.drone.yml

---
kind: pipeline
name: default
type: kubernetes

environment:
  APP_NAME: paf
  PROD_ENV: sas-paf-prod
  STG_ENV: paf-stg
  UAT_ENV: sas-paf-uat
  BRANCH_ENV: sas-paf-branch
  PRODUCTION_URL: www.imsallegations.homeoffice.gov.uk
  IMAGE_URL: quay.io/ukhomeofficedigital
  IMAGE_REPO: paf
  GIT_REPO: UKHomeOffice/paf
  HOF_CONFIG: hof-services-config/Public_Allegation_Form
  NON_PROD_AVAILABILITY: Mon-Fri 08:00-23:00 Europe/London
  READY_FOR_TEST_DELAY: 20s
  NOTIFY_STUB: stub

trigger:
  branch:
    - feature/*
    - master

linting: &linting
  pull: if-not-exists
  image: node:20
  commands:
    - yarn run test:lint

unit_tests: &unit_tests
  pull: if-not-exists
  image: node:20
  commands:
    - yarn run test:unit

# ui_integration_tests: &ui_integration_tests
#   pull: if-not-exists
#   image: node:20
#   commands:
#     - yarn run test:ui-integration

sonar_scanner: &sonar_scanner
  pull: if-not-exists
  image: quay.io/ukhomeofficedigital/gitlab-arun-test:sonar-scanner-node-v18.12.1
  commands:
    - sonar-scanner -Dproject.settings=./sonar-project.properties

steps:
  - name: clone_repos
    image: alpine/git
    environment:
      DRONE_GIT_USERNAME:
        from_secret: drone_git_username
      DRONE_GIT_TOKEN:
        from_secret: drone_git_token
    commands:
      - git clone https://$${DRONE_GIT_USERNAME}:$${DRONE_GIT_TOKEN}@github.com/UKHomeOfficeForms/hof-services-config.git
    when:
      branch:
        include:
        - master
        - feature/*
      event: [push, pull_request]

  - name: setup_deploy
    pull: if-not-exists
    image: node:20
    commands:
      - yarn install --frozen-lockfile
      - yarn run postinstall
    when:
      branch:
        include:
        - master
      event: push

  - name: linting_deploy
    <<: *linting
    when:
      branch:
        include:
          - master
      event: push

  - name: unit_tests_deploy
    <<: *unit_tests
    when:
      branch:
        include:
          - master
          - feature/*
      event: push

  - name: sonar_scanner_deploy
    <<: *sonar_scanner
    when:
      branch:
        include:
          - master
      event: push

  # - name: ui_integration_tests_deploy
  #   <<: *ui_integration_tests
  #   when:
  #     branch:
  #       include:
  #         - master
  #     event: push

  - name: build_image
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/dind
    commands:
      - n=0; while [ "$n" -lt 60 ] && [ ! docker stats --no-stream ]; do n=$(( n + 1 )); sleep 1; done
      - docker build --no-cache -t $${IMAGE_REPO}:$${DRONE_COMMIT_SHA} .
    volumes:
      - name: dockersock
        path: /var/run
    when:
      branch:
        include:
          - master
          - feature/*
      event: [push, pull_request]

  - name: image_to_quay
    pull: if-not-exists
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/dind
    environment:
      DOCKER_PASSWORD:
        from_secret: DOCKER_PASSWORD
    commands:
    - docker login -u="ukhomeofficedigital+paf" -p=$${DOCKER_PASSWORD} quay.io
    - docker tag $${IMAGE_REPO}:$${DRONE_COMMIT_SHA} $${IMAGE_URL}/$${IMAGE_REPO}:$${DRONE_COMMIT_SHA}
    - docker push $${IMAGE_URL}/$${IMAGE_REPO}:$${DRONE_COMMIT_SHA}
    when:
      branch:
        include:
          - master
          - feature/*
      event: [push, pull_request]

  # # # Trivy Security Scannner
  # # - name: scan-image
  # #   pull: always
  # #   image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/trivy/client:latest
  # #   resources:
  # #     limits:
  # #       cpu: 1000
  # #       memory: 1024Mi
  # #   environment:
  # #     IMAGE_NAME: paf:${DRONE_COMMIT_SHA}
  # #     SEVERITY: MEDIUM,HIGH,CRITICAL
  # #     FAIL_ON_DETECTION: false
  # #     IGNORE_UNFIXED: true
  # #     ALLOW_CVE_LIST_FILE: hof-services-config/Public_Allegation_Form/trivy-cve-exceptions.txt
  # #   when:
  # #     event:
  # #     - pull_request
  # #     - push
  # #     - tag

  # Deploy to pull request UAT environment.
  - name: deploy_to_branch
    pull: if-not-exists
    image: quay.io/ukhomeofficedigital/kd:v1.14.0
    environment:
      KUBE_SERVER:
        from_secret: kube_server_dev
      KUBE_TOKEN:
        from_secret: kube_token_dev
    commands:
      - sh bin/deploy.sh $${BRANCH_ENV}
    when:
      branch:
        include:
          - master
          - feature/*
      event: pull_request

  - name: setup_branch
    pull: if-not-exists
    image: node:20
    environment:
      NOTIFY_KEY: USE_MOCK
    commands:
      - yarn install --frozen-lockfile
      - yarn run postinstall
    when:
      branch:
        include:
          - master
          - feature/*
      event: pull_request

  - name: linting_branch
    <<: *linting
    when:
      branch:
        include:
          - master
          - feature/*
      event: pull_request

  - name: unit_tests_branch
    <<: *unit_tests
    when:
      branch:
        include:
        - master
        - feature/*
      event: pull_request

  # - name: ui_integration_tests_branch
  #   <<: *ui_integration_tests
  #   when:
  #     branch:
  #       include:
  #         - master
  #         - feature/*
  #     event: pull_request

  - name: sonar_scanner_branch
    <<: *sonar_scanner
    when:
      branch:
        include:
          - master
          - feature/*
      event: pull_request

  # Snyk  security scans which run after branch deployment to prevent blocking of PR UAT tests.
  - name: snyk_scan
    pull: if-not-exists
    image: node:20
    environment:
      NOTIFY_STUB: true
      SNYK_TOKEN:
        from_secret: snyk_token
    commands:
      - yarn run test:snyk
    when:
      branch:
        include:
          - master
          - feature/*
      event: pull_request


  # Deploy to master UAT environment
  - name: deploy_to_uat
    pull: if-not-exists
    image: quay.io/ukhomeofficedigital/kd:v1.14.0
    environment:
      KUBE_SERVER:
        from_secret: kube_server_dev
      KUBE_TOKEN:
        from_secret: kube_token_dev
    commands:
      - sh bin/deploy.sh $${UAT_ENV}
    when:
      branch: master
      event: push

  # Get pull request branch so correct PR UAT environment is torn down in the tear_down_branch step that follows.
  - name: get_pr_branch
    pull: if-not-exists
    image: drone/cli:alpine@sha256:14409f7f7247befb9dd2effdb2f61ac40d1f5fbfb1a80566cf6f2f8d21f3be11
    environment:
      DRONE_SERVER:
        from_secret: drone_server
      DRONE_TOKEN:
        from_secret: drone_token
    volumes:
      - name: dockersock
        path: /root/.dockersock
    commands:
      - drone build info $GIT_REPO $DRONE_BUILD_NUMBER --format {{.Message}} | grep -o " '.*' " | tr -d "[ ']" | tr '[:upper:]' '[:lower:]' | tr '/' '-' > /root/.dockersock/branch_name.txt
    when:
      branch: master
      event: push


  # Tear down pull request UAT environment.
  - name: tear_down_branch
    pull: if-not-exists
    image: quay.io/ukhomeofficedigital/kd:v1.14.0
    environment:
      KUBE_SERVER:
        from_secret: kube_server_dev
      KUBE_TOKEN:
        from_secret: kube_token_dev
    volumes:
      - name: dockersock
        path: /root/.dockersock
    commands:
      - sh bin/deploy.sh tear_down
    when:
      branch: master
      event: push

    # Deploy to Staging environment
  # - name: deploy_to_stg
  #   pull: if-not-exists
  #   image: quay.io/ukhomeofficedigital/kd:v1.14.0
  #   environment:
  #     KUBE_SERVER:
  #       from_secret: kube_server_stg
  #     KUBE_TOKEN:
  #       from_secret: kube_token_stg
  #   commands:
  #     - bin/deploy.sh $${STG_ENV}
  #   when:
  #     branch: master
  #     event: push

  # Checks a build being promoted has passed, is on main which effectively means a healthy build on UAT.
  # - name: sanity_check_build_prod
  #   pull: if-not-exists
  #   image: drone/cli:alpine@sha256:14409f7f7247befb9dd2effdb2f61ac40d1f5fbfb1a80566cf6f2f8d21f3be11
  #   environment:
  #     DRONE_SERVER:
  #       from_secret: drone_server
  #     DRONE_TOKEN:
  #       from_secret: drone_token
  #   commands:
  #     - bin/sanity_check_build.sh
  #   when:
  #     target: PROD
  #     event: promote

  - name: clone_repos_prod
    image: alpine/git
    environment:
      DRONE_GIT_USERNAME:
        from_secret: drone_git_username
      DRONE_GIT_TOKEN:
        from_secret: drone_git_token
    commands:
      - git clone https://$${DRONE_GIT_USERNAME}:$${DRONE_GIT_TOKEN}@github.com/UKHomeOfficeForms/hof-services-config.git
    when:
      target: PROD
      event: promote

    # Deploy to Production environment
  - name: deploy_to_prod
    pull: if-not-exists
    image: quay.io/ukhomeofficedigital/kd:v1.14.0
    environment:
      KUBE_SERVER:
        from_secret: kube_server_prod
      KUBE_TOKEN:
        from_secret: kube_token_prod
    commands:
      - bin/deploy.sh $${PROD_ENV}
    when:
      target: PROD
      event: promote

# CRON job step that tears down our pull request UAT environments
  - name: cron_tear_down
    pull: if-not-exists
    image: quay.io/ukhomeofficedigital/kd:v1.14.0
    environment:
      KUBE_SERVER:
        from_secret: kube_server_dev
      KUBE_TOKEN:
        from_secret: kube_token_dev
    commands:
      - bin/clean_up.sh $${BRANCH_ENV}
    when:
      cron: tear_down_pr_envs
      event: cron

  # # # CRON job steps that runs security scans using Snyk & Trivy
  # # - name: cron_clone_repos
  # #   image: alpine/git
  # #   environment:
  # #     DRONE_GIT_USERNAME:
  # #       from_secret: drone_git_username
  # #     DRONE_GIT_TOKEN:
  # #       from_secret: drone_git_token
  # #   commands:
  # #     - git clone https://$${DRONE_GIT_USERNAME}:$${DRONE_GIT_TOKEN}@github.com/UKHomeOfficeForms/hof-services-config.git
  # #   when:
  # #     cron: security_scans
  # #     event: cron

  - name: cron_build_image
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/dind
    commands:
      - docker build --no-cache -t $${IMAGE_REPO}:$${DRONE_COMMIT_SHA} .
    volumes:
      - name: dockersock
        path: /var/run
    when:
      cron: security_scans
      event: cron

  - name: cron_snyk_scan
    pull: if-not-exists
    image: node:20
    environment:
      SNYK_TOKEN:
        from_secret: snyk_token
    commands:
      - yarn install --frozen-lockfile
      - yarn run postinstall
      - yarn run test:snyk
    when:
      cron: security_scans
      event: cron

  # # - name: cron_trivy_scan
  # #   image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/trivy/client:latest
  # #   pull: always
  # #   environment:
  # #     IMAGE_NAME: paf:${DRONE_COMMIT_SHA}
  # #     SEVERITY: MEDIUM,HIGH,CRITICAL
  # #     FAIL_ON_DETECTION: false
  # #     IGNORE_UNFIXED: true
  # #     ALLOW_CVE_LIST_FILE: hof-services-config/Public_Allegation_Form/trivy-cve-exceptions.txt
  # #   when:
  # #     cron: security_scans
  # #     event: cron

  # Slack notification upon a CRON job fail
  # - name: cron_notify_slack_tear_down_pr_envs
  #   pull: if-not-exists
  #   image: plugins/slack
  #   settings:
  #     channel: sas-build
  #     failure: ignore
  #     icon_url: http://readme.drone.io/0.5/logo_dark.svg
  #     icon.url: http://readme.drone.io/0.5/logo_dark.svg
# template: "CRON Job {{build.deployTo}} of Public Allegation Form has {{build.status}} - <{{build.link}}|#{{build.number}}> {{#success build.status}}\n :thumbsup: :thumbsup: :thumbsup:\n{{else}}\n :x: :x: :x:\n{{/success}} Author: {{build.author}}\n\nDuration: {{since job.started}}\n\nJob: <{{build.link}}|#{{build.number}}>\n\nCommit: {{build.commit}}\n"  #     username: Drone
  #     webhook:
  #       from_secret: slack_webhook
  #   when:
  #     cron: tear_down_pr_envs
  #     event: cron
  #     status: failure

  - name: cron_notify_slack_security_scans
    pull: if-not-exists
    image: plugins/slack
    settings:
      channel: sas-build
      failure: ignore
      icon_url: http://readme.drone.io/0.5/logo_dark.svg
      icon.url: http://readme.drone.io/0.5/logo_dark.svg
      template: "CRON Job {{build.deployTo}} of Public Allegation Form has {{build.status}} - <{{build.link}}|#{{build.number}}> {{#success build.status}}\n :thumbsup: :thumbsup: :thumbsup:\n{{else}}\n :x: :x: :x:\n{{/success}} Author: {{build.author}}\n\nDuration: {{since job.started}}\n\nJob: <{{build.link}}|#{{build.number}}>\n\nCommit: {{build.commit}}\n"
      username: Drone
      webhook:
        from_secret: slack_webhook
    when:
      cron: security_scans
      event: cron
      status: failure

services:
  - name: docker
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/dind

  # Redis session setup in background so integration tests can run
  - name: session
    image: redis
    volumes:
      - name: dockersock
        path: /var/run

volumes:
  - name: dockersock
    temp: {}

...