.gitlab-ci.yml

---
workflow:
  # Allow pipelines only for Merge Requests, and on push/merge to main.
  # Do not allow duplicate pipelines.
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      variables:
        ENVIRONMENT: staging
        AUTO_STOP_IN: 6 hours
        TF_VAR_environment: $ENVIRONMENT
        TF_VAR_gitops_ref_name: $CI_MERGE_REQUEST_REF_PATH

    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
      when: never

    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      variables:
        ENVIRONMENT: prod
        AUTO_STOP_IN: never
        TF_VAR_environment: $ENVIRONMENT
        TF_VAR_gitops_ref_name: refs/heads/$CI_DEFAULT_BRANCH

default:
  tags:
    - openstack
  interruptible: true

stages:
  - prepare
  - lint
  - build
  - deploy
  - cleanup

cache:
  key: "$CI_COMMIT_REF_NAME"
  paths:
    - infra/envs/**/.terraform/

variables:
  TF_ROOT: ${CI_PROJECT_DIR}/infra/envs/prod
  TF_STATE_NAME: ${ENVIRONMENT}
  TF_VAR_gitops_repo: ${CI_PROJECT_URL}.git

include:
  - local: '/.gitlab/templates/build-docs.yml'

terraform:init:
  stage: prepare
  image: registry.gitlab.com/gitlab-org/terraform-images/releases/terraform:1.2.6
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "web"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE != "web"
      changes:
        - .gitlab-ci.yml
        - infra/**/*
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - .gitlab-ci.yml
        - infra/**/*
  script:
    - cd ${TF_ROOT}
    - gitlab-terraform init

ansible-lint:
  stage: lint
  image: registry.gitlab.com/pipeline-components/ansible-lint:latest
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - metal/**/*
  script:
    - ansible-lint --show-relpath metal

kube-linter:
  stage: lint
  image:
    name: docker.io/stackrox/kube-linter:v0.6.5-alpine
    entrypoint: [""]
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - .gitlab-ci.yml
        - .kube-linter.yml
        - cluster/**/*
  script:
    - /kube-linter lint cluster

markdownlint:
  stage: lint
  image:
    name: ghcr.io/igorshubovych/markdownlint-cli:v0.38.0
    entrypoint: [""]
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - .gitlab-ci.yml
        - "**/*.md"
  script:
    - markdownlint "**/*.md"

terraform:validate:
  stage: lint
  image: registry.gitlab.com/gitlab-org/terraform-images/releases/terraform:1.2.6
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - .gitlab-ci.yml
        - infra/**/*
  script:
    - cd ${TF_ROOT}
    - gitlab-terraform validate

terraform:plan:
  stage: build
  image: registry.gitlab.com/gitlab-org/terraform-images/releases/terraform:1.2.6
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "web"
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - .gitlab-ci.yml
        - infra/**/*
  variables:
    ENVIRONMENT: prod  # We always want to plan against prod
    TF_VAR_environment: ${ENVIRONMENT}
  environment:
    name: ${ENVIRONMENT}
    action: prepare
  script:
    - cd ${TF_ROOT}
    - gitlab-terraform plan -var openstack_clouds_file=${OS_CLOUDS} -var-file=${TF_VARS_FILE}
    - gitlab-terraform plan-json
  artifacts:
    paths:
      - ${TF_ROOT}/plan.cache
    reports:
      terraform: ${TF_ROOT}/plan.json

terraform:get_plan:
  stage: build
  image: registry.gitlab.com/gitlab-org/terraform-images/releases/terraform:1.2.6
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE != "web"
      changes:
        - .gitlab-ci.yml
        - infra/**/*
  variables:
    PROJECT_API_URL: "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}"
    TF_PLAN_PATH: "infra/envs/${ENVIRONMENT}/plan.cache"
  script:
    - cd ${TF_ROOT}
    - MR="$(printf "$CI_COMMIT_DESCRIPTION" | grep 'MR:')"
    - MR="${MR##*[/\!]}"
    - > # Download the cached Terraform plan from the Merge Request pipeline
      curl -vfLo plan.cache
      "${PROJECT_API_URL}/jobs/artifacts/refs/merge-requests/${MR}/head/raw/${TF_PLAN_PATH}?job=terraform:plan"
  artifacts:
    paths:
      - ${TF_ROOT}/plan.cache

terraform:apply:
  stage: deploy
  image: registry.gitlab.com/gitlab-org/terraform-images/releases/terraform:1.2.6
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "web"
      when: manual
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE != "web"
      changes:
        - .gitlab-ci.yml
        - infra/**/*
  environment:
    name: ${ENVIRONMENT}
    action: start
    on_stop: terraform:destroy
    auto_stop_in: ${AUTO_STOP_IN}
  script:
    - cd ${TF_ROOT}
    - gitlab-terraform apply

terraform:apply:staging:
  extends: terraform:apply
  dependencies: []
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - .gitlab-ci.yml
        - infra/**/*
      when: manual
      allow_failure: true  # true for non-blocking manual job
  script:
    - cd ${TF_ROOT}
    - gitlab-terraform plan -var openstack_clouds_file=${OS_CLOUDS} -var-file=${TF_VARS_FILE}
    - gitlab-terraform apply

terraform:destroy:
  stage: cleanup
  image: registry.gitlab.com/gitlab-org/terraform-images/releases/terraform:1.2.6
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: never
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - .gitlab-ci.yml
        - infra/**/*
      when: manual
      allow_failure: true  # true for non-blocking manual job
  environment:
    name: ${ENVIRONMENT}
    action: stop
  script:
    - cd ${TF_ROOT}
    - gitlab-terraform destroy -var openstack_clouds_file=${OS_CLOUDS} -var-file=${TF_VARS_FILE}