.gitlab-ci.yml

image: ruby:2.6.7

variables:
  BUNDLER_VERSION: 2.1.4
  LICENSED_VERSION: 2.14.1
  # Rubocop Cache for Large Project
  XDG_CACHE_HOME: $CI_PROJECT_DIR/.cache
  CUCUMBER_PUBLISH_QUIET: 'true'
  # Services
  DATABASE_URL: mysql2://unlight:unlight@mysql/unlight_db?encoding=utf8
  MYSQL_USER: unlight
  MYSQL_PASSWORD: unlight
  MYSQL_DATABASE: unlight_db
  MYSQL_ROOT_PASSWORD: unlight
  MEMCACHED_HOST: memcached:11211
  # Testing
  DATABASE_CLEANER_ALLOW_REMOTE_DATABASE_URL: 'true'

.install_ruby_gems: &install_ruby_gems
  - gem install bundler -v ${BUNDLER_VERSION}
  - bundle install --path vendor

.base_test: &base_test
  stage: test
  before_script:
    - *install_ruby_gems
  services:
    - name: mysql:8.0
      command: ["--character-set-server=utf8mb4", "--collation-server=utf8mb4_unicode_ci", "--default-authentication-plugin=mysql_native_password"]
    - memcached:alpine

stages:
  - lint
  - test
  - analytics
  - build

cache:
  paths:
    - vendor/ruby
    - .cache
    - .licenses

before_script:
  - export LANG=C.UTF-8
  - export LC_ALL=C.UTF-8
  - *install_ruby_gems

hadolint:
  stage: lint
  image: hadolint/hadolint:latest-alpine
  before_script: []
  script:
    - hadolint Dockerfile
  only:
    changes:
      - Dockerfile
  except:
    - schedules

rubocop:
  stage: lint
  script:
    - bundle exec rubocop -P --format progress --format json --out rubocop.json
  artifacts:
    paths:
      - rubocop.json
  except:
    - schedules

licensed:
  stage: lint
  before_script:
    - apt-get update
    - apt-get install -y cmake pkg-config
    - curl -sSLO https://github.com/github/licensed/releases/download/${LICENSED_VERSION}/licensed-${LICENSED_VERSION}-linux-x64.tar.gz && tar -xzf licensed-${LICENSED_VERSION}-linux-x64.tar.gz -C /usr/local/bin --strip-components=1;
    - *install_ruby_gems
  script:
    - licensed cache
    - licensed status
  only:
    changes:
      - Gemfile
      - Gemfile.lock
  except:
    - schedules

bundler-audit:
  stage: lint
  before_script:
    - gem install bundler-audit
    - bundle audit --update
  script:
    - bundle audit
  only:
    changes:
      - Gemfile
      - Gemfile.lock
  allow_failure: true

bundler-leak:
  stage: lint
  before_script:
    - gem install bundler-leak
    - bundle leak check --update
  script:
    - bundle leak
  only:
    changes:
      - Gemfile
      - Gemfile.lock
  allow_failure: true

rspec:
  <<: *base_test
  script:
    # TODO: Run database migration
    - bundle exec rspec --format progress --format RspecJunitFormatter --out rspec.xml
  artifacts:
    paths:
      - rspec.xml
      - coverage
    reports:
      junit: rspec.xml
      cobertura: coverage/coverage.xml
  needs: []

cucumber:
  <<: *base_test
  script:
    # TODO: Run database migration
    - bundle exec cucumber
  needs: []

sonarqube:
  stage: analytics
  image:
    name: sonarsource/sonar-scanner-cli
    entrypoint: [""]
  variables:
    GIT_DEPTH: 0
  before_script: []
  script:
    - sonar-scanner
      -Dsonar.projectKey=$SONAR_PROJECT_KEY
      -Dsonar.sourceEncoding=UTF-8
      -Dsonar.qualitygate.wait=true
      -Dsonar.ruby.rubocop.reportPaths=rubocop.json
      -Dsonar.ruby.coverage.reportPaths=coverage/.resultset.json
      -Dsonar.exclusions=vendor/ruby/**/*
      -Dsonar.sources=.
  allow_failure: true
  only:
    refs:
      - master
    variables:
      - $SONAR_PROJECT_KEY
  needs:
    - rspec
  except:
    - schedules

build:
  stage: build
  image: quay.io/open-unlight/ansible-in-docker:19.03.1
  services:
    - docker:19.03.1-dind
  variables:
    DOCKER_HOST: tcp://docker:2376
  before_script:
    - $(aws ecr get-login --no-include-email --region ap-northeast-1)
  script:
    - docker pull $DOCKER_IMAGE:$CI_COMMIT_REF_SLUG || true
    - docker pull $DOCKER_IMAGE:$CI_COMMIT_REF_SLUG-gem || true
    - docker build
      --target gem
      --cache-from $DOCKER_IMAGE:$CI_COMMIT_REF_SLUG-gem
      --pull
      -t dawn-gem .
    - docker build
      --build-arg REVISION=$(echo $CI_COMMIT_REF_NAME | cut -d '/' -f2)
      --cache-from dawn-gem
      --cache-from $DOCKER_IMAGE:$CI_COMMIT_REF_SLUG
      -t dawn .
    # Prepare for Upload
    - docker tag dawn-gem $DOCKER_IMAGE:$CI_COMMIT_REF_SLUG-gem
    - docker tag dawn $DOCKER_IMAGE:$CI_COMMIT_REF_SLUG
    # Upload to AWS
    - docker push $DOCKER_IMAGE:$CI_COMMIT_REF_SLUG-gem
    - docker push $DOCKER_IMAGE:$CI_COMMIT_REF_SLUG
    - if [ "$CI_COMMIT_REF_NAME" == "master" ]; then docker tag $DOCKER_IMAGE:$CI_COMMIT_REF_SLUG $DOCKER_IMAGE:latest; fi
    - if [ "$CI_COMMIT_REF_NAME" == "master" ]; then docker push $DOCKER_IMAGE:latest; fi
      # Security Check
    - |
      VERSION=$(
      curl --silent "https://api.github.com/repos/goodwithtech/dockle/releases/latest" | \
      grep '"tag_name":' | \
      sed -E 's/.*"v([^"]+)".*/\1/' \
      ) && curl -L -o dockle.tar.gz https://github.com/goodwithtech/dockle/releases/download/v${VERSION}/dockle_${VERSION}_Linux-64bit.tar.gz &&  \
      tar zxvf dockle.tar.gz
    - ./dockle --exit-code 1 $DOCKER_IMAGE:$CI_COMMIT_REF_SLUG
  only:
    - /^release\/.*$/
    - master
    - tags
  needs:
    - rspec
  except:
    - schedules