.drone.yml

# Copyright (c) 2022-2024 SIGHUP s.r.l All rights reserved.
# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE file.

name: QA
kind: pipeline
type: docker

trigger:
  ref:
    exclude:
      # this tag is created by Chart Releaser after the release.
      - refs/tags/gatekeeper-policy-manager-**

steps:
  - name: Check license headers presence
    image: docker.io/library/golang:1.17.3
    depends_on:
      - clone
    commands:
      - go get -u github.com/google/addlicense
      - addlicense -c "SIGHUP s.r.l" -v -l bsd -check -ignore 'chart/**' -ignore 'gpm.yaml' -ignore 'rendered_chart.yaml' .

  - name: Lint
    image: quay.io/sighup/policeman
    pull: always
    depends_on:
      - clone
    environment:
      FILTER_REGEX_EXCLUDE: (app/static-content/semantic.min.css|chart/|tests/e2e/|\.github)
      # Identifies false positives like missing 'selector'.
      # Doing this is valid for Kustomize patches
      VALIDATE_KUBERNETES_KUBECONFORM: "false"
      VALIDATE_KUBERNETES_KUBEVAL: "false"
      # Some duplicated code is intended.
      VALIDATE_JSCPD: "false"
      TYPESCRIPT_DEFAULT_STYLE: "prettier"
      # We ignore the command not found error, because in the linter image we don't have all the binaries being called.
      SHELLCHECK_OPTS: "-e SC2317"

  - name: Render manifests
    image: quay.io/sighup/e2e-testing:1.1.0_0.11.0_3.12.0_1.9.4_1.29.1_3.5.3_4.33.3
    depends_on:
      - clone
    commands:
      - kustomize build . > gpm.yaml
      - helm template --set config.secretKey=e2e chart > rendered_chart.yaml

  - name: Check deprecated APIs
    image: us-docker.pkg.dev/fairwinds-ops/oss/pluto:v5
    pull: always
    depends_on:
      - "Render manifests"
    commands:
      # we use --ignore-deprecations because we don't want the CI to fail when the API has not been removed yet.
      - /pluto detect gpm.yaml --ignore-deprecations --target-versions=k8s=v1.31.0
      - /pluto detect rendered_chart.yaml --ignore-deprecations --target-versions=k8s=v1.31.0

---
name: Build test and release
kind: pipeline
type: docker

depends_on:
  - QA

trigger:
  ref:
    include:
      - refs/tags/**
      - refs/heads/main
      - refs/heads/dependabot/**
    exclude:
      # this tag is created by Chart Releaser after the release.
      - refs/tags/gatekeeper-policy-manager-**
      # exclude this expensive pipeline when releasing only a new version of the chart
      - refs/tags/helm-chart-**

steps:
  - name: Build container image
    image: docker:dind
    pull: always
    environment:
      CONTAINER_IMAGE_NAME: gatekeeper-policy-manager
      CONTAINER_IMAGE_TAG: test-${DRONE_BUILD_NUMBER}
      DOCKERFILE: Dockerfile
      BUILD_CONTEXT: "."
    volumes:
      - name: dockerconfig
        path: /root/.docker/config.json
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - "apk add git"
      - "docker buildx create --name sighup-builder --use"
      - "docker buildx build --platform linux/amd64,linux/arm64 --pull -f $${DOCKERFILE} -t $${CONTAINER_IMAGE_NAME}:$${CONTAINER_IMAGE_TAG} $${BUILD_CONTEXT}"
      - "docker buildx build --load -t $${CONTAINER_IMAGE_NAME}:$${CONTAINER_IMAGE_TAG} $${BUILD_CONTEXT}"

  - name: Create Kind cluster
    image: docker:dind
    pull: always
    environment:
      KIND_VERSION: v0.24.0
      CLUSTER_VERSION: v1.31.0
      LOAD_IMAGE: gatekeeper-policy-manager:test-${DRONE_BUILD_NUMBER}
      CLUSTER_NAME: ${DRONE_REPO_NAME}-${DRONE_BUILD_NUMBER}
    volumes:
      - name: dockerconfig
        path: /root/.docker/config.json
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - wget -qO /usr/local/bin/kind "https://kind.sigs.k8s.io/dl/$${KIND_VERSION}/kind-$(uname)-amd64"
      - wget -qO /usr/local/bin/kubectl "https://storage.googleapis.com/kubernetes-release/release/$${CLUSTER_VERSION}/bin/linux/amd64/kubectl"
      - chmod +x /usr/local/bin/kind /usr/local/bin/kubectl
      - kind create cluster --name $${CLUSTER_NAME} --image registry.sighup.io/fury/kindest/node:$${CLUSTER_VERSION}
      - kind load docker-image $${LOAD_IMAGE} --name $${CLUSTER_NAME}
      - kind get kubeconfig --name $${CLUSTER_NAME} > kubeconfig.yml

  - name: E2E tests
    image: quay.io/sighup/e2e-testing:1.1.0_1.31.1_3.10.0_4.33.3
    network_mode: host
    environment:
      LOAD_IMAGE: gatekeeper-policy-manager:test-${DRONE_BUILD_NUMBER}
    commands:
      - export KUBECONFIG=$PWD/kubeconfig.yml
      - cd tests
      - kustomize edit set image quay.io/sighup/gatekeeper-policy-manager=$${LOAD_IMAGE}
      - cd -
      - bats -t tests/tests.sh

  - name: GPM port-forward
    image: quay.io/sighup/e2e-testing:1.1.0_1.31.1_3.10.0_4.33.3
    network_mode: host
    detach: true
    commands:
      - export KUBECONFIG=$PWD/kubeconfig.yml
      - kubectl port-forward svc/gatekeeper-policy-manager 8080:80 -n gatekeeper-system

  - name: UI tests
    # This must match the version in the package.json file
    image: mcr.microsoft.com/playwright:v1.30.0-focal
    network_mode: host
    commands:
      - cd tests/e2e && yarn install && yarn test

  - name: Print images diff on fail
    # This must match the version in the package.json file
    image: mcr.microsoft.com/playwright:v1.30.0-focal
    commands:
      - for f in tests/e2e/test-results/*/*diff.png; do echo $f; base64 -w 0 $f; echo; done;
      - "echo 'Use base64 to decode the images and see the diff'"
    when:
      status:
        - failure

  - name: Destroy Kind cluster
    image: docker:dind
    pull: always
    environment:
      KIND_VERSION: v0.24.0
      CLUSTER_NAME: ${DRONE_REPO_NAME}-${DRONE_BUILD_NUMBER}
    volumes:
      - name: dockerconfig
        path: /root/.docker/config.json
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - wget -qO /usr/local/bin/kind "https://kind.sigs.k8s.io/dl/$${KIND_VERSION}/kind-$(uname)-amd64"
      - chmod +x /usr/local/bin/kind
      - kind delete cluster --name $${CLUSTER_NAME}
      - rm kubeconfig.yml
    when:
      status:
        - success
        - failure

  - name: Push unstable image
    image: docker:dind
    pull: always
    environment:
      username:
        from_secret: quay_username
      password:
        from_secret: quay_password
      REGISTRY: quay.io
      IMAGE_NAME: sighup/gatekeeper-policy-manager
      DOCKERFILE: Dockerfile
      BUILD_CONTEXT: "."
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - "apk add git"
      - "docker login $${REGISTRY} -u $${username} -p $${password}"
      - "docker buildx create --name sighup-builder --use"
      - "docker buildx build --platform linux/amd64,linux/arm64 --pull --push -f $${DOCKERFILE} -t $${REGISTRY}/$${IMAGE_NAME}:${DRONE_COMMIT_SHA} -t $${REGISTRY}/$${IMAGE_NAME}:unstable $${BUILD_CONTEXT}"
    when:
      ref:
        include:
          - refs/heads/main

  - name: Push stable image
    image: docker:dind
    pull: always
    environment:
      username:
        from_secret: quay_username
      password:
        from_secret: quay_password
      REGISTRY: quay.io
      IMAGE_NAME: sighup/gatekeeper-policy-manager
      DOCKERFILE: Dockerfile
      BUILD_CONTEXT: "."
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - "apk add git"
      - "docker login $${REGISTRY} -u $${username} -p $${password}"
      - "docker buildx create --name sighup-builder --use"
      - "docker buildx build --platform linux/amd64,linux/arm64 --pull --push -f $${DOCKERFILE} -t $${REGISTRY}/$${IMAGE_NAME}:latest -t $${REGISTRY}/$${IMAGE_NAME}:${DRONE_TAG} $${BUILD_CONTEXT}"
    when:
      event:
        - tag

  - name: Package tar.gz
    image: alpine:latest
    pull: always
    commands:
      - tar -zcvf gatekeeper-policy-manager-${DRONE_TAG}.tar.gz manifests/ kustomization.yaml docs/releases/${DRONE_TAG}.md LICENSE README.md
    when:
      event:
        - tag

  - name: Prepare release notes
    image: quay.io/sighup/fury-release-notes-plugin:3.7_2.8.4
    settings:
      release_notes_file_path: release-notes.md
    when:
      event:
        - tag

  - name: Publish Preview Release
    image: plugins/github-release
    pull: always
    settings:
      api_key:
        from_secret: c3p0
      file_exists: overwrite
      files:
        - gatekeeper-policy-manager-${DRONE_TAG}.tar.gz
      prerelease: true
      overwrite: true
      title: "Release Candidate ${DRONE_TAG}"
      note: release-notes.md
      checksum:
        - md5
        - sha256
    when:
      ref:
        include:
          - refs/tags/v**-rc**

  - name: Publish Final Release
    image: plugins/github-release
    pull: always
    settings:
      api_key:
        from_secret: c3p0
      file_exists: overwrite
      files:
        - gatekeeper-policy-manager-${DRONE_TAG}.tar.gz
      prerelease: false
      overwrite: true
      title: "Release ${DRONE_TAG}"
      note: release-notes.md
      checksum:
        - md5
        - sha256
    when:
      ref:
        exclude:
          - refs/tags/v**-rc**
        include:
          - refs/tags/v**

volumes:
  - name: dockerconfig
    host:
      path: /root/.docker/config.json
  - name: dockersock
    host:
      path: /var/run/docker.sock

---
name: Release Helm Chart
kind: pipeline
type: docker

depends_on:
  - "Build test and release"

trigger:
  ref:
    include:
      # Trigger the Helm Chart Releaser only when tagging
      - refs/tags/**
    exclude:
      # Don't release the chart when tagging Release Candidates
      - refs/tags/v**-rc.**
      # These kind of tags are generated by `cr` in this pipeline
      # we exclude them to avoid a loop.
      - refs/tags/gatekeeper-policy-manager-**

steps:
  # We need to manually fetch the gh-pages branch because Drone by default
  # only checksout the current branch with a minimal depth
  # see: https://docs.drone.io/pipeline/docker/syntax/cloning/
  - name: fetch-gh-pages-branch
    image: alpine/git
    commands:
      - git fetch origin gh-pages

  # We use GitHub Pages as Helm Repository and `cr` (Chart Releaser)
  # to help us publish the chart.
  - name: chart-releaser
    image: quay.io/helmpack/chart-releaser:v1.4.0
    environment:
      CR_OWNER: sighupio
      CR_GIT_REPO: gatekeeper-policy-manager
      CR_TOKEN:
        from_secret: c3p0
    commands:
      # For some reason we need to manually create the folder each time
      # see: https://github.com/helm/chart-releaser/issues/187
      - mkdir -p .cr-index
      # Package the chart into a tar.gz
      - cr package ./chart
      # Upload the tar.gz to a GitHub release
      - cr upload --skip-existing
      # Update the index.yaml and push it to GitHub Pages
      - cr index --push