.gitlab-ci.yml

# CI/CD Pipeline
# - Live deployment (runs the latest code, with unfinished features hidden from the user; requires manual deployment)
# - Staging deployment (runs exactly the same code as live; opportunity to inspect the site before pushing to production)
# - Development deployment (runs the latest code, has all in-progress features enabled)

# include template to setup review app
include: '/gitlab-ci-templates/.setup-review-template.yaml'

# Define stages for the CI/CD pipeline
stages:
  - setup
  - test_build_static
  - build_docker_images
  - deploy-preview
  - deploy-live

variables:
  CONTAINER_IMAGE: ${CI_REGISTRY_IMAGE}:nginx-${CI_COMMIT_SHORT_SHA}
  CONTAINER_NODE_IMAGE: ${CI_REGISTRY_IMAGE}:node-${CI_COMMIT_SHORT_SHA}
  DOCKER_TLS_CERTDIR: ""

# The `before_script` commands for deployment jobs that are used to set up gitlab agent
# (will be used via yaml anchors in the jobs below)
.gitlab-agent-setup-commands: &gitlab-agent-setup-commands
  - kubectl config use-context ${AGENT}
  - kubectl config set-context --current --namespace=${NAMESPACE}

# Template to build static assets
.build-static:
  image: node:22.11.0
  before_script:
  - npm ci --loglevel warn
  script:
  - npm run test
  - npm run build
  after_script:
    - echo "BUILD_JOB_ID=${CI_JOB_ID}" >> build_static.env
  artifacts:
    name: build_artifacts
    paths:
      - dist/
      - package.json
      - package-lock.json
    reports:
      dotenv: build_static.env

# Template to build nginx docker image for WP k8s cluster
# WP k8s cluster uses ingress
.build-nginx:
  image: docker
  services:
    - docker:dind
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - apk update && apk add git
    - git clone --depth 1 https://github.com/Ensembl/ensembl-2020-static-assests.git
    - git clone https://gitlab.ebi.ac.uk/kamal/ensembl-client-nginx.git
    - git -C ensembl-client-nginx checkout migration/ssr
    - docker build -t ${CONTAINER_IMAGE} -f ensembl-client-nginx/Dockerfile --no-cache .
    - docker push ${CONTAINER_IMAGE}
    - docker rmi ${CONTAINER_IMAGE}
    - docker logout $CI_REGISTRY

# Template for publishing static assets for the new kubernetes cluster
.publish_assets:
  image: dockerhub.ebi.ac.uk/ensembl-web/deploy-tools:latest
  environment:
    name: jobs/k8s-job
  before_script:
    - *gitlab-agent-setup-commands
    - git clone https://gitlab.ebi.ac.uk/ensembl-web/ensembl-k8s-manifests.git
    - git -C ensembl-k8s-manifests/ checkout k8s123-migration
    - cd ensembl-k8s-manifests/ensembl-client/static-assets
  script:
    - sed -i "s#<PROJECT_ID>#${CI_PROJECT_ID}#g" copy_job.yaml
    - sed -i "s#<JOB_ID>#${BUILD_JOB_ID}#g" copy_job.yaml
    - kustomize edit set namesuffix -- -${CI_PROJECT_ID}-${BUILD_JOB_ID}
    - kubectl apply -k .

# Template to build node docker image for WP k8s cluster
# WP k8s cluster uses ingress
.build-node:
  image: docker
  services:
    - docker:dind
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker build -t ${CONTAINER_NODE_IMAGE} -f Dockerfile.node --no-cache .
    - docker push ${CONTAINER_NODE_IMAGE}
    - docker rmi ${CONTAINER_NODE_IMAGE}
    - docker logout $CI_REGISTRY

# Template for deployment to "stable" (non-review) environments that have static assets on a mounted drive
# (therefore, does not need to deploy a static assets container)
.deploy:
  image: dockerhub.ebi.ac.uk/ensembl-web/deploy-tools:latest
  before_script:
    - *gitlab-agent-setup-commands
  script:
    - git clone https://gitlab.ebi.ac.uk/ensembl-web/ensembl-k8s-manifests.git
    - git -C ensembl-k8s-manifests/ checkout k8s123-migration
    - cd ensembl-k8s-manifests/ensembl-client/node
    - kustomize edit set image DOCKER_IMAGE=${CONTAINER_NODE_IMAGE}
    - kubectl apply -k ./

# Template to deploy review-app to WP k8s cluster
.deploy-review:
  image: dockerhub.ebi.ac.uk/ensembl-web/deploy-tools:latest
  before_script:
    - *gitlab-agent-setup-commands
  script:
    - git clone https://gitlab.ebi.ac.uk/ensembl-web/ensembl-k8s-manifests.git
    - git -C ensembl-k8s-manifests/ checkout k8s123-migration
    - cd ensembl-k8s-manifests/ensembl-client/nginx
    - mv deployment_review.yaml deployment.yaml
    - kustomize edit set image DOCKER_IMAGE=${CONTAINER_IMAGE}
    - kubectl apply -k ./
    - cd ../node
    - kustomize edit set image DOCKER_IMAGE=${CONTAINER_NODE_IMAGE}
    - kubectl apply -k ./

# Template for stopping review app - Do cleanup here 
.stop-review:
  image: dockerhub.ebi.ac.uk/ensembl-web/deploy-tools:latest
  before_script:
    - kubectl config use-context ${AGENT}
    - kubectl config set-context --current --namespace=${DEV_NAMESPACE}
  script:
    - kubectl delete ingress compara-server-ingress-${CI_COMMIT_REF_SLUG} || true
    - kubectl delete ingress ensembl-help-docs-ingress-${CI_COMMIT_REF_SLUG} || true
    - kubectl delete ingress ensembl-in-app-search-api-ingress-${CI_COMMIT_REF_SLUG} || true
    - kubectl delete ingress ensembl-thoas-ingress-${CI_COMMIT_REF_SLUG} || true
    - kubectl delete ingress ensembl-web-tools-api-ingress-${CI_COMMIT_REF_SLUG} || true
    - kubectl delete ingress ensembl-track-api-ingress-${CI_COMMIT_REF_SLUG} || true
    - kubectl delete ingress genome-browser-server-hi-${CI_COMMIT_REF_SLUG} || true
    - kubectl delete ingress genome-browser-server-lo-${CI_COMMIT_REF_SLUG} || true
    - kubectl delete ingress metadata-api-ingress-${CI_COMMIT_REF_SLUG} || true
    - kubectl delete ingress ensembl-refget-file-ingress-${CI_COMMIT_REF_SLUG} || true
    - kubectl delete ingress variation-graphql-ingress-${CI_COMMIT_REF_SLUG} || true
    - kubectl delete namespace ${NAMESPACE}

# Job to build static assets for staging, live, and dev environments
# from the main branch
Test_N_Build:
  extends: .build-static
  stage: test_build_static
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# Job to build static assets for review deployments
# Should run after commits to feature branches.
Test_N_Build:review:
  extends: .build-static
  stage: test_build_static
  rules:
    - if: $CI_COMMIT_BRANCH != "main"

# Job to build node docker image for staging, live, and dev environments
# main branch -> Staging, Live
Node:Live:
  extends: .build-node
  stage: build_docker_images
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  needs:
    - Test_N_Build

# Job to build nginx docker image for review environment
# Runs after commits to feature branches
Nginx:review:
  extends: .build-nginx
  stage: build_docker_images
  variables:
    CONTAINER_IMAGE: ${CI_REGISTRY_IMAGE}:nginx-${CI_COMMIT_SHORT_SHA}-${CI_COMMIT_REF_SLUG}
  rules:
    - if: $CI_COMMIT_BRANCH != "main"
  needs:
    - Test_N_Build:review

# Job to build node docker image for review environment
# Runs after commits to feature branches
Node:review:
  extends: .build-node
  stage: build_docker_images
  variables:
    CONTAINER_NODE_IMAGE: ${CI_REGISTRY_IMAGE}:node-${CI_COMMIT_SHORT_SHA}-${CI_COMMIT_REF_SLUG}
  rules:
    - if: $CI_COMMIT_BRANCH != "main"
  needs:
    - Test_N_Build:review


######## DEPLOYMENT JOBS ########


# DEPLOYMENT TO THE LIVE (PRODUCTION) ENVIRONMENT (beta.ensembl.org)

# Deploy the Node server
Live:
  extends: .deploy
  stage: deploy-live
  variables:
    AGENT: ${PROD_AGENT}
    NAMESPACE: ${PROD_NS}
  environment:
    name: production
  rules:
    - if: '$CI_DEPLOY_FREEZE == null && $CI_COMMIT_BRANCH == "main"'
  when: manual
  needs:
    - Staging

# Publish static assets
Pub:Live:
  extends: .publish_assets
  stage: deploy-live
  environment:
    name: production
  variables:
    AGENT: ${PROD_AGENT}
    NAMESPACE: ${PROD_NS}
  rules:
    - if: '$CI_DEPLOY_FREEZE == null && $CI_COMMIT_BRANCH == "main"'
  when: manual
  needs:
    - Test_N_Build # The reason this job has to be in dependencies array is so that the Publish job can recover its BUILD_JOB_ID
    - Pub:Staging


# DEPLOYMENT TO THE LIVE (PRODUCTION) FALLBACK ENVIRONMENT (beta.ensembl.org, running in Hinxton)

# Deploy the Node server
LiveFallback:
  extends: .deploy
  stage: deploy-live
  variables:
    AGENT: ${FALLBACK_AGENT}
    NAMESPACE: ${FALLBACK_NS}
  environment:
    name: fallback
  rules:
    - if: '$CI_DEPLOY_FREEZE == null && $CI_COMMIT_BRANCH == "main"'
  when: manual
  needs:
    - Staging

# Publish static assets
Pub::LiveFallback:
  extends: .publish_assets
  stage: deploy-live
  environment:
    name: fallback
  variables:
    AGENT: ${FALLBACK_AGENT}
    NAMESPACE: ${FALLBACK_NS}
  rules:
    - if: '$CI_DEPLOY_FREEZE == null && $CI_COMMIT_BRANCH == "main"'
  when: manual
  needs:
    - Test_N_Build # The reason this job has to be in dependencies array is so that the Publish job can recover its BUILD_JOB_ID
    - Pub:Staging


# DEPLOYMENT TO THE STAGING ENVIRONMENT (staging-2020.ensembl.org)

# Deploy the Node server
Staging:
  extends: .deploy
  stage: deploy-preview
  environment:
    name: staging
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  needs:
    - Test_N_Build
    - Node:Live
  variables:
    AGENT: ${STAGING_AGENT}
    NAMESPACE: ${STAGING_NS}

# Publish static assets
Pub:Staging:
  extends: .publish_assets
  stage: deploy-preview
  environment:
    name: staging
  variables:
    AGENT: ${STAGING_AGENT}
    NAMESPACE: ${STAGING_NS}
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  needs:
    - Test_N_Build # The reason this job has to be in dependencies array is so that the Publish job can recover its BUILD_JOB_ID
    - Node:Live


# DEPLOYMENT TO THE DEVELOPMENT ENVIRONMENT (dev-2020.ensembl.org)

# Deploy the Node server
Dev:
  extends: .deploy
  stage: deploy-preview
  variables:
    AGENT: ${DEV_AGENT}
    NAMESPACE: ${DEV_NS}
  environment:
    name: development
    kubernetes:
      namespace: ensembl-dev
  rules:
    - if: '$CI_DEPLOY_FREEZE == null && $CI_COMMIT_BRANCH == "main"'
  needs:
    - Test_N_Build
    - Node:Live

# Publish static assets
Pub:Dev:
  extends: .publish_assets
  stage: deploy-preview
  environment:
    name: development
  variables:
    AGENT: ${DEV_AGENT}
    NAMESPACE: ${DEV_NS}
  rules:
    - if: '$CI_DEPLOY_FREEZE == null && $CI_COMMIT_BRANCH == "main"'
  needs:
    - Test_N_Build # The reason this job has to be in dependencies array is so that the Publish job can recover its BUILD_JOB_ID
    - Node:Live


# REVIEW DEPLOYMENTS (<branch_name>.review.ensembl.org)

# Job to deploy Node server and a dedicated Nginx container with embedded static assets
Review:
  extends: .deploy-review
  stage: deploy-preview
  variables:
    CONTAINER_IMAGE: ${CI_REGISTRY_IMAGE}:nginx-${CI_COMMIT_SHORT_SHA}-${CI_COMMIT_REF_SLUG}
    CONTAINER_NODE_IMAGE: ${CI_REGISTRY_IMAGE}:node-${CI_COMMIT_SHORT_SHA}-${CI_COMMIT_REF_SLUG}
    AGENT: ${DEV_AGENT}
    NAMESPACE: ${CI_COMMIT_REF_SLUG}
  environment:
    name: development
    url: http://$CI_COMMIT_REF_SLUG.review.ensembl.org
    on_stop: CleanUpReview
    kubernetes:
      namespace: ${CI_COMMIT_REF_SLUG}
  rules:
    - if: $CI_COMMIT_BRANCH != "main"
  needs:
    - Test_N_Build:review
    - Nginx:review
    - Node:review

# Clean up the review app resources
CleanUpReview:
  extends: .stop-review
  stage: deploy-preview
  environment:
    name: development
    action: stop
  variables:
    GIT_STRATEGY: none
    AGENT: ${DEV_AGENT}
    DEV_NAMESPACE: ${DEV_NS}
    NAMESPACE: ${CI_COMMIT_REF_SLUG}
  when: manual
  rules:
    - if: $CI_COMMIT_BRANCH != "main"


# Create a review deployment (runs once per new branch)
SetupReview:
  extends: .setup-review-newk8s
  stage: setup
  environment:
    name: development
  variables:
    GIT_STRATEGY: none
    AGENT: ${DEV_AGENT}
    DEV_NAMESPACE: ${DEV_NS}
    NAMESPACE: ${CI_COMMIT_REF_SLUG}
  rules:
    - if: $CI_PIPELINE_SOURCE == "push" && 
          $CI_COMMIT_BEFORE_SHA == "0000000000000000000000000000000000000000" &&
          $CI_COMMIT_BRANCH != "main"
      when: always