ldc-ker-chant/.gitlab-ci.yml

variables:
    KUBERNETES_CLUSTER_NAME: prod-k8s-ldc-web
    KUBERNETES_VERSION: 1.29.2

include:
  - project: "ldc-web/shared-ci"
    ref: "main"
    file: "lint/lint.yml"
  - project: "ldc-web/shared-ci"
    ref: "main"
    file: "security/security.yml"
  - project: "ldc-web/shared-ci"
    ref: "main"
    file: "test/test.yml"

composer_vendor:
  stage: deps
  image: composer:2.10
  cache:
    key:
      files:
        - composer.lock
    paths:
      - vendor/
    policy: pull-push
  before_script:
    - composer config gitlab-token.lab.s-web.fr "${CI_DEPLOY_USER}" "${CI_DEPLOY_PASSWORD}"
  script:
    - composer install --ignore-platform-reqs --no-interaction --no-plugins --no-scripts --no-dev --prefer-dist
  artifacts:
    paths:
      - vendor/
    expire_in: 1h
  dependencies:
    - composer-security
  needs:
    - job: composer-security
      optional: true

frontend_build:
  stage: deps
  image: node:24.11
  cache:
    key:
      files:
        - package-lock.json
    paths:
      - node_modules/
    policy: pull-push
  variables:
    VITE_APP_NAME: "${APP_APP_NAME}"
  before_script:
    - npm config set @ldc-web:registry https://lab.s-web.fr/api/v4/packages/npm/
    - npm config set -- '//lab.s-web.fr/api/v4/packages/npm/:_authToken' "${GITLAB_PASSWORD}"
    - npm config set @uwil:registry https://lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/
    - npm config set -- '//lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/:_authToken' "${GITLAB_PASSWORD}"
  script:
    - mkdir -p public/build && mkdir -p bootstrap/ssr
    - npm ci --no-audit --no-fund --loglevel=error
    - npm run prod
  artifacts:
    paths:
      - public/build/
      - bootstrap/ssr/
    expire_in: 1h
  dependencies:
    - npm-security
  needs:
    - job: npm-security
      optional: true

.docker-build:
  interruptible: true
  stage: build
  image:
    name: martizih/kaniko:v1.27.4-debug
    entrypoint: [""]
  script:
    - >-
      /kaniko/executor
      --context "${CI_PROJECT_DIR}"
      --dockerfile "${DOCKERFILE}"
      --destination "${IMAGE_TAG}"
      --destination "${IMAGE_LATEST_TAG}"
      --cache=true
      --cache-ttl=24h
      --snapshot-mode=redo
      --use-new-run
      --build-arg GITLAB_USER="${CI_DEPLOY_USER}"
      --build-arg GITLAB_PASSWORD="${CI_DEPLOY_PASSWORD}"
      --build-arg PHP_8_5_TAG="${PHP_8_5_TAG}"
  allow_failure: false
  needs:
    - job: composer_vendor
      artifacts: true
    - job: frontend_build
      artifacts: true

docker-build:staging:
  extends: .docker-build
  environment:
    name: staging
    action: prepare
  variables:
    DOCKERFILE: "${CI_PROJECT_DIR}/Dockerfile"
    IMAGE_TAG: "${CI_REGISTRY_IMAGE}:staging-${CI_COMMIT_SHA}"
    IMAGE_LATEST_TAG: "${CI_REGISTRY_IMAGE}:staging-latest"
  rules:
    - if: $CI_COMMIT_BRANCH == "trunk"

docker-build:latest:
  extends: .docker-build
  environment:
    name: production
    action: prepare
  variables:
    DOCKERFILE: "${CI_PROJECT_DIR}/Dockerfile"
    IMAGE_TAG: "${CI_REGISTRY_IMAGE}:production-${CI_COMMIT_SHA}"
    IMAGE_LATEST_TAG: "${CI_REGISTRY_IMAGE}:production-latest"
  rules:
    - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "master"

ssr-docker-build:staging:
  extends: .docker-build
  environment:
    name: staging
    action: prepare
  variables:
    DOCKERFILE: "${CI_PROJECT_DIR}/Dockerfile.ssr"
    IMAGE_TAG: "${CI_REGISTRY_IMAGE}:staging-ssr-${CI_COMMIT_SHA}"
    IMAGE_LATEST_TAG: "${CI_REGISTRY_IMAGE}:staging-ssr-latest"
  rules:
    - if: $CI_COMMIT_BRANCH == "trunk"

ssr-docker-build:latest:
  extends: .docker-build
  environment:
    name: production
    action: prepare
  variables:
    DOCKERFILE: "${CI_PROJECT_DIR}/Dockerfile.ssr"
    IMAGE_TAG: "${CI_REGISTRY_IMAGE}:production-ssr-${CI_COMMIT_SHA}"
    IMAGE_LATEST_TAG: "${CI_REGISTRY_IMAGE}:production-ssr-latest"
  rules:
    - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "master"

.kubernetes:
    stage: deploy
    image:
        name: "alpine/k8s:${KUBERNETES_VERSION}"
        entrypoint: ['']
    variables:
        KUBE_CONTEXT: "ldc-web/cluster-k8s:${KUBERNETES_CLUSTER_NAME}"
        KUBE_NAMESPACE: default
        CRT_TLS_NAME: "wildcard-k8s-ldc"
        REDIRECT:
    before_script:
        - kubectl config use-context ${KUBE_CONTEXT}
    script:
        - envsubst < manifest.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -

.kubernetes_stop:
    extends: .kubernetes
    script:
        - envsubst < manifest.yaml | kubectl delete --namespace ${KUBE_NAMESPACE} -f -
    when: manual
    environment:
        action: stop

kubernetes:staging:
    extends: .kubernetes
    variables:
        KUBE_NAMESPACE: staging
        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:staging-${CI_COMMIT_SHA}"
        SSR_IMAGE_TAG: "${CI_REGISTRY_IMAGE}:staging-ssr-${CI_COMMIT_SHA}"
    needs:
        - job: docker-build:staging
        - job: ssr-docker-build:staging
    rules:
        - if: $CI_COMMIT_BRANCH == "trunk"
    script:
        - envsubst < manifest.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -
        - envsubst < staging-resources.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -
    when: manual
    environment:
        name: staging
        url: https://${DOMAIN}
        on_stop: kubernetes_stop:staging

kubernetes_stop:staging:
    extends: .kubernetes_stop
    variables:
        KUBE_NAMESPACE: staging
    rules:
        - if: $CI_COMMIT_BRANCH == "trunk"
    environment:
        name: staging


kubernetes:prod:
    extends: .kubernetes
    variables:
        KUBE_NAMESPACE: production
        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:production-${CI_COMMIT_SHA}"
        SSR_IMAGE_TAG: "${CI_REGISTRY_IMAGE}:production-ssr-${CI_COMMIT_SHA}"
        CRT_TLS_NAME: "${APP_DOMAIN}"
        REDIRECT: "www."
    needs:
        - job: docker-build:latest
        - job: ssr-docker-build:latest
    rules:
        - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "master"
    script:
        - envsubst < manifest.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -
        - envsubst < production-resources.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -
    when: manual
    environment:
        name: production
        url: https://${DOMAIN}

stages:
  - lint
  - security
  - deps
  - build
  - test
  - deploy