.drone.yml

---
kind: pipeline
name: default
type: kubernetes

steps:

- name: redis-test-service
  pull: if-not-exists
  image: redis
  detach: true
  when:
    branch: [ master, development ]
    event: push

- name: test
  pull: if-not-exists
  image: mcr.microsoft.com/playwright:bionic
  environment:
    NOTIFY_KEY: USE_MOCK
  commands:
    - npm i -s && npm run build
    - npm test
    - npm run test:ui:server
  when:
    branch: [ master, development ]
    event: push

- name: build-image
  image: docker:dind
  commands:
    # wait for docker service to be up before running docker build
    - n=0; while [ "$n" -lt 60 ] && [ ! -e /var/run/docker.sock ]; do n=$(( n + 1 )); sleep 1; done
    - docker build -t sas/fbis-ccf:$${DRONE_COMMIT_SHA} .
  volumes:
    - name: dockersock
      path: /var/run
  when:
    branch: [ master, development ]
    event: push

- name: scan-image
  image: docker.digital.homeoffice.gov.uk/acp-anchore-submission:latest
  environment:
    IMAGE_NAME: sas/fbis-ccf:${DRONE_COMMIT_SHA}
    SERVICE_URL: http://anchore-submission-server:10080
    LOCAL_IMAGE: true
    TOLERATE: medium
    FAIL_ON_DETECTION: false
  when:
    branch: master
    event: push

- name: create-artefact
  image: docker:dind
  environment:
    DOCKER_PASSWORD:
      from_secret: docker_password
  commands:
    - docker login -u="ukhomeofficedigital+sas_fbis_robot" -p=$${DOCKER_PASSWORD} quay.io
    - docker tag sas/fbis-ccf:${DRONE_COMMIT_SHA} quay.io/ukhomeofficedigital/sas-fbis-ccf:${DRONE_COMMIT_SHA}
    - docker push quay.io/ukhomeofficedigital/sas-fbis-ccf:${DRONE_COMMIT_SHA}
  volumes:
    - name: dockersock
      path: /var/run
  when:
    branch: [ master, development ]
    event: push

- name: deploy-to-dev
  pull: if-not-exists
  image: quay.io/ukhomeofficedigital/kd:v1.14.0
  commands:
  - export KUBE_TOKEN=$${KUBE_TOKEN_FBIS_ACP_NOTPROD}
  - kd --insecure-skip-tls-verify --check-interval 10s -f kube/redis-service.yml -f kube/redis-network-policy.yml -f kube/redis-deployment.yml
  - kd --insecure-skip-tls-verify -f kube/dev/configmap.yaml -f kube/dev/ingress-internal.yaml -f kube/networkpolicy-internal.yaml -f kube/service.yaml
  - kd --insecure-skip-tls-verify --timeout 4m --check-interval 10s -f kube/dev/deployment.yaml
  environment:
    KUBE_NAMESPACE: sas-fbis-dev
    KUBE_SERVER: https://kube-api-notprod.notprod.acp.homeoffice.gov.uk
    KUBE_TOKEN_FBIS_ACP_NOTPROD:
      from_secret: kube_token_fbis_acp_notprod
  when:
    branch: master
    event: push

- name: deploy-to-branch
  pull: if-not-exists
  image: quay.io/ukhomeofficedigital/kd:v1.14.0
  commands:
  - export KUBE_TOKEN=$${KUBE_TOKEN_FBIS_ACP_NOTPROD}
  - kd --insecure-skip-tls-verify --check-interval 10s -f kube/redis-service.yml -f kube/redis-network-policy.yml -f kube/redis-deployment.yml
  - kd --insecure-skip-tls-verify -f kube/branch/configmap.yaml -f kube/branch/ingress-internal.yaml -f kube/networkpolicy-internal.yaml -f kube/service.yaml
  - kd --insecure-skip-tls-verify --timeout 4m --check-interval 10s -f kube/branch/deployment.yaml
  environment:
    KUBE_NAMESPACE: sas-fbis-branch
    KUBE_SERVER: https://kube-api-notprod.notprod.acp.homeoffice.gov.uk
    KUBE_TOKEN_FBIS_ACP_NOTPROD:
      from_secret: kube_token_fbis_acp_notprod
  when:
    branch: development
    event: push

- name: deploy-to-uat
  pull: if-not-exists
  image: quay.io/ukhomeofficedigital/kd:v1.14.0
  commands:
  - export KUBE_TOKEN=$${KUBE_TOKEN_FBIS_ACP_NOTPROD}
  - kd --insecure-skip-tls-verify --check-interval 10s -f kube/redis-service.yml -f kube/redis-network-policy.yml -f kube/redis-deployment.yml
  - kd --insecure-skip-tls-verify -f kube/uat/configmap.yaml -f kube/uat/ingress-internal.yaml -f kube/networkpolicy-internal.yaml -f kube/service.yaml
  - kd --insecure-skip-tls-verify --timeout 4m --check-interval 10s -f kube/uat/deployment.yaml
  environment:
    KUBE_NAMESPACE: sas-fbis-uat
    KUBE_SERVER: https://kube-api-notprod.notprod.acp.homeoffice.gov.uk
    KUBE_TOKEN_FBIS_ACP_NOTPROD:
      from_secret: kube_token_fbis_acp_notprod
  when:
    event: promote
    target: UAT

- name: deploy-to-stg
  pull: if-not-exists
  image: quay.io/ukhomeofficedigital/kd:v1.14.0
  commands:
  - export KUBE_TOKEN=$${KUBE_TOKEN_FBIS_ACP_PROD}
  - kd --insecure-skip-tls-verify --check-interval 10s -f kube/redis-service.yml -f kube/redis-network-policy.yml -f kube/redis-deployment.yml
  - kd --insecure-skip-tls-verify -f kube/stg/configmap.yaml -f kube/stg/ingress-internal.yaml -f kube/networkpolicy-internal.yaml -f kube/service.yaml
  - kd --insecure-skip-tls-verify -f kube/stg/ingress-external.yaml -f kube/networkpolicy-external.yaml
  - kd --insecure-skip-tls-verify --timeout 4m --check-interval 10s -f kube/stg/deployment.yaml
  environment:
    KUBE_NAMESPACE: sas-fbis-stg
    KUBE_SERVER: https://kube-api-prod.prod.acp.homeoffice.gov.uk
    KUBE_TOKEN_FBIS_ACP_PROD:
      from_secret: kube_token_fbis_acp_prod
  when:
    event: promote
    target: STG

- name: deploy-to-prod
  pull: if-not-exists
  image: quay.io/ukhomeofficedigital/kd:v1.14.0
  commands:
  - export KUBE_TOKEN=$${KUBE_TOKEN_FBIS_ACP_PROD}
  - kd --insecure-skip-tls-verify --check-interval 10s -f kube/redis-service.yml -f kube/redis-network-policy.yml -f kube/redis-deployment.yml
  - kd --insecure-skip-tls-verify -f kube/prod/configmap.yaml -f kube/prod/ingress-external.yaml -f kube/networkpolicy-external.yaml -f kube/service.yaml
  - kd --insecure-skip-tls-verify --timeout 4m --check-interval 10s -f kube/prod/deployment.yaml
  environment:
    KUBE_NAMESPACE: sas-fbis-prod
    KUBE_SERVER: https://kube-api-prod.prod.acp.homeoffice.gov.uk
    KUBE_TOKEN_FBIS_ACP_PROD:
      from_secret: kube_token_fbis_acp_prod
  when:
    event: promote
    target: PROD

- name: manual-deploy-to-branch
  pull: if-not-exists
  image: quay.io/ukhomeofficedigital/kd:v1.14.0
  commands:
  - export KUBE_TOKEN=$${KUBE_TOKEN_FBIS_ACP_NOTPROD}
  - kd --insecure-skip-tls-verify --check-interval 10s -f kube/redis-service.yml -f kube/redis-network-policy.yml -f kube/redis-deployment.yml
  - kd --insecure-skip-tls-verify -f kube/branch/configmap.yaml -f kube/branch/ingress-internal.yaml -f kube/networkpolicy-internal.yaml -f kube/service.yaml
  - kd --insecure-skip-tls-verify --timeout 4m --check-interval 10s -f kube/branch/deployment.yaml
  environment:
    KUBE_NAMESPACE: sas-fbis-branch
    KUBE_SERVER: https://kube-api-notprod.notprod.acp.homeoffice.gov.uk
    KUBE_TOKEN_FBIS_ACP_NOTPROD:
      from_secret: kube_token_fbis_acp_notprod
  when:
    event: promote
    target: BRANCH

- name: sonar-scanner
  pull: if-not-exists
  image: quay.io/ukhomeofficedigital/sonar-scanner-node:6a03c77c7e1bad005893cdcc9cd3d99479b79d5c
  settings:
    failure: ignore
  when:
    branch: master
    event: push

- name: notify-slack-build
  pull: if-not-exists
  image: plugins/slack
  settings:
    channel: sas-build
    failure: ignore
    icon.url: http://readme.drone.io/0.5/logo_dark.svg
    icon_url: http://readme.drone.io/0.5/logo_dark.svg
    template: "BUILD on {{build.event}} of FBIS has {{build.status}} - <{{build.link}}|#{{build.number}}> {{#success build.status}}\n  :thumbsup: :thumbsup: :thumbsup:\n{{else}}\n  :x: :x: :x:\n{{/success}} Author: {{build.author}}\n\nDuration: {{since job.started}}\\n\n\nJob: <{{build.link}}|#{{build.number}}>\\n\n\nCommit: {{build.commit}}\n"
    username: Drone
    webhook:
      from_secret: SLACK_WEBHOOK
  when:
    branch: [ master, development ]
    event: push
    status: [ success, failure ]

- name: notify-slack-deploy
  pull: if-not-exists
  image: plugins/slack
  settings:
    channel: sas-build
    failure: ignore
    icon.url: http://readme.drone.io/0.5/logo_dark.svg
    icon_url: http://readme.drone.io/0.5/logo_dark.svg
    template: "DEPLOY to {{build.deployTo}} of FBIS has {{build.status}} - <{{build.link}}|#{{build.number}}> {{#success build.status}}\n  :thumbsup: :thumbsup: :thumbsup:\n{{else}}\n  :x: :x: :x:\n{{/success}} Author: {{build.author}}\n\nDuration: {{since job.started}}\n\nJob: <{{build.link}}|#{{build.number}}>\n\nCommit: {{build.commit}}\n"
    username: Drone
    webhook:
      from_secret: SLACK_WEBHOOK
  when:
    event: promote
    status: [ success, failure ]

services:
  - name: docker
    image: docker:dind
    volumes:
      - name: dockersock
        path: /var/run

  - name: anchore-submission-server
    image: docker.digital.homeoffice.gov.uk/acp-anchore-submission:latest
    commands:
      - /anchore-submission server
    environment:
      ANCHORE_URL: "acp-anchore.acp.homeoffice.gov.uk"
      REGISTRY_URL: "acp-ephemeral-registry.acp.homeoffice.gov.uk"
    volumes:
      - name: dockersock
        path: /var/run

volumes:
  - name: dockersock
    temp: {}

...