.gitlab-ci.yml.sample

---

default:
  image: ubuntu:jammy

variables:
  # Because we are installing git-crypt as part of the job, we cannot reuse old
  # checkouts where git-crypt is already initialised as this results in an error
  GIT_STRATEGY: clone
  # Use the pipeline credentials for Terraform
  # This assumes that we are using GitLab-managed Terraform state (recommended when available)
  TF_HTTP_USERNAME: gitlab-ci-token
  TF_HTTP_PASSWORD: $CI_JOB_TOKEN

stages:
  # This stage owns the scheduled job that checks for upstream changes
  - scheduled
  # This stage owns the deploy and teardown jobs for dynamic environments
  - aio
  # This stage runs tests for dynamic environments
  - aio_test
  # This stage owns the deploy job for the staging environment
  - staging
  # This stage owns the test job for the staging environment
  - staging_test
  # This stage owns the deploy job for the production environment
  - production
  # This stage owns the test job for the production environment
  - production_test

#####
# This job checks to see if there is a new release that needs to be merged
#
# If there is, it will create a new branch containing the changes and a corresponding merge request
#
# It runs as a scheduled job, for which a suitable schedule must be defined, e.g. daily or weekly
#
# This job writes back to the repository and to the merge requests API
# To do this, it needs more power than is granted to the CI token
# So CI variables must be set that contain an access token and the corresponding username
# This can be a Project Access Token (paid feature, recommended if available) or a Personal Access Token (not ideal)
#####
check_for_release:
  stage: scheduled
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule" && $CI_COMMIT_BRANCH == "main"
  variables:
    GIT_STRATEGY: none
  before_script:
    - apt update -y
    - apt install -y curl git jq
  script:
    # Configure git to use the available credentials
    - git config --global credential.helper store
    # Do our own clone to make sure we don't get unrelated history errors from detached heads
    - git clone https://${GITLAB_PAT_USERNAME}:${GITLAB_PAT_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git ${CI_PROJECT_NAME}
    - cd ${CI_PROJECT_NAME}
    # Tell git who we are for commits
    - git config user.email "${CI_PROJECT_PATH_SLUG}-ci@${CI_SERVER_HOST}"
    - git config user.name "${CI_PROJECT_NAME} CI"
    # Create the merge branch
    - ./bin/create-merge-branch
    # Create a merge request for the branch
    - |
        if [ -f ".mergeenv" ]; then
          source ".mergeenv"
          BODY="{
            \"id\": ${CI_PROJECT_ID},
            \"title\": \"Upgrade Azimuth to ${RELEASE_TAG}\",
            \"source_branch\": \"${BRANCH_NAME}\",
            \"target_branch\": \"main\",
            \"remove_source_branch\": true,
            \"assignee_id\": \"${GITLAB_USER_ID}\"
          }"
          curl -kfsSL -X POST \
            "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/merge_requests" \
            --header "Authorization: Bearer ${GITLAB_PAT_TOKEN}" \
            --header "Content-Type: application/json" \
            --data "${BODY}"
        fi

#####
# This job deploys a dynamic review environment for a merge request
#
# Each environment is a single node deployment that is isolated from the other
# branches with it's own GitLab environment, Terraform state and OpenStack resources
# (although they do share an OpenStack project)
#
# This allows configuration changes to be tested  before being merged to main,
# subject to the differences between the aio and staging/production environments
#
# It is recommended to use a site mixin for the common configuration to increase the
# efficacy of this process!
#####
deploy_aio:
  stage: aio
  rules:
    # Do not run for commits to main
    - if: $CI_COMMIT_BRANCH == "main"
      when: never
    # Allow deployments to be manually triggered even when there are no changed files
    - if: $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "web"
    # Run when there is a push to a branch with a merge request to main
    - if: >-
        $CI_PIPELINE_SOURCE == "merge_request_event" &&
        $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main"
  environment:
    name: aio/$CI_COMMIT_REF_SLUG
    on_stop: stop_aio
  variables:
    # This is normally taken from the GitLab environment name, but in this case that
    # depends on the branch name so we need to be explicit about the config to use
    AZIMUTH_CONFIG_ENVIRONMENT: aio
    ANSIBLE_FORCE_COLOR: "true"
  before_script:
    - source ./bin/ci-setup
  script:
    - ansible-playbook stackhpc.azimuth_ops.provision

#####
# This job executes tests against dynamic review environments each time they are deployed
#####
test_aio:
  stage: aio_test
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: never
    - if: $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "web"
    - if: >-
        $CI_PIPELINE_SOURCE == "merge_request_event" &&
        $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main"
  environment:
    name: aio/$CI_COMMIT_REF_SLUG
  variables:
    AZIMUTH_CONFIG_ENVIRONMENT: aio
    ANSIBLE_FORCE_COLOR: "true"
  before_script:
    - source ./bin/ci-setup
  script:
    - ansible-playbook stackhpc.azimuth_ops.generate_tests
    # Use the unrestricted application credential to execute the tests, as per the docs
    - OS_CLOUD=unrestricted ./bin/run-tests

#####
# This job tears down dynamic review environments
#
# We need to work around the fact that the source branch may no longer exist
# See https://gitlab.com/gitlab-org/gitlab/-/issues/22943
#####
stop_aio:
  stage: aio
  rules:
    # These rules must match deploy_aio, but with manual trigger
    # Allow the job to fail so it does not block merges
    - if: $CI_COMMIT_BRANCH == "main"
      when: never
    - if: $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "web"
      when: manual
      allow_failure: true
    - if: >-
        $CI_PIPELINE_SOURCE == "merge_request_event" &&
        $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main"
      when: manual
      allow_failure: true
  environment:
    name: aio/$CI_COMMIT_REF_SLUG
    action: stop
  variables:
    AZIMUTH_CONFIG_ENVIRONMENT: aio
    GIT_STRATEGY: none
    ANSIBLE_FORCE_COLOR: "true"
  before_script:
    - git clone ${CI_REPOSITORY_URL} ${CI_PROJECT_NAME}
    - cd ${CI_PROJECT_NAME}
    # Use the commit SHA if it still exists because git garbage collection hasn't run yet
    # If not, assume the branch has been merged and run the destroy from main instead
    - git checkout ${CI_COMMIT_SHA} || git checkout main
    - source ./bin/ci-setup
  script:
    - ansible-playbook stackhpc.azimuth_ops.destroy

#####
# This job deploys Azimuth to the staging environment
#
# It runs automatically for every commit to main that changes one of the files
# that affects the environment
#####
deploy_staging:
  stage: staging
  rules:
    # Prevent the job from running on any branch that is not main
    - if: $CI_COMMIT_BRANCH != "main"
      when: never
    # Allow deployments to be manually triggered on main even when there are no changed files
    - if: $CI_PIPELINE_SOURCE == "web"
    # Run for commits to main that change particular files
    - if: $CI_PIPELINE_SOURCE == "push"
      changes:
        # Files that affect the staging environment
        - env
        - env.secret
        - requirements.yml
        - environments/base/**/*
        - environments/ha/**/*
        - environments/site/**/*
        - environments/site-ha/**/*
        - environments/staging/**/*
  environment:
    name: staging
  variables:
    ANSIBLE_FORCE_COLOR: "true"
  before_script:
    - source ./bin/ci-setup
  script:
    - ansible-playbook stackhpc.azimuth_ops.provision

#####
# This job executes tests against the staging environment each time it is deployed
#####
test_staging:
  stage: staging_test
  rules:
    # Prevent the job from running on any branch that is not main
    - if: $CI_COMMIT_BRANCH != "main"
      when: never
    # Allow deployments to be manually triggered on main even when there are no changed files
    - if: $CI_PIPELINE_SOURCE == "web"
    # Run for commits to main that change particular files
    - if: $CI_PIPELINE_SOURCE == "push"
      changes:
        # Files that affect the staging environment
        - env
        - env.secret
        - requirements.yml
        - environments/base/**/*
        - environments/ha/**/*
        - environments/site/**/*
        - environments/site-ha/**/*
        - environments/staging/**/*
  environment:
    name: staging
  variables:
    ANSIBLE_FORCE_COLOR: "true"
  before_script:
    - source ./bin/ci-setup
  script:
    - ansible-playbook stackhpc.azimuth_ops.generate_tests
    # Use the unrestricted application credential to execute the tests, as per the docs
    - OS_CLOUD=unrestricted ./bin/run-tests

#####
# This job deploys Azimuth to the production environment
#
# It runs for every commit to main that changes one of the files that affects
# the environment, but only if the staging deployment succeeded
#
# It also includes a manual gate that can be used as a confirmation that the
# relevant testing has taken place on staging
#####
deploy_production:
  stage: production
  rules:
    # Prevent the job from running on any branch that is not main
    - if: $CI_COMMIT_BRANCH != "main"
      when: never
    # Allow deployments to be manually triggered on main even when there are no changed files
    - if: $CI_PIPELINE_SOURCE == "web"
      when: manual
    # Run for commits to main that change particular files
    - if: $CI_PIPELINE_SOURCE == "push"
      changes:
        - env
        - env.secret
        - requirements.yml
        - environments/base/**/*
        - environments/ha/**/*
        - environments/site/**/*
        - environments/site-ha/**/*
        - environments/production/**/*
      when: manual
  environment:
    name: production
  variables:
    ANSIBLE_FORCE_COLOR: "true"
  before_script:
    - source ./bin/ci-setup
  script:
    - ansible-playbook stackhpc.azimuth_ops.provision

#####
# This job executes tests against the production environment each time it is deployed
#####
test_production:
  stage: production_test
  rules:
    - if: $CI_COMMIT_BRANCH != "main"
      when: never
    - if: $CI_PIPELINE_SOURCE == "web"
    - if: $CI_PIPELINE_SOURCE == "push"
      changes:
        - env
        - env.secret
        - requirements.yml
        - environments/base/**/*
        - environments/ha/**/*
        - environments/site/**/*
        - environments/site-ha/**/*
        - environments/production/**/*
  environment:
    name: production
  variables:
    ANSIBLE_FORCE_COLOR: "true"
  before_script:
    - source ./bin/ci-setup
  script:
    - ansible-playbook stackhpc.azimuth_ops.generate_tests
    # Use the unrestricted application credential to execute the tests, as per the docs
    - OS_CLOUD=unrestricted ./bin/run-tests