.gitlab-ci.yml

image: alpine:latest

variables:
  LM_JAVA_VERSION: 11

stages:
  - build
  - upload
  - deploy
  - test
  - compare
  - cleanup

# These are disabled because they fail with warnings, stopping pipelines being green, and we don't get a huge
# amount of value from them (the security license scanning is done by github on the mirror of the project, so
# we don't lose anything - and in fact it works better on github).
# https://gitlab.com/gitlab-org/gitlab/-/issues/220275 is one of the issues causing warnings, but it seems like
# another similar issue has been added to license scanning since
#include:
#  - template: Security/Dependency-Scanning.gitlab-ci.yml
#  - template: Security/License-Scanning.gitlab-ci.yml

.maven: &maven
  image: maven:3-jdk-11
  interruptible: true
  variables:
    MAVEN_CONFIG: $CI_PROJECT_DIR/.m2
    MAVEN_OPTS: "-Duser.home=$CI_PROJECT_DIR"
  cache:
    key: maven
    paths:
      - .m2/

build:
  <<: *maven
  stage: build
  script:
    # Don't compile the tests yet
    - mvn -B -Dmaven.test.skip -Dpmd.skip clean package
  artifacts:
    paths:
      - target/

upload:
  stage: upload
  interruptible: true
  needs: ["build"]
  image: docker:git
  services:
    - docker:dind
  variables:
    DOCKER_DRIVER: overlay2
  script:
    - setup_docker
    - install_build_dependencies
    - docker build -t conformance-suite .
    - upload
  allow_failure:
    exit_codes:
      - 137

test:
  <<: *maven
  stage: test
  needs: ["build"]
  coverage: '/Unit test coverage (\d+\%)/'
  script:
    # Don't recompile the main app
    - mvn -B -Dmaven.main.skip test
    - |
      perl -ne '/Total.*?(\d+%)/ && print "Unit test coverage $1\n"' target/site/jacoco/index.html
  only:
    - branches

.compare: &compare
  stage: compare
  interruptible: true
  # show a 'warning' (not a failure) if we successfully find differences
  allow_failure:
    exit_codes:
      - 16
  image: python:3.10-alpine3.15
  only:
    refs:
      - branches

compare_cloud:
  <<: *compare
  needs: ["server_test", "ciba_test", "client_test", "ekyc_test", "brazil_test"]
  script:
    - run_compare server_test ciba_test client_test ekyc_test brazil_test

compare_local:
  <<: *compare
  needs: ["local_test"]
  script:
    - run_compare local_test

check-trailing-whitespace:
  interruptible: true
  stage: build
  image: python:2
  script:
    - ./scripts/checkwhitespace.py
  only:
    - branches

#codequality:
#  image: docker:latest
#  variables:
#    DOCKER_DRIVER: overlay2
#  services:
#    - docker:dind
#  script:
#    - setup_docker
#    - codeclimate
#  artifacts:
#    paths: [codeclimate.json]

.auto-deploy:
  image: "registry.gitlab.com/gitlab-org/cluster-integration/auto-deploy-image:v2.28.2"

.deploy: &deploy
  extends: .auto-deploy
  stage: deploy
  # there's a race condition between 'find_deploy_url' and the actual deploy where we could end up with multiple
  # deployments to the same url - use a resource_group to avoid multiple deploy jobs running at the same time
  resource_group: deploy
  script:
    - find_deploy_url
    - echo "DYNAMIC_ENVIRONMENT_URL=$CI_ENVIRONMENT_URL" >> deploy.env
    - auto-deploy check_kube_domain
    - auto-deploy download_chart
    - auto-deploy use_kube_context || true
    - auto-deploy ensure_namespace
    # - auto-deploy create_secret
    - auto-deploy initialize_tiller
    - deploy
    #    - auto-deploy deploy
    #    - auto-deploy persist_environment_url

  artifacts:
    reports:
      dotenv: deploy.env
  dependencies: []
  only:
    refs:
      - branches

deploy-review:
  <<: *deploy
  environment:
    name: review/$CI_COMMIT_REF_NAME
    on_stop: stop_review
    url: $DYNAMIC_ENVIRONMENT_URL
  except:
    - master
    - production
    - demo

deploy-normal:
  <<: *deploy
  environment:
    name: $CI_COMMIT_BRANCH
    on_stop: stop_normal
    url: $DYNAMIC_ENVIRONMENT_URL
  only:
    - production
    - demo

deploy-staging:
  <<: *deploy
  environment:
    name: staging
    url: $DYNAMIC_ENVIRONMENT_URL
  only:
    - master

stop_review:
  extends: .auto-deploy
  stage: cleanup
  variables:
    GIT_STRATEGY: none
  script:
    - auto-deploy initialize_tiller
    - auto-deploy delete
  environment:
    name: review/$CI_COMMIT_REF_NAME
    action: stop
  needs: []
  when: manual
  allow_failure: true
  only:
    refs:
      - branches
  except:
    - master
    - production
    - demo

stop_normal:
  extends: .auto-deploy
  stage: cleanup
  variables:
    GIT_STRATEGY: none
  script:
    - auto-deploy initialize_tiller
    - auto-deploy delete
  environment:
    name: $CI_COMMIT_BRANCH
    action: stop
  needs: []
  when: manual
  allow_failure: true
  only:
    - demo

.deployment_test: &deployment_test
  stage: test
  interruptible: true
  image: python:3.10-alpine3.15
  only:
    refs:
      - branches
  artifacts:
    when: always
    paths:
      - "*.zip"

client_test:
  <<: *deployment_test
  script:
    - set_up_for_running_test_plan
    - run_client_test_plan

server_test:
  <<: *deployment_test
  script:
    - set_up_for_running_test_plan
    - run_server_test_plan

ciba_test:
  <<: *deployment_test
  script:
    - set_up_for_running_test_plan
    - run_ciba_test_plan

brazil_test:
  <<: *deployment_test
  script:
    - set_up_for_running_test_plan
    - run_brazil_test_plan

ekyc_test:
  <<: *deployment_test
  script:
    - set_up_for_running_test_plan
    - run_ekyc_test_plan

local_test:
  stage: test
  interruptible: true
  image: docker:19.03.10
  services:
    - docker:dind
  needs: ["build"]
  script:
    - apk add docker-compose
    - docker-compose -f $CI_PROJECT_DIR/docker-compose-localtest.yml pull
    - docker-compose -f $CI_PROJECT_DIR/docker-compose-localtest.yml build --pull
    - docker-compose -f $CI_PROJECT_DIR/docker-compose-localtest.yml up --detach httpd
    - sleep 5
    - docker-compose -f $CI_PROJECT_DIR/docker-compose-localtest.yml logs --tail="all" oidcc-provider
    - docker-compose -f $CI_PROJECT_DIR/docker-compose-localtest.yml run test
  after_script:
    - docker-compose -f $CI_PROJECT_DIR/docker-compose-localtest.yml logs --tail="all" oidcc-provider > $CI_PROJECT_DIR/oidcc-provider-log.txt
    - docker-compose -f $CI_PROJECT_DIR/docker-compose-localtest.yml logs --tail="all" server > $CI_PROJECT_DIR/server-log.txt
    - docker-compose -f $CI_PROJECT_DIR/docker-compose-localtest.yml exec -T mongodb mongodump --db=test_suite --archive=/data/db/mongodb-dump.gz --gzip
    - docker-compose -f $CI_PROJECT_DIR/docker-compose-localtest.yml down
  artifacts:
    when: always
    paths:
      - oidcc-provider-log.txt
      - server-log.txt
      - mongo/data/mongodb-dump.gz
      - "*.zip"

# ---------------------------------------------------------------------------

.auto_devops: &auto_devops |
  # Auto DevOps variables and functions
  [[ "$TRACE" ]] && set -x
  export CI_APPLICATION_REPOSITORY=gcr.io/$GCP_PROJECT_ID/$CI_COMMIT_REF_SLUG
  export CI_APPLICATION_TAG=$CI_COMMIT_SHA
  export CI_CONTAINER_NAME=ci_job_build_${CI_JOB_ID}
  export TILLER_NAMESPACE=$KUBE_NAMESPACE
  export HELM_HOST="localhost:44134"

  function codeclimate() {
    cc_opts="--env CODECLIMATE_CODE="$PWD" \
             --volume "$PWD":/code \
             --volume /var/run/docker.sock:/var/run/docker.sock \
             --volume /tmp/cc:/tmp/cc"

    docker run ${cc_opts} codeclimate/codeclimate analyze -f json src > codeclimate.json
  }

  function find_deploy_url() {
    if [ "$CI_COMMIT_BRANCH" = "master" ]; then
      CI_ENVIRONMENT_URL=https://staging.$KUBE_INGRESS_BASE_DOMAIN
      return
    elif [ "$CI_COMMIT_BRANCH" = "production" ]; then
      CI_ENVIRONMENT_URL=https://www.$KUBE_INGRESS_BASE_DOMAIN
      return
    elif [ "$CI_COMMIT_BRANCH" = "demo" ]; then
      CI_ENVIRONMENT_URL=https://demo.$KUBE_INGRESS_BASE_DOMAIN
      return
    fi
    # not one of the fixed branches - find a review app to use
    apk add jq
    url="${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/environments?states=available&per_page=100&search=review/"
    curl -o env-list.js --silent --show-error --header "PRIVATE-TOKEN: ${GITLAB_API_KEY_OIDF_BOT}" "$url"
    res=$?
    if [ $res -ne 0 ]; then
      echo "curl of $url failed: $res"
      exit 1
    fi
    echo "Active review apps:"
    jq ".[] | del(.project,.state)" < env-list.js # the project element is big/always the same/unimportant
    echo "Checking for environment for CI_ENVIRONMENT_SLUG '${CI_ENVIRONMENT_SLUG}'"
    # first check if there's already an environment for this branch
    CI_ENVIRONMENT_URL=`jq -r ".[] | select(.slug==\"${CI_ENVIRONMENT_SLUG}\") | .external_url" < env-list.js`
    if [ -z "$CI_ENVIRONMENT_URL" ] || [ "$CI_ENVIRONMENT_URL" == "null" ]; then
      echo "None found; trying to find a free environment"
      x=1
      while :; do
        FAKE_BRANCH_NAME=dev-branch-$x
        CI_ENVIRONMENT_URL=https://review-app-$FAKE_BRANCH_NAME.$KUBE_INGRESS_BASE_DOMAIN
        echo "Checking: $CI_ENVIRONMENT_URL"
        res=0
        jq --exit-status  ".[] | select(.external_url==\"$CI_ENVIRONMENT_URL\") | halt_error(9)" < env-list.js || res=$?
        echo "jq exit status: $res"
        if [ $res -eq 4 ]; then
          # no match - we found a free one
          break
        fi
        x=$(( $x + 1 ))
        if [ $x -gt 9 ]; then
          echo "All review app environments seem to already be in use. Instructions on how to proceed can be found on the wiki:"
          echo "https://gitlab.com/openid/conformance-suite/-/wikis/Developers/Contributing#review-app-failures"
          exit 1
        fi
      done
      echo "Found a free environment: $CI_ENVIRONMENT_URL"
    else
      echo "This branch is already using environment: $CI_ENVIRONMENT_URL"
    fi
  }

  function deploy() {
    track="${1-stable}"
    name="$CI_ENVIRONMENT_SLUG"

    if [[ "$track" != "stable" ]]; then
      name="$name-$track"
    fi

    replicas="1"
    service_enabled="false"

    env_track=$( echo $track | tr -s  '[:lower:]'  '[:upper:]' )
    env_slug=$( echo ${CI_ENVIRONMENT_SLUG//-/_} | tr -s  '[:lower:]'  '[:upper:]' )

    if [[ "$track" == "stable" ]]; then
      # for stable track get number of replicas from `PRODUCTION_REPLICAS`
      eval new_replicas=\$${env_slug}_REPLICAS
      service_enabled="true"
    else
      # for all tracks get number of replicas from `CANARY_PRODUCTION_REPLICAS`
      eval new_replicas=\$${env_track}_${env_slug}_REPLICAS
    fi
    if [[ -n "$new_replicas" ]]; then
      replicas="$new_replicas"
    fi

    if [[ "$CI_COMMIT_BRANCH" == "master" ]]; then
      # we expect much bigger databases on staging as it persists; use more RAM and disk for mongo
      mongo_settings="--set mongodb.resources.limits.memory=4Gi \
        --set mongodb.persistence.size=250Gi"
    fi
    if [[ "$CI_COMMIT_BRANCH" == "production" ]]; then
      # we expect much bigger databases on production and we have a dedicated node; use much more RAM and disk for mongo
      mongo_settings="--set mongodb.resources.limits.memory=9Gi \
        --set mongodb.persistence.size=250Gi"
    fi

    # Create OIDC credentials secrets
    kubectl delete secret oidc-gitlab-credentials \
      --namespace="$KUBE_NAMESPACE" \
      --ignore-not-found=true
    kubectl delete secret oidc-google-credentials \
      --namespace="$KUBE_NAMESPACE" \
      --ignore-not-found=true
    kubectl create secret generic oidc-gitlab-credentials \
      --namespace="$KUBE_NAMESPACE" \
      --from-literal=clientid="$OIDC_GITLAB_CLIENTID" \
      --from-literal=secret="$OIDC_GITLAB_SECRET"
    kubectl create secret generic oidc-google-credentials \
      --namespace="$KUBE_NAMESPACE" \
      --from-literal=clientid="$OIDC_GOOGLE_CLIENTID" \
      --from-literal=secret="$OIDC_GOOGLE_SECRET"

    helm upgrade --install \
      --wait \
      --set application.env_slug="$CI_ENVIRONMENT_SLUG" \
      --set application.path_slug="$CI_PROJECT_PATH_SLUG" \
      --set service.enabled="$service_enabled" \
      --set releaseOverride="$CI_ENVIRONMENT_SLUG" \
      --set image.repository="$CI_APPLICATION_REPOSITORY" \
      --set image.tag="$CI_APPLICATION_TAG" \
      --set image.pullPolicy=IfNotPresent \
      --set application.track="$track" \
      --set service.url="$CI_ENVIRONMENT_URL" \
      --set replicaCount="$replicas" \
      $mongo_settings \
      --namespace="$KUBE_NAMESPACE" \
      --version="$CI_PIPELINE_ID-$CI_JOB_ID" \
      "$name" \
      chart/

    echo -n "Waiting for mongodb pod to start"
    export MONGO_POD=""
    while [ -z "$MONGO_POD" ]; do echo -n .; sleep 5; get_mongo_pod; done; echo
    echo "Using pod: $MONGO_POD"
    echo -n "Connecting to mongodb"
    while ! kubectl exec $MONGO_POD -- mongo mongodb://localhost/test_suite --eval "db.version()" > /dev/null 2>&1; do echo -n .; sleep 1; done; echo
    # despite the db.version check we've seen instances of the insert failing - give it an extra few seconds to settle
    sleep 2
    echo "Inserting CI token"
    CI_TOKEN=$( dd bs=64 count=1 < /dev/urandom | base64 - | tr -d '\n=' )
    kubectl exec $MONGO_POD -- \
      mongo mongodb://localhost/test_suite --eval \
        "db.API_TOKEN.update({ _id: \"ci_token\" }, { _id: \"ci_token\", owner: { sub: \"ci\", iss: \"${CI_ENVIRONMENT_URL}\" }, info: {}, token: \"${CI_TOKEN}\", expires: null }, { upsert: true })"

    # This passes these two variables to the test jobs
    echo "CONFORMANCE_SERVER=$CI_ENVIRONMENT_URL" >> deploy.env
    # Note that this means the token is available to download from the pipeline artifacts - this isn't great, but equally the token doesn't give access to anything really important
    echo "CONFORMANCE_TOKEN=$CI_TOKEN" >> deploy.env
  }

  function get_mongo_pod() {
    MONGO_POD=`kubectl -n ${KUBE_NAMESPACE} get pod \
      -l app.kubernetes.io/component=mongodb -l app.kubernetes.io/instance=${CI_ENVIRONMENT_SLUG} \
      --field-selector=status.phase=Running \
      -o template --template="{{(index .items 0).metadata.name}}" 2>&1` \
      || MONGO_POD=''
    export MONGO_POD
  }

  function setup_docker() {
    if ! docker info &>/dev/null; then
      if [ -z "$DOCKER_HOST" -a "$KUBERNETES_PORT" ]; then
        export DOCKER_HOST='tcp://localhost:2375'
      fi
    fi
  }

  function ensure_namespace() {
    kubectl describe namespace "$KUBE_NAMESPACE" || kubectl create namespace "$KUBE_NAMESPACE"
  }

  function check_kube_domain() {
    if [ -z ${KUBE_INGRESS_BASE_DOMAIN+x} ]; then
      echo "In order to deploy, KUBE_INGRESS_BASE_DOMAIN must be set as a variable at the group or project level, or manually added in .gitlab-ci.yml"
      false
    else
      true
    fi
  }

  function install_build_dependencies() {
    apk -q add --no-cache --update --upgrade curl tar gzip make ca-certificates openssl python3 py-pip
    update-ca-certificates
    pip -q install docker-compose==1.23.2
    docker-compose --version

    curl https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-375.0.0-linux-x86_64.tar.gz | tar zx
    ./google-cloud-sdk/install.sh --usage-reporting=false --path-update=true
  }

  function run_compare() {
    apk add curl colordiff
    mkdir reference
    cd reference
    for i in $*; do
      curl --silent --show-error -L -o $i.zip https://gitlab.com/openid/conformance-suite/-/jobs/artifacts/master/download?job=$i
      unzip $i.zip
      rm $i.zip
    done
    cd ..
    ./scripts/compare-results.py reference .
  }

  function upload() {
    if [ -z "$GCP_PROJECT_ID" ]; then
      echo "No GCP integration configured - the full set of tests cannot be run."
      echo ""
      echo "If this is a merge request being submitted to"
      echo "https://gitlab.com/openid/conformance-suite"
      echo "an OIDF developer will review the code and then create a new pipeline"
      echo "to run the full set of tests."
      exit 137 # this will show as a warning in the pipeline, see allow_failure: entry
    fi

    docker tag conformance-suite "$CI_APPLICATION_REPOSITORY:$CI_APPLICATION_TAG"

    echo "Logging in to container registry..."
    echo "$GCLOUD_SERVICE_KEY" | base64 -d > ${HOME}/gcloud-service-key.json
    ./google-cloud-sdk/bin/gcloud auth activate-service-account --key-file ${HOME}/gcloud-service-key.json

    echo "Pushing to GCR..."
    ./google-cloud-sdk/bin/gcloud docker -- push "$CI_APPLICATION_REPOSITORY:$CI_APPLICATION_TAG"
    echo ""
  }

  function install_test_dependencies() {
    echo "Installing extra dependencies"
    apk add -U openssh-client git bash
    eval $(ssh-agent -s)
    echo "$SSH_PRIVATE_KEY" | ssh-add -
    cd ..
    GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no" git clone git@gitlab.com:openid/conformance-suite-private.git
    cd conformance-suite-private
  }

  function set_up_for_running_test_plan() {
    install_test_dependencies
    pip install httpx
  }

  function run_client_test_plan() {
    apk add nodejs npm
    echo "Running automated tests against $CONFORMANCE_SERVER"
    ../conformance-suite/.gitlab-ci/run-tests.sh --client-tests-only
  }

  function run_server_test_plan() {
    echo "Running automated tests against $CONFORMANCE_SERVER"
    ../conformance-suite/.gitlab-ci/run-tests.sh --server-tests-only
  }

  function run_ciba_test_plan() {
    echo "Running automated tests against $CONFORMANCE_SERVER"
    ../conformance-suite/.gitlab-ci/run-tests.sh --ciba-tests-only
  }

  function run_brazil_test_plan() {
    echo "Running automated tests against $CONFORMANCE_SERVER"
    ../conformance-suite/scripts/test-configs-brazil/run-raidiam.sh
  }

  function run_ekyc_test_plan() {
    echo "Running automated tests against $CONFORMANCE_SERVER"
    ../conformance-suite/.gitlab-ci/run-tests.sh --ekyc-tests
  }

before_script:
  - *auto_devops