opendesk/.gitlab-ci.yml

# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
# SPDX-License-Identifier: Apache-2.0
---
include:
  - project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
    ref: "main"
    file:
      - "ci/common/automr.yml"
      - "ci/common/lint.yml"
      - "ci/release-automation/semantic-release.yml"
  - project: "${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}"
    file: "gitlab/environments.yaml"
    rules:
      - if: "$INCLUDE_ENVIRONMENTS_ENABLED != 'false'"

stages:
  - ".pre"
  - "automr"
  - "lint"
  - "env-cleanup"
  - "env"
  - "basic-services-deploy"
  - "component-deploy-stage-1"
  - "component-deploy-stage-2"
  - "tests"
  - "env-stop"
  - "generate-release-assets"
  - ".post"

variables:
  NAMESPACE:
    description: "The name of namespaces to deploy to."
    value: ""
  CLUSTER:
    description: "Define which cluster to use. Cluster must be defined in gitlab/environments.yaml of
      sovereign-workplace-env included above."
    value: "dev"
  MASTER_PASSWORD_WEB_VAR:
    description: "Optional: Provide a passphrase to be used for password generation."
    value: ""
  ENV_STOP_BEFORE:
    description: "Stop environment/delete namespace for the deployment"
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_ALL_COMPONENTS:
    description: "Enable all component deployment (overwrites 'no' setting on component level)."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_SERVICES:
    description: "Enable Service deployment."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_UCS:
    description: >-
      Enable Univention Corporate Server deployment.
      "ums-eval" does deploy the Univention Management Stack instead of the UCS container.
    value: "no"
    options:
      - "yes"
      - "ums-eval"
      - "no"
  DEPLOY_PROVISIONING:
    description: "Enable Provisioning Components."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_COLLABORA:
    description: "Enable Collabora deployment."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_CRYPTPAD:
    description: "Enable CryptPad deployment."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_ELEMENT:
    description: "Enable Element deployment."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_KEYCLOAK:
    description: "Enable Keycloak deployment."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_OX:
    description: "Enable OX AppSuite8 deployment."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_ICS:
    description: "Enable ICS deployment."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_XWIKI:
    description: "Enable XWiki deployment."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_NEXTCLOUD:
    description: "Enable Nextcloud deployment."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_OPENPROJECT:
    description: "Enable OpenProject deployment."
    value: "no"
    options:
      - "yes"
      - "no"
  DEPLOY_JITSI:
    description: "Enable Jitsi deployment."
    value: "no"
    options:
      - "yes"
      - "no"
  RUN_TESTS:
    description: "Triggers execution of E2E-tests."
    value: "yes"
    options:
      - "yes"
      - "no"
  TESTS_BRANCH:
    description: "Branch of E2E-tests on which the test pipeline is triggered"
    value: "main"
  RUN_UMS_TESTS:
    description: "Run E2E test suite of SouvAP Dev team"
    value: "no"
    options:
      - "yes"
      - "no"
  UMS_TESTS_BRANCH:
    description: "Branch of E2E test suite of SouvAP Dev team"
    value: "main"

.deploy-common:
  cache: {}
  dependencies: []
  extends: ".environments"
  image: "registry.souvap-univention.de/souvap/tooling/images/helm:latest"
  script:
    - "cd ${CI_PROJECT_DIR}/helmfile/apps/${COMPONENT}"
    # MASTER_PASSWORD_WEB_VAR as precedence for MASTER_PASSWORD
    - |
      if ! [ -z "${MASTER_PASSWORD_WEB_VAR}" ]; then
        export MASTER_PASSWORD="${MASTER_PASSWORD_WEB_VAR}"
      fi;
    - >
      echo "Installing ${COMPONENT} into ${NAMESPACE} namespace as ${HELMFILE_ENVIRONMENT} environment on ${CLUSTER}"
    - "helmfile --namespace ${NAMESPACE} apply --suppress-diff"
  tags:
    - "docker"
    - "kubernetes"
    - "${CLUSTER}"
  variables:
    HELMFILE_ENVIRONMENT: "dev"

env-cleanup:
  extends: ".deploy-common"
  environment:
    name: "${NAMESPACE}"
    action: "stop"
  needs: []
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          $ENV_STOP_BEFORE != "no"
      when: "always"
  script:
    - |
      if [ "${OPENDESK_SLEDGEHAMMER_DESTROY_ENABLED}" = "yes" ]; then
        for OPENDESK_RELEASE in $(helm ls -n ${NAMESPACE} -aq); do
          helm uninstall -n ${NAMESPACE} ${OPENDESK_RELEASE};
        done
        kubectl delete pvc --all --namespace ${NAMESPACE};
        kubectl delete jobs --all --namespace ${NAMESPACE};
      else
        helmfile destroy --namespace ${NAMESPACE};
      fi
  stage: "env-cleanup"

env-start:
  environment:
    name: "${NAMESPACE}"
    on_stop: "env-stop"
  extends: ".deploy-common"
  image: "${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/
      when: "always"
  script:
    - "echo \"Deploying to Environment ${NAMESPACE} in ${CLUSTER} Cluster\""
    - "kubectl create namespace ${NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -"
    - >
      kubectl create secret
      --namespace "${NAMESPACE}"
      docker-registry external-registry
      --docker-server "external-registry.souvap-univention.de"
      --docker-username sovereign-workplace
      --docker-password "${EXTERNAL_REGISTRY_PASSWORD}"
      --dry-run=client -o yaml | kubectl apply -f -
  stage: "env"

services-deploy:
  stage: "basic-services-deploy"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
      when: "always"
  variables:
    COMPONENT: "services"

ucs-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UCS == "yes")
      when: "always"
  variables:
    COMPONENT: "univention-corporate-container"

provisioning-deploy:
  stage: "component-deploy-stage-2"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UCS != "no" || $DEPLOY_PROVISIONING != "no")
      when: "always"
  variables:
    COMPONENT: "provisioning"

ums-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          $DEPLOY_UCS == "ums-eval"
      when: "always"
  variables:
    COMPONENT: "univention-management-stack"

keycloak-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_KEYCLOAK != "no")
      when: "always"
  variables:
    COMPONENT: "keycloak"

keycloak-bootstrap-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  timeout: "30m"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_KEYCLOAK != "no")
      when: "always"
  variables:
    COMPONENT: "keycloak-bootstrap"

ox-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  timeout: "30m"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_OX != "no")
      when: "always"
  variables:
    COMPONENT: "open-xchange"

ics-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ICS != "no")
      when: "always"
  variables:
    COMPONENT: "intercom-service"

xwiki-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_XWIKI != "no")
      when: "always"
  variables:
    COMPONENT: "xwiki"

collabora-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NEXTCLOUD != "no" || $DEPLOY_COLLABORA != "no")
      when: "always"
  variables:
    COMPONENT: "collabora"

cryptpad-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NEXTCLOUD != "no" || $DEPLOY_CRYPTPAD != "no")
      when: "always"
  variables:
    COMPONENT: "cryptpad"

nextcloud-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NEXTCLOUD != "no")
      when: "always"
  variables:
    COMPONENT: "nextcloud"

openproject-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_OPENPROJECT != "no")
      when: "always"
  variables:
    COMPONENT: "openproject"

openproject-bootstrap-deploy:
  stage: "component-deploy-stage-2"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || ($DEPLOY_OPENPROJECT != "no" && $DEPLOY_NEXTCLOUD != "no"))
      when: "always"
  variables:
    COMPONENT: "openproject-bootstrap"

jitsi-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_JITSI != "no")
      when: "always"
  variables:
    COMPONENT: "jitsi"

element-deploy:
  stage: "component-deploy-stage-1"
  extends: ".deploy-common"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
          $NAMESPACE =~ /.+/ &&
          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ELEMENT != "no")
      when: "always"
  variables:
    COMPONENT: "element"

env-stop:
  extends: ".deploy-common"
  environment:
    name: "${NAMESPACE}"
    action: "stop"
  image: "${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
  needs: []
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" && $NAMESPACE =~ /.+/
      when: "manual"
  script:
    - "echo 'We do not stop the env (delete the namespace) at the moment in this stage, as deleting a branches also
      triggers this env-stop stage and we do not want this to happen.'"
    # - kubectl delete namespace "${NAMESPACE}"
  stage: "env-stop"
  variables:
    GIT_STRATEGY: "none"

run-tests:
  extends: ".deploy-common"
  environment:
    name: "${NAMESPACE}"
  stage: "tests"
  rules:
    - if: >
          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" && $NAMESPACE =~ /.+/ && $RUN_TESTS == "yes"
      when: "always"
  script:
    - |
      UCS_CONTAINER_NAME=$( \
        kubectl -n ${NAMESPACE} get pods --no-headers --selector \
          'app.kubernetes.io/instance=univention-corporate-container' \
        | grep Running \
        | awk '{print $1}' \
      )
      DEFAULT_USER_PASSWORD=$( \
        kubectl -n ${NAMESPACE} describe pod ${UCS_CONTAINER_NAME} \
        | grep DEFAULT_ACCOUNT_USER_PASSWORD \
        | awk '{print $2}' \
      )
      DEFAULT_ADMIN_PASSWORD=$(
        kubectl -n ${NAMESPACE} describe pod ${UCS_CONTAINER_NAME} \
        | grep DEFAULT_ACCOUNT_ADMIN_PASSWORD \
        | awk '{print $2}' \
      )

      curl --request POST \
      --header "Content-Type: application/json" \
      --data "{ \
        \"ref\": \"${TESTS_BRANCH}\", \
        \"token\": \"${CI_JOB_TOKEN}\", \
        \"variables\": { \
          \"url\": \"https://portal.${DOMAIN}\", \
          \"user_name\": \"${DEFAULT_USER_NAME}\", \
          \"user_password\": \"${DEFAULT_USER_PASSWORD}\", \
          \"admin_name\": \"${DEFAULT_ADMIN_NAME}\", \
          \"admin_password\": \"${DEFAULT_ADMIN_PASSWORD}\", \
          \"DEPLOY_ALL_COMPONENTS\": \"${DEPLOY_ALL_COMPONENTS}\", \
          \"DEPLOY_COLLABORA\": \"${DEPLOY_COLLABORA}\", \
          \"DEPLOY_ELEMENT\": \"${DEPLOY_ELEMENT}\", \
          \"DEPLOY_ICS\": \"${DEPLOY_ICS}\", \
          \"DEPLOY_JITSI\": \"${DEPLOY_JITSI}\", \
          \"DEPLOY_KEYCLOAK\": \"${DEPLOY_KEYCLOAK}\", \
          \"DEPLOY_NEXTCLOUD\": \"${DEPLOY_NEXTCLOUD}\", \
          \"DEPLOY_OPENPROJECT\": \"${DEPLOY_OPENPROJECT}\", \
          \"DEPLOY_OX\": \"${DEPLOY_OX}\", \
          \"DEPLOY_SERVICES\": \"${DEPLOY_SERVICES}\", \
          \"DEPLOY_UCS\": \"${DEPLOY_UCS}\", \
          \"DEPLOY_XWIKI\": \"${DEPLOY_XWIKI}\", \
          \"DEPLOY_PROVISIONING\": \"${DEPLOY_PROVISIONING}\" \
        } \
      }" \
      "https://${TESTS_PROJECT_URL}/trigger/pipeline"

run-souvap-dev-tests:
  extends: ".deploy-common"
  environment:
    name: "${NAMESPACE}"
  stage: "tests"
  rules:
    - if: >
        $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" && $NAMESPACE =~ /.+/ && $RUN_UMS_TESTS == "yes"
      when: "always"
  script:
    - |
      UCS_CONTAINER_NAME=$( \
        kubectl -n ${NAMESPACE} get pods --no-headers --selector \
          'app.kubernetes.io/instance=univention-corporate-container' \
        | grep Running \
        | awk '{print $1}' \
      )
      DEFAULT_USER_PASSWORD=$( \
        kubectl -n ${NAMESPACE} describe pod ${UCS_CONTAINER_NAME} \
        | grep DEFAULT_ACCOUNT_USER_PASSWORD \
        | awk '{print $2}' \
      )
      DEFAULT_ADMIN_PASSWORD=$(
        kubectl -n ${NAMESPACE} describe pod ${UCS_CONTAINER_NAME} \
        | grep DEFAULT_ACCOUNT_ADMIN_PASSWORD \
        | awk '{print $2}' \
      )

      curl --request POST \
      --header "Content-Type: application/json" \
      --data "{ \
        \"ref\": \"${UMS_TESTS_BRANCH}\", \
        \"token\": \"${CI_JOB_TOKEN}\", \
        \"variables\": { \
          \"portal_base_url\": \"https://portal.${DOMAIN}\", \
          \"username\": \"${DEFAULT_USER_NAME}\", \
          \"password\": \"${DEFAULT_USER_PASSWORD}\", \
          \"admin_username\": \"${DEFAULT_ADMIN_NAME}\", \
          \"admin_password\": \"${DEFAULT_ADMIN_PASSWORD}\", \
          \"keycloak_base_url\": \"https://id.${DOMAIN}\" \
        } \
      }" \
      "https://${UMS_TESTS_PROJECT_URL}/trigger/pipeline"

generate-release-assets:
  stage: "generate-release-assets"
  image: "registry.souvap-univention.de/souvap/tooling/images/ansible:4.10.0"
  rules:
    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
      when: "always"
    - when: "never"
  script:
    - |
      git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}/${ASSET_GENERATOR_REPO_PATH}
      cd opendesk-asset-generator
      export OPENDESK_DEPLOYMENT_AUTOMATION_PATH=${CI_PROJECT_DIR}
      ./opendesk_asset_generator.py
      mv ./build_artefacts ${CI_PROJECT_DIR}
      cd ..
      rm -rf opendesk-asset-generator
      ls -l ./build_artefacts
  artifacts:
    paths:
      - "./build_artefacts/chart-index.json"
      - "./build_artefacts/image-index.json"
  tags: []
  variables:
    ASSET_GENERATOR_REPO_PATH: "bmi/opendesk/tooling/opendesk-asset-generator"


# Declare .environments which is in environments repository and only loaded when INCLUDE_ENVIRONMENTS_ENABLED not false.
# 'cache' is used because job must contain at least one key, so cache is just a dummy key.
.environments:
  cache: {}

# Overwrite shared settings
.common-semantic-release:
  image: "registry.souvap-univention.de/souvap/tooling/images/semantic-release-patched:latest"
  tags: []

common-yaml-linter:
  rules:
    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|triggers|web|merge_request_event'"
      when: "never"
    - when: "always"

reuse-linter:
  allow_failure: false
  rules:
    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|triggers|web|merge_request_event'"
      when: "never"
    - when: "always"

generate-release-version:
  rules:
    - if: "$JOB_RELEASE_ENABLED != 'false'"
      when: "always"

release:
  dependencies:
    - "generate-release-assets"
  rules:
    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
      when: "always"
  script:
    - |
      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
      {
        "branches": ["main"],
        "plugins": [
          ["@semantic-release/gitlab",
            {
              "assets": [
                { "path": "./build_artefacts/chart-index.json",
                  "label": "Chart Index JSON" },
                { "path": "./build_artefacts/image-index.json",
                  "label": "Image Index JSON" },
              ]
            }
          ],
          "@semantic-release/release-notes-generator",
          "@semantic-release/changelog",
          ["@semantic-release/git", {
            "assets": ["charts/**/Chart.yaml", "CHANGELOG.md", "charts/**/README.md"],
            "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
          }]
        ]
      }
      EOF
    - "semantic-release"
  needs:
    - "generate-release-assets"
...