config.yml

version: 2.1

aliases:
  - &filter-not-release-or-master
    tags:
      ignore: /^v[0-9]+(\.[0-9]+){2}(-.+|[^-.]*)$/
    branches:
      ignore: master
  - &filter-only-master
    branches:
      only: master

defaults: &defaults
  working_directory: ~/grafana-image-renderer
  docker:
    - image: cimg/node:14.18.3

commands:
  install-grabpl:
    description: 'Install Grafana build pipeline tool'
    steps:
      - run:
          name: 'Install Grafana build pipeline tool'
          command: |
            VERSION=2.1.1
            curl -fLO https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v${VERSION}/grabpl
            chmod +x grabpl
            mv grabpl /tmp

jobs:
  build:
    <<: *defaults
    steps:
      - checkout
      - restore_cache:
          keys:
            - dependency-cache-{{ checksum "yarn.lock" }}
      - run:
          name: Yarn Install
          command: 'yarn install --frozen-lockfile --no-progress'
      - save_cache:
          name: Save Yarn Package Cache
          key: dependency-cache-{{ checksum "yarn.lock" }}
          paths:
            - node_modules
      - run:
          name: Build
          command: 'yarn build'
      - persist_to_workspace:
          root: .
          paths:
            - build/*

  package:
    description: 'Package plugin'
    parameters:
      arch:
        type: string
      skip_chromium:
        type: boolean
        default: false
      override_output:
        type: string
        default: ''
      skip_signing_errors:
        type: boolean
        default: false
    <<: *defaults
    steps:
      - checkout
      - attach_workspace:
          at: .
      - restore_cache:
          keys:
            - dependency-cache-{{ checksum "yarn.lock" }}
      - run:
          name: Install dependencies
          command: 'yarn install --pure-lockfile --no-progress'
      - run:
          name: Package
          command: |
            if [ << parameters.skip_chromium >> = true ]; then
              ./scripts/package_target.sh << parameters.arch >> true << parameters.override_output >>
            else
              ./scripts/package_target.sh << parameters.arch >>
            fi
      - install-grabpl
      - run:
          name: Create and sign plugin manifest
          command: |
            set +e
            if [ << parameters.skip_chromium >> = true ]; then
              /tmp/grabpl build-plugin-manifest ./dist/<< parameters.override_output >>
            else
              /tmp/grabpl build-plugin-manifest ./dist/plugin-<< parameters.arch >>
            fi
            EXIT_CODE=$?

            if [ << parameters.skip_signing_errors >> = true ]; then
              exit 0
            else
              exit $EXIT_CODE
            fi
      - run:
          name: Archive
          command: |
            if [ << parameters.skip_chromium >> = true ]; then
              ./scripts/archive_target.sh << parameters.arch >> << parameters.override_output >>
            else
              ./scripts/archive_target.sh << parameters.arch >>
            fi
      - persist_to_workspace:
          root: .
          paths:
            - dist/*
            - artifacts/*
      - store_artifacts:
          path: artifacts

  publish-github-release:
    working_directory: ~/grafana-image-renderer
    docker:
      - image: cibuilds/github:0.12
    steps:
      - checkout
      - add_ssh_keys:
          fingerprints:
            - '9a:40:f1:ad:ea:d5:c9:07:bd:54:dc:a8:0d:ea:be:0e'
      - attach_workspace:
          at: .
      - run:
          name: 'Install dependencies'
          command: 'apk add --update --no-cache jq'
      - run:
          name: 'Generate MD5 checksums'
          command: './scripts/generate_md5sum.sh'
      - run:
          name: 'Publish Release on GitHub'
          command: './scripts/publish_github_release.sh'

  publish-docker-release:
    working_directory: ~/grafana-image-renderer
    environment:
      IMAGE_NAME: grafana/grafana-image-renderer
    docker:
      - image: circleci/buildpack-deps:stretch
    steps:
      - checkout
      - setup_remote_docker:
          version: 19.03.13
      - run:
          name: 'Build and push Docker image'
          command: ./scripts/build_push_docker.sh
  publish-docker-master:
    working_directory: ~/grafana-image-renderer
    environment:
      IMAGE_NAME: grafana/grafana-image-renderer
    docker:
      - image: circleci/buildpack-deps:stretch
    steps:
      - checkout
      - setup_remote_docker:
          version: 19.03.13
      - run:
          name: 'Build and push Docker image'
          command: ./scripts/build_push_docker.sh master
  security_scan:
    executor: scan_exec
    steps:
      - checkout
      - attach_workspace:
          at: .
      - restore_cache:
          name: restore node_modules
          keys:
            - build-cache-{{ .Environment.CACHE_VERSION }}-{{ checksum "yarn.lock" }}
      - run:
          name: Run Veracode scan
          command: |
            apk add curl
            # Increase heap size or the scanner will die.
            export _JAVA_OPTIONS=-Xmx4g
            mkdir -p ci/jobs/security_scan
            curl -sSL https://download.sourceclear.com/ci.sh | sh | tee ci/jobs/security_scan/sourclear_scan.out
            ##
            # Not failing builds now if we detect items we deem a problem in the scan output, but the following
            # Would be an example
            #
            # grep "High Risk" ci/jobs/security_scan/sourclear_scan.out && false || true
      - persist_to_workspace:
          root: .
          paths:
            - ci/jobs/security_scan
      - store_test_results:
          path: ci/jobs/security_scan
      - store_artifacts:
          path: ci/jobs/security_scan      

  

workflows:
  version: 2
  build-master:
    jobs:
      - build:
          filters: *filter-only-master
      - security_scan:
          filters: *filter-only-master
          requires:
            - build
      - package:
          filters: *filter-only-master
          requires:
            - build
          name: package-<< matrix.arch >>
          matrix:
            parameters:
              arch: [linux-x64-glibc, darwin-x64-unknown, darwin-arm64-unknown, win32-x64-unknown]
      - package:
          filters: *filter-only-master
          requires:
            - build
          name: package-linux-x64-glibc-no-chromium
          arch: linux-x64-glibc
          skip_chromium: true
          override_output: plugin-linux-x64-glibc-no-chromium
      - publish-docker-master:
          requires:
            - build
          filters: *filter-only-master
      - approve-release:
          type: approval
          requires:
            - build
            - package-linux-x64-glibc
            - package-darwin-x64-unknown
            - package-darwin-arm64-unknown
            - package-win32-x64-unknown
            - package-linux-x64-glibc-no-chromium
          filters: *filter-only-master
      - publish-github-release:
          requires:
            - approve-release
          filters: *filter-only-master
      - publish-docker-release:
          requires:
            - publish-github-release
          filters: *filter-only-master

  build-branches-and-prs:
    jobs:
      - build:
          filters: *filter-not-release-or-master
      - security_scan:
          requires:
            - build
      - package:
          filters: *filter-not-release-or-master
          requires:
            - build
          name: package-<< matrix.arch >>
          matrix:
            parameters:
              arch: [linux-x64-glibc, darwin-x64-unknown, darwin-arm64-unknown, win32-x64-unknown]
              skip_signing_errors: [true]

      - package:
          filters: *filter-not-release-or-master
          requires:
            - build
          name: package-linux-x64-glibc-no-chromium
          arch: linux-x64-glibc
          skip_chromium: true
          override_output: plugin-linux-x64-glibc-no-chromium
          skip_signing_errors: true

executors:
  scan_exec:
    docker:
    - image: srclosson/grafana-plugin-ci-alpine:latest