootapp:bootapp /opt/bootapp/ ; sudo systemctl restart bootapp@${SERVICE_NAME}-${ENV}"
    - eval $(ssh-agent -k)
    - echo "Deploy done. Application should be available at http://${SERVER_IP}:${APP_PORT}/${CONTEXT_PATH}"
  allow_failure: false
  interruptible: false
  needs:
    - job: build
      optional: false

deploy-to-beta:
  stage: deploy-beta
  extends: .deploy-to-vm
  variables:
    SERVER_USER: ${SERVER_USER_OPENSTACK}
    SERVER_IP: ${SERVER_IP_OPENSTACK_DEV}
    APP_PORT: ${BETA_FAIDARE_PORT}
    ENV: beta
    CONTEXT_PATH: faidare
  environment:
    name: beta
    url: "http://${SERVER_IP_OPENSTACK_DEV}:${BETA_FAIDARE_PORT}/faidare"
  resource_group: env-beta
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_DRAFT == "true"'
      when: never
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

deploy-to-staging-public:
  stage: deploy-staging
  extends: .deploy-to-vm
  variables:
    SERVER_USER: ${SERVER_USER_OPENSTACK}
    SERVER_IP: ${SERVER_IP_OPENSTACK_DEV}
    APP_PORT: ${STAGING_PUBLIC_FAIDARE_PORT}
    ENV: staging-public
    CONTEXT_PATH: faidare
  environment:
    name: staging-public
    url: "http://staging-urgi.versailles.inrae.fr/faidare"
  resource_group: env-staging-public
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_DRAFT == "true"'
      when: never
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual

deploy-to-staging-private:
  stage: deploy-staging
  extends: .deploy-to-vm
  variables:
    SERVER_USER: ${SERVER_USER_OPENSTACK}
    SERVER_IP: ${SERVER_IP_OPENSTACK_DEV}
    APP_PORT: ${STAGING_PRIVATE_FAIDARE_PORT}
    ENV: staging-private
    CONTEXT_PATH: faidare-private
  environment:
    name: staging-private
    url: "http://staging-urgi.versailles.inrae.fr/faidare-private"
  resource_group: env-staging-private
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_DRAFT == "true"'
      when: never
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual

deploy-to-prod-public:
  stage: deploy-production
  extends: .deploy-to-vm
  variables:
    SERVER_USER: ${SERVER_USER_OPENSTACK}
    SERVER_IP: ${SERVER_IP_OPENSTACK_PROD}
    APP_PORT: ${PROD_PUBLIC_FAIDARE_PORT}
    ENV: prod-public
    CONTEXT_PATH: faidare
  environment:
    name: prod-public
    url: "http://urgi.versailles.inrae.fr/faidare"
  resource_group: env-prod-public
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_DRAFT == "true"'
      when: never
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual

deploy-to-prod-private:
  stage: deploy-production
  extends: .deploy-to-vm
  variables:
    SERVER_USER: ${SERVER_USER_OPENSTACK}
    SERVER_IP: ${SERVER_IP_OPENSTACK_PROD}
    APP_PORT: ${PROD_PRIVATE_FAIDARE_PORT}
    ENV: prod-private
    CONTEXT_PATH: faidare-private
  environment:
    name: prod-private
    url: "http://urgi.versailles.inrae.fr/faidare-private"
  resource_group: env-prod-private
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_DRAFT == "true"'
      when: never
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual