.gitlab-ci.yml

# ------------------------------------------------------------------------------
# The testing matrix considers ruby/puppet versions supported by SIMP and PE:
#
# https://puppet.com/docs/pe/2019.8/component_versions_in_recent_pe_releases.html
# https://puppet.com/misc/puppet-enterprise-lifecycle
# https://puppet.com/docs/pe/2018.1/overview/getting_support_for_pe.html
# ------------------------------------------------------------------------------
# Release       Puppet   Ruby    EOL
# PE 2019.8     6.28     2.5.7   2023-07 (LTS)
# PE 2021.7     7.20     2.7.6   TBD (LTS)
---

stages:
  - 'validation'
  - 'acceptance'
  - 'deployment'

variables:
  # PUPPET_VERSION is a canary variable!
  #
  # The value `UNDEFINED` will (intentionally) cause `bundler install|update` to
  # fail.  The intended value for PUPPET_VERSION is provided by the `pup_#` YAML
  # anchors.  If it is still `UNDEFINED`, all the other setting from the job's
  # anchor are also missing.
  PUPPET_VERSION:    'UNDEFINED' # <- Matrixed jobs MUST override this (or fail)
  BUNDLER_VERSION:   '2.2.19'
  SIMP_MATRIX_LEVEL: '1'
  SIMP_FORCE_RUN_MATRIX: 'no'

  # Force dependencies into a path the gitlab-runner user can write to.
  # (This avoids some failures on Runners with misconfigured ruby environments.)
  GEM_HOME:          .vendor/gem_install
  BUNDLE_CACHE_PATH: .vendor/bundle
  BUNDLE_PATH:       .vendor/bundle
  BUNDLE_BIN:        .vendor/gem_install/bin
  BUNDLE_NO_PRUNE:   'true'

.snippets:
  before_beaker_google:
    # Logic for beaker-google environments
    - echo -e "\e[0Ksection_start:`date +%s`:before_script05[collapsed=true]\r\e[0KGCP environment checks"
    - "if [ \"$BEAKER_HYPERVISOR\" ==  google ]; then mkdir -p ~/.ssh; chmod 700 ~/.ssh; test -f ~/.ssh/google_compute_engine || ssh-keygen -f ~/.ssh/google_compute_engine < /dev/null; echo 'gem \"beaker-google\"' >> Gemfile.local ; fi"
    - echo -e "\e[0Ksection_end:`date +%s`:before_script05\r\e[0K"

  before:
    # Print important environment variables that may affect this job
    - 'ruby -e "puts %(\n\n), %q(=)*80, %(\nSIMP-relevant Environment Variables:\n\n#{e=ENV.keys.grep(/^PUPPET|^SIMP|^BEAKER|MATRIX/); pad=((e.map{|x| x.size}.max||0)+1); e.map{|v| %(    * #{%(#{v}:).ljust(pad)} #{39.chr + ENV[v] + 39.chr}\n)}.join}\n),  %q(=)*80, %(\n\n)" || :'

    - echo -e "\e[0Ksection_start:`date +%s`:before_script10[collapsed=true]\r\e[0KDiagnostic ruby & gem information"
    # Diagnostic ruby & gem information
    - 'which ruby && ruby --version || :'
    - "[[ $- == *i* ]] && echo 'Interactive shell session' || echo 'Non-interactive shell session'"
    - "shopt -q login_shell && echo 'Login shell' || echo 'Not a login shell'"
    - 'rvm ls || :'
    - echo -e "\e[0Ksection_end:`date +%s`:before_script10\r\e[0K"

    # If RVM is available, make SURE it's using the right Ruby:
    #   * Source rvm (to run in non-login shells)
    #   * Use $MATRIX_RUBY_VERSION ruby, install if not present
    - echo -e "\e[0Ksection_start:`date +%s`:before_script20[collapsed=true]\r\e[0KEnsure RVM & ruby is installed"
    - "if command -v rvm; then if declare -p rvm_path &> /dev/null; then source \"${rvm_path}/scripts/rvm\"; else source \"$HOME/.rvm/scripts/rvm\" || source /etc/profile.d/rvm.sh; fi; fi"
    - "if command -v rvm && ! grep rvm_install_on_use_flag=1 ~/.rvmrc; then echo rvm_install_on_use_flag=1 >> ~/.rvmrc || echo '== WARNING: ~/.rvmrc is missing rvm_install_on_use_flag=1 and I failed to add it'; fi"
    - "if command -v rvm; then rvm use \"$MATRIX_RUBY_VERSION\"; else echo \"rvm not detected; skipping 'rvm use'\"; fi"
    - 'ruby --version || :'
    - 'gem list sync || :'
    - echo -e "\e[0Ksection_end:`date +%s`:before_script20\r\e[0K"

    # Bundle gems (preferring cached > local > downloaded resources)
    #   * Try to use cached and local resources before downloading dependencies
    - echo -e "\e[0Ksection_start:`date +%s`:before_script30[collapsed=true]\r\e[0KBundle gems (preferring cached > local > downloaded resources)"
    - 'declare GEM_BUNDLER_VER=(-v "~> ${BUNDLER_VERSION:-2.2.6}")'
    - 'declare GEM_INSTALL_CMD=(gem install --no-document)'
    - 'declare BUNDLER_INSTALL_CMD=(bundle install --no-binstubs --jobs $(nproc) "${FLAGS[@]}")'
    - 'mkdir -p ${GEM_HOME} ${BUNDLER_BIN}'
    - 'gem list -ie "${GEM_BUNDLER_VER[@]}" --silent bundler || "${GEM_INSTALL_CMD[@]}" --local "${GEM_BUNDLER_VER[@]}" bundler || "${GEM_INSTALL_CMD[@]}" "${GEM_BUNDLER_VER[@]}" bundler'
    - 'rm -rf pkg/ || :'
    - 'bundle check || rm -f Gemfile.lock && ("${BUNDLER_INSTALL_CMD[@]}" --local || "${BUNDLER_INSTALL_CMD[@]}" || bundle pristine ||  "${BUNDLER_INSTALL_CMD[@]}") || { echo "PIPELINE: Bundler could not install everything (see log output above)" && exit 99 ; }'
    - echo -e "\e[0Ksection_end:`date +%s`:before_script30\r\e[0K"

    # Diagnostic bundler, ruby, and gem checks:
    - echo -e "\e[0Ksection_start:`date +%s`:before_script40[collapsed=true]\r\e[0KDiagnostic bundler, ruby, and gem checks"
    - 'bundle exec rvm ls || :'
    - 'bundle exec which ruby || :'
    - 'bundle show sync || :'
    - 'bundle exec gem list sync || :'
    - echo -e "\e[0Ksection_end:`date +%s`:before_script40\r\e[0K"

# bundler dependencies and caching
#
# - Cache bundler gems between pipelines foreach Ruby version
# - Try to use cached and local resources before downloading dependencies
# --------------------------------------
.setup_bundler_env: &setup_bundler_env
  cache:
    key: "${CI_PROJECT_NAMESPACE}_ruby-${MATRIX_RUBY_VERSION}_bundler"
    paths:
      - '.vendor'
  before_script:
    !reference [.snippets, before]


# Assign a matrix level when your test will run.  Heavier jobs get higher numbers
# NOTE: To skip all jobs with a SIMP_MATRIX_LEVEL, set SIMP_MATRIX_LEVEL=0

.relevant_file_conditions_trigger_spec_tests: &relevant_file_conditions_trigger_spec_tests
  changes:
    - .gitlab-ci.yml
    - .fixtures.yml
    - "spec/spec_helper.rb"
    - "spec/{bin,lib,test_utils}/**/*.rb"
    - "{bin,ext,lib}/**/*"
    - "Gemfile"
  exists:
    - "spec/{lib,bin}/**/*_spec.rb"

.relevant_file_conditions_trigger_acceptance_tests: &relevant_file_conditions_trigger_acceptance_tests
  changes:
    - .gitlab-ci.yml
    - .fixtures.yml
    - "spec/spec_helper_acceptance.rb"
    - "spec/{acceptance,support}/**/*"
    - "{bin,ext,lib}/**/*"
    - "Gemfile"
  exists:
    - "spec/acceptance/**/*_spec.rb"

# For some reason, the rule regexes stopped matching line starts inside
# $CI_COMMIT_MESSAGE with carets /^/, so we're using /\n?/ as a workaround.
.skip_job_when_commit_message_says_to: &skip_job_when_commit_message_says_to
  if: '$CI_COMMIT_MESSAGE =~ /\n?CI: (SKIP MATRIX|MATRIX LEVEL 0)/'
  when: never

.force_run_job_when_commit_message_lvl_1_or_above: &force_run_job_when_commit_mssage_lvl_1_or_above
  if: '$CI_COMMIT_MESSAGE =~ /\n?CI: MATRIX LEVEL [123]/'
  when: on_success

.force_run_job_when_commit_message_lvl_2_or_above: &force_run_job_when_commit_mssage_lvl_2_or_above
  if: '$CI_COMMIT_MESSAGE =~ /\n?CI: MATRIX LEVEL [23]/'
  when: on_success

.force_run_job_when_commit_message_lvl_3_or_above: &force_run_job_when_commit_mssage_lvl_3_or_above
  if: '$CI_COMMIT_MESSAGE =~ /\n?CI: MATRIX LEVEL [3]/'
  when: on_success

# check for $CI_PIPELINE_SOURCE needed because this is combined w/when:changes
.run_job_when_level_1_or_above_w_changes: &run_job_when_level_1_or_above_w_changes
  if: '$SIMP_MATRIX_LEVEL =~ /^[123]$/ && $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
  when: on_success

.run_job_when_level_2_or_above_w_changes: &run_job_when_level_2_or_above_w_changes
  if: '$SIMP_MATRIX_LEVEL =~ /^[23]$/ && $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
  when: on_success

.run_job_when_level_3_or_above_w_changes: &run_job_when_level_3_or_above_w_changes
  if: '$SIMP_MATRIX_LEVEL =~ /^[3]$/ && $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
  when: on_success

.force_run_job_when_var_and_lvl_1_or_above: &force_run_job_when_var_and_lvl_1_or_above
  if: '$SIMP_FORCE_RUN_MATRIX == "yes" && $SIMP_MATRIX_LEVEL =~ /^[123]$/'
  when: on_success

.force_run_job_when_var_and_lvl_2_or_above: &force_run_job_when_var_and_lvl_2_or_above
  if: '$SIMP_FORCE_RUN_MATRIX == "yes" && $SIMP_MATRIX_LEVEL =~ /^[23]$/'
  when: on_success

.force_run_job_when_var_and_lvl_3_or_above: &force_run_job_when_var_and_lvl_3_or_above
  if: '$SIMP_FORCE_RUN_MATRIX == "yes" && $SIMP_MATRIX_LEVEL =~ /^[3]$/'
  when: on_success



# SIMP_MATRIX_LEVEL=1: Intended to run every commit
.with_SIMP_ACCEPTANCE_MATRIX_LEVEL_1: &with_SIMP_ACCEPTANCE_MATRIX_LEVEL_1
  rules:
    - <<: *skip_job_when_commit_message_says_to
    - <<: *force_run_job_when_var_and_lvl_1_or_above
    - <<: *force_run_job_when_commit_mssage_lvl_1_or_above
    - <<: *run_job_when_level_1_or_above_w_changes
      <<: *relevant_file_conditions_trigger_acceptance_tests
    - when: never

.with_SIMP_SPEC_MATRIX_LEVEL_1: &with_SIMP_SPEC_MATRIX_LEVEL_1
  rules:
    - <<: *skip_job_when_commit_message_says_to
    - <<: *force_run_job_when_commit_mssage_lvl_1_or_above
    - <<: *force_run_job_when_var_and_lvl_1_or_above
    - <<: *run_job_when_level_1_or_above_w_changes
      <<: *relevant_file_conditions_trigger_spec_tests
    - when: never

# SIMP_MATRIX_LEVEL=2: Resource-heavy or redundant jobs
.with_SIMP_ACCEPTANCE_MATRIX_LEVEL_2: &with_SIMP_ACCEPTANCE_MATRIX_LEVEL_2
  rules:
    - <<: *skip_job_when_commit_message_says_to
    - <<: *force_run_job_when_var_and_lvl_2_or_above
    - <<: *force_run_job_when_commit_mssage_lvl_2_or_above
    - <<: *run_job_when_level_2_or_above_w_changes
      <<: *relevant_file_conditions_trigger_acceptance_tests
    - when: never

.with_SIMP_SPEC_MATRIX_LEVEL_2: &with_SIMP_SPEC_MATRIX_LEVEL_2
  rules:
    - <<: *skip_job_when_commit_message_says_to
    - <<: *force_run_job_when_commit_mssage_lvl_2_or_above
    - <<: *force_run_job_when_var_and_lvl_2_or_above
    - <<: *run_job_when_level_2_or_above_w_changes
      <<: *relevant_file_conditions_trigger_spec_tests
    - when: never

# SIMP_MATRIX_LEVEL=3: Reserved for FULL matrix testing
.with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3: &with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3
  rules:
    - <<: *skip_job_when_commit_message_says_to
    - <<: *force_run_job_when_var_and_lvl_3_or_above
    - <<: *force_run_job_when_commit_mssage_lvl_3_or_above
    - <<: *run_job_when_level_3_or_above_w_changes
      <<: *relevant_file_conditions_trigger_acceptance_tests
    - when: never


# Puppet Versions
#-----------------------------------------------------------------------

.pup_7_x: &pup_7_x
  image: 'ruby:2.7'
  variables:
    PUPPET_VERSION: '~> 7.0'
    BEAKER_PUPPET_COLLECTION: 'puppet7'
    MATRIX_RUBY_VERSION: '2.7'

.pup_7_pe: &pup_7_pe
  image: 'ruby:2.7'
  variables:
    PUPPET_VERSION: '7.21.0'
    BEAKER_PUPPET_COLLECTION: 'puppet7'
    MATRIX_RUBY_VERSION: '2.7'

.pup_8_x: &pup_8_x
  image: 'ruby:3.2'
  variables:
    PUPPET_VERSION: '~> 8.0'
    BEAKER_PUPPET_COLLECTION: 'puppet8'
    MATRIX_RUBY_VERSION: '3.2'



# Testing Environments
#-----------------------------------------------------------------------

.unit_tests: &unit_tests
  stage: 'validation'
  tags: ['docker']
  <<: *setup_bundler_env
  <<: *with_SIMP_SPEC_MATRIX_LEVEL_1
  script:
    # simp cli code uses libpwquality or cracklib to validate passwords and
    # rsync in simp environment commands
    - 'if `hash apt-get`; then apt-get update; fi'
    - 'if `hash apt-get`; then apt-get install -y rpm cracklib-runtime openssl libicu-dev rsync; fi'
    # simp cli needs to be able to get the default route using the 'ip' command
    - 'if `hash apt-get`; then apt-get install -y iproute2; fi'
    # simp config uses grub2-mkpasswd-pbkdf2 when encrypting a GRUB password,
    # but the command has a different name on Ubuntu
    - 'if `hash apt-get`; then apt-get install -y grub-common; fi'
    - 'if `hash apt-get`; then ln -s /usr/bin/grub-mkpasswd-pbkdf2 /usr/bin/grub2-mkpasswd-pbkdf2 ; fi'
    # simp cli code fetches USER env variable.  In the docker container USER is
    # not available, but the process is running as root.
    - 'USER=root bundle exec rake spec'

.acceptance_base: &acceptance_base
  stage: 'acceptance'
  tags: ['beaker']
  <<: *setup_bundler_env
  <<: *with_SIMP_ACCEPTANCE_MATRIX_LEVEL_1

# Pipeline / testing matrix
#=======================================================================

releng_checks:
  <<: *pup_7_x
  <<: *setup_bundler_env
  stage: 'validation'
  tags: ['docker']
  script:
    - 'command -v rpm || if command -v apt-get; then apt-get update; apt-get install -y rpm; fi ||:'
    - 'command -v rpm || { >&2 echo "FATAL: Cannot find executable: ''rpm''";  exit 1 ;}'
    - 'bundle exec rake pkg:check_version'
    - 'bundle exec rake pkg:compare_latest_tag'
    - 'bundle exec rake pkg:create_tag_changelog'
    - 'bundle exec rake pkg:gem'


# Unit Tests
#-----------------------------------------------------------------------

pup7.x-unit:
  <<: *pup_7_x
  <<: *unit_tests
  <<: *with_SIMP_SPEC_MATRIX_LEVEL_2

pup7.pe-unit:
  <<: *pup_7_pe
  <<: *unit_tests

pup8.x-unit:
  <<: *pup_8_x
  <<: *unit_tests


# Acceptance tests
# ==============================================================================
pup7.pe:
  <<: *pup_7_pe
  <<: *acceptance_base
  <<: *with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3
  script:
    - 'bundle exec rake beaker:suites[default,default]'

pup7.pe_config:
  <<: *pup_7_pe
  <<: *acceptance_base
  <<: *with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3
  script:
    - 'bundle exec rake beaker:suites[config,default]'

pup7.pe_simp_kv:
  <<: *pup_7_pe
  <<: *acceptance_base
  <<: *with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3
  script:
    - 'bundle exec rake beaker:suites[simp_kv,default]'

pup7.x:
  <<: *pup_7_x
  <<: *acceptance_base
  script:
    - 'bundle exec rake beaker:suites[default,default]'

pup7.x-fips:
  <<: *pup_7_x
  <<: *acceptance_base
  <<: *with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3
  script:
    - 'BEAKER_fips=yes bundle exec rake beaker:suites[default,default]'

pup7.x_centos8:
  <<: *pup_7_x
  <<: *acceptance_base
  script:
    - 'bundle exec rake beaker:suites[default,centos8]'

# puppetserver RPMs do not yet install on EL8 because the RPM digest
# algorithm used is MD5
pup7.x_centos8-fips:
  <<: *pup_7_x
  <<: *acceptance_base
  allow_failure: true
  script:
    - 'BEAKER_fips=yes bundle exec rake beaker:suites[default,centos8]'


pup7.x_config:
  <<: *pup_7_x
  <<: *acceptance_base
  <<: *with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3
  script:
    - 'bundle exec rake beaker:suites[config,default]'

pup7.x_config_centos8:
  <<: *pup_7_x
  <<: *acceptance_base
  script:
    - 'bundle exec rake beaker:suites[config,centos8]'

# puppetserver RPMs do not yet install on EL8 because the RPM digest
# algorithm used is MD5
pup7.x_config_centos8-fips:
  <<: *pup_7_x
  <<: *acceptance_base
  <<: *with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3
  allow_failure: true
  script:
    - 'BEAKER_fips=yes bundle exec rake beaker:suites[config,centos8]'

pup7.x_simp_kv:
  <<: *pup_7_x
  <<: *acceptance_base
  <<: *with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3
  script:
    - 'bundle exec rake beaker:suites[simp_kv,default]'

pup7.x_simp_kv-fips:
  <<: *pup_7_x
  <<: *acceptance_base
  <<: *with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3
  script:
    - 'BEAKER_fips=yes bundle exec rake beaker:suites[simp_kv,default]'

pup7.x_simp_kv_centos8:
  <<: *pup_7_x
  <<: *acceptance_base
  script:
    - 'bundle exec rake beaker:suites[simp_kv,centos8]'

pup8.x_centos8:
  <<: *pup_8_x
  <<: *acceptance_base
  script:
    - 'bundle exec rake beaker:suites[default,centos8]'

pup8.x_config_centos8:
  <<: *pup_8_x
  <<: *acceptance_base
  script:
    - 'bundle exec rake beaker:suites[config,centos8]'

pup8.x_simp_kv_centos8:
  <<: *pup_8_x
  <<: *acceptance_base
  script:
    - 'bundle exec rake beaker:suites[simp_kv,centos8]'