.gitlab-ci.yml

# ------------------------------------------------------------------------------
# The testing matrix considers ruby/puppet versions supported by SIMP and PE:
#
# https://puppet.com/docs/pe/2019.8/component_versions_in_recent_pe_releases.html
# https://puppet.com/misc/puppet-enterprise-lifecycle
# https://puppet.com/docs/pe/2018.1/overview/getting_support_for_pe.html
# ------------------------------------------------------------------------------
# Release       Puppet   Ruby    EOL
# SIMP 6.4      5.5      2.4.10  TBD
# PE 2018.1     5.5      2.4.10  2021-01 (LTS overlap)
# PE 2019.8     6.18     2.5.7   2022-12 (LTS)
---

stages:
  - 'validation'
  - 'acceptance'
  - 'compliance'
  - 'deployment'

variables:
  # PUPPET_VERSION is a canary variable!
  #
  # The value `UNDEFINED` will (intentionally) cause `bundler install|update` to
  # fail.  The intended value for PUPPET_VERSION is provided by the `pup_#` YAML
  # anchors.  If it is still `UNDEFINED`, all the other setting from the job's
  # anchor are also missing.
  PUPPET_VERSION:    'UNDEFINED' # <- Matrixed jobs MUST override this (or fail)
  BUNDLER_VERSION:   '2.2.19'
  SIMP_MATRIX_LEVEL: '1'
  SIMP_FORCE_RUN_MATRIX: 'no'

  # Force dependencies into a path the gitlab-runner user can write to.
  # (This avoids some failures on Runners with misconfigured ruby environments.)
  GEM_HOME:          .vendor/gem_install
  BUNDLE_CACHE_PATH: .vendor/bundle
  BUNDLE_PATH:       .vendor/bundle
  BUNDLE_BIN:        .vendor/gem_install/bin
  BUNDLE_NO_PRUNE:   'true'

.snippets:
  before_beaker_google:
    # Logic for beaker-google environments
    - echo -e "\e[0Ksection_start:`date +%s`:before_script05[collapsed=true]\r\e[0KGCP environment checks"
    - "if [ \"$BEAKER_HYPERVISOR\" ==  google ]; then mkdir -p ~/.ssh; chmod 700 ~/.ssh; test -f ~/.ssh/google_compute_engine || ssh-keygen -f ~/.ssh/google_compute_engine < /dev/null; echo 'gem \"beaker-google\"' >> Gemfile.local ; fi"
    - echo -e "\e[0Ksection_end:`date +%s`:before_script05\r\e[0K"

  before:
    # Print important environment variables that may affect this job
    - 'ruby -e "puts %(\n\n), %q(=)*80, %(\nSIMP-relevant Environment Variables:\n\n#{e=ENV.keys.grep(/^PUPPET|^SIMP|^BEAKER|MATRIX|GOOGLE/); pad=((e.map{|x| x.size}.max||0)+1); e.map{|v| %(    * #{%(#{v}:).ljust(pad)} #{39.chr + ENV[v] + 39.chr}\n)}.join}\n),  %q(=)*80, %(\n\n)" || :'

    - echo -e "\e[0Ksection_start:`date +%s`:before_script10[collapsed=true]\r\e[0KDiagnostic ruby & gem information"
    # Diagnostic ruby & gem information
    - 'which ruby && ruby --version || :'
    - "[[ $- == *i* ]] && echo 'Interactive shell session' || echo 'Non-interactive shell session'"
    - "shopt -q login_shell && echo 'Login shell' || echo 'Not a login shell'"
    - 'rvm ls || :'
    - echo -e "\e[0Ksection_end:`date +%s`:before_script10\r\e[0K"

    # If RVM is available, make SURE it's using the right Ruby:
    #   * Source rvm (to run in non-login shells)
    #   * If any $MATRIX_RUBY_VERSION rubies are available, use the latest
    #   * Otherwise: install & use ${MATRIX_RUBY_VERSION}-head (e.g., latest)
    #     * ^^ This could be wonky and introduce variations across runners
    #     * ^^ maybe it should just fail if there is no $MATRIX_RUBY_VERSION installed?
    - "command -v rvm && { if declare -p rvm_path &> /dev/null; then source \"${rvm_path}/scripts/rvm\"; else source \"$HOME/.rvm/scripts/rvm\" || source /etc/profile.d/rvm.sh; fi; }"
    - "command -v rvm && { LATEST_RVM_RUBY_XY=\"$(rvm ls | grep \"$MATRIX_RUBY_VERSION\" | tail -1 | sed -e 's/^.*\\([0-9]\\+\\.[0-9]\\+\\.[0-9]\\+\\).*$/\\1/g')\"; if [ -z \"$LATEST_RVM_RUBY_XY\" ]; then LATEST_RVM_RUBY_XY=\"${MATRIX_RUBY_VERSION}-head\"; rvm install \"$LATEST_RVM_RUBY\" --no-docs; else echo \"Found RVM Ruby: '${LATEST_RVM_RUBY_XY}'\"; fi; rvm use \"$LATEST_RVM_RUBY_XY\" ;  }"
    - 'ruby --version || :'
    - 'gem list sync || :'
    - echo -e "\e[0Ksection_end:`date +%s`:before_script20\r\e[0K"

    # Bundle gems (preferring cached > local > downloaded resources)
    #   * Try to use cached and local resources before downloading dependencies
    - echo -e "\e[0Ksection_start:`date +%s`:before_script30[collapsed=true]\r\e[0KBundle gems (preferring cached > local > downloaded resources)"
    - 'declare GEM_BUNDLER_VER=(-v "~> ${BUNDLER_VERSION:-2.2.6}")'
    - 'declare GEM_INSTALL_CMD=(gem install --no-document)'
    - 'declare BUNDLER_INSTALL_CMD=(bundle install --no-binstubs --jobs $(nproc) "${FLAGS[@]}")'
    - 'mkdir -p ${GEM_HOME} ${BUNDLER_BIN}'
    - 'gem list -ie "${GEM_BUNDLER_VER[@]}" --silent bundler || "${GEM_INSTALL_CMD[@]}" --local "${GEM_BUNDLER_VER[@]}" bundler || "${GEM_INSTALL_CMD[@]}" "${GEM_BUNDLER_VER[@]}" bundler'
    - 'rm -rf pkg/ || :'
    - 'bundle check || rm -f Gemfile.lock && ("${BUNDLER_INSTALL_CMD[@]}" --local || "${BUNDLER_INSTALL_CMD[@]}" || bundle pristine ||  "${BUNDLER_INSTALL_CMD[@]}") || { echo "PIPELINE: Bundler could not install everything (see log output above)" && exit 99 ; }'
    - echo -e "\e[0Ksection_end:`date +%s`:before_script30\r\e[0K"

    # Diagnostic bundler, ruby, and gem checks:
    - echo -e "\e[0Ksection_start:`date +%s`:before_script40[collapsed=true]\r\e[0KDiagnostic bundler, ruby, and gem checks"
    - 'bundle exec rvm ls || :'
    - 'bundle exec which ruby || :'
    - 'bundle show sync || :'
    - 'bundle exec gem list sync || :'
    - echo -e "\e[0Ksection_end:`date +%s`:before_script40\r\e[0K"

# bundler dependencies and caching
#
# - Cache bundler gems between pipelines foreach Ruby version
# - Try to use cached and local resources before downloading dependencies
# --------------------------------------
.setup_bundler_env: &setup_bundler_env
  cache:
    key: "${CI_PROJECT_NAMESPACE}_ruby-${MATRIX_RUBY_VERSION}_bundler"
    paths:
      - '.vendor'
  before_script:
    !reference [.snippets, before]


# Assign a matrix level when your test will run.  Heavier jobs get higher numbers
# NOTE: To skip all jobs with a SIMP_MATRIX_LEVEL, set SIMP_MATRIX_LEVEL=0
# ------------------------------------------------------------------------------

.relevant_file_conditions_trigger_spec_tests: &relevant_file_conditions_trigger_spec_tests
  changes:
    - .gitlab-ci.yml
    - .fixtures.yml
    - .rspec
    - metadata.json
    - "spec/spec_helper.rb"
    - "spec/{classes,unit,defines,type_aliases,types,hosts,lib}/**/*.rb"
    - "{SIMP,data,manifests,files,types,lib}/**/*"
    - "templates/**/*.{erb,epp}"
    - "Gemfile"
  exists:
    - "spec/{classes,unit,defines,type_aliases,types,hosts,lib}/**/*_spec.rb"

.relevant_file_conditions_trigger_acceptance_tests: &relevant_file_conditions_trigger_acceptance_tests
  changes:
    - .gitlab-ci.yml
    - .fixtures.yml
    - "spec/spec_helper_acceptance.rb"
    - "spec/acceptance/**/*"
    - "{SIMP,data,manifests,files,types,lib}/**/*"
    - "templates/**/*.{erb,epp}"
    - "Gemfile"
  exists:
    - "spec/acceptance/**/*_spec.rb"

# For some reason, the rule regexes stopped matching line starts inside
# $CI_COMMIT_MESSAGE with carets /^/, so we're using /\n?/ as a workaround.
.skip_job_when_commit_message_says_to: &skip_job_when_commit_message_says_to
  if: '$CI_COMMIT_MESSAGE =~ /\n?CI: (SKIP MATRIX|MATRIX LEVEL 0)/'
  when: never

.force_run_job_when_commit_message_lvl_1_or_above: &force_run_job_when_commit_mssage_lvl_1_or_above
  if: '$CI_COMMIT_MESSAGE =~ /\n?CI: MATRIX LEVEL [123]/'
  when: on_success

.force_run_job_when_commit_message_lvl_2_or_above: &force_run_job_when_commit_mssage_lvl_2_or_above
  if: '$CI_COMMIT_MESSAGE =~ /\n?CI: MATRIX LEVEL [23]/'
  when: on_success

.force_run_job_when_commit_message_lvl_3_or_above: &force_run_job_when_commit_mssage_lvl_3_or_above
  if: '$CI_COMMIT_MESSAGE =~ /\n?CI: MATRIX LEVEL [3]/'
  when: on_success

# check for $CI_PIPELINE_SOURCE needed because this is combined w/when:changes
.run_job_when_level_1_or_above_w_changes: &run_job_when_level_1_or_above_w_changes
  if: '$SIMP_MATRIX_LEVEL =~ /^[123]$/ && $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
  when: on_success

.run_job_when_level_2_or_above_w_changes: &run_job_when_level_2_or_above_w_changes
  if: '$SIMP_MATRIX_LEVEL =~ /^[23]$/ && $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
  when: on_success

.run_job_when_level_3_or_above_w_changes: &run_job_when_level_3_or_above_w_changes
  if: '$SIMP_MATRIX_LEVEL =~ /^[3]$/ && $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
  when: on_success

.force_run_job_when_var_and_lvl_1_or_above: &force_run_job_when_var_and_lvl_1_or_above
  if: '$SIMP_FORCE_RUN_MATRIX == "yes" && $SIMP_MATRIX_LEVEL =~ /^[123]$/'
  when: on_success

.force_run_job_when_var_and_lvl_2_or_above: &force_run_job_when_var_and_lvl_2_or_above
  if: '$SIMP_FORCE_RUN_MATRIX == "yes" && $SIMP_MATRIX_LEVEL =~ /^[23]$/'
  when: on_success

.force_run_job_when_var_and_lvl_3_or_above: &force_run_job_when_var_and_lvl_3_or_above
  if: '$SIMP_FORCE_RUN_MATRIX == "yes" && $SIMP_MATRIX_LEVEL =~ /^[3]$/'
  when: on_success



# SIMP_MATRIX_LEVEL=1: Intended to run every commit
.with_SIMP_ACCEPTANCE_MATRIX_LEVEL_1: &with_SIMP_ACCEPTANCE_MATRIX_LEVEL_1
  rules:
    - <<: *skip_job_when_commit_message_says_to
    - <<: *force_run_job_when_var_and_lvl_1_or_above
    - <<: *force_run_job_when_commit_mssage_lvl_1_or_above
    - <<: *run_job_when_level_1_or_above_w_changes
      <<: *relevant_file_conditions_trigger_acceptance_tests
    - when: never

.with_SIMP_SPEC_MATRIX_LEVEL_1: &with_SIMP_SPEC_MATRIX_LEVEL_1
  rules:
    - <<: *skip_job_when_commit_message_says_to
    - <<: *force_run_job_when_commit_mssage_lvl_1_or_above
    - <<: *force_run_job_when_var_and_lvl_1_or_above
    - <<: *run_job_when_level_1_or_above_w_changes
      <<: *relevant_file_conditions_trigger_spec_tests
    - when: never

# SIMP_MATRIX_LEVEL=2: Resource-heavy or redundant jobs
.with_SIMP_ACCEPTANCE_MATRIX_LEVEL_2: &with_SIMP_ACCEPTANCE_MATRIX_LEVEL_2
  rules:
    - <<: *skip_job_when_commit_message_says_to
    - <<: *force_run_job_when_var_and_lvl_2_or_above
    - <<: *force_run_job_when_commit_mssage_lvl_2_or_above
    - <<: *run_job_when_level_2_or_above_w_changes
      <<: *relevant_file_conditions_trigger_acceptance_tests
    - when: never

.with_SIMP_SPEC_MATRIX_LEVEL_2: &with_SIMP_SPEC_MATRIX_LEVEL_2
  rules:
    - <<: *skip_job_when_commit_message_says_to
    - <<: *force_run_job_when_commit_mssage_lvl_2_or_above
    - <<: *force_run_job_when_var_and_lvl_2_or_above
    - <<: *run_job_when_level_2_or_above_w_changes
      <<: *relevant_file_conditions_trigger_spec_tests
    - when: never

# SIMP_MATRIX_LEVEL=3: Reserved for FULL matrix testing
.with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3: &with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3
  rules:
    - <<: *skip_job_when_commit_message_says_to
    - <<: *force_run_job_when_var_and_lvl_3_or_above
    - <<: *force_run_job_when_commit_mssage_lvl_3_or_above
    - <<: *run_job_when_level_3_or_above_w_changes
      <<: *relevant_file_conditions_trigger_acceptance_tests
    - when: never


# Puppet Versions
#-----------------------------------------------------------------------

.pup_6_x: &pup_6_x
  image: 'ruby:2.5'
  variables:
    PUPPET_VERSION: '~> 6.0'
    BEAKER_PUPPET_COLLECTION: 'puppet6'
    MATRIX_RUBY_VERSION: '2.5'

.pup_6_pe: &pup_6_pe
  image: 'ruby:2.5'
  variables:
    PUPPET_VERSION: '6.22.1'
    BEAKER_PUPPET_COLLECTION: 'puppet6'
    MATRIX_RUBY_VERSION: '2.5'

.pup_7_x: &pup_7_x
  image: 'ruby:2.7'
  variables:
    PUPPET_VERSION: '~> 7.0'
    BEAKER_PUPPET_COLLECTION: 'puppet7'
    MATRIX_RUBY_VERSION: '2.7'

# Testing Environments
#-----------------------------------------------------------------------

.lint_tests: &lint_tests
  stage: 'validation'
  tags: ['docker']
  <<: *setup_bundler_env
  script:
    - 'bundle exec rake syntax'
    - 'bundle exec rake lint'
    - 'bundle exec rake metadata_lint'

.unit_tests: &unit_tests
  stage: 'validation'
  tags: ['docker']
  <<: *setup_bundler_env
  <<: *with_SIMP_SPEC_MATRIX_LEVEL_1
  script:
    - 'bundle exec rake spec'

.beaker: &beaker
  image: ruby:2.7.2  # must be 2.7.2 if running in GCP
  tags:
    - beaker
  before_script:
    - !reference [.snippets, before_beaker_google]
    - !reference [.snippets, before]



.acceptance_base: &acceptance_base
  stage: 'acceptance'
  <<: *setup_bundler_env
  <<: *with_SIMP_ACCEPTANCE_MATRIX_LEVEL_1
  <<: *beaker

.compliance_base: &compliance_base
  stage: 'compliance'
  <<: *setup_bundler_env
  <<: *with_SIMP_ACCEPTANCE_MATRIX_LEVEL_1
  <<: *beaker


# Unit Tests
#-----------------------------------------------------------------------

pup6.x-unit:
  <<: *pup_6_x
  <<: *unit_tests

pup7.x-unit:
  <<: *pup_7_x
  <<: *unit_tests


# Repo-specific content
# ==============================================================================

#=======================================================================
# Packaging test

pup6.x-pkg:
  <<: *pup_6_x
  <<: *unit_tests
  script:
    'bundle exec rake pkg:gem'

pup7.x-pkg:
  <<: *pup_7_x
  <<: *unit_tests
  script:
    'bundle exec rake pkg:gem'

#=======================================================================
# Acceptance tests

# Verify a suite fails when an explicitly-specified nodeset does not exist.
# It is significantly quicker to test here (where rvm is already installed
# and the bundle is configured with this version of simp-beaker-helpers)
# than in an acceptance test with a build user.
default-bad-nodeset:
  <<: *pup_6_x
  <<: *acceptance_base
  script:
    - 'RESULT=`bundle exec rake beaker:suites[default,oops] 1>/dev/null; echo $?`; (test $RESULT == "1")'
    - echo 'beaker:suites correctly failed with unknown nodeset'

default:
  <<: *pup_6_x
  <<: *acceptance_base
  script:
    - bundle exec rake beaker:suites[default]

default-amzn2:
  <<: *pup_6_x
  <<: *acceptance_base
  script:
    - bundle exec rake beaker:suites[default,amzn2]

default-fips:
  <<: *pup_6_x
  <<: *acceptance_base
  script:
    - BEAKER_fips=yes bundle exec rake beaker:suites[default]

fips_from_fixtures:
  <<: *pup_6_x
  <<: *acceptance_base
  script:
    - bundle exec rake beaker:suites[fips_from_fixtures]

puppet6_collections:
  <<: *pup_6_x
  <<: *acceptance_base
  script:
    - bundle exec rake beaker:suites[puppet_collections]

puppet7_collections:
  <<: *pup_7_x
  <<: *acceptance_base
  script:
    - bundle exec rake beaker:suites[puppet_collections]

oel_ssg:
  <<: *pup_6_x
  <<: *acceptance_base
  script:
    - bundle exec rake beaker:suites[ssg,oel]

windows:
  <<: *pup_6_x
  <<: *acceptance_base
  allow_failure: true
  script:
    - bundle exec rake beaker:suites[windows]

snapshot:
  <<: *pup_6_x
  <<: *acceptance_base
  # This is prone to breakage in the underlying system
  allow_failure: true
  script:
    - BEAKER_simp_snapshot=yes bundle exec rake beaker:suites[snapshot]