.gitlab-ci.yml

stages:
  - build
  - test
  - pre-merge
  - deploy
  - post-deploy

cache:
  # TODO: Try key as package-lock.json to speed up across branches.
  # key:
  #   files:
  #       - package-lock.json
  key: $CI_COMMIT_REF_SLUG
  paths:
    - .npm

variables:
  AUTO_DEVOPS_BUILD_IMAGE_CNB_ENABLED: 'true'
  AUTO_DEVOPS_BUILD_IMAGE_CNB_BUILDER: 'heroku/buildpacks:20'
  npm_config_cache: '$CI_PROJECT_DIR/.npm'
  NEW_RELIC_ENABLED: 'false'
  NEW_RELIC_NO_CONFIG_FILE: 'true'

.docker_service:
  services:
    - docker:29.0.3-dind
  variables:
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: '/certs'
    DOCKER_TLS_VERIFY: '1'
    DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"

.build_docker:
  extends: .docker_service
  stage: build
  image: registry.gitlab.com/upchieve/subway/gitlab-ci-image:1.0.3
  cache: []
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: api://AzureADTokenExchange
  variables:
    IMAGE_TAG: $AZURE_CONTAINER_REGISTRY/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA
    AZURE_TENANT_ID: $AZURE_TENANT_ID
  environment:
    action: prepare
  before_script:
    - az login --service-principal --username $AZURE_IDENTITY_CLIENT_ID --tenant $AZURE_TENANT_ID --federated-token $GITLAB_OIDC_TOKEN
    - az acr login --name $AZURE_CONTAINER_REGISTRY
  script:
    - echo $IMAGE_TAG
    - docker build -t $IMAGE_TAG .
    - docker push $IMAGE_TAG

# Build the application as part of a MR - does not also push to registry.
build_ci:
  extends: .docker_service
  stage: build
  image: docker:29.0.3
  cache: []
  script:
    - docker build .
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event' # MR is created or updated.

# If you want to build/deploy for dev on a feature branch from CI, you can do so by:
# - changing the rule for `build_dev` and `deploy_dev`.
# - updating the subject of the federated credential. See grand-central-station/new-environment/ci-configuration/README.md for more details.
# For the vast majority of cases, it will be easier to simply deploy to dev from
# your machine.
build_dev:
  extends: .build_docker
  environment:
    name: dev
  variables:
    AZURE_IDENTITY_CLIENT_ID: $AZURE_IDENTITY_CLIENT_ID_DEV
    AZURE_CONTAINER_REGISTRY: $AZURE_CONTAINER_REGISTRY_DEV
  rules:
    - when: never
    # - if: $CI_PIPELINE_SOURCE == 'merge_request_event' # MR is created or updated.

# Build the application and push to staging registry.
build_staging:
  extends: .build_docker
  environment:
    name: staging
  variables:
    AZURE_IDENTITY_CLIENT_ID: $AZURE_IDENTITY_CLIENT_ID_STAGING
    AZURE_CONTAINER_REGISTRY: $AZURE_CONTAINER_REGISTRY_STAGING
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH # Committed to main.

# Build the application and push to production registry.
build_production:
  extends: .build_docker
  environment:
    name: production
  allow_failure: false
  variables:
    AZURE_IDENTITY_CLIENT_ID: $AZURE_IDENTITY_CLIENT_ID_PRODUCTION
    AZURE_CONTAINER_REGISTRY: $AZURE_CONTAINER_REGISTRY_PRODUCTION
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH # Committed to main.

.deploy:
  stage: deploy
  image: mcr.microsoft.com/azure-cli:latest
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: api://AzureADTokenExchange
  variables:
    IMAGE_TAG: $AZURE_CONTAINER_REGISTRY/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA
  before_script:
    - az login --service-principal --username $AZURE_IDENTITY_CLIENT_ID --tenant $AZURE_TENANT_ID --federated-token $GITLAB_OIDC_TOKEN
    - az extension add --name containerapp --upgrade
  script:
    - az containerapp update --name $CONTAINER_APP --resource-group $RESOURCE_GROUP --image $IMAGE_TAG --revision-suffix $CI_COMMIT_SHORT_SHA
    - az containerapp update --name $CONTAINER_APP_WORKER --resource-group $RESOURCE_GROUP --image $IMAGE_TAG --revision-suffix $CI_COMMIT_SHORT_SHA

deploy_dev:
  extends: .deploy
  environment:
    name: dev
  resource_group: development
  variables:
    CONTAINER_APP: development-container-app-subway
    CONTAINER_APP_WORKER: development-container-app-worker
    RESOURCE_GROUP: development-resource-group
    AZURE_IDENTITY_CLIENT_ID: $AZURE_IDENTITY_CLIENT_ID_DEV
    AZURE_CONTAINER_REGISTRY: $AZURE_CONTAINER_REGISTRY_DEV
  needs:
    - job: build_dev
      artifacts: true
  rules:
    - when: never
    # - if: $CI_PIPELINE_SOURCE == 'merge_request_event' # MR is created or updated.

deploy_staging:
  extends: .deploy
  environment:
    name: staging
  resource_group: staging
  variables:
    CONTAINER_APP: staging-container-app-subway
    CONTAINER_APP_WORKER: staging-container-app-worker
    RESOURCE_GROUP: staging-resource-group
    AZURE_IDENTITY_CLIENT_ID: $AZURE_IDENTITY_CLIENT_ID_STAGING
    AZURE_CONTAINER_REGISTRY: $AZURE_CONTAINER_REGISTRY_STAGING
  needs:
    - job: build_staging
      artifacts: true
    - job: test_backend
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH # Committed to main.

deploy_production:
  extends: .deploy
  environment:
    name: production
  resource_group: production
  variables:
    CONTAINER_APP: production-container-app-subway
    CONTAINER_APP_WORKER: production-container-app-worker
    RESOURCE_GROUP: production-resource-group
    AZURE_IDENTITY_CLIENT_ID: $AZURE_IDENTITY_CLIENT_ID_PRODUCTION
    AZURE_CONTAINER_REGISTRY: $AZURE_CONTAINER_REGISTRY_PRODUCTION
  needs:
    - job: build_production
      artifacts: true
    - job: test_backend
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH # Committed to main.
      when: manual

tag_commit_production:
  stage: post-deploy
  image: registry.gitlab.com/gitlab-org/release-cli:latest
  needs:
    - job: deploy_production
  script:
    - echo 'Tag commit $CI_COMMIT_SHA'
  release:
    tag_name: 'deployed-$(date +%Y-%m-%d_%H-%M-%S)'
    description: 'Deployed from GitLab CI.'
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH # Committed to main.

new_relic_deploy_tracker:
  stage: post-deploy
  needs:
    - job: deploy_production
  variables:
    NEW_RELIC_DEPLOYMENT_USER_KEY: $NEW_RELIC_DEPLOYMENT_USER_KEY
    NEW_RELIC_SERVICE_GUID_PRODUCTION: $NEW_RELIC_SERVICE_GUID_PRODUCTION
  script: >
    curl -v https://api.newrelic.com/graphql
    -H 'content-type: application/json; charset=utf-8'
    -H "API-Key: $NEW_RELIC_DEPLOYMENT_USER_KEY"
    --data-raw '{"query":"mutation { changeTrackingCreateDeployment(deployment: {version: \"'$CI_COMMIT_SHA'\", entityGuid: \"'$NEW_RELIC_SERVICE_GUID_PRODUCTION'\"}) { deploymentId timestamp } }"}'
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH # Committed to main.

test_backend:
  stage: test
  image: node:24.14.1-bullseye
  variables:
    NODE_OPTIONS: --max_old_space_size=5120
  services:
    - redis:latest
  before_script:
    - npm ci --cache .npm --prefer-offline
  script:
    - npm run test:backend
  rules:
    - if: '$TEST_DISABLED'
      when: never
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event' # MR is created or updated.
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH # Committed to main.

test_database:
  stage: test
  image: node:24.14.1-bullseye
  services:
    - name: postgres:15.17
      alias: postgres
      command:
        [
          'postgres',
          '-c',
          'shared_preload_libraries=pg_stat_statements',
          '-c',
          'pg_stat_statements.track=all',
        ]
  variables:
    POSTGRES_USER: admin
    POSTGRES_PASSWORD: Password123 # pragma: allowlist secret
    POSTGRES_DB: upchieve
    CI: 'true'
    DB_PORT: 5432
  before_script:
    - npm ci --cache .npm --prefer-offline
    - apt-get update && apt-get install -y postgresql-client
    - export PGPASSWORD=$POSTGRES_PASSWORD
    - psql -h "postgres" -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "SELECT 'OK' AS status;"
    - |
      for file in database/db_init/{schema,test_seeds,seed_migrations}.sql; do
        PGPASSWORD=$POSTGRES_PASSWORD psql -h postgres -U $POSTGRES_USER -d $POSTGRES_DB -f $file
      done
  script:
    - npm run test:database
  rules:
    - if: '$TEST_DISABLED'
      when: never
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

lint:
  stage: test
  image: node:24.14.1-bullseye
  before_script:
    - npm ci --cache .npm --prefer-offline
  script:
    - npm run lint
  rules:
    - if: '$TEST_DISABLED'
      when: never
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event' # MR is created or updated.
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH # Committed to main.

lint_sql:
  stage: test
  image: node:24.14.1-bullseye
  before_script:
    - npm ci --cache .npm --prefer-offline
  script:
    - npm run lint:sql:check
  rules:
    - if: '$TEST_DISABLED'
      when: never
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event' # MR is created or updated.
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH # Committed to main.

lint_database:
  stage: test
  image: node:24.14.1-bullseye
  before_script:
    - npm ci --cache .npm --prefer-offline
  script:
    - npm run lint:database:dry
  rules:
    - if: '$TEST_DISABLED'
      when: never
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event' # MR is created or updated.
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH # Committed to main.

verify_migration_data_deletion:
  stage: pre-merge
  image: alpine:latest
  script:
    - echo "When you're creating a database migration, there might be a new column or columns within a new table that should be deleted/anonymized when a user requests account deletion."
    - echo ""
    - echo "If anything should be deleted/anonymized, update the DeidentifyUser job accordingly, then go ahead and run this job to continue with merging."
    - echo "If there is nothing to update, just go ahead and run this job!"
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event' # MR is created or updated.
      changes:
        - database/migrations/**/*.sql
      when: manual
  allow_failure: false