.gitlab-ci.yml

include:
  - remote: https://open.greenhost.net/stackspin/stackspin/raw/main/.gitlab/ci_templates/kaniko.yml
  - remote: https://open.greenhost.net/stackspin/stackspin/-/raw/main/.gitlab/ci_templates/helm_package.yml
  - template: 'Workflows/MergeRequest-Pipelines.gitlab-ci.yml'

stages:
  - build
  - lint
  # TODO: Re-enable after fixing #73
  # - application-test
  - integration-test
  - lint-helm-chart
  - package-helm-chart
  - release-helm-chart

variables:
  CHART_NAME: single-sign-on
  CHART_DIR: helmchart/single-sign-on/

#login_test:
#  image: python:3.8
#  stage: unittest
#  needs: []
#  variables:
#    HYDRA_ADMIN_URL: http://localhost/ignored
#    KRATOS_PUBLIC_URL: http://localhost/ignored
#    PUBLIC_URL: http://localhost/ignored
#  cache:
#    paths:
#      - "$CI_PROJECT_DIR/pip-cache"
#    key: "$CI_PROJECT_ID"
#    before_script:
#      - cd login
#      - python -V
#      - pip install -r requirements.txt
#    script:
#      - pytest -v --cov=login --cov-report=term --cov-report=xml tests
#    artifacts:
#      reports:
#        cobertura: login/coverage.xml
#    coverage: '/^TOTAL.+?(\d+\%)$/'



# Stackspin login panel
login:
  stage: build
  needs: []
  extends: .kaniko_build
  variables:
    KANIKO_CONTEXT: "login"
    KANIKO_BUILD_IMAGENAME: $CI_JOB_NAME
  before_script:
    - ls -l ${CI_PROJECT_DIR}/${KANIKO_CONTEXT:-.}/Dockerfile 
  only:
    changes:
      - login/**/*


# For full integration testing we need to build the full stack in CI/CD
#
# - postgres    : Backend database, the Dockerfile is based on the upstream
#                 with a small addition to create inital databases
# - kratos      : Identity manager, based on the upstream. We set the DSN
#                 in the Dockerimage, as its different from hydra's DSN, 
#                 however, gitlab-ci will apply the same enviroment for all
#                 services.
# - hydra       : See above, the identiy provider
# - login       : Our login panel
# - sso_testapp : A test app which implements OIDC for testing
# - behave      : Image to do behave testing

# Build our own postgres image, which is based on upstream
postgres:
  stage: build
  needs: []
  variables:
    KANIKO_CONTEXT: ".gitlab/ci/postgres"
    KANIKO_BUILD_IMAGENAME: $CI_JOB_NAME
  extends: .kaniko_build
  only:
    changes:
      - .gitlab/ci/postgres/**/*


# Build our own kratos image, which is based on upstream
kratos:
  stage: build
  needs: []
  variables:
    KANIKO_CONTEXT: ".gitlab/ci/kratos"
    KANIKO_BUILD_IMAGENAME: $CI_JOB_NAME
  extends: .kaniko_build
  only:
    changes:
      - .gitlab/ci/kratos/**/*

# Build our own hydra image, which is based on upstream
hydra:
  stage: build
  needs: []
  variables:
    KANIKO_CONTEXT: ".gitlab/ci/hydra"
    KANIKO_BUILD_IMAGENAME: $CI_JOB_NAME
  extends: .kaniko_build
  only:
    changes:
      - .gitlab/ci/hydra/**/*

# A Fake SSO app to test the behaviour
sso_testapp:
  stage: build
  variables:
    KANIKO_CONTEXT: "test/sso_testapp/"
    KANIKO_BUILD_IMAGENAME: $CI_JOB_NAME
  extends: .kaniko_build
  only:
    changes:
      - test/sso_testapp/**/*

# Image to test behaviour (web)
behave:
  stage: build
  variables:
    KANIKO_CONTEXT: "test/behave"
    KANIKO_BUILD_IMAGENAME: $CI_JOB_NAME
  extends: .kaniko_build
  only:
    changes:
      - test/behave/*

behave-integration:
  stage: integration-test
  services:
    - name: ${CI_REGISTRY_IMAGE}/postgres:${CI_COMMIT_REF_NAME}
      alias: postgres
    - name: ${CI_REGISTRY_IMAGE}/kratos:${CI_COMMIT_REF_NAME}
      alias: kratosmigrate
      command:
        - migrate
        - sql
        - -e
        - -y
    - name: ${CI_REGISTRY_IMAGE}/kratos:${CI_COMMIT_REF_NAME}
      alias: kratos
      command:
        - serve
        - --config
        - /etc/config/kratos.yaml
    - name: ${CI_REGISTRY_IMAGE}/hydra:${CI_COMMIT_REF_NAME}
      alias: hydramigrate
      command:
        - migrate
        - sql
        - -e
        - -y
    - name: ${CI_REGISTRY_IMAGE}/hydra:${CI_COMMIT_REF_NAME}
      alias: hydra
      command:
        - serve
        - all
        - --dangerous-force-http
        - --dangerous-allow-insecure-redirect-urls
        - http://oidc:5000/login
    - name: ${CI_REGISTRY_IMAGE}/login:${CI_COMMIT_REF_NAME}
      alias: oidc
    - name: ${CI_REGISTRY_IMAGE}/sso_testapp:${CI_COMMIT_REF_NAME}
      alias: ssoapp
  variables:
    # Feature Flag FF_NETWORK_PER_BUILD Enables creation of a docker network per build
    # with the docker executor of the gitlab-runner. This is required for service
    # interconnection. Requires gitlab-runner v12.9.0
    FF_NETWORK_PER_BUILD: 1
    OAUTHLIB_INSECURE_TRANSPORT: "true"
    # For hydra
    URLS_SELF_ISSUER: http://hydra:4445/
    URLS_CONSENT: http://oidc:5000/login
    URLS_LOGIN: http://oidc:5000/consent
    SECRETS_SYSTEM: RandomSecretForTesting
    # For postgres image super user credentials, additional credentials are
    # created from `.gitlab/ci/postgres/setup.sql` during initialization
    POSTGRES_PASSWORD: postgres
    POSTGRES_USER: postgres
    POSTGRES_DB: postgres
    # For Login image
    FLASK_RUN_HOST: "0.0.0.0"
    FLASK_RUN_PORT: "5000"
    PUBLIC_URL: "http://localhost:5000/"
    HYDRA_ADMIN_URL: "http://hydra:4445"
    KRATOS_PUBLIC_URL: "http://kratos:4433"
    KRATOS_ADMIN_URL: "http://kratos:4434"
    DATABASE_URL: "postgresql://stackspin:stackspin@localhost/stackspin"
    APP_SETTINGS: "config.DevelopmentConfig"
    # General flask
    DEBUG: "true"
    FLASK_ENV: "development"
    # For sso test app
    BASE_URL: "http://hydra:4444/"
    KEY: "testapp"
    SECRET: "secret"
  image: ${CI_REGISTRY_IMAGE}/behave:${CI_COMMIT_REF_NAME}
  script:
    - curl -s http://hydra:4445/health/alive
    - curl -s http://kratos:4433/health/alive
    - curl -s http://oidc:5000/status
    # Steps to do:
    # - create user & access roles & grant access
    # - add client applition ID + key for testing
    # - test login etc

  artifacts:
    paths:
      - test/integration_tests/test/behave/screenshots/
    expire_in: 1 month
    when: on_failure
  only:
    changes:
      - .gitlab/ci/**/*
      - login/**/*

pylint:
  stage: build
  variables:
    KANIKO_CONTEXT: "test/lint/pylint"
    KANIKO_BUILD_IMAGENAME: $CI_JOB_NAME
  extends: .kaniko_build
  only:
    changes:
      - test/lint/pylint/Dockerfile
      - test/lint/pylint/requirements.txt
      - .gitlab-ci.yml

pylint-lint:
  stage: lint
  variables:
    GIT_STRATEGY: clone
    GIT_DEPTH: 0
    PYLINT_PLUGINS: "pylint_flask pylint_flask_sqlalchemy"
  image: ${CI_REGISTRY_IMAGE}/pylint:${CI_COMMIT_REF_NAME}
  script:
    # Run darker with --diff command. This will throw exit code 1 if there are
    # lint errors, but a 0 if there are only formatting recommendations
    - darker -i -L pylint --diff --revision remotes/origin/main .
  only:
    changes:
      - test/lint/pylint/Dockerfile
      - test/lint/pylint/requirements.txt
      - .gitlab-ci.yml
      - login/**/*