.gitlab-ci.yml

stages:
  - test
  - build
  - deploy
  - cleanup

variables:
  CONTAINER_NAME: gcr.io/$PROJECT_ID/$EXPORTER_CR_SERVICE_NAME/$CI_COMMIT_BRANCH/$IMAGE_NAME:latest


before_script:
  - echo $GCP_SA_KEY | base64 -d > sa.json

flake8:
  image: python:3.9
  stage: test
  script:
    - pip3 install flake8
    - python -m flake8

mypy:
  image: python:3.9
  stage: test
  script:
    - pip install -r requirements.txt
    - pip install -r test_requirements.txt
    - pip install mypy
    - mypy email_exporter

pytest:
  stage: test
  image: python:3.9
  script:
    - pip install -r requirements.txt
    - pip install -r test_requirements.txt
    - pytest --junitxml=report.xml
  artifacts:
    when: always
    reports:
      junit: report.xml

pytest-coverage:
  stage: test
  image: python:3.9
  script:
    - pip install -r requirements.txt
    - pip install -r test_requirements.txt
    - pip install pytest-cov
    - pytest --cov=email_exporter/ tests/ --cov-fail-under=$MIN_TEST_COVERAGE
    - coverage xml
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
  allow_failure: true

build:
  image: docker:latest
  only:
    refs:
      - master
      - main
  services:
    - docker:dind
  stage: build
  script:
    # Login to Google Container Registry
    - cat sa.json | docker login -u _json_key --password-stdin https://gcr.io
    # Build and tag image for both GCR and Gitlab registries
    - docker build --cache-from $CONTAINER_NAME -t $CONTAINER_NAME -t $IMAGE_NAME:latest .
    # Push image to GCR
    - docker push $CONTAINER_NAME

deploy-exporter:
  image: google/cloud-sdk:latest
  only:
    refs:
      - master
      - main
  stage: deploy
  script:
    # Authenticate with service account
    - gcloud auth activate-service-account $GCP_SA_NAME --key-file sa.json
    # Push container to Cloud Run
    - >-
        gcloud run deploy $EXPORTER_CR_SERVICE_NAME
        --image $CONTAINER_NAME
        --region $EXPORTER_CR_REGION
        --project $PROJECT_ID
        --no-allow-unauthenticated
        --update-env-vars FINGERPRINT=$CI_COMMIT_SHORT_SHA,HEADER_SECRET=$HEADER_SECRET

deploy-feed:
  image: google/cloud-sdk:latest
  only:
    refs:
      - master
      - main
  stage: deploy
  script:
    # Authenticate with service account
    - gcloud auth activate-service-account $GCP_SA_NAME --key-file sa.json
    # Push container to Cloud Run
    - >-
        gcloud run deploy $FEED_CR_SERVICE_NAME
        --image $CONTAINER_NAME
        --region $FEED_CR_REGION
        --project $PROJECT_ID
        --allow-unauthenticated
        --update-env-vars FINGERPRINT=$CI_COMMIT_SHORT_SHA,HEADER_SECRET=$HEADER_SECRET

verify-exporter:
  image: google/cloud-sdk:latest
  only:
    refs:
      - master
      - main
  stage: cleanup
  script:
    # Authenticate with service account
    - gcloud auth activate-service-account $GCP_SA_NAME --key-file sa.json
    # Find run endpoint, call the fingerprint path and check against expected commit signature
    - "gcloud run services describe $EXPORTER_CR_SERVICE_NAME --region $EXPORTER_CR_REGION --project $PROJECT_ID --format=\"value(status.url)\" | sed 's/$/\\/fingerprint/'| xargs -n 1 curl -H \"Authorization: Bearer $(gcloud auth print-identity-token)\" -H \"X-API-SECRET: $HEADER_SECRET\" | grep \"$CI_COMMIT_SHORT_SHA\""

verify-feed:
  image: google/cloud-sdk:latest
  only:
    refs:
      - master
      - main
  stage: cleanup
  script:
    # Authenticate with service account
    - gcloud auth activate-service-account $GCP_SA_NAME --key-file sa.json
    # Find run endpoint, call the fingerprint path and check against expected commit signature
    - "gcloud run services describe $FEED_CR_SERVICE_NAME --region $FEED_CR_REGION --project $PROJECT_ID --format=\"value(status.url)\" | sed 's/$/\\/fingerprint/'| xargs -n 1 curl -H \"Authorization: Bearer $(gcloud auth print-identity-token)\" -H \"X-API-SECRET: $HEADER_SECRET\" | grep \"$CI_COMMIT_SHORT_SHA\""


prune_containers:
  image: google/cloud-sdk:latest
  only:
    refs:
      - master
      - main
  stage: cleanup
  script:
    # Authenticate with service account
    - gcloud auth activate-service-account $GCP_SA_NAME --key-file sa.json
    # Delete older containers
    - python3 ci/prune_containers.py $PROJECT_ID "$EXPORTER_CR_SERVICE_NAME:$EXPORTER_CR_REGION,$FEED_CR_SERVICE_NAME:$FEED_CR_REGION" $CONTAINER_NAME