.gitlab-ci.yml

variables:
  GET_SOURCES_ATTEMPTS: 3
  DEPLOY_DOMAIN_SUFFIX: -ce.review.mist.io
  TEST_DEPLOY_DOMAIN_SUFFIX: -ce.test.mist.io

  # Possible values are CI_REGISTRY, EXT_REGISTRY, DOCKERHUB
  COMPOSE_REGISTRY: DOCKERHUB
  DEPLOY_REGISTRY: CI_REGISTRY
  # Set to empty string '' to disable.
  DEPLOY_REGISTRY_AUTH: '1'
  # API & UI tests image
  TESTS_IMAGE: $DOCKERHUB_IMAGE/tests:$CI_COMMIT_SHA
  SUBMODULES_IMAGE: mist

stages:
  - discover
  - build
  - release
  - deploy
  - test
  - undeploy


#################### DISCOVER STAGE ####################

discover submodules:
  stage: discover
  image: alpine:3.9
  retry: 1  # sometimes gitlab api returns 500
  before_script:
    - apk add --no-cache git
  script:
    - |
        git submodule status --recursive | \
          sed 's/^[ +-]\([0-9a-f]*\) \([^ ]*\).*$/\1,\2/' > submodules.csv
  artifacts:
    paths:
      - submodules.csv
    expire_in: 10 days
  dependencies: []


#################### BUILD STAGE ####################

.dind_template: &docker_template
  stage: build
  image: docker:19.03-git
  services:
    - docker:19.03-dind
  variables: &docker_variables
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_CERTDIR: "/certs"
  retry: 2
  tags:
    - builder
  before_script:
    - docker info
    # Configure registries.
    - |
        export REGISTRIES=""

        # Login to gitlab docker registry.
        if [ -n "$CI_REGISTRY_IMAGE" ]; then
          echo "Logging in to gitlab registry."
          docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" \
            $CI_REGISTRY
          export REGISTRIES="$REGISTRIES $CI_REGISTRY_IMAGE"
          echo "Logged in to gitlab registry."
        else
          echo "No credentials provided for gitlab registry, skipping."
        fi

        # Login to other registry.
        if [ -n "$EXT_REGISTRY" ] && \
           [ -n "$EXT_REGISTRY_IMAGE" ] && \
           [ -n "$EXT_REGISTRY_USER" ] && \
           [ -n "$EXT_REGISTRY_PASSWORD" ]
        then
          echo "Logging in to $EXT_REGISTRY."
          docker login -u "$EXT_REGISTRY_USER" -p "$EXT_REGISTRY_PASSWORD" \
            "$EXT_REGISTRY"
          export REGISTRIES="$REGISTRIES $EXT_REGISTRY_IMAGE"
          echo "Logged in to $EXT_REGISTRY."
        else
          echo "No credentials provided for external registry, skipping."
        fi

        # Login to dockerhub.
        if [ -n "$DOCKERHUB_IMAGE" ] && \
           [ -n "$DOCKERHUB_USER" ] && \
           [ -n "$DOCKERHUB_PASSWORD" ]
        then
          echo "Logging in to dockerhub."
          docker login -u "$DOCKERHUB_USER" -p "$DOCKERHUB_PASSWORD"
          export REGISTRIES="$REGISTRIES $DOCKERHUB_IMAGE"
          echo "Logged in to dockerhub."
        else
          echo "No credentials provided for dockerhub, skipping."
        fi

        # Check if any registry configured.
        if [ -z "$REGISTRIES" ]; then
          echo "No registries configured, exiting."
          exit 1
        fi
    - |
        function docker_pull() {
          # docker_pull <img> : Will retry several times to pull image.
          img=$1
          tries=60
          sleep=10
          echo "Will try to pull image $img ($tries tries, ${sleep}s sleep)."
          for i in $(seq 1 $tries); do
            if docker pull $img; then
              echo "Image $img pulled successfully!"
              return 0
            fi
            sleep $sleep
          done
          echo "Failed too pull image $img."
          return 1
        }
    - |
        function docker_push() {
          # docker_push <src> <dest>: Retag and push image
          # <src> must be the full name of a local image.
          # <dest> must be just the image identifier, registry and tag will be
          # added automatically.
          tags="$CI_COMMIT_SHA $CI_COMMIT_REF_SLUG"
          if [ "$CI_COMMIT_REF_NAME" = "master" ]; then
            tags="$tags latest"
          fi
          src=$1
          for registry in $REGISTRIES; do
            for tag in $tags; do
              dest="$registry/$2:$tag"
              echo "Tagging image $src as $dest..."
              docker tag $src $dest
              echo "Pushing image $dest..."
              docker push $dest
            done
          done
        }
    - |
        function get_submodule_sha() {
          cat submodules.csv | grep ",$1$" | cut -d, -f1
        }
    - |
        function docker_retag_submodule() {
          repo=$1
          img=$2
          src_img="$img:$(get_submodule_sha $repo)"
          docker_pull $src_img
          docker_push $src_img $repo
        }
  dependencies:
    - discover submodules


build api:
  <<: *docker_template
  script:
    - |
        for submodule in orchestration; do
          git submodule sync $submodule
          git submodule update --init $submodule
        done
    - SRC_IMG="${SUBMODULES_IMAGE:-mist}/api:$(get_submodule_sha api)"
    - docker_pull $SRC_IMG
    - |
        docker build \
          -t $CI_PROJECT_NAME/api:$CI_COMMIT_SHA \
          --build-arg FROM_IMAGE=$SRC_IMG \
          --build-arg MIST_VERSION_SHA=$CI_COMMIT_SHA \
          --build-arg MIST_VERSION_NAME=$CI_COMMIT_REF_NAME \
          .
    - docker_push $CI_PROJECT_NAME/api:$CI_COMMIT_SHA api

build tests:
  <<: *docker_template
  script:
    - git submodule sync --recursive api
    - git submodule update --init --recursive api
    - export SRC_IMG="${SUBMODULES_IMAGE:-mist}/tests:$(get_submodule_sha tests)"
    - export IMG=$(echo "$CI_JOB_NAME" | cut -d " " -f2)
    - |
        docker build \
          -t $CI_PROJECT_NAME/$IMG:$CI_COMMIT_SHA \
          --build-arg SRC_IMG=$SRC_IMG \
          -f docker/tests/Dockerfile .
    - docker_push $CI_PROJECT_NAME/$IMG:$CI_COMMIT_SHA $IMG

.docker_build_template: &docker_build_template
  <<: *docker_template
  script:
    - export img=$(echo "$CI_JOB_NAME" | cut -d " " -f2)
    - docker build -t $CI_PROJECT_NAME/$img:$CI_COMMIT_SHA docker/$img
    - docker_push $CI_PROJECT_NAME/$img:$CI_COMMIT_SHA $img
  dependencies: []

build nginx: *docker_build_template
build gocky: *docker_build_template
build logstash: *docker_build_template
build elasticsearch-manage: *docker_build_template
build sheller: *docker_build_template
build wsproxy: *docker_build_template
build vault: *docker_build_template


.docker_retag_template: &docker_retag_template
  <<: *docker_template
  variables:
    <<: *docker_variables
    GIT_STRATEGY: none
  script:
    - export arg1=$(echo "$CI_JOB_NAME" | cut -d " " -f2)
    - export arg2=$(echo "$CI_JOB_NAME" | cut -d " " -f3)
    - export img="${SUBMODULES_IMAGE:-mist}/${arg1}"
    - export submodule="${arg2:-$arg1}"
    - echo "Will retag image $img from submodule $submodule."
    - docker_retag_submodule $submodule $img
  tags:
  - builder

retag landing: *docker_retag_template
retag ui: *docker_retag_template
retag portal: *docker_retag_template


compose:
  stage: build
  image: docker/compose:alpine-1.25.4
  before_script:
    - apk add --no-cache gettext
  script:
    - mkdir -p artifacts
    - export IMG_REGISTRY=$(eval echo \$${COMPOSE_REGISTRY}_IMAGE)
    - echo "IMG_REGISTRY=$IMG_REGISTRY"
    - export IMG_TAG=$CI_COMMIT_REF_SLUG
    - echo "IMG_TAG=$IMG_TAG"
    - export CONF_DIR=/etc/mist
    - envsubst < docker-compose.yml > artifacts/docker-compose.yml
  artifacts:
    paths:
      - artifacts/docker-compose.yml
  dependencies: []


#################### DEPLOY STAGE ####################

.deploy_template: &deploy_template
  stage: deploy
  image: mist/helm-automation
  before_script:
    - |
        set -e

        function set_chart_version() {
          if [ -n "$CI_COMMIT_TAG" ]; then
            CHART_VERSION=${CI_COMMIT_TAG:1}
          else
            CHART_VERSION=0.0.0
          fi
          export CHART_VERSION
          sed -i "s/0.0.0/$CHART_VERSION/g" ./chart/mist/Chart.yaml
        }

        function set_if_not_empty() {
          key="$1"
          val="$2"
          if [ -n "$val" ]; then
            echo " --set $key=$val"
          fi
        }

        function elasticsearch_params() {
          set_if_not_empty elasticsearch.host $ELASTICSEARCH_HOST
          set_if_not_empty elasticsearch.port $ELASTICSEARCH_PORT
          set_if_not_empty elasticsearch.username $ELASTICSEARCH_USERNAME
          set_if_not_empty elasticsearch.password $ELASTICSEARCH_PASSWORD
          set_if_not_empty elasticsearch.tls $ELASTICSEARCH_TLS
          set_if_not_empty elasticsearch.verifyCerts $ELASTICSEARCH_TLS
        }

        function deploy() {
          export namespace="$1"
          export release="$2"
          touch values.yaml
          export host=$(echo $CI_ENVIRONMENT_URL | sed 's/^https\?:\/\/\(.*\)/\1/')
          kubectl describe namespace/$namespace || \
            kubectl create namespace $namespace

          export image_secret_name=
          export REGISTRY_IMAGE="$(eval echo \$${DEPLOY_REGISTRY}_IMAGE)"
          export REGISTRY_USER="$(eval echo \$${DEPLOY_REGISTRY}_USER)"
          export REGISTRY_PASSWORD="$(eval echo \"\$${DEPLOY_REGISTRY}_PASSWORD\")"
          if [ "$DEPLOY_REGISTRY" = "CI_REGISTRY" ]; then
            if [ "$CI_PROJECT_VISIBILITY" = "public" ]; then
              export DEPLOY_REGISTRY_AUTH=
            elif [ -n "$CI_REGISTRY_USER_PERMANENT" -a -n "$CI_REGISTRY_PASSWORD_PERMANENT" ]; then
              export REGISTRY_USER="$CI_REGISTRY_USER_PERMANENT
              export REGISTRY_PASSWORD="$CI_REGISTRY_PASSWORD_PERMANENT
            fi
          fi
          if [ -n "$DEPLOY_REGISTRY_AUTH" ]; then
            export image_secret_name=registry
            kubectl create secret --namespace $namespace \
              docker-registry $image_secret_name \
              --docker-server=$REGISTRY_IMAGE \
              --docker-username=$REGISTRY_USER \
              --docker-password="$REGISTRY_PASSWORD" \
              --docker-email=$GITLAB_USER_EMAIL \
              -o yaml --dry-run | \
                kubectl replace --namespace $namespace --force -f -
          fi

          export tls_settings=
          if [ -n "$TLS_KEY" ] && [ -n "$TLS_CRT" ]; then
            tls_tmpdir=$(mktemp -d)
            echo "$TLS_KEY" > $tls_tmpdir/tls.key
            echo "$TLS_CRT" > $tls_tmpdir/tls.crt
            kubectl create secret --namespace $namespace \
              tls https \
              --key $tls_tmpdir/tls.key \
              --cert $tls_tmpdir/tls.crt \
              -o yaml --dry-run | \
                kubectl replace --namespace $namespace --force -f -
            export tls_settings="--set http.tlsSecret=https"
            rm -rf $tls_tmpdir
          fi

          set_chart_version

          helm repo add bitnami https://charts.bitnami.com/bitnami
          helm repo add mist-charts https://mist-charts.storage.googleapis.com/
          helm repo add vm https://victoriametrics.github.io/helm-charts/
          helm repo update
          helm dependency update ./chart/mist/

          helm upgrade --install --namespace $namespace \
            --wait --timeout=10m \
            -f values.yaml \
            --set image.tag="$CI_COMMIT_SHA" \
            --set image.registry="$REGISTRY_IMAGE" \
            --set image.secrets[0].name="$image_secret_name" \
            --set http.host="$host" \
            --set stripe.publicApiKey="$STRIPE_PUBLIC_APIKEY" \
            --set stripe.secretApiKey="$STRIPE_SECRET_APIKEY" \
            --set portalAdmin.enabled=false \
            --set auth.email.signup=true \
            --set awsAccessKey="$AWS_ACCESS_KEY" \
            --set awsSecretKey="$AWS_SECRET_KEY" \
            --set victoriametrics.vminsert.fullnameOverride="$release-vminsert" \
            --set victoriametrics.vmstorage.fullnameOverride="$release-vmstorage" \
            --set victoriametrics.vmselect.fullnameOverride="$release-vmselect" \
            --set vault.server.volumes[0].configMap.name="$release-vaultcfg" \
            --set vault.server.volumes[0].configMap.defaultMode=511 \
            --set vault.server.volumes[0].name="vault-config" \
            --set vault.server.volumes[1].secret.secretName="$release-vaultsecret" \
            --set vault.server.volumes[1].name="vault-approle-secret" \
            --set vault.server.volumes[2].persistentVolumeClaim.claimName="$release-vaultroot" \
            --set vault.server.volumes[2].name="vault-root-creds-pvc" \
            --set ingress-nginx.deploy=false \
            --set prometheus.enabled=true \
            --set deployment.api.replicas=2 \
            --set deployment.dramatiq.dramatiq.replicas=2 \
            $tls_settings \
            $(elasticsearch_params) \
            $release ./chart/mist/
          apk add --no-cache curl
          echo "Waiting for environment to be ready..."
          while kubectl --namespace $namespace get pods -l release=$release | grep -v -e NAME -e Running -e Completed -e Evicted -e OutOfcpu; do
            sleep 10 && echo '.'
          done
          while !(curl -sSLf "$CI_ENVIRONMENT_URL" >/dev/null); do
            sleep 5 && echo 'Environment not ready yet...'
          done
          echo "Environment ready at $CI_ENVIRONMENT_URL"
          if [ $(curl -LI $VAULT_ADDR/v1/sys/sealed -o /dev/null -w '%{http_code}\n' -s) = 503 ]; then
            echo "Vault is sealed"
            curl --request POST -d "{\"key\":\"$VAULT_UNSEAL_1\"}" $VAULT_ADDR/v1/sys/unseal
            curl --request POST -d "{\"key\":\"$VAULT_UNSEAL_2\"}" $VAULT_ADDR/v1/sys/unseal
            curl --request POST -d "{\"key\":\"$VAULT_UNSEAL_3\"}" $VAULT_ADDR/v1/sys/unseal
            if [ $(curl -LI $VAULT_ADDR/v1/sys/sealed -o /dev/null -w '%{http_code}\n' -s) == 503 ]; then
              echo "Failed to unseal"
            else
              echo "Unsealed"
            fi
          fi
        }
  script:
    - echo "$values" > values.yaml
    - deploy $namespace $release
  dependencies: []

deploy test:
  <<: *deploy_template
  environment:
    name: test/$CI_COMMIT_REF_SLUG
    url: https://$CI_COMMIT_REF_SLUG$TEST_DEPLOY_DOMAIN_SUFFIX
    on_stop: undeploy test
  variables:
    namespace: test-$CI_PROJECT_NAME
    release: test-$CI_PROJECT_NAME-$CI_COMMIT_REF_SLUG
    values: |-
      http:
        tlsSecret: tls-wildcard-test-mist-io
        tlsHosts:
          - '*.test.mist.io'
        tlsAnnotations:
          certmanager.k8s.io/cluster-issuer: letsencrypt-prod
          certmanager.k8s.io/acme-challenge-type: dns01
          certmanager.k8s.io/acme-dns01-provider: mist-dns
      enableDevUsers: true
      sentry:
        api: $SENTRY_API
        apiv2: $SENTRY_API_V2
        dramatiq: $SENTRY_DRAMATIQ
        sockjs: $SENTRY_SOCKJS
      #jsBuild: false

.deploy_review_template: &deploy_review_template
  <<: *deploy_template
  variables:
    namespace: $CI_PROJECT_NAME
    release: $CI_PROJECT_NAME-$CI_COMMIT_REF_SLUG
    values: |
      http:
        tlsSecret: tls-wildcard-review-mist-io
        tlsHosts:
          - '*.review.mist.io'
        tlsAnnotations:
          certmanager.k8s.io/cluster-issuer: letsencrypt-prod
          certmanager.k8s.io/acme-challenge-type: dns01
          certmanager.k8s.io/acme-dns01-provider: mist-dns
      enableDevUsers: false
      smtp:
        host: smtp.sendgrid.net
        port: 2525
        starttls: true
        username: apikey
        password: $SENDGRID_PASSWORD
      sentry:
        api: $SENTRY_API
        apiv2: $SENTRY_API_V2
        dramatiq: $SENTRY_DRAMATIQ
        sockjs: $SENTRY_SOCKJS

deploy review:
  <<: *deploy_review_template
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    url: https://$CI_COMMIT_REF_SLUG$DEPLOY_DOMAIN_SUFFIX
    on_stop: undeploy review
  except:
    - master
  when: manual

deploy master:
  <<: *deploy_review_template
  environment:
    name: master
    url: https://master$DEPLOY_DOMAIN_SUFFIX
  only:
    - master
  when: manual


#################### TEST STAGE ####################

.test_template: &test_template
  stage: test
  image: $TESTS_IMAGE
  variables:
    GIT_STRATEGY: none
    MIST_URL: https://$CI_COMMIT_REF_SLUG$TEST_DEPLOY_DOMAIN_SUFFIX
    DISPLAY: ":1.0"
    REGISTER_USER_BEFORE_FEATURE: "True"
    EMAIL: thingirl.tester.mist.io+${CI_JOB_ID}@gmail.com
    IMAP_HOST: test-$CI_PROJECT_NAME-$CI_COMMIT_REF_SLUG-mailmock.test-$CI_PROJECT_NAME.svc.cluster.local
  before_script:
    - 'export TEST=$(echo "$CI_JOB_NAME" | cut -d/ -f1 | cut -d: -f2-4 | tr : /)'
    - echo "Test argument is $TEST"
    - echo "Image used is $TESTS_IMAGE"
    - echo $TEST_SETTINGS | base64 -d > test_settings.py
  dependencies: []
  timeout: 15 minutes

# API Integration tests #

.api_test_template: &api_test_template
  <<: *test_template
  script:
    - /mist.tests/prepare_env.py --api -s -x /mist.tests/misttests/integration/api/$TEST.py

.api_test_template_manual: &api_test_template_manual
  <<: *test_template
  script:
    - /mist.tests/prepare_env.py --api -s -x /mist.tests/misttests/integration/api/$TEST.py
  when: manual

API:main:api_token: *api_test_template
API:main:buckets: *api_test_template
API:main:clouds: *api_test_template
API:main:dns: *api_test_template
API:main:keys: *api_test_template
API:main:images: *api_test_template
API:main:libcloud_1/2: *api_test_template
API:main:libcloud_2/2: *api_test_template
API:main:machines: *api_test_template
API:main:networks: *api_test_template
API:main:schedules: *api_test_template
API:main:scripts: *api_test_template
API:main:secrets: *api_test_template
API:main:teams: *api_test_template
API:main:ip_whitelisting: *api_test_template
API:main:volumes: *api_test_template
API:main:v2:test_clouds_controller: *api_test_template
API:main:v2:test_clusters_controller: *api_test_template_manual
API:main:v2:test_datapoints_controller: *api_test_template
API:main:v2:test_images_controller: *api_test_template
API:main:v2:test_jobs_controller: *api_test_template
API:main:v2:test_keys_controller: *api_test_template
API:main:v2:test_locations_controller: *api_test_template
API:main:v2:test_networks_controller: *api_test_template
API:main:v2:test_rules_controller: *api_test_template
API:main:v2:test_orgs_controller: *api_test_template
API:main:v2:test_scripts_controller: *api_test_template
API:main:v2:test_schedules_controller: *api_test_template
API:main:v2:test_sizes_controller: *api_test_template
API:main:v2:test_users_controller: *api_test_template
API:main:v2:test_volumes_controller: *api_test_template
API:main:v2:test_zones_controller: *api_test_template
API:main:v2:test_snapshots_controller: *api_test_template
API:main:v2:test_machines_controller_1: *api_test_template
API:main:v2:test_machines_controller_2: *api_test_template
API:main:v2:test_machines_controller_3: *api_test_template
API:main:v2:test_search_tags: *api_test_template
API:plugin:orchestration: *api_test_template_manual
.API:plugin:tunnels: *api_test_template


.ui_test_template: &ui_test_template
  <<: *test_template
  script:
    - /mist.tests/prepare_env.py -k --stop --tags=$TEST /mist.tests/misttests/integration/gui/v1/pr/features
  artifacts:
    paths:
      - js_console.log
      - artifacts/error.png
      - artifacts/output.mp4
    expire_in: 3 days
    when: on_failure
  tags:
    - chrome

# UI Integration tests #

UI:clouds-add-1/2: *ui_test_template
UI:clouds-add-2/2: *ui_test_template
UI:clouds-actions: *ui_test_template
UI:keys: *ui_test_template
UI:scripts: *ui_test_template
UI:images-networks: *ui_test_template
UI:user-actions: *ui_test_template
UI:teams: *ui_test_template
UI:zones: *ui_test_template
UI:rules-1/3: *ui_test_template
UI:rules-2/3: *ui_test_template
UI:rules-3/3: *ui_test_template
UI:machines-1/2:
  <<: *ui_test_template
  retry: 1
UI:machines-2/2:
  <<: *ui_test_template
  retry: 1
UI:monitoring:
  <<: *ui_test_template
  retry: 1
UI:schedulers-1/2:
  <<: *ui_test_template
  retry: 1
UI:schedulers-2/2:
  <<: *ui_test_template
  retry: 1
UI:schedulers-script: *ui_test_template
UI:ip-whitelisting:
  <<: *ui_test_template
  only:
    - staging

.UI:rbac-1/4: *ui_test_template
.UI:rbac-2/4: *ui_test_template
.UI:rbac-3/4: *ui_test_template
.UI:rbac-4/4: *ui_test_template
UI:orchestration: *ui_test_template
.UI:insights:
  <<: *ui_test_template
  retry: 1

# Machine Provisioning tests #

.multiprovisioning_test_template: &multiprovisioning_test_template
  <<: *test_template
  script:
    - /mist.tests/prepare_env.py -k --tags=$TEST /mist.tests/misttests/multiprovisioning/gui/features
  artifacts:
    paths:
      - js_console.log
      - artifacts/error.png
      - artifacts/output.mp4
    expire_in: 3 days
    when: on_failure
  tags:
    - chrome
  when: manual

MP:aliyun-machine-create: *multiprovisioning_test_template
MP:azure-machine-create: *multiprovisioning_test_template
MP:digital-ocean-machine-create: *multiprovisioning_test_template
MP:ec2-machine-create: *multiprovisioning_test_template
MP:gce-machine-create: *multiprovisioning_test_template
MP:kubevirt-machine-create: *multiprovisioning_test_template
MP:kvm-machine-create: *multiprovisioning_test_template
MP:linode-machine-create: *multiprovisioning_test_template
MP:lxd-provisioning: *multiprovisioning_test_template
# MP:openstack-machine-create: *multiprovisioning_test_template
MP:equinix-metal-machine-create: *multiprovisioning_test_template
MP:rackspace-machine-create: *multiprovisioning_test_template
MP:cloudsigma-machine-create: *multiprovisioning_test_template

# Machine Provisioning tests #
VP:aliyun-volume-create: *multiprovisioning_test_template
VP:azure-volume-create: *multiprovisioning_test_template
VP:digital-ocean-volume-create: *multiprovisioning_test_template
VP:ec2-volume-create: *multiprovisioning_test_template
VP:gce-volume-create: *multiprovisioning_test_template
VP:cloudsigma-volume-create: *multiprovisioning_test_template
# VP:openstack-volume-create: *multiprovisioning_test_template
#################### UNDEPLOY STAGE ####################

.undeploy_template: &undeploy_template
  stage: undeploy
  image: dtzar/helm-kubectl:3.4.0
  variables:
    GIT_STRATEGY: none
  script:
    - helm uninstall $release -n $namespace
  allow_failure: true
  dependencies: []

undeploy test:
  <<: *undeploy_template
  environment:
    name: test/$CI_COMMIT_REF_SLUG
    action: stop
  variables:
    GIT_STRATEGY: none
    release: test-$CI_PROJECT_NAME-$CI_COMMIT_REF_SLUG
    namespace: test-$CI_PROJECT_NAME
undeploy review:
  <<: *undeploy_template
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    action: stop
  variables:
    GIT_STRATEGY: none
    release: $CI_PROJECT_NAME-$CI_COMMIT_REF_SLUG
    namespace: $CI_PROJECT_NAME
  when: manual
  except:
    - master


#################### RELEASE STAGE ####################

release: &release_template
  when: manual
  stage: release
  image: python:3.8-alpine
  before_script:
    - apk add --update libmagic openssl
    - pip install requests python-magic
    - wget -O /usr/local/bin/submark https://github.com/dahlia/submark/releases/download/0.2.0/submark-linux-x86_64
    - chmod +x /usr/local/bin/submark
  script:
    - mkdir release
    - cp artifacts/docker-compose.yml release/docker-compose.yml
    - HEADER=$(sed -n "s/^## \($CI_BUILD_REF_NAME .*\)$/\1/p" CHANGELOG.md)
    - submark --omit-heading --h2="$HEADER" --out-file=release.md CHANGELOG.md
    - sed -i 's/^### Changes/## Changes/' release.md
    - echo >> release.md
    - sed "s/TAG/$CI_BUILD_REF_NAME/g;s/REPO/$CI_PROJECT_NAME/g" ci/release.md >> release.md
    - ./ci/release.py $RELEASE_ARGS --draft -f release/* -m @release.md mistio $CI_PROJECT_NAME $CI_BUILD_REF_NAME
  only:
    # only for references that match a version string (v1.2.3)
    - /^v\d+\.\d+\.\d+$/
  except:
    # Except branches, meaning it'll only apply to git tags
    - branches
  dependencies:
    - compose

prerelease:
  <<: *release_template
  variables:
    RELEASE_ARGS: "--prerelease"
  only:
    # only for references that match a prelease version string (v1.2.3-beta)
    - /^v\d+\.\d+\.\d+-.+$/

helm_chart_release:
  stage: release
  image: mist/helm-automation

  script:
    - |
        #! /usr/bin/env bash

        export CHART_VERSION=${CI_COMMIT_TAG:1}
        echo "CHART_VERSION=$CHART_VERSION"
        sed -i "s/0.0.0/$CHART_VERSION/g" ./chart/mist/Chart.yaml

        gcloud auth activate-service-account --key-file=$GCLOUD_SERVICE_KEY
        set -o errexit
        set -o nounset
        set -o pipefail
        readonly REPO_URL=https://mist-charts.storage.googleapis.com/
        readonly GCS_BUCKET=gs://mist-charts

        main() {
          if ! sync_repo chart "$GCS_BUCKET" "$REPO_URL"; then
              log_error "Not all charts could be packaged and synced!"
          fi
        }

        sync_repo() {
          local repo_dir="${1?Specify repo dir}"
          local bucket="${2?Specify repo bucket}"
          local repo_url="${3?Specify repo url}"
          local sync_dir="${repo_dir}-sync"
          local index_dir="${repo_dir}-index"

          echo "Syncing repo '$repo_dir'..."

          mkdir -p "$sync_dir"
          mkdir -p "$index_dir"

          # Disable cache in requests and responses
          gsutil -m setmeta -h "Cache-Control:no-cache" "$bucket"/*.tgz
          gsutil -m setmeta -h "Cache-Control:no-cache" "$bucket"/index.yaml

          # Copy the index.yaml file from the bucket.
          if ! gsutil cp "$bucket/index.yaml" "$index_dir/index.yaml"; then
            log_error "Exiting because unable to copy index locally. Not safe to proceed."
            exit 1
          fi

          local return_value=0

          # Loop around each chart and package.
          for dir in "$repo_dir"/*; do
            if helm dependency build "$dir"; then
              helm package --destination "$sync_dir" "$dir"
            else
              log_error "Problem building dependencies. Skipping packaging of '$dir'."
              return_value=1
            fi
          done

          if helm repo index --url "$repo_url" --merge "$index_dir/index.yaml" "$sync_dir"; then

            # Move updated index.yaml to sync folder so we don't push the old one again
            mv -f "$sync_dir/index.yaml" "$index_dir/index.yaml"

            # Push all the local chart tarballs to the bucket.
            gsutil -m rsync "$sync_dir" "$bucket"

            # Make sure index.yaml is synced last
            gsutil cp "$index_dir/index.yaml" "$bucket"

          else
            log_error "Exiting because unable to update index. Not safe to push update."
            exit 1
          fi

          ls -l "$sync_dir"

          return "$return_value"
        }

        log_error() {
          printf '\e[31mERROR: %s\n\e[39m' "$1" >&2
        }

        main
  when: manual
  only:
    # only for references that match a version string (v1.2.3)
    - /^v\d+\.\d+\.\d+$/
    # only for references that match a prelease version string (v1.2.3-beta)
    - /^v\d+\.\d+\.\d+-.+$/
  dependencies: []
  except:
    # Except branches, meaning it'll only apply to git tags
    - branches