-
Notifications
You must be signed in to change notification settings - Fork 1
/
config.yml
646 lines (613 loc) · 18 KB
/
config.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
version: 2.1
parameters:
approval_required:
type: boolean
default: true
orbs:
slack: circleci/[email protected]
aws-cli: circleci/[email protected]
aws-ecr: circleci/[email protected]
executors:
cloud-platform-executor:
docker:
- image: ministryofjustice/cloud-platform-tools:2.3.0
environment:
GITHUB_TEAM_NAME_SLUG: laa-estimate-eligibility
linting-executor:
docker:
- image: cimg/ruby:3.3.4-node
environment:
- RAILS_ENV=test
- TZ: "Europe/London"
notification-executor:
docker:
- image: 'cibuilds/base:latest'
environment:
TERM: dumb
resource_class: small
test-executor:
docker:
- image: cimg/ruby:3.3.4-node
environment:
- RAILS_ENV=test
- PGHOST=localhost
- PGUSER=user
- TZ: "Europe/London"
- RUBY_YJIT_ENABLE: "1"
- image: cimg/postgres:14.8
environment:
- POSTGRES_USER=user
- POSTGRES_DB=cfe_civil_test
ccq-executor:
docker:
- image: cimg/ruby:3.3.4-browsers
environment:
VCR_RECORD_MODE: none
COVERAGE: true
RAILS_ENV: test
PGHOST: localhost
PGUSER: postgres
TZ: "Europe/London"
CFE_HOST: http://localhost:3000
- image: cimg/postgres:14.8
environment:
POSTGRES_USER: postgres
POSTGRES_DB: ccq_test
- image: ${ECR_ENDPOINT}:${CIRCLE_SHA1}
aws_auth:
oidc_role_arn: $ECR_ROLE_TO_ASSUME
environment:
- RAILS_ENV: production
- LEGAL_FRAMEWORK_API_HOST: https://legal-framework-api-staging.cloud-platform.service.justice.gov.uk
- SECRET_KEY_BASE: any_old_secret_key_base
- POSTGRES_HOST: localhost
- POSTGRES_USER: postgres
- POSTGRES_PASSWORD: cfe_ccq_pass
- POSTGRES_DATABASE: cfe_db
- PROBE_TIMEOUT: 60
- TZ: "Europe/London"
commands:
build_and_push:
parameters:
docker_tag_prefix:
description: Docker repository tag prefix
type: string
steps:
- checkout
# Authenticate to AWS using OIDC v2 with the AWS CLI
- aws-cli/setup:
role_arn: $ECR_ROLE_TO_ASSUME
region: $ECR_REGION
# Authenticate to the ECR repository using the standard command
- run: |
aws ecr get-login-password --region $ECR_REGION | docker login --username AWS --password-stdin ${AWS_ECR_REGISTRY_ID}.dkr.ecr.${ECR_REGION}.amazonaws.com
# Build and push your Docker image
- aws-ecr/build_image:
push_image: true
account_id: $AWS_ECR_REGISTRY_ID
tag: ${CIRCLE_SHA1},<< parameters.docker_tag_prefix >>-${CIRCLE_SHA1} # add a suffix to make it unique, since a tag can point at only one image at a time
region: $ECR_REGION # this will use the env var
repo: $ECR_REPOSITORY # this will use the env var
# The intent here is to slack notify *only* for main/production failures which the team tend not to spot
notify_slack_on_failure:
steps:
- slack/notify:
channel: laa-eligibility-platform-alerts-prod
event: fail
branch_pattern: main
template: basic_fail_1
references:
authenticate_k8s: &authenticate_k8s
run:
name: Authenticate with cluster
command: |
echo -n ${K8S_CLUSTER_CERT} | base64 -d > ./ca.crt
kubectl config set-cluster ${K8S_CLUSTER_NAME} --certificate-authority=./ca.crt --server=https://${K8S_CLUSTER_NAME}
kubectl config set-credentials circleci --token=${K8S_TOKEN}
kubectl config set-context ${K8S_CLUSTER_NAME} --cluster=${K8S_CLUSTER_NAME} --user=circleci --namespace=${K8S_UAT_NAMESPACE}
kubectl config use-context ${K8S_CLUSTER_NAME}
install_packages_for_testing: &install_packages_for_testing
run:
name: Install System packages needed for testing
command: |
sudo apt-get update
sudo apt-get install -y postgresql-client cmake
restore_gems_cache: &restore_gems_cache
restore_cache:
keys:
- cfe-civil-gems-{{ checksum "Gemfile.lock" }}
- cfe-civil-gems
install_gems: &install_gems
run:
name: Install ruby gems
command: |
sudo gem update --system
bundle config set --local frozen 'true'
bundle config set --local path 'vendor/bundle'
bundle config set --local without 'development'
bundle install --jobs=4 && bundle clean
save_gems_cache: &save_gems_cache
save_cache:
key: cfe-civil-gems-{{ checksum "Gemfile.lock" }}
paths:
- vendor/bundle
restore_helm_cache: &restore_helm_cache
restore_cache:
keys:
- cfe-civil-helm-{{ checksum "deploy/helm/Chart.lock" }}
- cfe-civil-helm
save_helm_cache: &save_helm_cache
save_cache:
key: cfe-civil-helm-{{ checksum "deploy/helm/Chart.lock" }}
paths:
- deploy/helm/charts
setup_database: &setup_database
run:
name: Database Setup
command: |
bundle exec rake db:schema:load
bundle exec rake db:migrate
jobs:
lint_checks:
executor: linting-executor
steps:
- checkout
- *restore_gems_cache
- *install_gems
- *save_gems_cache
- run:
name: Run Rubocop
command: bundle exec rubocop
- notify_slack_on_failure
create_helm_cache:
executor: cloud-platform-executor
steps:
- checkout
- *restore_helm_cache
- run:
name: Grab postgres chart from bitnami
working_directory: deploy/helm
command: |
helm repo add bitnami https://charts.bitnami.com/bitnami
helm dependency build
- *save_helm_cache
- notify_slack_on_failure
end2end_tests:
executor: ccq-executor
steps:
- run:
name: Checkout CCQ main line
command: |
git clone https://github.com/ministryofjustice/laa-estimate-financial-eligibility-for-legal-aid.git ~/project/ccq
- run:
name: Setup CCQ ready to execute tests
working_directory: ~/project/ccq
command: |
bundle install --without=development
- run:
name: Setup CCQ database and test env
working_directory: ~/project/ccq
command: |
bundle exec rails db:schema:load
bundle exec rake test:prepare
- run:
name: CFE/CCQ end2end specs
working_directory: ~/project/ccq
command: |
COVERAGE=false bundle exec rspec -t end2end --format documentation spec/**/*_spec.rb
- notify_slack_on_failure
unit_tests:
executor: test-executor
steps:
- run:
environment:
GIT_SSH_COMMAND: ssh -o StrictHostKeyChecking=accept-new
name: Checkout code
command: |
git clone -b "$CIRCLE_BRANCH" "$CIRCLE_REPOSITORY_URL" .
- *install_packages_for_testing
- *restore_gems_cache
- *install_gems
- *save_gems_cache
- *setup_database
- run:
name: Run ruby tests
command: |
bundle exec rake spec
- run:
name: Check coverage with undercover
command: |
bundle exec undercover -c origin/main -l coverage/lcov.info
- store_test_results:
path: /tmp/test-results/rspec
- store_artifacts:
path: ./coverage
- notify_slack_on_failure
integration_tests:
executor: test-executor
steps:
- checkout
- *install_packages_for_testing
- *restore_gems_cache
- *install_gems
- *save_gems_cache
- *setup_database
- run:
name: Run cucumber tests
command: |
bundle exec cucumber --format html --out report.html --format pretty
- store_artifacts:
path: ./report.html
- notify_slack_on_failure
check_swagger:
executor: test-executor
steps:
- checkout
- *install_packages_for_testing
- *restore_gems_cache
- *install_gems
- *save_gems_cache
- *setup_database
- run:
name: Check for unapplied swagger documentation specs
command: |
bundle exec rails check_swaggerization
- notify_slack_on_failure
# The ECR.tf file in cloud-platform uses 'dev' for UAT tags
# These tags ensure that ephemeral images get deleted after 30
# days and do not contribute to the list of production images
build_and_push_uat:
executor: aws-ecr/default
steps:
- build_and_push:
docker_tag_prefix: uat
build_and_push_staging:
executor: aws-ecr/default
steps:
- build_and_push:
docker_tag_prefix: staging
- notify_slack_on_failure
build_and_push_staging_mtr:
executor: aws-ecr/default
steps:
- build_and_push:
docker_tag_prefix: staging_mtr
- notify_slack_on_failure
build_and_push_production:
executor: aws-ecr/default
steps:
- build_and_push:
docker_tag_prefix: production
- notify_slack_on_failure
deploy_uat: &deploy_uat
executor: cloud-platform-executor
steps:
- checkout
- setup_remote_docker:
docker_layer_caching: true
- *authenticate_k8s
- *restore_helm_cache
- run:
name: Helm deployment to UAT
command: |
./bin/uat_deploy
- notify_slack_on_failure
deploy_main_uat:
<<: *deploy_uat
deploy_staging:
executor: cloud-platform-executor
steps:
- checkout
- setup_remote_docker:
docker_layer_caching: true
- *authenticate_k8s
- *restore_helm_cache
- run:
name: Helm deploy CFE Civil to Staging
command: |
helm upgrade cfe-civil ./deploy/helm/. \
--install --wait \
--namespace=${K8S_NAMESPACE} \
--values ./deploy/helm/values/staging.yaml \
--set image.repository="$ECR_ENDPOINT" \
--set image.tag="${CIRCLE_SHA1}"
- notify_slack_on_failure
deploy_staging_mtr:
executor: cloud-platform-executor
steps:
- checkout
- setup_remote_docker:
docker_layer_caching: true
- *authenticate_k8s
- *restore_helm_cache
- run:
name: Helm deploy CFE Civil to Staging MTR
command: |
helm upgrade cfe-civil ./deploy/helm/. \
--install --wait \
--namespace=${K8S_NAMESPACE} \
--values ./deploy/helm/values/staging-mtr.yaml \
--set image.repository="$ECR_ENDPOINT" \
--set image.tag="${CIRCLE_SHA1}"
- notify_slack_on_failure
deploy_production:
executor: cloud-platform-executor
steps:
- checkout
- setup_remote_docker:
docker_layer_caching: true
- *authenticate_k8s
- *restore_helm_cache
- run:
name: Helm deploy CFE Civil to Production
command: |
helm upgrade cfe-civil ./deploy/helm/. \
--install --wait \
--namespace=${K8S_NAMESPACE} \
--values ./deploy/helm/values/production.yaml \
--set image.repository="$ECR_ENDPOINT" \
--set image.tag="${CIRCLE_SHA1}" \
- notify_slack_on_failure
delete_dependabot_deployment:
executor: cloud-platform-executor
steps:
- checkout
- setup_remote_docker
- *authenticate_k8s
- run:
name: Delete dependabot deployment
command: |
./bin/delete_dependabot_deployment
deploy_infrastructure:
executor: cloud-platform-executor
steps:
- checkout
- *authenticate_k8s
- run:
name: Deploy infrastructure
command: |
kubectl -n ${K8S_NAMESPACE} apply --record=false -f ./infrastructure/${K8S_NAMESPACE}/
- notify_slack_on_failure
workflows:
version: 2
deploy_branch:
jobs:
- lint_checks:
filters:
branches:
ignore: main
- unit_tests:
filters:
branches:
ignore: main
- create_helm_cache:
filters:
branches:
ignore: main
- end2end_tests:
filters:
branches:
ignore: main
requires:
- build_and_push_uat
- create_helm_cache
- integration_tests:
filters:
branches:
ignore: main
- check_swagger:
filters:
branches:
ignore: main
- build_and_push_uat:
context: cfe-civil-uat
filters:
branches:
ignore: main
- deploy_uat:
context: cfe-civil-uat
requires:
- lint_checks
- check_swagger
- unit_tests
- integration_tests
- end2end_tests
filters:
branches:
ignore: main
- delete_dependabot_deployment:
context: cfe-civil-uat
filters:
branches:
only:
- /dependabot.*/
requires:
- deploy_uat
deploy_main_approval_required:
when: << pipeline.parameters.approval_required >>
jobs:
- lint_checks:
filters:
branches:
only: main
- unit_tests:
filters:
branches:
only: main
- build_and_push_staging:
context: cfe-civil-staging
filters:
branches:
only: main
- build_and_push_staging_mtr:
context: cfe-civil-staging-mtr
filters:
branches:
only:
- main
- end2end_tests:
filters:
branches:
only: main
requires:
- build_and_push_staging
- create_helm_cache
- integration_tests:
filters:
branches:
only: main
- deploy_infrastructure:
name: deploy_infrastructure_uat
context: cfe-civil-uat
filters:
branches:
only: main
- deploy_infrastructure:
name: deploy_infrastructure_staging
context: cfe-civil-staging
filters:
branches:
only: main
- deploy_infrastructure:
name: deploy_infrastructure_production
context: cfe-civil-production
filters:
branches:
only: main
- create_helm_cache:
filters:
branches:
only: main
- check_swagger:
filters:
branches:
only: main
- deploy_main_uat:
context: cfe-civil-uat
requires:
- end2end_tests
filters:
branches:
only: main
- deploy_staging:
context: cfe-civil-staging
requires:
- end2end_tests
filters:
branches:
only:
- main
- deploy_staging_mtr:
context: cfe-civil-staging-mtr
requires:
- end2end_tests
- build_and_push_staging_mtr
filters:
branches:
only:
- main
- build_and_push_production:
requires:
- lint_checks
- check_swagger
- unit_tests
- integration_tests
- end2end_tests
filters:
branches:
only: main
- deploy_production_approval:
type: approval
requires:
- build_and_push_production
filters:
branches:
only:
- main
- deploy_production:
context: cfe-civil-production
requires:
- deploy_production_approval
filters:
branches:
only:
- main
deploy_main:
unless: << pipeline.parameters.approval_required >>
jobs:
- lint_checks:
filters:
branches:
only: main
- unit_tests:
filters:
branches:
only: main
- build_and_push_staging:
context: cfe-civil-staging
filters:
branches:
only: main
- build_and_push_staging_mtr:
context: cfe-civil-staging-mtr
filters:
branches:
only:
- main
- end2end_tests:
filters:
branches:
only: main
requires:
- build_and_push_staging
- create_helm_cache
- integration_tests:
filters:
branches:
only: main
- create_helm_cache:
filters:
branches:
only: main
- check_swagger:
filters:
branches:
only: main
- build_and_push_production:
requires:
- lint_checks
- check_swagger
- unit_tests
- integration_tests
- deploy_staging
- deploy_staging_mtr
- deploy_main_uat:
context: cfe-civil-uat
requires:
- end2end_tests
- deploy_staging:
context: cfe-civil-staging
requires:
- end2end_tests
filters:
branches:
only:
- main
- deploy_staging_mtr:
context: cfe-civil-staging-mtr
requires:
- end2end_tests
- build_and_push_staging_mtr
filters:
branches:
only:
- main
- deploy_production:
context: cfe-civil-production
requires:
- end2end_tests
- build_and_push_production
filters:
branches:
only:
- main