.gitlab-ci.yml

stages:
  - prepare
  - build
  - test
  - deploy-stage-ansible
  - deploy-stage-nginx
  - deploy-stage-helm
  - deploy-prod-ansible
  - deploy-prod-nginx
  - deploy-prod-helm

.manual-web:
  rules:
    - if: $CI_PIPELINE_SOURCE == 'web'
      when: manual
      allow_failure: true

Assign Docker image tag:
  stage: prepare
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - Dockerfile
      variables:
        DOCKER_IMAGE_TAG: $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      variables:
        DOCKER_IMAGE_TAG: latest
    - if:  ($CI_PIPELINE_SOURCE != "merge_request_event" && $CI_COMMIT_BRANCH == 'main')
      variables:
        DOCKER_IMAGE_TAG: latest
  script:
    - echo "DOCKER_IMAGE_TAG=${DOCKER_IMAGE_TAG}" >> docker.env
  artifacts:
    reports:
      dotenv: docker.env

Build container with Kubernetes and git-crypt:
  stage: build
  rules:
    - !reference [.manual-web, rules]
    - if: ($CI_PIPELINE_SOURCE != "schedule" && $CI_COMMIT_BRANCH == 'main') || $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        - Dockerfile
  image: docker-private.gesis.intra/gesis/dc:5.7
  services:
    - name:  docker-private.gesis.intra/gesis/dind:5.5
      alias: docker
  script:
    - docker build --target k8s --no-cache --pull -t docker-private-snapshots.gesis.intra/gesis/ilcm/orc2/k8s:${DOCKER_IMAGE_TAG} .
    - docker push docker-private-snapshots.gesis.intra/gesis/ilcm/orc2/k8s:${DOCKER_IMAGE_TAG}

Build container with Ansible and git-crypt:
  stage: build
  rules:
    - !reference [.manual-web, rules]
    - if: ($CI_PIPELINE_SOURCE != "schedule" && $CI_COMMIT_BRANCH == 'main') || $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        - Dockerfile
  image: docker-private.gesis.intra/gesis/dc:5.7
  services:
    - name:  docker-private.gesis.intra/gesis/dind:5.5
      alias: docker
  script:
    - docker build --target ansible --no-cache --pull -t docker-private-snapshots.gesis.intra/gesis/ilcm/orc2/ansible:${DOCKER_IMAGE_TAG} .
    - docker push docker-private-snapshots.gesis.intra/gesis/ilcm/orc2/ansible:${DOCKER_IMAGE_TAG}

.gesis ansible lint:
  stage: test
  rules:
    - !reference [.manual-web, rules]
    - if: (($CI_PIPELINE_SOURCE != "schedule") && $CI_COMMIT_BRANCH == 'main') || $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        - ansible/**/*
  image: 
    name: docker-private-snapshots.gesis.intra/gesis/ilcm/orc2/ansible:${DOCKER_IMAGE_TAG}
    entrypoint: [""]
  script:
    - ansible-lint --version
    - ansible-lint --show-relpath ansible

.gesis ansible deploy:
  image: 
    name: docker-private-snapshots.gesis.intra/gesis/ilcm/orc2/ansible:${DOCKER_IMAGE_TAG}
    entrypoint: [""]
  variables:
    ANSIBLE_INVENTORY: template
  script:
    - mkdir ~/.ssh/
    - echo StrictHostKeyChecking no > ~/.ssh/config
    - cp $ANSIBLE_SSH_PUBLIC_KEY ~/.ssh/id_ed25519.pub
    - cp $ANSIBLE_SSH_PRIVATE_KEY ~/.ssh/id_ed25519
    - chmod 600 ~/.ssh/id_ed25519
    - echo $ANSIBLE_VAULT > ansible/.ansible-vault-password-file
    - ansible --version
    - |
      ansible-playbook \
      --vault-password-file ansible/.ansible-vault-password-file \
      --extra-vars @ansible/vault/${ANSIBLE_INVENTORY}.yml \
      --extra-vars "ANSIBLE_CONTROL_NODE_TMP=$(pwd)/tmp" \
      --inventory ansible/inventories/${ANSIBLE_INVENTORY} \
      --user ansible \
      ansible/orc2.yml

.gesis ansible stage deploy:
  resource_group: stage
  stage: deploy-stage-ansible
  rules:
    - !reference [.manual-web, rules]
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - ansible/**/*
        - nginx/**/*
        - cron/**/*
  variables:
    ANSIBLE_INVENTORY: stage
  extends:
    - .gesis ansible deploy

gesis ansible production deploy:
  resource_group: production
  stage: deploy-prod-ansible
  rules:
    - !reference [.manual-web, rules]
    - if: $CI_COMMIT_BRANCH == 'main'
      changes:
        - ansible/**/*
        - nginx/**/*
        - cron/**/*
  variables:
    ANSIBLE_INVENTORY: production
  extends:
    - .gesis ansible deploy

.gesis nginx update with ansible:
  image: 
    name: docker-private-snapshots.gesis.intra/gesis/ilcm/orc2/ansible:${DOCKER_IMAGE_TAG}
    entrypoint: [""]
  variables:
    ANSIBLE_INVENTORY: template
  script:
    - mkdir ~/.ssh/
    - echo StrictHostKeyChecking no > ~/.ssh/config
    - cp $ANSIBLE_SSH_PUBLIC_KEY ~/.ssh/id_ed25519.pub
    - cp $ANSIBLE_SSH_PRIVATE_KEY ~/.ssh/id_ed25519
    - chmod 600 ~/.ssh/id_ed25519
    - echo $ANSIBLE_VAULT > ansible/.ansible-vault-password-file
    - ansible --version
    - |
      ansible-playbook \
      --vault-password-file ansible/.ansible-vault-password-file \
      --extra-vars @ansible/vault/${ANSIBLE_INVENTORY}.yml \
      --extra-vars "ANSIBLE_CONTROL_NODE_TMP=$(pwd)/tmp" \
      --inventory ansible/inventories/${ANSIBLE_INVENTORY} \
      --user ansible \
      --tags nginx-config \
      ansible/orc2.yml

.gesis nginx update with ansible at stage environment:
  resource_group: stage
  stage: deploy-stage-nginx
  rules:
    - !reference [.manual-web, rules]
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - helm/charts/gesis/files/etc/binderhub/templates/page.html
        - pages/**/*
        - nginx/**/*
  variables:
    ANSIBLE_INVENTORY: stage
  extends:
    - .gesis nginx update with ansible

gesis nginx update with ansible at stage production:
  resource_group: production
  stage: deploy-prod-nginx
  rules:
    - !reference [.manual-web, rules]
    - if: $CI_COMMIT_BRANCH == 'main'
      changes:
        - helm/charts/gesis/files/etc/binderhub/templates/page.html
        - pages/**/*
        - nginx/**/*
  variables:
    ANSIBLE_INVENTORY: production
  extends:
    - .gesis nginx update with ansible

gesis helm lint:
  stage: test
  rules:
    - !reference [.manual-web, rules]
    - if: (($CI_PIPELINE_SOURCE != "schedule") && $CI_COMMIT_BRANCH == 'main') || $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        - helm/**/*
  image: 
    name: docker-private-snapshots.gesis.intra/gesis/ilcm/orc2/k8s:${DOCKER_IMAGE_TAG}
    entrypoint: [""]
  script:
    - helm version
    - helm dependency update ./helm/charts/gesis
    - helm lint ./helm/charts/gesis
    - helm template gesis ./helm/charts/gesis > gesis.helm.chart.yaml

.gesis helm deploy:
  image: 
    name: docker-private-snapshots.gesis.intra/gesis/ilcm/orc2/k8s:${DOCKER_IMAGE_TAG}
    entrypoint: [""]
  variables:
    HELM_ENVIRONMENT: template
  script:
    - cat $git_crypt_secret_key | base64 -d > git_crypt_secret_key
    - git-crypt unlock git_crypt_secret_key
    - kubectl config use-context ilcm/orc2:${HELM_ENVIRONMENT}
    - helm version
    - helm dependency update ./helm/charts/gesis
    - |
      helm upgrade \
      binderhub ./helm/charts/gesis \
      --cleanup-on-fail \
      --create-namespace \
      --history-max 3 \
      --install \
      --namespace=gesis \
      --render-subchart-notes \
      --values ./helm/gesis-config/${HELM_ENVIRONMENT}.yaml \
      --values ./helm/gesis-config/secrets/values.yaml \
      --values ./helm/gesis-config/secrets/ban.yaml \
      --values ./helm/gesis-config/secrets/${HELM_ENVIRONMENT}.yaml \
      --values ./helm/copy-of-mybinder.org-deploy/secrets/config/common/common.yaml \
      --values ./helm/copy-of-mybinder.org-deploy/secrets/config/common/bans.yaml \
      --values ./helm/copy-of-mybinder.org-deploy/secrets/config/common/cryptnono.yaml

.gesis helm stage deploy:
  resource_group: stage
  stage: deploy-stage-helm
  rules:
    - !reference [.manual-web, rules]
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - helm/**/*
  variables:
    HELM_ENVIRONMENT: stage
  extends:
    - .gesis helm deploy

gesis helm production deploy:
  resource_group: production
  stage: deploy-prod-helm
  rules:
    - !reference [.manual-web, rules]
    - if: $CI_PIPELINE_SOURCE != "merge_request_event" && $CI_COMMIT_BRANCH == 'main'
      changes:
        - helm/**/*
  variables:
    HELM_ENVIRONMENT: production
  extends:
    - .gesis helm deploy

pages:
  stage: build
  rules:
    - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == 'main'
      changes:
        - docs/**/*
  image: docker-private-snapshots.gesis.intra/gesis/methods-hub/quarto:latest
  dependencies: []
  script:
    - quarto check
    - quarto render docs -t html --output-dir public
    - mv docs/public .
  artifacts:
    paths:
      - public