454 lines
16 KiB
YAML
454 lines
16 KiB
YAML
# -----------------------------------------------------------------------------
|
|
# SETTINGS
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# Drone matrix: Additional ENV vars for substitution - http://docs.drone.io/matrix-builds/
|
|
# Will be evaluated BEFORE the YAML is parsed, ONLY strings allowed, NO substitutions ${XXX} here.
|
|
|
|
matrix:
|
|
include:
|
|
- BUILD_ENV: all
|
|
# The name of the k8s namespaces that these pipelines will target.
|
|
# K8S_DEPLOY_NS_DEV:
|
|
# K8S_DEPLOY_NS_STAGING:
|
|
# K8S_DEPLOY_NS_PRODUCTION:
|
|
|
|
# YAML Configuration anchors - https://learnxinyminutes.com/docs/yaml/
|
|
# Will be evaluated WHILE the YAML is parsed, any valid yaml allowed, substitutions ${XXX} allowed.
|
|
|
|
alias:
|
|
# The image will be tagged with this, pushed to gcr and referenced with this key in the k8s deployment
|
|
- &IMAGE_DEPLOY_TAG ${DRONE_COMMIT_SHA}
|
|
|
|
# The image name, defaults to lowercase repo name <owner>/<project>, e.g. aw/aaa-cab-kubernetes-test
|
|
- &IMAGE_DEPLOY_NAME ${DRONE_REPO,,}
|
|
|
|
# The intermediate builder image name
|
|
- &IMAGE_BUILDER_ID ${DRONE_REPO,,}-builder:${DRONE_COMMIT_SHA}
|
|
|
|
# The full uniquely tagged app image name
|
|
- &IMAGE_DEPLOY_ID ${DRONE_REPO,,}:${DRONE_COMMIT_SHA}
|
|
|
|
# # Defines which branches will trigger a docker image push our Google Cloud Registry (tags are always published)
|
|
# - &GCR_PUBLISH_BRANCHES [dev, staging, master]
|
|
|
|
# # Docker registry publish default settings
|
|
# - &GCR_REGISTRY_SETTINGS
|
|
# image: plugins/gcr
|
|
# repo: a3cloud-192413/${DRONE_REPO,,}
|
|
# registry: eu.gcr.io
|
|
# secrets:
|
|
# - source: AAA_GCR_SERVICE_ACCOUNT_JSON
|
|
# target: google_credentials
|
|
# # local short-time-cache: don't cleanup any image layers after pushing
|
|
# purge: false
|
|
# # force compress of docker build context
|
|
# compress: true
|
|
# volumes: # mount needed to push the already build container
|
|
# - /var/run/docker.sock:/var/run/docker.sock
|
|
|
|
# # Deployment default settings
|
|
# - &K8S_DEPLOY_SETTINGS
|
|
# image: eu.gcr.io/a3cloud-192413/aw/aaa-drone-kubernetes:latest
|
|
# pull: true
|
|
# secrets:
|
|
# - source: AAA_K8S_SERVER
|
|
# target: KUBERNETES_SERVER
|
|
# - source: AAA_K8S_SERVICE_ACCOUNT_CRT
|
|
# target: KUBERNETES_CERT
|
|
# - source: AAA_K8S_SERVICE_ACCOUNT_TOKEN
|
|
# target: KUBERNETES_TOKEN
|
|
# - source: AAA_GCR_SERVICE_ACCOUNT_JSON
|
|
# target: GCR_SERVICE_ACCOUNT
|
|
# deployment: app
|
|
# repo: eu.gcr.io/a3cloud-192413/${DRONE_REPO,,}
|
|
# container: [app]
|
|
# tag: *IMAGE_DEPLOY_TAG
|
|
# gcr_service_account_email: drone-ci-a3cloud@a3cloud-192413.iam.gserviceaccount.com
|
|
# mgmt_repo: https://github.com/allaboutapps/a3cloud-mgmt.git
|
|
# mgmt_git_email: infrastructure+drone@allaboutapps.at
|
|
|
|
# ENV variables for executing within the test env (similar to the env in docker-compose.yml)
|
|
- &TEST_ENV
|
|
CI: ${CI}
|
|
|
|
# required: env for main working database, service
|
|
# default for sql-migrate (target development) and psql cli tool
|
|
PGDATABASE: &PGDATABASE "development"
|
|
PGUSER: &PGUSER "dbuser"
|
|
PGPASSWORD: &PGPASSWORD "dbpass"
|
|
PGHOST: &PGHOST "postgres"
|
|
PGPORT: &PGPORT "5432"
|
|
PGSSLMODE: &PGSSLMODE "disable"
|
|
|
|
# optional: env for sql-boiler (ability to generate models out of a "spec" database)
|
|
# sql-boiler should operate on a "spec" database only
|
|
PSQL_DBNAME: "spec"
|
|
PSQL_USER: *PGUSER
|
|
PSQL_PASS: *PGPASSWORD
|
|
PSQL_HOST: *PGHOST
|
|
PSQL_PORT: *PGPORT
|
|
PSQL_SSLMODE: *PGSSLMODE
|
|
|
|
# required for drone: project root directory, used for relative path resolution (e.g. fixtures)
|
|
PROJECT_ROOT_DIR: /app
|
|
|
|
# docker run related.
|
|
SERVER_MANAGEMENT_SECRET: "mgmt-secret"
|
|
|
|
# Which build events should trigger the main pipeline (defaults to all)
|
|
- &BUILD_EVENTS [push, tag]
|
|
|
|
# Pipeline merge helper: only execute if build event received
|
|
- &WHEN_BUILD_EVENT
|
|
when:
|
|
event: *BUILD_EVENTS
|
|
|
|
# The actual pipeline building our product
|
|
pipeline:
|
|
# ---------------------------------------------------------------------------
|
|
# BUILD
|
|
# ---------------------------------------------------------------------------
|
|
|
|
"database connection":
|
|
group: build
|
|
image: postgres:17.4-alpine # should be the same version as used in .drone.yml, .github/workflows, Dockerfile and live
|
|
commands:
|
|
# wait for postgres service to become available
|
|
- |
|
|
until psql -U $PGUSER -d $PGDATABASE -h postgres \
|
|
-c "SELECT 1;" >/dev/null 2>&1; do sleep 1; done
|
|
# query the database
|
|
- |
|
|
psql -U $PGUSER -d $PGDATABASE -h postgres \
|
|
-c "SELECT name, setting FROM pg_settings;"
|
|
environment: *TEST_ENV
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
"docker build (target builder)":
|
|
group: build
|
|
image: docker:latest
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
environment:
|
|
IMAGE_TAG: *IMAGE_BUILDER_ID
|
|
commands:
|
|
- "docker build --target builder --compress -t $${IMAGE_TAG} ."
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
"docker build (target app)":
|
|
group: build-app
|
|
image: docker:latest
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
environment:
|
|
IMAGE_TAG: *IMAGE_DEPLOY_ID
|
|
commands:
|
|
- "docker build --target app --compress -t $${IMAGE_TAG} ."
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# CHECK
|
|
# ---------------------------------------------------------------------------
|
|
|
|
"trivy scan":
|
|
group: pre-test
|
|
image: aquasec/trivy:latest
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- /server/drone/trivy-cache:/root/.cache/
|
|
environment:
|
|
IMAGE_TAG: *IMAGE_DEPLOY_ID
|
|
commands:
|
|
# Print report
|
|
- "trivy image --exit-code 0 --no-progress $${IMAGE_TAG}"
|
|
# Fail on severity HIGH and CRITICAL
|
|
- "trivy image --exit-code 1 --severity HIGH,CRITICAL --no-progress --ignore-unfixed $${IMAGE_TAG}"
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
"build & diff":
|
|
group: pre-test
|
|
image: *IMAGE_BUILDER_ID
|
|
commands:
|
|
- cd $PROJECT_ROOT_DIR # reuse go build cache from Dockerfile builder stage
|
|
- make tidy
|
|
- make build
|
|
- /bin/cp -Rf $PROJECT_ROOT_DIR/* $DRONE_WORKSPACE # switch back to drone workspace ...
|
|
- cd $DRONE_WORKSPACE
|
|
- "git diff --exit-code" # ... for git diffing (otherwise not possible as .git is .dockerignored)
|
|
environment: *TEST_ENV
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
"info":
|
|
group: test
|
|
image: *IMAGE_BUILDER_ID
|
|
commands:
|
|
- cd $PROJECT_ROOT_DIR # reuse go build cache from Dockerfile builder stage
|
|
- make info
|
|
environment: *TEST_ENV
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
"test":
|
|
group: test
|
|
image: *IMAGE_BUILDER_ID
|
|
commands:
|
|
- cd $PROJECT_ROOT_DIR # reuse go build cache from Dockerfile builder stage
|
|
- make test
|
|
environment: *TEST_ENV
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
"test-scripts (gsdev, go-starter only)":
|
|
group: test
|
|
image: *IMAGE_BUILDER_ID
|
|
commands:
|
|
- cd $PROJECT_ROOT_DIR # reuse go build cache from Dockerfile builder stage
|
|
- make test-scripts
|
|
environment: *TEST_ENV
|
|
when:
|
|
repo: allaboutapps/AW-go-starter
|
|
event: *BUILD_EVENTS
|
|
|
|
"git-compare-go-starter":
|
|
group: test
|
|
image: *IMAGE_BUILDER_ID
|
|
commands:
|
|
- make git-compare-go-starter
|
|
environment: *TEST_ENV
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
"swagger-codegen-cli":
|
|
group: test
|
|
# https://github.com/swagger-api/swagger-codegen/blob/master/modules/swagger-codegen-cli/Dockerfile
|
|
image: swaggerapi/swagger-codegen-cli
|
|
commands:
|
|
# run the main swagger.yml validation.
|
|
- "java -jar /opt/swagger-codegen-cli/swagger-codegen-cli.jar validate -i ./api/swagger.yml"
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
"binary: deps":
|
|
group: test
|
|
image: *IMAGE_BUILDER_ID
|
|
commands:
|
|
- cd $PROJECT_ROOT_DIR
|
|
- make get-embedded-modules-count
|
|
- make get-embedded-modules
|
|
environment: *TEST_ENV
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
"binary: licenses":
|
|
group: test
|
|
image: *IMAGE_BUILDER_ID
|
|
commands:
|
|
- cd $PROJECT_ROOT_DIR
|
|
- make get-licenses
|
|
environment: *TEST_ENV
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
"docker run (target app)":
|
|
group: test
|
|
image: docker:latest
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
environment:
|
|
<<: *TEST_ENV
|
|
IMAGE_TAG: *IMAGE_DEPLOY_ID
|
|
commands:
|
|
# Note: NO network related tests are possible here, dnd can just
|
|
# run sibling containers. We have no possibility to connect them
|
|
# into the drone user defined per build docker network!
|
|
# https://github.com/drone-plugins/drone-docker/issues/193
|
|
# https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-docker-for-ci/
|
|
- (env | grep "^\S*=" | grep -v -e "DRONE=" -e "DRONE_" -e "CI_" -e "CI=" -e "HOME=" -e "HOSTNAME=" -e "SHELL=" -e "PWD=" -e "PATH=") > .hostenv
|
|
- cat .hostenv
|
|
- "docker run --env-file .hostenv $${IMAGE_TAG} help"
|
|
- "docker run --env-file .hostenv $${IMAGE_TAG} -v"
|
|
- "docker run --env-file .hostenv $${IMAGE_TAG} env"
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# PUBLISH
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# # Built a allowed branch? Push to cloud registry
|
|
# "publish ${DRONE_BRANCH}_${DRONE_COMMIT_SHA:0:10}":
|
|
# group: publish
|
|
# <<: *GCR_REGISTRY_SETTINGS
|
|
# tags:
|
|
# - build_${DRONE_BUILD_NUMBER}
|
|
# - ${DRONE_BRANCH/\//-}_${DRONE_COMMIT_SHA:0:10}
|
|
# - *IMAGE_DEPLOY_TAG
|
|
# - latest
|
|
# - ${DRONE_BRANCH/\//-}
|
|
# - '${DRONE_COMMIT_SHA:0:10}'
|
|
# when:
|
|
# branch: *GCR_PUBLISH_BRANCHES
|
|
# event: *BUILD_EVENTS
|
|
|
|
# # Built a tag? Push to cloud registry
|
|
# "publish tag_${DRONE_COMMIT_SHA:0:10}":
|
|
# group: publish
|
|
# <<: *GCR_REGISTRY_SETTINGS
|
|
# tags:
|
|
# - build_${DRONE_BUILD_NUMBER}
|
|
# - tag_${DRONE_COMMIT_SHA:0:10}
|
|
# - *IMAGE_DEPLOY_TAG
|
|
# - latest
|
|
# - ${DRONE_TAG}
|
|
# - ${DRONE_COMMIT_SHA:0:10}
|
|
# when:
|
|
# event: tag
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# DEPLOYMENT
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# # autodeploy dev if it hits the branch
|
|
# "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_DEV} (auto)":
|
|
# <<: *K8S_DEPLOY_SETTINGS
|
|
# namespace: ${K8S_DEPLOY_NS_DEV}
|
|
# mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_DEV}/app.deployment.yaml
|
|
# when:
|
|
# event: *BUILD_EVENTS
|
|
# branch: [dev]
|
|
|
|
# # promote dev through "drone deploy <repo> <build> dev"
|
|
# "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_DEV} (promote)":
|
|
# <<: *K8S_DEPLOY_SETTINGS
|
|
# namespace: ${K8S_DEPLOY_NS_DEV}
|
|
# mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_DEV}/app.deployment.yaml
|
|
# when:
|
|
# environment: dev
|
|
# event: deployment
|
|
|
|
# # autodeploy staging if it hits the branch
|
|
# "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_STAGING} (auto)":
|
|
# <<: *K8S_DEPLOY_SETTINGS
|
|
# namespace: ${K8S_DEPLOY_NS_STAGING}
|
|
# mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_STAGING}/app.deployment.yaml
|
|
# when:
|
|
# event: *BUILD_EVENTS
|
|
# branch: [staging]
|
|
|
|
# # promote staging through "drone deploy <repo> <build> staging"
|
|
# "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_STAGING} (promote)":
|
|
# <<: *K8S_DEPLOY_SETTINGS
|
|
# namespace: ${K8S_DEPLOY_NS_STAGING}
|
|
# mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_STAGING}/app.deployment.yaml
|
|
# when:
|
|
# environment: staging
|
|
# event: deployment
|
|
|
|
# # promote production through "drone deploy <repo> <build> production"
|
|
# "deploy ${DRONE_COMMIT_SHA:0:10} to ${K8S_DEPLOY_NS_PRODUCTION} (promote)":
|
|
# <<: *K8S_DEPLOY_SETTINGS
|
|
# namespace: ${K8S_DEPLOY_NS_PRODUCTION}
|
|
# mgmt_deployment_yaml: namespaces/${K8S_DEPLOY_NS_PRODUCTION}/app.deployment.yaml
|
|
# when:
|
|
# environment: production
|
|
# event: deployment
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# DEPLOYMENT go-starter
|
|
# Purpose: go-starter drone specific publish and deployment steps
|
|
# NOTE: you do not need to uncomment them for our customer projects
|
|
# These steps won't be executed unless we work in the main "allaboutapps/AW-go-starter" repo
|
|
# ---------------------------------------------------------------------------
|
|
|
|
"go-starter publish ${DRONE_BRANCH}_${DRONE_COMMIT_SHA:0:10}":
|
|
group: go-starter-publish
|
|
image: plugins/gcr
|
|
repo: a3cloud-192413/${DRONE_REPO,,}
|
|
registry: eu.gcr.io
|
|
secrets:
|
|
- source: AAA_GCR_SERVICE_ACCOUNT_JSON
|
|
target: google_credentials
|
|
# local short-time-cache: don't cleanup any image layers after pushing
|
|
purge: false
|
|
# force compress of docker build context
|
|
compress: true
|
|
volumes: # mount needed to push the already build container
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
tags:
|
|
- build_${DRONE_BUILD_NUMBER}
|
|
- ${DRONE_BRANCH/\//-}_${DRONE_COMMIT_SHA:0:10}
|
|
- *IMAGE_DEPLOY_TAG
|
|
- latest
|
|
- ${DRONE_BRANCH/\//-}
|
|
- "${DRONE_COMMIT_SHA:0:10}"
|
|
when:
|
|
repo: allaboutapps/AW-go-starter
|
|
branch: [master]
|
|
event: [push, tag]
|
|
|
|
"go-starter deploy ${DRONE_COMMIT_SHA:0:10} to allaboutapps-go-starter-dev (auto)":
|
|
group: go-starter-deploy
|
|
image: eu.gcr.io/a3cloud-192413/aw/aaa-drone-kubernetes:latest
|
|
pull: true
|
|
secrets:
|
|
- source: AAA_K8S_SERVER
|
|
target: KUBERNETES_SERVER
|
|
- source: AAA_K8S_SERVICE_ACCOUNT_CRT
|
|
target: KUBERNETES_CERT
|
|
- source: AAA_K8S_SERVICE_ACCOUNT_TOKEN
|
|
target: KUBERNETES_TOKEN
|
|
- source: AAA_GCR_SERVICE_ACCOUNT_JSON
|
|
target: GCR_SERVICE_ACCOUNT
|
|
deployment: app
|
|
repo: eu.gcr.io/a3cloud-192413/${DRONE_REPO,,}
|
|
container: [app]
|
|
tag: *IMAGE_DEPLOY_TAG
|
|
gcr_service_account_email: drone-ci-a3cloud@a3cloud-192413.iam.gserviceaccount.com
|
|
mgmt_repo: https://github.com/allaboutapps/a3cloud-mgmt.git
|
|
mgmt_git_email: infrastructure+drone@allaboutapps.at
|
|
namespace: allaboutapps-go-starter-dev
|
|
mgmt_deployment_yaml: namespaces/allaboutapps-go-starter-dev/app.deployment.yaml
|
|
skip_live_update: true
|
|
kubernetes_cluster: a3cloud-dev
|
|
# pre-sync migration job
|
|
job: pre-sync-migration
|
|
mgmt_job_yaml: namespaces/allaboutapps-go-starter-dev/application.yaml
|
|
when:
|
|
repo: allaboutapps/AW-go-starter
|
|
branch: [master]
|
|
event: [push, tag]
|
|
|
|
# Long living services where the startup order does not matter (otherwise use detach: true)
|
|
services:
|
|
# ---------------------------------------------------------------------------
|
|
# SERVICES
|
|
# ---------------------------------------------------------------------------
|
|
|
|
"env":
|
|
image: alpine
|
|
commands:
|
|
- "env | sort"
|
|
|
|
"postgres":
|
|
image: postgres:17.4-alpine # should be the same version as used in .drone.yml, .github/workflows, Dockerfile and live
|
|
environment:
|
|
POSTGRES_DB: *PGDATABASE
|
|
POSTGRES_USER: *PGUSER
|
|
POSTGRES_PASSWORD: *PGPASSWORD
|
|
# ATTENTION
|
|
# fsync=off, synchronous_commit=off and full_page_writes=off
|
|
# gives us a major speed up during local development and testing (~30%),
|
|
# however you should NEVER use these settings in PRODUCTION unless
|
|
# you want to have CORRUPTED data.
|
|
# DO NOT COPY/PASTE THIS BLINDLY.
|
|
# YOU HAVE BEEN WARNED.
|
|
# Apply some performance improvements to pg as these guarantees are not needed while running integration tests
|
|
command: "-c 'shared_buffers=128MB' -c 'fsync=off' -c 'synchronous_commit=off' -c 'full_page_writes=off' -c 'max_connections=100' -c 'client_min_messages=warning'"
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
"integresql":
|
|
image: ghcr.io/allaboutapps/integresql:v1.1.0
|
|
environment:
|
|
PGHOST: *PGHOST
|
|
PGUSER: *PGUSER
|
|
PGPASSWORD: *PGPASSWORD
|
|
<<: *WHEN_BUILD_EVENT
|
|
|
|
"mailhog":
|
|
image: mailhog/mailhog
|
|
<<: *WHEN_BUILD_EVENT
|