config.yml

# https://circleci.com/docs/2.0/configuration-reference/

# NB https://circleci.com/docs/2.0/configuration-reference/#default-shell-options:
#  * CircleCI explicitly sets `set -eo pipefail`, which several of this project's
#    `run` steps rely on. The construct of `<failing-command> | <decorator-command>`
#    is used throughout, and needs to be present in any shell environment this
#    workflow evolves into.

version: 2.1

jobs:

  install_and_update_dependencies:
    docker:
    - image: cimg/python:3.12
    working_directory: ~/repo
    steps:
    - checkout
    - restore_cache:
        keys:
        - v8-dependencies-{{ checksum "Pipfile.lock" }}
    - run: &install-pipenv pip install -U pipenv "urllib3<=2.0" pip --quiet --no-input
    - run: pipenv sync --categories "api dev-packages frontend"
      #- run: pipenv run pipenv check # before save_cache so an insecure cache is never saved
    - run: make lambda-layers/FrontendDependenciesLayer/requirements.txt
    - run: pipenv run collectstatic
    - run: pipenv run make aggregator/apps/api_docs/v1/templates/api_docs_rendered.html APP_IS_BEHIND_CLOUDFRONT=True
    - persist_to_workspace:
        root: ~/repo/
        paths:
          - lambda-layers/FrontendDependenciesLayer/requirements.txt
          - aggregator/apps/api_docs/v1/templates/api_docs_rendered.html
          - frontend/static_files/
    - save_cache:
        when: on_success
        paths:
        - ~/.local/share/virtualenvs/
        key: v8-dependencies-{{ checksum "Pipfile.lock" }}

  test:
    docker:
    - image: cimg/python:3.12
    working_directory: ~/repo
    steps:
    - checkout
    - restore_cache:
        keys:
        - v8-dependencies-{{ checksum "Pipfile.lock" }}
    - run: *install-pipenv
    - run: pipenv run pipenv verify
    - run: pipenv run ruff-check
    - run: pipenv run djhtml --check .
    - run: pipenv run pytest --ruff --cov-report= --cov=frontend --cov=api --junitxml=test-results/junit.xml
    - run: |
        if [ -n "$COVERALLS_REPO_TOKEN" ]; then
          pipenv run coveralls
        else
          echo "skipping coverage for forked PR"
        fi
    - store_artifacts:
        path: test-results
        destination: test-results
    - store_test_results:
        path: test-results

  sam_build:
    docker:
    - image: public.ecr.aws/sam/build-python3.12:latest
    working_directory: ~/repo
    steps:
    - checkout
    - attach_workspace:
        at: ~/repo/
    - run: pip install --upgrade pip pipenv
    - run: sam build ${DASH_DASH_DEBUG}
    - persist_to_workspace:
        root: ~/repo/
        paths: [ .aws-sam/build/ ]

  sam_deploy:
    docker:
    - image: public.ecr.aws/sam/build-python3.12:latest
    working_directory: ~/repo/
    parameters:
      dc-environment:
        type: enum
        enum: [ development, staging, production ]
      dc-django-settings-module:
        type: string
    environment:
      DJANGO_SETTINGS_MODULE: "<<parameters.dc-django-settings-module>>"
      SAM_CONFIG_FILE: samconfig.toml.d/ci-<<parameters.dc-environment>>.toml
      SAM_LAMBDA_CONFIG_ENV: <<parameters.dc-environment>>
      SAM_PUBLIC_CONFIG_ENV: <<parameters.dc-environment>>-public-access
      DC_ENVIRONMENT: <<parameters.dc-environment>>
    steps:
    - checkout
    - attach_workspace:
        at: ~/repo/
    - restore_cache:
        keys:
        - v8-dependencies-{{ checksum "Pipfile.lock" }}
    - run: printenv DJANGO_SETTINGS_MODULE SAM_CONFIG_FILE SAM_LAMBDA_CONFIG_ENV SAM_PUBLIC_CONFIG_ENV
    - run: printenv SECRET_KEY | md5sum
    - run: printenv AWS_ACCESS_KEY_ID | md5sum
    - run:
        name: printenv DEVS_DC_API_KEY
          # These envvars are stored inside CircleCI, which helpfully masks them if they're echoed.
          # This command errors if the envvar isn't set, which is intentional. We don't want to
          # /start/ deploying if we can't test the API immediately afterwards.
        command: |
          #
          # NB Do *not* copy any of these string values!
          #  -> In order to make them visible inside CircleCI, a null character
          #  -> has been inserted between characters 1 and 2, which may have
          #  -> unintended consequences if you copy & paste them.
          #
          printenv DEVS_DC_API_KEY | sed -E 's/^(.)(.)/\1\x00\2/'

    - run:
        name: "pipenv run sam deploy # App: Lambda + API Gateway"
        command: |
          sam deploy ${DASH_DASH_DEBUG} \
            --config-file ~/repo/${SAM_CONFIG_FILE} \
            --config-env $SAM_LAMBDA_CONFIG_ENV \
            --template-file ~/repo/.aws-sam/build/template.yaml \
            --parameter-overrides " \
               AppDjangoSettingsModule=$DJANGO_SETTINGS_MODULE \
               AppSecretKey='$SECRET_KEY' \
               AppSentryDSN='$SENTRY_DSN' \
               AppIsBehindCloudFront=True \
               AppLogRetentionDays=60 \
               DCEnvironment=$DC_ENVIRONMENT \

              "

    - run:
        name: "Migrate database"
        command: |
          AWS_REGION=eu-west-2 aws lambda invoke --function-name ApiFrontendManagementFunction --payload '{ "command": "migrate", "args": ["--no-input"] }' --cli-binary-format raw-in-base64-out -

    - run:
        name:   "Install test dependencies"
        command: pip install -r .circleci/tests/requirements.txt
    - run:
        name:   "pytest .circleci/tests/system/test_app_via_api_gateway.py # Smoke test Lambda deployment"
        command: pytest -vrA --disable-warnings .circleci/tests/system/test_app_via_api_gateway.py

    - run:
        name: printenv PUBLIC_FQDN CERTIFICATE_ARN
          # These envvars are stored inside CircleCI, which helpfully masks them if they're echoed.
        command: |
          #
          # NB Do *not* copy any of these string values!
          #  -> In order to make them visible inside CircleCI, a null character
          #  -> has been inserted between characters 1 and 2, which may have
          #  -> unintended consequences if you copy & paste them.
          #
          printenv PUBLIC_FQDN CERTIFICATE_ARN | sed -E 's/^(.)(.)/\1\x00\2/'

    - run:
        name: "sam deploy # Public access: CDN + DNS"
        no_output_timeout: 20m # CloudFront can take longer than CircleCI's 10m default
        command: |
          sam deploy ${DASH_DASH_DEBUG} \
            --config-file ~/repo/${SAM_CONFIG_FILE} \
            --config-env $SAM_PUBLIC_CONFIG_ENV \
            --template-file ~/repo/public-access-template.yaml \
            --parameter-overrides " \
               StackNameSuffix=<<parameters.dc-environment>> \
               CertificateArn=$CERTIFICATE_ARN \
               PublicFqdn=$PUBLIC_FQDN \
              "

    - run:
        name:   "pytest .circleci/tests/system/ # Smoke test CDN+DNS deployment"
        command: pytest -vrA --disable-warnings .circleci/tests/system/

workflows:
  version: 2
  test_build_deploy:
    jobs:

    - install_and_update_dependencies

    - test:
        requires:
        - install_and_update_dependencies # tests need installed dev package set

    - sam_build:
        requires:
        - install_and_update_dependencies # FrontendDependenciesLayer build needs lambda-layers/FrontendDependenciesLayer/requirements.txt
        - test

    # This deployment tracks the tip of the main branch in Github. It is not intended
    # to block staging (hence production) deployments: staging is the testing ground for
    # production. This deployment is intended to give developers a target in their main
    # AWS account that they can debug against, read its logs, etc, without having to escalate
    # their access to the staging account. This deployment should not be modified manually,
    # but only through commits which also reach staging and then production.
    # This deployment doesn't wait on the `test` job to succeed.
    - sam_deploy:
        name: sam_deploy_development
        dc-environment: development
        dc-django-settings-module: frontend.settings.lambda_no_debug_merged_assets
        requires:
        - install_and_update_dependencies # SAM CLI is in the dev package set
        - sam_build                       # deploy needs .aws-sam/build/
        context: [ deployment-development-aggregator-api ]

    - sam_deploy:
        name: sam_deploy_staging
        dc-environment: staging
        dc-django-settings-module: frontend.settings.lambda_no_debug_merged_assets
        requires:
        - install_and_update_dependencies # SAM CLI is in the dev package set
        - test                            # staging should only deploy if tests pass
        - sam_build                       # deploy needs .aws-sam/build/
        context: [ deployment-staging-aggregator-api ]
        filters: { branches: { only: [ main, master ] } }

    - sam_deploy:
        name: sam_deploy_production
        dc-environment: production
        dc-django-settings-module: frontend.settings.lambda_no_debug_merged_assets
        requires:
        - install_and_update_dependencies # SAM CLI is in the dev package set
        - test                            # production should only deploy if tests pass
        - sam_build                       # deploy needs .aws-sam/build/
        - sam_deploy_staging              # production should only deploy if staging deploys successfully
        context: [ deployment-production-aggregator-api ]
        filters: { branches: { only: [ main, master ] } }