.gitlab-ci.yml

image: docker.io/alpine/k8s:1.26.6

stages:
  - prepare
  - update_check
  - test
  - release
  - push

# Define Global Definitions
.defaults:
  cache: &global_cache
    policy: push
    unprotect: false
    untracked: true
    when: on_success
    key: "$CI_COMMIT_REF_SLUG"
    paths:
      - Chart.lock
      - charts/
  except: &skip_tags
    refs:
      - tags

# Prepare Docker access
.kaniko:
  before_script:
    - echo "{\"auths\":{\"${CI_CONTAINER_REGISTRY}\":{\"auth\":\"$(printf "%s:%s" "${REGISTRY_USER}" "${REGISTRY_PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json

## Builds the dependency-cache for consecutive stages
build dependency:
  stage: prepare
  except:
    <<: *skip_tags
  cache:
    <<: *global_cache
  script:
    - helm dependency update

## builds the datree image
scanner image:
  stage: prepare
  except:
    <<: *skip_tags
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  extends: .kaniko
  only:
    changes:
      - docker/Dockerfile
    refs:
      - main
  script: |
    /kaniko/executor \
      --context $CI_PROJECT_DIR/docker \
      --dockerfile $CI_PROJECT_DIR/docker/Dockerfile \
      --destination "$CI_CONTAINER_REGISTRY/$CI_REGISTRY_PROJECT/datree-scanner:latest"

## builds the diff-image for version comparisons
yaml diff image:
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  stage: prepare
  except:
    <<: *skip_tags
  extends: .kaniko
  only:
    changes:
      - docker/Dockerfile-k8s
    refs:
      - main
  script: |
    /kaniko/executor \
      --context $CI_PROJECT_DIR \
      --dockerfile $CI_PROJECT_DIR/docker/Dockerfile-k8s \
      --destination "$CI_CONTAINER_REGISTRY/$CI_REGISTRY_PROJECT/diff-image:latest"

## runs the diff-image and prints out updates
check chart for updates:
  image: "$CI_CONTAINER_REGISTRY/$CI_REGISTRY_PROJECT/diff-image:latest"
  stage: update_check
  except:
    <<: *skip_tags
  allow_failure: true
  script:
    - cd /apps
    - sh -c /apps/getChartVersions.sh

## scans the chart with datree
chart scan:
  image: $CI_CONTAINER_REGISTRY/$CI_REGISTRY_PROJECT/datree-scanner:latest
  stage: test
  except:
    <<: *skip_tags
  cache:
    <<: *global_cache
    policy: pull
  script:
    - helm template clops -f values.yaml . > rendered.yaml
    - datree test --no-record --ignore-missing-schemas --schema-version 1.27.3 ./rendered.yaml || true

## prints out the templated chart
## if this fails there is an error in the chart vlaues
template dump:
  stage: test
  except:
    <<: *skip_tags
  cache:
    <<: *global_cache
    policy: pull
  script:
    - helm template clops -f values.yaml .

## semantic-release
release:
  image: $CI_CONTAINER_REGISTRY/cci-tools/semantic-release@sha256:3c237539f069b3ed5a863f9d02682ca5844a4c5cb3c1e2629043c33c56b93c6d
  stage: release
  script:
    - semantic-release
  only:
    refs:
      - main
      #- dev

## builds the chart on a new release
build chart:
  stage: push
  only:
    refs:
      - tags
  except:
    refs:
      - branches
  script:
    - |
      sed -i "s/^version:.*$/version: $CI_COMMIT_TAG/g" Chart.yaml
    - helm dependency update
    - helm package .
  artifacts:
    untracked: false
    when: on_success
    expire_in: "30 days"
    paths:
      - "clops-helm-*.tgz"

## pushes the chart on a new release
push chart:
  stage: push
  needs:
    - "build chart"
  only:
    refs:
      - tags
  except:
    refs:
      - branches
  script:
    ## Not needed since already present in container
    #- helm plugin install https://github.com/chartmuseum/helm-push
    - helm repo add cloudical-clops "https://$CI_CHART_REGISTRY/$CI_REGISTRY_PROJECT"
    - helm cm-push --dependency-update clops-helm-*.tgz cloudical-clops