@catladder/pipeline 1.159.0 → 1.160.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (108) hide show
  1. package/dist/bundles/catladder-gitlab/index.js +1 -1
  2. package/dist/constants.js +1 -1
  3. package/examples/.test-gen-ignore +1 -0
  4. package/examples/__snapshots__/{cloud-run-memory-limit.ts.snap → cloud-run-memory-limit.test.ts.snap} +1 -1
  5. package/examples/__snapshots__/{cloud-run-meteor-with-worker.ts.snap → cloud-run-meteor-with-worker.test.ts.snap} +1 -1
  6. package/examples/__snapshots__/{cloud-run-no-cpu-throttling.ts.snap → cloud-run-no-cpu-throttling.test.ts.snap} +1 -1
  7. package/examples/__snapshots__/{cloud-run-no-service.ts.snap → cloud-run-no-service.test.ts.snap} +1 -1
  8. package/examples/__snapshots__/{cloud-run-non-public.ts.snap → cloud-run-non-public.test.ts.snap} +1 -1
  9. package/examples/__snapshots__/{cloud-run-post-stop-job.ts.snap → cloud-run-post-stop-job.test.ts.snap} +1 -1
  10. package/examples/__snapshots__/{cloud-run-service-gen2.ts.snap → cloud-run-service-gen2.test.ts.snap} +1 -1
  11. package/examples/__snapshots__/{cloud-run-service-increase-timout.ts.snap → cloud-run-service-increase-timout.test.ts.snap} +1 -1
  12. package/examples/__snapshots__/{cloud-run-service-with-volumes.ts.snap → cloud-run-service-with-volumes.test.ts.snap} +1 -1
  13. package/examples/__snapshots__/{cloud-run-storybook.ts.snap → cloud-run-storybook.test.ts.snap} +1 -1
  14. package/examples/__snapshots__/{cloud-run-with-ngnix.ts.snap → cloud-run-with-ngnix.test.ts.snap} +1 -1
  15. package/examples/__snapshots__/{cloud-run-with-sql-reuse-db.ts.snap → cloud-run-with-sql-reuse-db.test.ts.snap} +1 -1
  16. package/examples/__snapshots__/{cloud-run-with-sql.ts.snap → cloud-run-with-sql.test.ts.snap} +1 -1
  17. package/examples/__snapshots__/{cloud-run-with-worker.ts.snap → cloud-run-with-worker.test.ts.snap} +1 -1
  18. package/examples/__snapshots__/{custom-build-job-with-tests.ts.snap → custom-build-job-with-tests.test.ts.snap} +1 -1
  19. package/examples/__snapshots__/{custom-build-job.ts.snap → custom-build-job.test.ts.snap} +1 -1
  20. package/examples/__snapshots__/{custom-deploy.ts.snap → custom-deploy.test.ts.snap} +1 -1
  21. package/examples/__snapshots__/{custom-envs.ts.snap → custom-envs.test.ts.snap} +1 -1
  22. package/examples/__snapshots__/{custom-sbom-java.ts.snap → custom-sbom-java.test.ts.snap} +1 -1
  23. package/examples/__snapshots__/{git-submodule.ts.snap → git-submodule.test.ts.snap} +1 -1
  24. package/examples/__snapshots__/{kubernetes-application-customization.ts.snap → kubernetes-application-customization.test.ts.snap} +1 -1
  25. package/examples/__snapshots__/{kubernetes-with-cloud-sql-legacy.ts.snap → kubernetes-with-cloud-sql-legacy.test.ts.snap} +1 -1
  26. package/examples/__snapshots__/{kubernetes-with-cloud-sql.ts.snap → kubernetes-with-cloud-sql.test.ts.snap} +1 -1
  27. package/examples/__snapshots__/{kubernetes-with-jobs.ts.snap → kubernetes-with-jobs.test.ts.snap} +1 -1
  28. package/examples/__snapshots__/{kubernetes-with-mongodb.ts.snap → kubernetes-with-mongodb.test.ts.snap} +1 -1
  29. package/examples/__snapshots__/{local-dot-env.ts.snap → local-dot-env.test.ts.snap} +1 -1
  30. package/examples/__snapshots__/{meteor-kubernetes.ts.snap → meteor-kubernetes.test.ts.snap} +1 -1
  31. package/examples/__snapshots__/{multiline-var.ts.snap → multiline-var.test.ts.snap} +1 -1
  32. package/examples/__snapshots__/{native-app.ts.snap → native-app.test.ts.snap} +1 -1
  33. package/examples/__snapshots__/{node-build-with-custom-image.ts.snap → node-build-with-custom-image.test.ts.snap} +1 -1
  34. package/examples/__snapshots__/{node-build-with-docker-additions.ts.snap → node-build-with-docker-additions.test.ts.snap} +1 -1
  35. package/examples/__snapshots__/rails-k8s-with-worker-dockerfile.test.ts.snap +2011 -0
  36. package/examples/__snapshots__/rails-k8s-with-worker.test.ts.snap +1995 -0
  37. package/examples/__snapshots__/{wait-for-other-deploy.ts.snap → wait-for-other-deploy.test.ts.snap} +1 -1
  38. package/examples/cloud-run-memory-limit.test.ts +10 -0
  39. package/examples/cloud-run-memory-limit.ts +2 -4
  40. package/examples/cloud-run-meteor-with-worker.test.ts +10 -0
  41. package/examples/cloud-run-meteor-with-worker.ts +2 -4
  42. package/examples/cloud-run-no-cpu-throttling.test.ts +10 -0
  43. package/examples/cloud-run-no-cpu-throttling.ts +2 -4
  44. package/examples/cloud-run-no-service.test.ts +10 -0
  45. package/examples/cloud-run-no-service.ts +1 -4
  46. package/examples/cloud-run-non-public.test.ts +10 -0
  47. package/examples/cloud-run-non-public.ts +1 -4
  48. package/examples/cloud-run-post-stop-job.test.ts +10 -0
  49. package/examples/cloud-run-post-stop-job.ts +2 -4
  50. package/examples/cloud-run-service-gen2.test.ts +10 -0
  51. package/examples/cloud-run-service-gen2.ts +2 -4
  52. package/examples/cloud-run-service-increase-timout.test.ts +10 -0
  53. package/examples/cloud-run-service-increase-timout.ts +2 -4
  54. package/examples/cloud-run-service-with-volumes.test.ts +10 -0
  55. package/examples/cloud-run-service-with-volumes.ts +2 -4
  56. package/examples/cloud-run-storybook.test.ts +10 -0
  57. package/examples/cloud-run-storybook.ts +1 -4
  58. package/examples/cloud-run-with-ngnix.test.ts +10 -0
  59. package/examples/cloud-run-with-ngnix.ts +1 -4
  60. package/examples/cloud-run-with-sql-reuse-db.test.ts +10 -0
  61. package/examples/cloud-run-with-sql-reuse-db.ts +1 -4
  62. package/examples/cloud-run-with-sql.test.ts +10 -0
  63. package/examples/cloud-run-with-sql.ts +2 -4
  64. package/examples/cloud-run-with-worker.test.ts +10 -0
  65. package/examples/cloud-run-with-worker.ts +2 -4
  66. package/examples/custom-build-job-with-tests.test.ts +10 -0
  67. package/examples/custom-build-job-with-tests.ts +1 -4
  68. package/examples/custom-build-job.test.ts +10 -0
  69. package/examples/custom-build-job.ts +1 -4
  70. package/examples/custom-deploy.test.ts +10 -0
  71. package/examples/custom-deploy.ts +1 -4
  72. package/examples/custom-envs.test.ts +10 -0
  73. package/examples/custom-envs.ts +1 -4
  74. package/examples/custom-sbom-java.test.ts +10 -0
  75. package/examples/custom-sbom-java.ts +1 -4
  76. package/examples/git-submodule.test.ts +10 -0
  77. package/examples/git-submodule.ts +1 -4
  78. package/examples/kubernetes-application-customization.test.ts +10 -0
  79. package/examples/kubernetes-application-customization.ts +2 -4
  80. package/examples/kubernetes-with-cloud-sql-legacy.test.ts +10 -0
  81. package/examples/kubernetes-with-cloud-sql-legacy.ts +2 -4
  82. package/examples/kubernetes-with-cloud-sql.test.ts +10 -0
  83. package/examples/kubernetes-with-cloud-sql.ts +2 -4
  84. package/examples/kubernetes-with-jobs.test.ts +10 -0
  85. package/examples/kubernetes-with-jobs.ts +2 -4
  86. package/examples/kubernetes-with-mongodb.test.ts +10 -0
  87. package/examples/kubernetes-with-mongodb.ts +2 -4
  88. package/examples/local-dot-env.test.ts +10 -0
  89. package/examples/local-dot-env.ts +2 -4
  90. package/examples/meteor-kubernetes.test.ts +10 -0
  91. package/examples/meteor-kubernetes.ts +0 -5
  92. package/examples/multiline-var.test.ts +10 -0
  93. package/examples/multiline-var.ts +1 -4
  94. package/examples/native-app.test.ts +10 -0
  95. package/examples/native-app.ts +2 -4
  96. package/examples/node-build-with-custom-image.test.ts +10 -0
  97. package/examples/node-build-with-custom-image.ts +1 -4
  98. package/examples/node-build-with-docker-additions.test.ts +10 -0
  99. package/examples/node-build-with-docker-additions.ts +1 -4
  100. package/examples/rails-k8s-with-worker-dockerfile.test.ts +9 -0
  101. package/examples/rails-k8s-with-worker.test.ts +10 -0
  102. package/examples/rails-k8s-with-worker.ts +1 -11
  103. package/examples/wait-for-other-deploy.test.ts +10 -0
  104. package/examples/wait-for-other-deploy.ts +1 -4
  105. package/package.json +5 -2
  106. package/scripts/generate-examples-test.ts +91 -0
  107. package/scripts/tsconfig.json +7 -0
  108. package/examples/__snapshots__/rails-k8s-with-worker.ts.snap +0 -4005
package/examples/__snapshots__/rails-k8s-with-worker.test.ts.snap ADDED
@@ -0,0 +1,1995 @@
1
+ // Jest Snapshot v1, https://goo.gl/fbAQLP
2
+
3
+ exports[`matches snapshot for rails-k8s-with-worker 1`] = `
4
+ {
5
+ "mainBranch": {
6
+ "image": "path/to/docker/jobs-default:the-version",
7
+ "jobs": {
8
+ "app ↩️ Rollback ⚠️ | dev ": {
9
+ "allow_failure": true,
10
+ "artifacts": {
11
+ "reports": {
12
+ "dotenv": "gitlab_environment.env",
13
+ },
14
+ },
15
+ "environment": {
16
+ "action": "access",
17
+ "name": "dev/app",
18
+ "url": "$CL_GITLAB_ENVIRONMENT_URL",
19
+ },
20
+ "image": "path/to/docker/kubernetes:the-version",
21
+ "interruptible": true,
22
+ "needs": [],
23
+ "retry": {
24
+ "max": 2,
25
+ "when": [
26
+ "runner_system_failure",
27
+ "stuck_or_timeout_failure",
28
+ ],
29
+ },
30
+ "rules": [
31
+ {
32
+ "when": "manual",
33
+ },
34
+ ],
35
+ "script": [
36
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
37
+ "export ENV_SHORT="dev"",
38
+ "export APP_DIR="."",
39
+ "export ENV_TYPE="dev"",
40
+ "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
41
+ "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
42
+ "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
43
+ "export ROOT_URL="https://app.dev.test-app.pan.panter.cloud"",
44
+ "export HOST_INTERNAL="app.dev.test-app.pan.panter.cloud"",
45
+ "export HOST_CANONICAL="app.dev.test-app.pan.panter.cloud"",
46
+ "export ROOT_URL_INTERNAL="https://app.dev.test-app.pan.panter.cloud"",
47
+ "export KUBE_NAMESPACE="pan-test-app-dev"",
48
+ "export KUBE_APP_NAME="app"",
49
+ "export KUBE_APP_NAME_PREFIX=""",
50
+ "export SECRET_KEY_BASE="$CL_dev_app_SECRET_KEY_BASE"",
51
+ "export POSTGRESQL_PASSWORD="$CL_dev_app_POSTGRESQL_PASSWORD"",
52
+ "export cloudsqlProxyCredentials="$CL_dev_app_cloudsqlProxyCredentials"",
53
+ "export RAILS_ENV="production"",
54
+ "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"SECRET_KEY_BASE\\",\\"POSTGRESQL_PASSWORD\\",\\"cloudsqlProxyCredentials\\",\\"RAILS_ENV\\"]"",
55
+ "export RELEASE_NAME="pan-test-app-dev-app"",
56
+ "export HELM_EXPERIMENTAL_OCI="1"",
57
+ "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-app"",
58
+ "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
59
+ "export HELM_ARGS=""",
60
+ "export COMPONENT_NAME="app"",
61
+ "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
62
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
63
+ "kubectl config set-cluster "kube-pan-test-app-dev-app" --server="$CL_dev_app_KUBE_URL" --certificate-authority <(echo $CL_dev_app_KUBE_CA_PEM | base64 -d) --embed-certs=true",
64
+ "kubectl config set-credentials "kube-pan-test-app-dev-app" --token="$CL_dev_app_KUBE_TOKEN"",
65
+ "kubectl config set-context "kube-pan-test-app-dev-app" --cluster="kube-pan-test-app-dev-app" --user="kube-pan-test-app-dev-app" --namespace="pan-test-app-dev"",
66
+ "kubectl config use-context "kube-pan-test-app-dev-app"",
67
+ "kubernetesRollback",
68
+ "echo "CL_GITLAB_ENVIRONMENT_URL=https://app.dev.test-app.pan.panter.cloud" >> gitlab_environment.env",
69
+ ],
70
+ "stage": "rollback dev",
71
+ "variables": {
72
+ "GIT_STRATEGY": "none",
73
+ "KUBERNETES_CPU_REQUEST": "0.22",
74
+ "KUBERNETES_MEMORY_LIMIT": "400Mi",
75
+ "KUBERNETES_MEMORY_REQUEST": "200Mi",
76
+ },
77
+ },
78
+ "app 👮 lint": {
79
+ "cache": {
80
+ "key": {
81
+ "files": [
82
+ "Gemfile.lock",
83
+ ],
84
+ "prefix": "$CI_JOB_IMAGE",
85
+ },
86
+ "paths": [
87
+ "tmp/cache",
88
+ ],
89
+ },
90
+ "image": "ruby:3.2.1",
91
+ "interruptible": true,
92
+ "needs": [],
93
+ "retry": {
94
+ "max": 2,
95
+ "when": [
96
+ "runner_system_failure",
97
+ "stuck_or_timeout_failure",
98
+ ],
99
+ },
100
+ "script": [
101
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
102
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
103
+ "cd .",
104
+ "bundle config set path 'tmp/cache'",
105
+ "bundle install -j $(nproc)",
106
+ "bundle exec rubocop",
107
+ ],
108
+ "stage": "test",
109
+ "variables": {},
110
+ },
111
+ "app 🔨 docker | dev ": {
112
+ "image": "path/to/docker/docker-build:the-version",
113
+ "interruptible": true,
114
+ "needs": [],
115
+ "retry": {
116
+ "max": 2,
117
+ "when": [
118
+ "runner_system_failure",
119
+ "stuck_or_timeout_failure",
120
+ ],
121
+ },
122
+ "script": [
123
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
124
+ "export APP_DIR="."",
125
+ "export DOCKER_BUILD_CONTEXT="."",
126
+ "export DOCKER_REGISTRY="$CI_REGISTRY"",
127
+ "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/app"",
128
+ "export DOCKER_IMAGE_NAME="dev/app"",
129
+ "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
130
+ "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
131
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
132
+ "docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY",
133
+ "cd .",
134
+ "docker pull $DOCKER_CACHE_IMAGE || true",
135
+ "wget --output-document=- https://github.com/buildpacks/pack/releases/download/v0.32.1/pack-v0.32.1-linux.tgz | tar -zx --directory /usr/local/bin pack",
136
+ "chmod +x /usr/local/bin/pack",
137
+ "sed --in-place 's|git@\\([^:]*\\):|https://\\1/|g' Gemfile Gemfile.lock",
138
+ "pack build "$DOCKER_IMAGE:$DOCKER_IMAGE_TAG" --builder 'heroku/builder:22' --publish --cache-image "$DOCKER_CACHE_IMAGE" --env 'SECRET_KEY_BASE=dummy-value' ",
139
+ ],
140
+ "services": [
141
+ {
142
+ "command": [
143
+ "--tls=false",
144
+ ],
145
+ "name": "docker:24.0.6-dind",
146
+ },
147
+ ],
148
+ "stage": "build",
149
+ "variables": {
150
+ "DOCKER_BUILDKIT": "1",
151
+ "DOCKER_DRIVER": "overlay2",
152
+ "DOCKER_HOST": "tcp://0.0.0.0:2375",
153
+ "DOCKER_TLS_CERTDIR": "",
154
+ "KUBERNETES_CPU_REQUEST": "0.45",
155
+ "KUBERNETES_MEMORY_LIMIT": "2Gi",
156
+ "KUBERNETES_MEMORY_REQUEST": "1Gi",
157
+ },
158
+ },
159
+ "app 🚀 Deploy | dev ": {
160
+ "allow_failure": false,
161
+ "artifacts": {
162
+ "reports": {
163
+ "dotenv": "gitlab_environment.env",
164
+ },
165
+ },
166
+ "environment": {
167
+ "auto_stop_in": "4 weeks",
168
+ "name": "dev/app",
169
+ "on_stop": "app 🛑 Stop ⚠️ | dev ",
170
+ "url": "$CL_GITLAB_ENVIRONMENT_URL",
171
+ },
172
+ "image": "path/to/docker/kubernetes:the-version",
173
+ "interruptible": true,
174
+ "needs": [
175
+ {
176
+ "artifacts": false,
177
+ "job": "app 👮 lint",
178
+ },
179
+ {
180
+ "artifacts": false,
181
+ "job": "app 🔨 docker | dev ",
182
+ },
183
+ {
184
+ "artifacts": false,
185
+ "job": "app 🧪 test",
186
+ },
187
+ {
188
+ "artifacts": true,
189
+ "job": "app 🧾 sbom | dev ",
190
+ },
191
+ {
192
+ "artifacts": false,
193
+ "job": "app 🛡 audit",
194
+ },
195
+ ],
196
+ "retry": {
197
+ "max": 2,
198
+ "when": [
199
+ "runner_system_failure",
200
+ "stuck_or_timeout_failure",
201
+ ],
202
+ },
203
+ "rules": [
204
+ {
205
+ "when": "on_success",
206
+ },
207
+ ],
208
+ "script": [
209
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
210
+ "export ENV_SHORT="dev"",
211
+ "export APP_DIR="."",
212
+ "export ENV_TYPE="dev"",
213
+ "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
214
+ "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
215
+ "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
216
+ "export ROOT_URL="https://app.dev.test-app.pan.panter.cloud"",
217
+ "export HOST_INTERNAL="app.dev.test-app.pan.panter.cloud"",
218
+ "export HOST_CANONICAL="app.dev.test-app.pan.panter.cloud"",
219
+ "export ROOT_URL_INTERNAL="https://app.dev.test-app.pan.panter.cloud"",
220
+ "export KUBE_NAMESPACE="pan-test-app-dev"",
221
+ "export KUBE_APP_NAME="app"",
222
+ "export KUBE_APP_NAME_PREFIX=""",
223
+ "export SECRET_KEY_BASE="$CL_dev_app_SECRET_KEY_BASE"",
224
+ "export POSTGRESQL_PASSWORD="$CL_dev_app_POSTGRESQL_PASSWORD"",
225
+ "export cloudsqlProxyCredentials="$CL_dev_app_cloudsqlProxyCredentials"",
226
+ "export RAILS_ENV="production"",
227
+ "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"SECRET_KEY_BASE\\",\\"POSTGRESQL_PASSWORD\\",\\"cloudsqlProxyCredentials\\",\\"RAILS_ENV\\"]"",
228
+ "export DOCKER_REGISTRY="$CI_REGISTRY"",
229
+ "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/app"",
230
+ "export DOCKER_IMAGE_NAME="dev/app"",
231
+ "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
232
+ "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
233
+ "export RELEASE_NAME="pan-test-app-dev-app"",
234
+ "export HELM_EXPERIMENTAL_OCI="1"",
235
+ "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-app"",
236
+ "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
237
+ "export HELM_ARGS=""",
238
+ "export COMPONENT_NAME="app"",
239
+ "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
240
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
241
+ "kubectl config set-cluster "kube-pan-test-app-dev-app" --server="$CL_dev_app_KUBE_URL" --certificate-authority <(echo $CL_dev_app_KUBE_CA_PEM | base64 -d) --embed-certs=true",
242
+ "kubectl config set-credentials "kube-pan-test-app-dev-app" --token="$CL_dev_app_KUBE_TOKEN"",
243
+ "kubectl config set-context "kube-pan-test-app-dev-app" --cluster="kube-pan-test-app-dev-app" --user="kube-pan-test-app-dev-app" --namespace="pan-test-app-dev"",
244
+ "kubectl config use-context "kube-pan-test-app-dev-app"",
245
+ "echo -e "\\e[0Ksection_start:$(date +%s):writeallvalues[collapsed=true]\\r\\e[0KWrite __all_values.yml for helm deployment"",
246
+ "cat > __all_values.yml <<EOF
247
+ env:
248
+ secret:
249
+ SECRET_KEY_BASE: |-
250
+ $(printf %s "$CL_dev_app_SECRET_KEY_BASE" | sed 's/^/ /')
251
+ POSTGRESQL_PASSWORD: |-
252
+ $(printf %s "$CL_dev_app_POSTGRESQL_PASSWORD" | sed 's/^/ /')
253
+ cloudsqlProxyCredentials: |-
254
+ $(printf %s "$CL_dev_app_cloudsqlProxyCredentials" | sed 's/^/ /')
255
+ public:
256
+ ENV_SHORT: |-
257
+ dev
258
+ APP_DIR: |-
259
+ .
260
+ ENV_TYPE: |-
261
+ dev
262
+ BUILD_INFO_BUILD_ID: |-
263
+ $(printf %s "$(git describe --tags 2>/dev/null || git rev-parse HEAD)" | sed 's/^/ /')
264
+ BUILD_INFO_BUILD_TIME: |-
265
+ $(printf %s "$CI_JOB_STARTED_AT" | sed 's/^/ /')
266
+ BUILD_INFO_CURRENT_VERSION: |-
267
+ $(printf %s "$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")" | sed 's/^/ /')
268
+ ROOT_URL: |-
269
+ https://app.dev.test-app.pan.panter.cloud
270
+ HOST_INTERNAL: |-
271
+ app.dev.test-app.pan.panter.cloud
272
+ HOST_CANONICAL: |-
273
+ app.dev.test-app.pan.panter.cloud
274
+ ROOT_URL_INTERNAL: |-
275
+ https://app.dev.test-app.pan.panter.cloud
276
+ KUBE_NAMESPACE: |-
277
+ pan-test-app-dev
278
+ KUBE_APP_NAME: |-
279
+ app
280
+ KUBE_APP_NAME_PREFIX: ""
281
+ RAILS_ENV: |-
282
+ production
283
+ _ALL_ENV_VAR_KEYS: |-
284
+ ["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_BUILD_ID","BUILD_INFO_BUILD_TIME","BUILD_INFO_CURRENT_VERSION","ROOT_URL","HOST_INTERNAL","HOST_CANONICAL","ROOT_URL_INTERNAL","KUBE_NAMESPACE","KUBE_APP_NAME","KUBE_APP_NAME_PREFIX","SECRET_KEY_BASE","POSTGRESQL_PASSWORD","cloudsqlProxyCredentials","RAILS_ENV"]
285
+ application:
286
+ host: |-
287
+ app.dev.test-app.pan.panter.cloud
288
+ command: |-
289
+ /cnb/process/web
290
+ livenessProbe:
291
+ httpGet:
292
+ path: |-
293
+ __health
294
+ readinessProbe:
295
+ httpGet:
296
+ path: |-
297
+ __health
298
+ startupProbe:
299
+ httpGet:
300
+ path: |-
301
+ __health
302
+ worker:
303
+ enabled: true
304
+ command: |-
305
+ launcher bundle exec rake jobs:work
306
+ livenessProbe: false
307
+ cloudsql:
308
+ enabled: true
309
+ dbUser: |-
310
+ postgres
311
+ instanceConnectionName: |-
312
+ some-project-id:europe-west6:pan-test-app-dev
313
+ proxyCredentials: |-
314
+ $CL_dev_app_cloudsqlProxyCredentials
315
+ fullDbName: |-
316
+ app
317
+ projectId: |-
318
+ some-project-id
319
+ jobs:
320
+ db-migrate:
321
+ hook: |-
322
+ post-install,post-upgrade
323
+ command: |-
324
+ launcher bundle exec rake db:migrate
325
+
326
+ EOF
327
+ ",
328
+ "echo -e "\\e[0Ksection_end:$(date +%s):writeallvalues\\r\\e[0K"",
329
+ "kubernetesCreateSecret",
330
+ "kubernetesDeploy",
331
+ "echo 'Uploading SBOM to Dependency Track'",
332
+ "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-test-app/app" "https://app.dev.test-app.pan.panter.cloud" "__sbom.json" vex.json || true",
333
+ "echo deployment successful 😻",
334
+ "echo "CL_GITLAB_ENVIRONMENT_URL=https://app.dev.test-app.pan.panter.cloud" >> gitlab_environment.env",
335
+ ],
336
+ "stage": "deploy dev",
337
+ "variables": {
338
+ "KUBERNETES_CPU_REQUEST": "0.22",
339
+ "KUBERNETES_MEMORY_LIMIT": "400Mi",
340
+ "KUBERNETES_MEMORY_REQUEST": "200Mi",
341
+ },
342
+ },
343
+ "app 🛑 Stop ⚠️ | dev ": {
344
+ "allow_failure": true,
345
+ "artifacts": {
346
+ "reports": {
347
+ "dotenv": "gitlab_environment.env",
348
+ },
349
+ },
350
+ "environment": {
351
+ "action": "stop",
352
+ "name": "dev/app",
353
+ "url": "$CL_GITLAB_ENVIRONMENT_URL",
354
+ },
355
+ "image": "path/to/docker/kubernetes:the-version",
356
+ "interruptible": true,
357
+ "needs": [],
358
+ "retry": {
359
+ "max": 2,
360
+ "when": [
361
+ "runner_system_failure",
362
+ "stuck_or_timeout_failure",
363
+ ],
364
+ },
365
+ "rules": [
366
+ {
367
+ "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+\\.([0-9]+|x)\\.x$/",
368
+ "when": "on_success",
369
+ },
370
+ {
371
+ "when": "manual",
372
+ },
373
+ ],
374
+ "script": [
375
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
376
+ "export ENV_SHORT="dev"",
377
+ "export APP_DIR="."",
378
+ "export ENV_TYPE="dev"",
379
+ "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
380
+ "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
381
+ "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
382
+ "export ROOT_URL="https://app.dev.test-app.pan.panter.cloud"",
383
+ "export HOST_INTERNAL="app.dev.test-app.pan.panter.cloud"",
384
+ "export HOST_CANONICAL="app.dev.test-app.pan.panter.cloud"",
385
+ "export ROOT_URL_INTERNAL="https://app.dev.test-app.pan.panter.cloud"",
386
+ "export KUBE_NAMESPACE="pan-test-app-dev"",
387
+ "export KUBE_APP_NAME="app"",
388
+ "export KUBE_APP_NAME_PREFIX=""",
389
+ "export SECRET_KEY_BASE="$CL_dev_app_SECRET_KEY_BASE"",
390
+ "export POSTGRESQL_PASSWORD="$CL_dev_app_POSTGRESQL_PASSWORD"",
391
+ "export cloudsqlProxyCredentials="$CL_dev_app_cloudsqlProxyCredentials"",
392
+ "export RAILS_ENV="production"",
393
+ "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"SECRET_KEY_BASE\\",\\"POSTGRESQL_PASSWORD\\",\\"cloudsqlProxyCredentials\\",\\"RAILS_ENV\\"]"",
394
+ "export RELEASE_NAME="pan-test-app-dev-app"",
395
+ "export HELM_EXPERIMENTAL_OCI="1"",
396
+ "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-app"",
397
+ "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
398
+ "export HELM_ARGS=""",
399
+ "export COMPONENT_NAME="app"",
400
+ "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
401
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
402
+ "kubectl config set-cluster "kube-pan-test-app-dev-app" --server="$CL_dev_app_KUBE_URL" --certificate-authority <(echo $CL_dev_app_KUBE_CA_PEM | base64 -d) --embed-certs=true",
403
+ "kubectl config set-credentials "kube-pan-test-app-dev-app" --token="$CL_dev_app_KUBE_TOKEN"",
404
+ "kubectl config set-context "kube-pan-test-app-dev-app" --cluster="kube-pan-test-app-dev-app" --user="kube-pan-test-app-dev-app" --namespace="pan-test-app-dev"",
405
+ "kubectl config use-context "kube-pan-test-app-dev-app"",
406
+ "kubernetesDelete",
407
+ "echo 'Disabling component in Dependency Track'",
408
+ "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-test-app/app" "https://app.dev.test-app.pan.panter.cloud" || true",
409
+ "echo "CL_GITLAB_ENVIRONMENT_URL=https://app.dev.test-app.pan.panter.cloud" >> gitlab_environment.env",
410
+ ],
411
+ "stage": "stop dev",
412
+ "variables": {
413
+ "GIT_STRATEGY": "none",
414
+ "KUBERNETES_CPU_REQUEST": "0.22",
415
+ "KUBERNETES_MEMORY_LIMIT": "400Mi",
416
+ "KUBERNETES_MEMORY_REQUEST": "200Mi",
417
+ },
418
+ },
419
+ "app 🛡 audit": {
420
+ "allow_failure": true,
421
+ "image": "ruby:3.2.1",
422
+ "interruptible": true,
423
+ "needs": [],
424
+ "retry": {
425
+ "max": 2,
426
+ "when": [
427
+ "runner_system_failure",
428
+ "stuck_or_timeout_failure",
429
+ ],
430
+ },
431
+ "script": [
432
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
433
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
434
+ "cd .",
435
+ "gem install bundler-audit",
436
+ "bundle audit check",
437
+ ],
438
+ "stage": "test",
439
+ "variables": {},
440
+ },
441
+ "app 🧪 test": {
442
+ "cache": {
443
+ "key": {
444
+ "files": [
445
+ "Gemfile.lock",
446
+ ],
447
+ "prefix": "$CI_JOB_IMAGE",
448
+ },
449
+ "paths": [
450
+ "tmp/cache",
451
+ ],
452
+ },
453
+ "image": "ruby:3.2.1",
454
+ "interruptible": true,
455
+ "needs": [],
456
+ "retry": {
457
+ "max": 2,
458
+ "when": [
459
+ "runner_system_failure",
460
+ "stuck_or_timeout_failure",
461
+ ],
462
+ },
463
+ "script": [
464
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
465
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
466
+ "cd .",
467
+ "bundle config set path 'tmp/cache'",
468
+ "bundle install -j $(nproc)",
469
+ "bundle exec rspec",
470
+ ],
471
+ "stage": "test",
472
+ "variables": {},
473
+ },
474
+ "app 🧾 sbom | dev ": {
475
+ "allow_failure": true,
476
+ "artifacts": {
477
+ "paths": [
478
+ "__sbom.json",
479
+ ],
480
+ },
481
+ "image": "aquasec/trivy:0.38.3",
482
+ "interruptible": true,
483
+ "needs": [],
484
+ "retry": {
485
+ "max": 2,
486
+ "when": [
487
+ "runner_system_failure",
488
+ "stuck_or_timeout_failure",
489
+ ],
490
+ },
491
+ "script": [
492
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
493
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
494
+ "trivy fs --quiet --format cyclonedx --output "__sbom.json" .",
495
+ ],
496
+ "stage": "build",
497
+ "variables": {},
498
+ },
499
+ },
500
+ "stages": [
501
+ "setup",
502
+ "setup dev",
503
+ "setup review",
504
+ "setup stage",
505
+ "setup prod",
506
+ "test",
507
+ "test dev",
508
+ "test review",
509
+ "test stage",
510
+ "test prod",
511
+ "build",
512
+ "build dev",
513
+ "build review",
514
+ "build stage",
515
+ "build prod",
516
+ "deploy",
517
+ "deploy dev",
518
+ "deploy review",
519
+ "deploy stage",
520
+ "deploy prod",
521
+ "verify",
522
+ "verify dev",
523
+ "verify review",
524
+ "verify stage",
525
+ "verify prod",
526
+ "rollback",
527
+ "rollback dev",
528
+ "rollback review",
529
+ "rollback stage",
530
+ "rollback prod",
531
+ "stop",
532
+ "stop dev",
533
+ "stop review",
534
+ "stop stage",
535
+ "stop prod",
536
+ ],
537
+ "variables": {
538
+ "ARTIFACT_COMPRESSION_LEVEL": "fast",
539
+ "CACHE_COMPRESSION_LEVEL": "fast",
540
+ "FF_USE_FASTZIP": "true",
541
+ "GIT_DEPTH": "1",
542
+ "TRANSFER_METER_FREQUENCY": "5s",
543
+ },
544
+ "workflow": {
545
+ "rules": [
546
+ {
547
+ "if": "$CI_COMMIT_TAG",
548
+ },
549
+ {
550
+ "if": "$CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/",
551
+ "when": "never",
552
+ },
553
+ {
554
+ "if": "$CI_PIPELINE_SOURCE == "schedule"",
555
+ "when": "never",
556
+ },
557
+ {
558
+ "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+.([0-9]+|x).x$/",
559
+ },
560
+ {
561
+ "if": "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH",
562
+ },
563
+ {
564
+ "if": "$CI_MERGE_REQUEST_ID",
565
+ },
566
+ ],
567
+ },
568
+ },
569
+ "mr": {
570
+ "image": "path/to/docker/jobs-default:the-version",
571
+ "jobs": {
572
+ "app ↩️ Rollback ⚠️ | review ": {
573
+ "allow_failure": true,
574
+ "artifacts": {
575
+ "reports": {
576
+ "dotenv": "gitlab_environment.env",
577
+ },
578
+ },
579
+ "environment": {
580
+ "action": "access",
581
+ "name": "review/$CI_COMMIT_REF_NAME/app",
582
+ "url": "$CL_GITLAB_ENVIRONMENT_URL",
583
+ },
584
+ "image": "path/to/docker/kubernetes:the-version",
585
+ "interruptible": true,
586
+ "needs": [],
587
+ "retry": {
588
+ "max": 2,
589
+ "when": [
590
+ "runner_system_failure",
591
+ "stuck_or_timeout_failure",
592
+ ],
593
+ },
594
+ "rules": [
595
+ {
596
+ "when": "manual",
597
+ },
598
+ ],
599
+ "script": [
600
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
601
+ "export ENV_SHORT="review"",
602
+ "export APP_DIR="."",
603
+ "export ENV_TYPE="review"",
604
+ "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
605
+ "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
606
+ "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
607
+ "export ROOT_URL="https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud"",
608
+ "export HOST_INTERNAL="app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud"",
609
+ "export HOST_CANONICAL="app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud"",
610
+ "export ROOT_URL_INTERNAL="https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud"",
611
+ "export KUBE_NAMESPACE="pan-test-app-review"",
612
+ "export KUBE_APP_NAME="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app"",
613
+ "export KUBE_APP_NAME_PREFIX="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-"",
614
+ "export SECRET_KEY_BASE="$CL_review_app_SECRET_KEY_BASE"",
615
+ "export POSTGRESQL_PASSWORD="$CL_review_app_POSTGRESQL_PASSWORD"",
616
+ "export cloudsqlProxyCredentials="$CL_review_app_cloudsqlProxyCredentials"",
617
+ "export RAILS_ENV="production"",
618
+ "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"SECRET_KEY_BASE\\",\\"POSTGRESQL_PASSWORD\\",\\"cloudsqlProxyCredentials\\",\\"RAILS_ENV\\"]"",
619
+ "export RELEASE_NAME="pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app"",
620
+ "export HELM_EXPERIMENTAL_OCI="1"",
621
+ "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-app"",
622
+ "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
623
+ "export HELM_ARGS=""",
624
+ "export COMPONENT_NAME="app"",
625
+ "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
626
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
627
+ "kubectl config set-cluster "kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --server="$CL_review_app_KUBE_URL" --certificate-authority <(echo $CL_review_app_KUBE_CA_PEM | base64 -d) --embed-certs=true",
628
+ "kubectl config set-credentials "kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --token="$CL_review_app_KUBE_TOKEN"",
629
+ "kubectl config set-context "kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --cluster="kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --user="kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --namespace="pan-test-app-review"",
630
+ "kubectl config use-context "kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app"",
631
+ "kubernetesRollback",
632
+ "echo "CL_GITLAB_ENVIRONMENT_URL=https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud" >> gitlab_environment.env",
633
+ ],
634
+ "stage": "rollback review",
635
+ "variables": {
636
+ "GIT_STRATEGY": "none",
637
+ "KUBERNETES_CPU_REQUEST": "0.22",
638
+ "KUBERNETES_MEMORY_LIMIT": "400Mi",
639
+ "KUBERNETES_MEMORY_REQUEST": "200Mi",
640
+ },
641
+ },
642
+ "app 👮 lint": {
643
+ "cache": {
644
+ "key": {
645
+ "files": [
646
+ "Gemfile.lock",
647
+ ],
648
+ "prefix": "$CI_JOB_IMAGE",
649
+ },
650
+ "paths": [
651
+ "tmp/cache",
652
+ ],
653
+ },
654
+ "image": "ruby:3.2.1",
655
+ "interruptible": true,
656
+ "needs": [],
657
+ "retry": {
658
+ "max": 2,
659
+ "when": [
660
+ "runner_system_failure",
661
+ "stuck_or_timeout_failure",
662
+ ],
663
+ },
664
+ "script": [
665
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
666
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
667
+ "cd .",
668
+ "bundle config set path 'tmp/cache'",
669
+ "bundle install -j $(nproc)",
670
+ "bundle exec rubocop",
671
+ ],
672
+ "stage": "test",
673
+ "variables": {},
674
+ },
675
+ "app 🔨 docker | review ": {
676
+ "image": "path/to/docker/docker-build:the-version",
677
+ "interruptible": true,
678
+ "needs": [],
679
+ "retry": {
680
+ "max": 2,
681
+ "when": [
682
+ "runner_system_failure",
683
+ "stuck_or_timeout_failure",
684
+ ],
685
+ },
686
+ "script": [
687
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
688
+ "export APP_DIR="."",
689
+ "export DOCKER_BUILD_CONTEXT="."",
690
+ "export DOCKER_REGISTRY="$CI_REGISTRY"",
691
+ "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/app"",
692
+ "export DOCKER_IMAGE_NAME="review/app"",
693
+ "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
694
+ "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
695
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
696
+ "docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY",
697
+ "cd .",
698
+ "docker pull $DOCKER_CACHE_IMAGE || true",
699
+ "wget --output-document=- https://github.com/buildpacks/pack/releases/download/v0.32.1/pack-v0.32.1-linux.tgz | tar -zx --directory /usr/local/bin pack",
700
+ "chmod +x /usr/local/bin/pack",
701
+ "sed --in-place 's|git@\\([^:]*\\):|https://\\1/|g' Gemfile Gemfile.lock",
702
+ "pack build "$DOCKER_IMAGE:$DOCKER_IMAGE_TAG" --builder 'heroku/builder:22' --publish --cache-image "$DOCKER_CACHE_IMAGE" --env 'SECRET_KEY_BASE=dummy-value' ",
703
+ ],
704
+ "services": [
705
+ {
706
+ "command": [
707
+ "--tls=false",
708
+ ],
709
+ "name": "docker:24.0.6-dind",
710
+ },
711
+ ],
712
+ "stage": "build",
713
+ "variables": {
714
+ "DOCKER_BUILDKIT": "1",
715
+ "DOCKER_DRIVER": "overlay2",
716
+ "DOCKER_HOST": "tcp://0.0.0.0:2375",
717
+ "DOCKER_TLS_CERTDIR": "",
718
+ "KUBERNETES_CPU_REQUEST": "0.45",
719
+ "KUBERNETES_MEMORY_LIMIT": "2Gi",
720
+ "KUBERNETES_MEMORY_REQUEST": "1Gi",
721
+ },
722
+ },
723
+ "app 🚀 Deploy | review ": {
724
+ "allow_failure": false,
725
+ "artifacts": {
726
+ "reports": {
727
+ "dotenv": "gitlab_environment.env",
728
+ },
729
+ },
730
+ "environment": {
731
+ "auto_stop_in": "1 week",
732
+ "name": "review/$CI_COMMIT_REF_NAME/app",
733
+ "on_stop": "app 🛑 Stop ⚠️ | review ",
734
+ "url": "$CL_GITLAB_ENVIRONMENT_URL",
735
+ },
736
+ "image": "path/to/docker/kubernetes:the-version",
737
+ "interruptible": true,
738
+ "needs": [
739
+ {
740
+ "artifacts": false,
741
+ "job": "app 👮 lint",
742
+ },
743
+ {
744
+ "artifacts": false,
745
+ "job": "app 🔨 docker | review ",
746
+ },
747
+ {
748
+ "artifacts": false,
749
+ "job": "app 🧪 test",
750
+ },
751
+ {
752
+ "artifacts": true,
753
+ "job": "app 🧾 sbom | review ",
754
+ },
755
+ {
756
+ "artifacts": false,
757
+ "job": "app 🛡 audit",
758
+ },
759
+ ],
760
+ "retry": {
761
+ "max": 2,
762
+ "when": [
763
+ "runner_system_failure",
764
+ "stuck_or_timeout_failure",
765
+ ],
766
+ },
767
+ "rules": [
768
+ {
769
+ "when": "on_success",
770
+ },
771
+ ],
772
+ "script": [
773
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
774
+ "export ENV_SHORT="review"",
775
+ "export APP_DIR="."",
776
+ "export ENV_TYPE="review"",
777
+ "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
778
+ "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
779
+ "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
780
+ "export ROOT_URL="https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud"",
781
+ "export HOST_INTERNAL="app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud"",
782
+ "export HOST_CANONICAL="app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud"",
783
+ "export ROOT_URL_INTERNAL="https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud"",
784
+ "export KUBE_NAMESPACE="pan-test-app-review"",
785
+ "export KUBE_APP_NAME="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app"",
786
+ "export KUBE_APP_NAME_PREFIX="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-"",
787
+ "export SECRET_KEY_BASE="$CL_review_app_SECRET_KEY_BASE"",
788
+ "export POSTGRESQL_PASSWORD="$CL_review_app_POSTGRESQL_PASSWORD"",
789
+ "export cloudsqlProxyCredentials="$CL_review_app_cloudsqlProxyCredentials"",
790
+ "export RAILS_ENV="production"",
791
+ "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"SECRET_KEY_BASE\\",\\"POSTGRESQL_PASSWORD\\",\\"cloudsqlProxyCredentials\\",\\"RAILS_ENV\\"]"",
792
+ "export DOCKER_REGISTRY="$CI_REGISTRY"",
793
+ "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/app"",
794
+ "export DOCKER_IMAGE_NAME="review/app"",
795
+ "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
796
+ "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
797
+ "export RELEASE_NAME="pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app"",
798
+ "export HELM_EXPERIMENTAL_OCI="1"",
799
+ "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-app"",
800
+ "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
801
+ "export HELM_ARGS=""",
802
+ "export COMPONENT_NAME="app"",
803
+ "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
804
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
805
+ "kubectl config set-cluster "kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --server="$CL_review_app_KUBE_URL" --certificate-authority <(echo $CL_review_app_KUBE_CA_PEM | base64 -d) --embed-certs=true",
806
+ "kubectl config set-credentials "kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --token="$CL_review_app_KUBE_TOKEN"",
807
+ "kubectl config set-context "kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --cluster="kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --user="kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --namespace="pan-test-app-review"",
808
+ "kubectl config use-context "kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app"",
809
+ "echo -e "\\e[0Ksection_start:$(date +%s):writeallvalues[collapsed=true]\\r\\e[0KWrite __all_values.yml for helm deployment"",
810
+ "cat > __all_values.yml <<EOF
811
+ env:
812
+ secret:
813
+ SECRET_KEY_BASE: |-
814
+ $(printf %s "$CL_review_app_SECRET_KEY_BASE" | sed 's/^/ /')
815
+ POSTGRESQL_PASSWORD: |-
816
+ $(printf %s "$CL_review_app_POSTGRESQL_PASSWORD" | sed 's/^/ /')
817
+ cloudsqlProxyCredentials: |-
818
+ $(printf %s "$CL_review_app_cloudsqlProxyCredentials" | sed 's/^/ /')
819
+ public:
820
+ ENV_SHORT: |-
821
+ review
822
+ APP_DIR: |-
823
+ .
824
+ ENV_TYPE: |-
825
+ review
826
+ BUILD_INFO_BUILD_ID: |-
827
+ $(printf %s "$(git describe --tags 2>/dev/null || git rev-parse HEAD)" | sed 's/^/ /')
828
+ BUILD_INFO_BUILD_TIME: |-
829
+ $(printf %s "$CI_JOB_STARTED_AT" | sed 's/^/ /')
830
+ BUILD_INFO_CURRENT_VERSION: |-
831
+ $(printf %s "$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")" | sed 's/^/ /')
832
+ ROOT_URL: |-
833
+ $(printf %s "https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud" | sed 's/^/ /')
834
+ HOST_INTERNAL: |-
835
+ $(printf %s "app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud" | sed 's/^/ /')
836
+ HOST_CANONICAL: |-
837
+ $(printf %s "app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud" | sed 's/^/ /')
838
+ ROOT_URL_INTERNAL: |-
839
+ $(printf %s "https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud" | sed 's/^/ /')
840
+ KUBE_NAMESPACE: |-
841
+ pan-test-app-review
842
+ KUBE_APP_NAME: |-
843
+ $(printf %s "$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" | sed 's/^/ /')
844
+ KUBE_APP_NAME_PREFIX: |-
845
+ $(printf %s "$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-" | sed 's/^/ /')
846
+ RAILS_ENV: |-
847
+ production
848
+ _ALL_ENV_VAR_KEYS: |-
849
+ ["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_BUILD_ID","BUILD_INFO_BUILD_TIME","BUILD_INFO_CURRENT_VERSION","ROOT_URL","HOST_INTERNAL","HOST_CANONICAL","ROOT_URL_INTERNAL","KUBE_NAMESPACE","KUBE_APP_NAME","KUBE_APP_NAME_PREFIX","SECRET_KEY_BASE","POSTGRESQL_PASSWORD","cloudsqlProxyCredentials","RAILS_ENV"]
850
+ application:
851
+ host: |-
852
+ $(printf %s "app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud" | sed 's/^/ /')
853
+ command: |-
854
+ /cnb/process/web
855
+ livenessProbe:
856
+ httpGet:
857
+ path: |-
858
+ __health
859
+ readinessProbe:
860
+ httpGet:
861
+ path: |-
862
+ __health
863
+ startupProbe:
864
+ httpGet:
865
+ path: |-
866
+ __health
867
+ worker:
868
+ enabled: true
869
+ command: |-
870
+ launcher bundle exec rake jobs:work
871
+ livenessProbe: false
872
+ cloudsql:
873
+ enabled: true
874
+ dbUser: |-
875
+ postgres
876
+ instanceConnectionName: |-
877
+ some-project-id:europe-west6:pan-test-app-review
878
+ proxyCredentials: |-
879
+ $CL_review_app_cloudsqlProxyCredentials
880
+ fullDbName: |-
881
+ $(printf %s "$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" | sed 's/^/ /')
882
+ projectId: |-
883
+ some-project-id
884
+ jobs:
885
+ db-migrate:
886
+ hook: |-
887
+ post-upgrade
888
+ command: |-
889
+ launcher bundle exec rake db:migrate
890
+ db-prepare-seed:
891
+ hook: |-
892
+ post-install
893
+ command: |-
894
+ launcher bundle exec rake db:prepare db:seed
895
+
896
+ EOF
897
+ ",
898
+ "echo -e "\\e[0Ksection_end:$(date +%s):writeallvalues\\r\\e[0K"",
899
+ "kubernetesCreateSecret",
900
+ "kubernetesDeploy",
901
+ "echo 'Uploading SBOM to Dependency Track'",
902
+ "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-test-app/app" "https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud" "__sbom.json" vex.json || true",
903
+ "echo deployment successful 😻",
904
+ "echo "CL_GITLAB_ENVIRONMENT_URL=https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud" >> gitlab_environment.env",
905
+ ],
906
+ "stage": "deploy review",
907
+ "variables": {
908
+ "KUBERNETES_CPU_REQUEST": "0.22",
909
+ "KUBERNETES_MEMORY_LIMIT": "400Mi",
910
+ "KUBERNETES_MEMORY_REQUEST": "200Mi",
911
+ },
912
+ },
913
+ "app 🛑 Stop ⚠️ | review ": {
914
+ "allow_failure": true,
915
+ "artifacts": {
916
+ "reports": {
917
+ "dotenv": "gitlab_environment.env",
918
+ },
919
+ },
920
+ "environment": {
921
+ "action": "stop",
922
+ "name": "review/$CI_COMMIT_REF_NAME/app",
923
+ "url": "$CL_GITLAB_ENVIRONMENT_URL",
924
+ },
925
+ "image": "path/to/docker/kubernetes:the-version",
926
+ "interruptible": true,
927
+ "needs": [],
928
+ "retry": {
929
+ "max": 2,
930
+ "when": [
931
+ "runner_system_failure",
932
+ "stuck_or_timeout_failure",
933
+ ],
934
+ },
935
+ "rules": [
936
+ {
937
+ "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+\\.([0-9]+|x)\\.x$/",
938
+ "when": "on_success",
939
+ },
940
+ {
941
+ "when": "manual",
942
+ },
943
+ ],
944
+ "script": [
945
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
946
+ "export ENV_SHORT="review"",
947
+ "export APP_DIR="."",
948
+ "export ENV_TYPE="review"",
949
+ "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
950
+ "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
951
+ "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
952
+ "export ROOT_URL="https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud"",
953
+ "export HOST_INTERNAL="app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud"",
954
+ "export HOST_CANONICAL="app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud"",
955
+ "export ROOT_URL_INTERNAL="https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud"",
956
+ "export KUBE_NAMESPACE="pan-test-app-review"",
957
+ "export KUBE_APP_NAME="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app"",
958
+ "export KUBE_APP_NAME_PREFIX="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-"",
959
+ "export SECRET_KEY_BASE="$CL_review_app_SECRET_KEY_BASE"",
960
+ "export POSTGRESQL_PASSWORD="$CL_review_app_POSTGRESQL_PASSWORD"",
961
+ "export cloudsqlProxyCredentials="$CL_review_app_cloudsqlProxyCredentials"",
962
+ "export RAILS_ENV="production"",
963
+ "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"SECRET_KEY_BASE\\",\\"POSTGRESQL_PASSWORD\\",\\"cloudsqlProxyCredentials\\",\\"RAILS_ENV\\"]"",
964
+ "export RELEASE_NAME="pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app"",
965
+ "export HELM_EXPERIMENTAL_OCI="1"",
966
+ "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-app"",
967
+ "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
968
+ "export HELM_ARGS=""",
969
+ "export COMPONENT_NAME="app"",
970
+ "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
971
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
972
+ "kubectl config set-cluster "kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --server="$CL_review_app_KUBE_URL" --certificate-authority <(echo $CL_review_app_KUBE_CA_PEM | base64 -d) --embed-certs=true",
973
+ "kubectl config set-credentials "kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --token="$CL_review_app_KUBE_TOKEN"",
974
+ "kubectl config set-context "kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --cluster="kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --user="kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app" --namespace="pan-test-app-review"",
975
+ "kubectl config use-context "kube-pan-test-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-app"",
976
+ "kubernetesDelete",
977
+ "echo 'Disabling component in Dependency Track'",
978
+ "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-test-app/app" "https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud" || true",
979
+ "echo "CL_GITLAB_ENVIRONMENT_URL=https://app.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.test-app.pan.panter.cloud" >> gitlab_environment.env",
980
+ ],
981
+ "stage": "stop review",
982
+ "variables": {
983
+ "GIT_STRATEGY": "none",
984
+ "KUBERNETES_CPU_REQUEST": "0.22",
985
+ "KUBERNETES_MEMORY_LIMIT": "400Mi",
986
+ "KUBERNETES_MEMORY_REQUEST": "200Mi",
987
+ },
988
+ },
989
+ "app 🛡 audit": {
990
+ "allow_failure": true,
991
+ "image": "ruby:3.2.1",
992
+ "interruptible": true,
993
+ "needs": [],
994
+ "retry": {
995
+ "max": 2,
996
+ "when": [
997
+ "runner_system_failure",
998
+ "stuck_or_timeout_failure",
999
+ ],
1000
+ },
1001
+ "script": [
1002
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1003
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1004
+ "cd .",
1005
+ "gem install bundler-audit",
1006
+ "bundle audit check",
1007
+ ],
1008
+ "stage": "test",
1009
+ "variables": {},
1010
+ },
1011
+ "app 🧪 test": {
1012
+ "cache": {
1013
+ "key": {
1014
+ "files": [
1015
+ "Gemfile.lock",
1016
+ ],
1017
+ "prefix": "$CI_JOB_IMAGE",
1018
+ },
1019
+ "paths": [
1020
+ "tmp/cache",
1021
+ ],
1022
+ },
1023
+ "image": "ruby:3.2.1",
1024
+ "interruptible": true,
1025
+ "needs": [],
1026
+ "retry": {
1027
+ "max": 2,
1028
+ "when": [
1029
+ "runner_system_failure",
1030
+ "stuck_or_timeout_failure",
1031
+ ],
1032
+ },
1033
+ "script": [
1034
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1035
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1036
+ "cd .",
1037
+ "bundle config set path 'tmp/cache'",
1038
+ "bundle install -j $(nproc)",
1039
+ "bundle exec rspec",
1040
+ ],
1041
+ "stage": "test",
1042
+ "variables": {},
1043
+ },
1044
+ "app 🧾 sbom | review ": {
1045
+ "allow_failure": true,
1046
+ "artifacts": {
1047
+ "paths": [
1048
+ "__sbom.json",
1049
+ ],
1050
+ },
1051
+ "image": "aquasec/trivy:0.38.3",
1052
+ "interruptible": true,
1053
+ "needs": [],
1054
+ "retry": {
1055
+ "max": 2,
1056
+ "when": [
1057
+ "runner_system_failure",
1058
+ "stuck_or_timeout_failure",
1059
+ ],
1060
+ },
1061
+ "script": [
1062
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1063
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1064
+ "trivy fs --quiet --format cyclonedx --output "__sbom.json" .",
1065
+ ],
1066
+ "stage": "build",
1067
+ "variables": {},
1068
+ },
1069
+ },
1070
+ "stages": [
1071
+ "setup",
1072
+ "setup dev",
1073
+ "setup review",
1074
+ "setup stage",
1075
+ "setup prod",
1076
+ "test",
1077
+ "test dev",
1078
+ "test review",
1079
+ "test stage",
1080
+ "test prod",
1081
+ "build",
1082
+ "build dev",
1083
+ "build review",
1084
+ "build stage",
1085
+ "build prod",
1086
+ "deploy",
1087
+ "deploy dev",
1088
+ "deploy review",
1089
+ "deploy stage",
1090
+ "deploy prod",
1091
+ "verify",
1092
+ "verify dev",
1093
+ "verify review",
1094
+ "verify stage",
1095
+ "verify prod",
1096
+ "rollback",
1097
+ "rollback dev",
1098
+ "rollback review",
1099
+ "rollback stage",
1100
+ "rollback prod",
1101
+ "stop",
1102
+ "stop dev",
1103
+ "stop review",
1104
+ "stop stage",
1105
+ "stop prod",
1106
+ ],
1107
+ "variables": {
1108
+ "ARTIFACT_COMPRESSION_LEVEL": "fast",
1109
+ "CACHE_COMPRESSION_LEVEL": "fast",
1110
+ "FF_USE_FASTZIP": "true",
1111
+ "GIT_DEPTH": "1",
1112
+ "TRANSFER_METER_FREQUENCY": "5s",
1113
+ },
1114
+ "workflow": {
1115
+ "rules": [
1116
+ {
1117
+ "if": "$CI_COMMIT_TAG",
1118
+ },
1119
+ {
1120
+ "if": "$CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/",
1121
+ "when": "never",
1122
+ },
1123
+ {
1124
+ "if": "$CI_PIPELINE_SOURCE == "schedule"",
1125
+ "when": "never",
1126
+ },
1127
+ {
1128
+ "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+.([0-9]+|x).x$/",
1129
+ },
1130
+ {
1131
+ "if": "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH",
1132
+ },
1133
+ {
1134
+ "if": "$CI_MERGE_REQUEST_ID",
1135
+ },
1136
+ ],
1137
+ },
1138
+ },
1139
+ "taggedRelease": {
1140
+ "image": "path/to/docker/jobs-default:the-version",
1141
+ "jobs": {
1142
+ "app ↩️ Rollback ⚠️ | prod ": {
1143
+ "allow_failure": true,
1144
+ "artifacts": {
1145
+ "reports": {
1146
+ "dotenv": "gitlab_environment.env",
1147
+ },
1148
+ },
1149
+ "environment": {
1150
+ "action": "access",
1151
+ "name": "prod/app",
1152
+ "url": "$CL_GITLAB_ENVIRONMENT_URL",
1153
+ },
1154
+ "image": "path/to/docker/kubernetes:the-version",
1155
+ "interruptible": true,
1156
+ "needs": [],
1157
+ "retry": {
1158
+ "max": 2,
1159
+ "when": [
1160
+ "runner_system_failure",
1161
+ "stuck_or_timeout_failure",
1162
+ ],
1163
+ },
1164
+ "rules": [
1165
+ {
1166
+ "when": "manual",
1167
+ },
1168
+ ],
1169
+ "script": [
1170
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1171
+ "export ENV_SHORT="prod"",
1172
+ "export APP_DIR="."",
1173
+ "export ENV_TYPE="prod"",
1174
+ "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
1175
+ "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
1176
+ "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
1177
+ "export ROOT_URL="https://my-fancy-website.com"",
1178
+ "export HOST_INTERNAL="app.prod.test-app.pan.panter.cloud"",
1179
+ "export HOST_CANONICAL="app.prod.test-app.pan.panter.cloud"",
1180
+ "export ROOT_URL_INTERNAL="https://app.prod.test-app.pan.panter.cloud"",
1181
+ "export KUBE_NAMESPACE="pan-test-app-prod"",
1182
+ "export KUBE_APP_NAME="app"",
1183
+ "export KUBE_APP_NAME_PREFIX=""",
1184
+ "export SECRET_KEY_BASE="$CL_prod_app_SECRET_KEY_BASE"",
1185
+ "export POSTGRESQL_PASSWORD="$CL_prod_app_POSTGRESQL_PASSWORD"",
1186
+ "export cloudsqlProxyCredentials="$CL_prod_app_cloudsqlProxyCredentials"",
1187
+ "export RAILS_ENV="production"",
1188
+ "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"SECRET_KEY_BASE\\",\\"POSTGRESQL_PASSWORD\\",\\"cloudsqlProxyCredentials\\",\\"RAILS_ENV\\"]"",
1189
+ "export RELEASE_NAME="pan-test-app-prod-app"",
1190
+ "export HELM_EXPERIMENTAL_OCI="1"",
1191
+ "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-app"",
1192
+ "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
1193
+ "export HELM_ARGS=""",
1194
+ "export COMPONENT_NAME="app"",
1195
+ "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
1196
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1197
+ "kubectl config set-cluster "kube-pan-test-app-prod-app" --server="$CL_prod_app_KUBE_URL" --certificate-authority <(echo $CL_prod_app_KUBE_CA_PEM | base64 -d) --embed-certs=true",
1198
+ "kubectl config set-credentials "kube-pan-test-app-prod-app" --token="$CL_prod_app_KUBE_TOKEN"",
1199
+ "kubectl config set-context "kube-pan-test-app-prod-app" --cluster="kube-pan-test-app-prod-app" --user="kube-pan-test-app-prod-app" --namespace="pan-test-app-prod"",
1200
+ "kubectl config use-context "kube-pan-test-app-prod-app"",
1201
+ "kubernetesRollback",
1202
+ "echo "CL_GITLAB_ENVIRONMENT_URL=https://my-fancy-website.com" >> gitlab_environment.env",
1203
+ ],
1204
+ "stage": "rollback prod",
1205
+ "variables": {
1206
+ "GIT_STRATEGY": "none",
1207
+ "KUBERNETES_CPU_REQUEST": "0.22",
1208
+ "KUBERNETES_MEMORY_LIMIT": "400Mi",
1209
+ "KUBERNETES_MEMORY_REQUEST": "200Mi",
1210
+ },
1211
+ },
1212
+ "app ↩️ Rollback ⚠️ | stage ": {
1213
+ "allow_failure": true,
1214
+ "artifacts": {
1215
+ "reports": {
1216
+ "dotenv": "gitlab_environment.env",
1217
+ },
1218
+ },
1219
+ "environment": {
1220
+ "action": "access",
1221
+ "name": "stage/app",
1222
+ "url": "$CL_GITLAB_ENVIRONMENT_URL",
1223
+ },
1224
+ "image": "path/to/docker/kubernetes:the-version",
1225
+ "interruptible": true,
1226
+ "needs": [],
1227
+ "retry": {
1228
+ "max": 2,
1229
+ "when": [
1230
+ "runner_system_failure",
1231
+ "stuck_or_timeout_failure",
1232
+ ],
1233
+ },
1234
+ "rules": [
1235
+ {
1236
+ "when": "manual",
1237
+ },
1238
+ ],
1239
+ "script": [
1240
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1241
+ "export ENV_SHORT="stage"",
1242
+ "export APP_DIR="."",
1243
+ "export ENV_TYPE="stage"",
1244
+ "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
1245
+ "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
1246
+ "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
1247
+ "export ROOT_URL="https://app.stage.test-app.pan.panter.cloud"",
1248
+ "export HOST_INTERNAL="app.stage.test-app.pan.panter.cloud"",
1249
+ "export HOST_CANONICAL="app.stage.test-app.pan.panter.cloud"",
1250
+ "export ROOT_URL_INTERNAL="https://app.stage.test-app.pan.panter.cloud"",
1251
+ "export KUBE_NAMESPACE="pan-test-app-stage"",
1252
+ "export KUBE_APP_NAME="app"",
1253
+ "export KUBE_APP_NAME_PREFIX=""",
1254
+ "export SECRET_KEY_BASE="$CL_stage_app_SECRET_KEY_BASE"",
1255
+ "export POSTGRESQL_PASSWORD="$CL_stage_app_POSTGRESQL_PASSWORD"",
1256
+ "export cloudsqlProxyCredentials="$CL_stage_app_cloudsqlProxyCredentials"",
1257
+ "export RAILS_ENV="production"",
1258
+ "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"SECRET_KEY_BASE\\",\\"POSTGRESQL_PASSWORD\\",\\"cloudsqlProxyCredentials\\",\\"RAILS_ENV\\"]"",
1259
+ "export RELEASE_NAME="pan-test-app-stage-app"",
1260
+ "export HELM_EXPERIMENTAL_OCI="1"",
1261
+ "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-app"",
1262
+ "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
1263
+ "export HELM_ARGS=""",
1264
+ "export COMPONENT_NAME="app"",
1265
+ "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
1266
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1267
+ "kubectl config set-cluster "kube-pan-test-app-stage-app" --server="$CL_stage_app_KUBE_URL" --certificate-authority <(echo $CL_stage_app_KUBE_CA_PEM | base64 -d) --embed-certs=true",
1268
+ "kubectl config set-credentials "kube-pan-test-app-stage-app" --token="$CL_stage_app_KUBE_TOKEN"",
1269
+ "kubectl config set-context "kube-pan-test-app-stage-app" --cluster="kube-pan-test-app-stage-app" --user="kube-pan-test-app-stage-app" --namespace="pan-test-app-stage"",
1270
+ "kubectl config use-context "kube-pan-test-app-stage-app"",
1271
+ "kubernetesRollback",
1272
+ "echo "CL_GITLAB_ENVIRONMENT_URL=https://app.stage.test-app.pan.panter.cloud" >> gitlab_environment.env",
1273
+ ],
1274
+ "stage": "rollback stage",
1275
+ "variables": {
1276
+ "GIT_STRATEGY": "none",
1277
+ "KUBERNETES_CPU_REQUEST": "0.22",
1278
+ "KUBERNETES_MEMORY_LIMIT": "400Mi",
1279
+ "KUBERNETES_MEMORY_REQUEST": "200Mi",
1280
+ },
1281
+ },
1282
+ "app 🔨 docker | prod ": {
1283
+ "image": "path/to/docker/docker-build:the-version",
1284
+ "interruptible": true,
1285
+ "needs": [],
1286
+ "retry": {
1287
+ "max": 2,
1288
+ "when": [
1289
+ "runner_system_failure",
1290
+ "stuck_or_timeout_failure",
1291
+ ],
1292
+ },
1293
+ "script": [
1294
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1295
+ "export APP_DIR="."",
1296
+ "export DOCKER_BUILD_CONTEXT="."",
1297
+ "export DOCKER_REGISTRY="$CI_REGISTRY"",
1298
+ "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/app"",
1299
+ "export DOCKER_IMAGE_NAME="prod/app"",
1300
+ "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
1301
+ "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
1302
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1303
+ "docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY",
1304
+ "cd .",
1305
+ "docker pull $DOCKER_CACHE_IMAGE || true",
1306
+ "wget --output-document=- https://github.com/buildpacks/pack/releases/download/v0.32.1/pack-v0.32.1-linux.tgz | tar -zx --directory /usr/local/bin pack",
1307
+ "chmod +x /usr/local/bin/pack",
1308
+ "sed --in-place 's|git@\\([^:]*\\):|https://\\1/|g' Gemfile Gemfile.lock",
1309
+ "pack build "$DOCKER_IMAGE:$DOCKER_IMAGE_TAG" --builder 'heroku/builder:22' --publish --cache-image "$DOCKER_CACHE_IMAGE" --env 'SECRET_KEY_BASE=dummy-value' ",
1310
+ ],
1311
+ "services": [
1312
+ {
1313
+ "command": [
1314
+ "--tls=false",
1315
+ ],
1316
+ "name": "docker:24.0.6-dind",
1317
+ },
1318
+ ],
1319
+ "stage": "build",
1320
+ "variables": {
1321
+ "DOCKER_BUILDKIT": "1",
1322
+ "DOCKER_DRIVER": "overlay2",
1323
+ "DOCKER_HOST": "tcp://0.0.0.0:2375",
1324
+ "DOCKER_TLS_CERTDIR": "",
1325
+ "KUBERNETES_CPU_REQUEST": "0.45",
1326
+ "KUBERNETES_MEMORY_LIMIT": "2Gi",
1327
+ "KUBERNETES_MEMORY_REQUEST": "1Gi",
1328
+ },
1329
+ },
1330
+ "app 🔨 docker | stage ": {
1331
+ "image": "path/to/docker/docker-build:the-version",
1332
+ "interruptible": true,
1333
+ "needs": [],
1334
+ "retry": {
1335
+ "max": 2,
1336
+ "when": [
1337
+ "runner_system_failure",
1338
+ "stuck_or_timeout_failure",
1339
+ ],
1340
+ },
1341
+ "script": [
1342
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1343
+ "export APP_DIR="."",
1344
+ "export DOCKER_BUILD_CONTEXT="."",
1345
+ "export DOCKER_REGISTRY="$CI_REGISTRY"",
1346
+ "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/app"",
1347
+ "export DOCKER_IMAGE_NAME="stage/app"",
1348
+ "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
1349
+ "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
1350
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1351
+ "docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY",
1352
+ "cd .",
1353
+ "docker pull $DOCKER_CACHE_IMAGE || true",
1354
+ "wget --output-document=- https://github.com/buildpacks/pack/releases/download/v0.32.1/pack-v0.32.1-linux.tgz | tar -zx --directory /usr/local/bin pack",
1355
+ "chmod +x /usr/local/bin/pack",
1356
+ "sed --in-place 's|git@\\([^:]*\\):|https://\\1/|g' Gemfile Gemfile.lock",
1357
+ "pack build "$DOCKER_IMAGE:$DOCKER_IMAGE_TAG" --builder 'heroku/builder:22' --publish --cache-image "$DOCKER_CACHE_IMAGE" --env 'SECRET_KEY_BASE=dummy-value' ",
1358
+ ],
1359
+ "services": [
1360
+ {
1361
+ "command": [
1362
+ "--tls=false",
1363
+ ],
1364
+ "name": "docker:24.0.6-dind",
1365
+ },
1366
+ ],
1367
+ "stage": "build",
1368
+ "variables": {
1369
+ "DOCKER_BUILDKIT": "1",
1370
+ "DOCKER_DRIVER": "overlay2",
1371
+ "DOCKER_HOST": "tcp://0.0.0.0:2375",
1372
+ "DOCKER_TLS_CERTDIR": "",
1373
+ "KUBERNETES_CPU_REQUEST": "0.45",
1374
+ "KUBERNETES_MEMORY_LIMIT": "2Gi",
1375
+ "KUBERNETES_MEMORY_REQUEST": "1Gi",
1376
+ },
1377
+ },
1378
+ "app 🚀 Deploy | prod ": {
1379
+ "allow_failure": true,
1380
+ "artifacts": {
1381
+ "reports": {
1382
+ "dotenv": "gitlab_environment.env",
1383
+ },
1384
+ },
1385
+ "environment": {
1386
+ "auto_stop_in": undefined,
1387
+ "name": "prod/app",
1388
+ "on_stop": "app 🛑 Stop ⚠️ | prod ",
1389
+ "url": "$CL_GITLAB_ENVIRONMENT_URL",
1390
+ },
1391
+ "image": "path/to/docker/kubernetes:the-version",
1392
+ "interruptible": true,
1393
+ "needs": [
1394
+ {
1395
+ "artifacts": false,
1396
+ "job": "app 🔨 docker | prod ",
1397
+ },
1398
+ {
1399
+ "artifacts": true,
1400
+ "job": "app 🧾 sbom | prod ",
1401
+ },
1402
+ ],
1403
+ "retry": {
1404
+ "max": 2,
1405
+ "when": [
1406
+ "runner_system_failure",
1407
+ "stuck_or_timeout_failure",
1408
+ ],
1409
+ },
1410
+ "rules": [
1411
+ {
1412
+ "when": "manual",
1413
+ },
1414
+ ],
1415
+ "script": [
1416
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1417
+ "export ENV_SHORT="prod"",
1418
+ "export APP_DIR="."",
1419
+ "export ENV_TYPE="prod"",
1420
+ "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
1421
+ "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
1422
+ "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
1423
+ "export ROOT_URL="https://my-fancy-website.com"",
1424
+ "export HOST_INTERNAL="app.prod.test-app.pan.panter.cloud"",
1425
+ "export HOST_CANONICAL="app.prod.test-app.pan.panter.cloud"",
1426
+ "export ROOT_URL_INTERNAL="https://app.prod.test-app.pan.panter.cloud"",
1427
+ "export KUBE_NAMESPACE="pan-test-app-prod"",
1428
+ "export KUBE_APP_NAME="app"",
1429
+ "export KUBE_APP_NAME_PREFIX=""",
1430
+ "export SECRET_KEY_BASE="$CL_prod_app_SECRET_KEY_BASE"",
1431
+ "export POSTGRESQL_PASSWORD="$CL_prod_app_POSTGRESQL_PASSWORD"",
1432
+ "export cloudsqlProxyCredentials="$CL_prod_app_cloudsqlProxyCredentials"",
1433
+ "export RAILS_ENV="production"",
1434
+ "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"SECRET_KEY_BASE\\",\\"POSTGRESQL_PASSWORD\\",\\"cloudsqlProxyCredentials\\",\\"RAILS_ENV\\"]"",
1435
+ "export DOCKER_REGISTRY="$CI_REGISTRY"",
1436
+ "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/app"",
1437
+ "export DOCKER_IMAGE_NAME="prod/app"",
1438
+ "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
1439
+ "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
1440
+ "export RELEASE_NAME="pan-test-app-prod-app"",
1441
+ "export HELM_EXPERIMENTAL_OCI="1"",
1442
+ "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-app"",
1443
+ "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
1444
+ "export HELM_ARGS=""",
1445
+ "export COMPONENT_NAME="app"",
1446
+ "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
1447
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1448
+ "kubectl config set-cluster "kube-pan-test-app-prod-app" --server="$CL_prod_app_KUBE_URL" --certificate-authority <(echo $CL_prod_app_KUBE_CA_PEM | base64 -d) --embed-certs=true",
1449
+ "kubectl config set-credentials "kube-pan-test-app-prod-app" --token="$CL_prod_app_KUBE_TOKEN"",
1450
+ "kubectl config set-context "kube-pan-test-app-prod-app" --cluster="kube-pan-test-app-prod-app" --user="kube-pan-test-app-prod-app" --namespace="pan-test-app-prod"",
1451
+ "kubectl config use-context "kube-pan-test-app-prod-app"",
1452
+ "echo -e "\\e[0Ksection_start:$(date +%s):writeallvalues[collapsed=true]\\r\\e[0KWrite __all_values.yml for helm deployment"",
1453
+ "cat > __all_values.yml <<EOF
1454
+ env:
1455
+ secret:
1456
+ SECRET_KEY_BASE: |-
1457
+ $(printf %s "$CL_prod_app_SECRET_KEY_BASE" | sed 's/^/ /')
1458
+ POSTGRESQL_PASSWORD: |-
1459
+ $(printf %s "$CL_prod_app_POSTGRESQL_PASSWORD" | sed 's/^/ /')
1460
+ cloudsqlProxyCredentials: |-
1461
+ $(printf %s "$CL_prod_app_cloudsqlProxyCredentials" | sed 's/^/ /')
1462
+ public:
1463
+ ENV_SHORT: |-
1464
+ prod
1465
+ APP_DIR: |-
1466
+ .
1467
+ ENV_TYPE: |-
1468
+ prod
1469
+ BUILD_INFO_BUILD_ID: |-
1470
+ $(printf %s "$(git describe --tags 2>/dev/null || git rev-parse HEAD)" | sed 's/^/ /')
1471
+ BUILD_INFO_BUILD_TIME: |-
1472
+ $(printf %s "$CI_JOB_STARTED_AT" | sed 's/^/ /')
1473
+ BUILD_INFO_CURRENT_VERSION: |-
1474
+ $(printf %s "$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")" | sed 's/^/ /')
1475
+ ROOT_URL: |-
1476
+ https://my-fancy-website.com
1477
+ HOST_INTERNAL: |-
1478
+ app.prod.test-app.pan.panter.cloud
1479
+ HOST_CANONICAL: |-
1480
+ app.prod.test-app.pan.panter.cloud
1481
+ ROOT_URL_INTERNAL: |-
1482
+ https://app.prod.test-app.pan.panter.cloud
1483
+ KUBE_NAMESPACE: |-
1484
+ pan-test-app-prod
1485
+ KUBE_APP_NAME: |-
1486
+ app
1487
+ KUBE_APP_NAME_PREFIX: ""
1488
+ RAILS_ENV: |-
1489
+ production
1490
+ _ALL_ENV_VAR_KEYS: |-
1491
+ ["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_BUILD_ID","BUILD_INFO_BUILD_TIME","BUILD_INFO_CURRENT_VERSION","ROOT_URL","HOST_INTERNAL","HOST_CANONICAL","ROOT_URL_INTERNAL","KUBE_NAMESPACE","KUBE_APP_NAME","KUBE_APP_NAME_PREFIX","SECRET_KEY_BASE","POSTGRESQL_PASSWORD","cloudsqlProxyCredentials","RAILS_ENV"]
1492
+ application:
1493
+ host: |-
1494
+ my-fancy-website.com
1495
+ command: |-
1496
+ /cnb/process/web
1497
+ livenessProbe:
1498
+ httpGet:
1499
+ path: |-
1500
+ __health
1501
+ readinessProbe:
1502
+ httpGet:
1503
+ path: |-
1504
+ __health
1505
+ startupProbe:
1506
+ httpGet:
1507
+ path: |-
1508
+ __health
1509
+ worker:
1510
+ enabled: true
1511
+ command: |-
1512
+ launcher bundle exec rake jobs:work
1513
+ livenessProbe: false
1514
+ cloudsql:
1515
+ enabled: true
1516
+ dbUser: |-
1517
+ postgres
1518
+ instanceConnectionName: |-
1519
+ some-project-id:europe-west6:pan-test-app-prod
1520
+ proxyCredentials: |-
1521
+ $CL_prod_app_cloudsqlProxyCredentials
1522
+ fullDbName: |-
1523
+ app
1524
+ projectId: |-
1525
+ some-project-id
1526
+ jobs:
1527
+ db-migrate:
1528
+ hook: |-
1529
+ post-install,post-upgrade
1530
+ command: |-
1531
+ launcher bundle exec rake db:migrate
1532
+
1533
+ EOF
1534
+ ",
1535
+ "echo -e "\\e[0Ksection_end:$(date +%s):writeallvalues\\r\\e[0K"",
1536
+ "kubernetesCreateSecret",
1537
+ "kubernetesDeploy",
1538
+ "echo 'Uploading SBOM to Dependency Track'",
1539
+ "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-test-app/app" "https://my-fancy-website.com" "__sbom.json" vex.json || true",
1540
+ "echo deployment successful 😻",
1541
+ "echo "CL_GITLAB_ENVIRONMENT_URL=https://my-fancy-website.com" >> gitlab_environment.env",
1542
+ ],
1543
+ "stage": "deploy prod",
1544
+ "variables": {
1545
+ "KUBERNETES_CPU_REQUEST": "0.22",
1546
+ "KUBERNETES_MEMORY_LIMIT": "400Mi",
1547
+ "KUBERNETES_MEMORY_REQUEST": "200Mi",
1548
+ },
1549
+ },
1550
+ "app 🚀 Deploy | stage ": {
1551
+ "allow_failure": false,
1552
+ "artifacts": {
1553
+ "reports": {
1554
+ "dotenv": "gitlab_environment.env",
1555
+ },
1556
+ },
1557
+ "environment": {
1558
+ "auto_stop_in": undefined,
1559
+ "name": "stage/app",
1560
+ "on_stop": "app 🛑 Stop ⚠️ | stage ",
1561
+ "url": "$CL_GITLAB_ENVIRONMENT_URL",
1562
+ },
1563
+ "image": "path/to/docker/kubernetes:the-version",
1564
+ "interruptible": true,
1565
+ "needs": [
1566
+ {
1567
+ "artifacts": false,
1568
+ "job": "app 🔨 docker | stage ",
1569
+ },
1570
+ {
1571
+ "artifacts": true,
1572
+ "job": "app 🧾 sbom | stage ",
1573
+ },
1574
+ ],
1575
+ "retry": {
1576
+ "max": 2,
1577
+ "when": [
1578
+ "runner_system_failure",
1579
+ "stuck_or_timeout_failure",
1580
+ ],
1581
+ },
1582
+ "rules": [
1583
+ {
1584
+ "when": "on_success",
1585
+ },
1586
+ ],
1587
+ "script": [
1588
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1589
+ "export ENV_SHORT="stage"",
1590
+ "export APP_DIR="."",
1591
+ "export ENV_TYPE="stage"",
1592
+ "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
1593
+ "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
1594
+ "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
1595
+ "export ROOT_URL="https://app.stage.test-app.pan.panter.cloud"",
1596
+ "export HOST_INTERNAL="app.stage.test-app.pan.panter.cloud"",
1597
+ "export HOST_CANONICAL="app.stage.test-app.pan.panter.cloud"",
1598
+ "export ROOT_URL_INTERNAL="https://app.stage.test-app.pan.panter.cloud"",
1599
+ "export KUBE_NAMESPACE="pan-test-app-stage"",
1600
+ "export KUBE_APP_NAME="app"",
1601
+ "export KUBE_APP_NAME_PREFIX=""",
1602
+ "export SECRET_KEY_BASE="$CL_stage_app_SECRET_KEY_BASE"",
1603
+ "export POSTGRESQL_PASSWORD="$CL_stage_app_POSTGRESQL_PASSWORD"",
1604
+ "export cloudsqlProxyCredentials="$CL_stage_app_cloudsqlProxyCredentials"",
1605
+ "export RAILS_ENV="production"",
1606
+ "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"SECRET_KEY_BASE\\",\\"POSTGRESQL_PASSWORD\\",\\"cloudsqlProxyCredentials\\",\\"RAILS_ENV\\"]"",
1607
+ "export DOCKER_REGISTRY="$CI_REGISTRY"",
1608
+ "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/app"",
1609
+ "export DOCKER_IMAGE_NAME="stage/app"",
1610
+ "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
1611
+ "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
1612
+ "export RELEASE_NAME="pan-test-app-stage-app"",
1613
+ "export HELM_EXPERIMENTAL_OCI="1"",
1614
+ "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-app"",
1615
+ "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
1616
+ "export HELM_ARGS=""",
1617
+ "export COMPONENT_NAME="app"",
1618
+ "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
1619
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1620
+ "kubectl config set-cluster "kube-pan-test-app-stage-app" --server="$CL_stage_app_KUBE_URL" --certificate-authority <(echo $CL_stage_app_KUBE_CA_PEM | base64 -d) --embed-certs=true",
1621
+ "kubectl config set-credentials "kube-pan-test-app-stage-app" --token="$CL_stage_app_KUBE_TOKEN"",
1622
+ "kubectl config set-context "kube-pan-test-app-stage-app" --cluster="kube-pan-test-app-stage-app" --user="kube-pan-test-app-stage-app" --namespace="pan-test-app-stage"",
1623
+ "kubectl config use-context "kube-pan-test-app-stage-app"",
1624
+ "echo -e "\\e[0Ksection_start:$(date +%s):writeallvalues[collapsed=true]\\r\\e[0KWrite __all_values.yml for helm deployment"",
1625
+ "cat > __all_values.yml <<EOF
1626
+ env:
1627
+ secret:
1628
+ SECRET_KEY_BASE: |-
1629
+ $(printf %s "$CL_stage_app_SECRET_KEY_BASE" | sed 's/^/ /')
1630
+ POSTGRESQL_PASSWORD: |-
1631
+ $(printf %s "$CL_stage_app_POSTGRESQL_PASSWORD" | sed 's/^/ /')
1632
+ cloudsqlProxyCredentials: |-
1633
+ $(printf %s "$CL_stage_app_cloudsqlProxyCredentials" | sed 's/^/ /')
1634
+ public:
1635
+ ENV_SHORT: |-
1636
+ stage
1637
+ APP_DIR: |-
1638
+ .
1639
+ ENV_TYPE: |-
1640
+ stage
1641
+ BUILD_INFO_BUILD_ID: |-
1642
+ $(printf %s "$(git describe --tags 2>/dev/null || git rev-parse HEAD)" | sed 's/^/ /')
1643
+ BUILD_INFO_BUILD_TIME: |-
1644
+ $(printf %s "$CI_JOB_STARTED_AT" | sed 's/^/ /')
1645
+ BUILD_INFO_CURRENT_VERSION: |-
1646
+ $(printf %s "$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")" | sed 's/^/ /')
1647
+ ROOT_URL: |-
1648
+ https://app.stage.test-app.pan.panter.cloud
1649
+ HOST_INTERNAL: |-
1650
+ app.stage.test-app.pan.panter.cloud
1651
+ HOST_CANONICAL: |-
1652
+ app.stage.test-app.pan.panter.cloud
1653
+ ROOT_URL_INTERNAL: |-
1654
+ https://app.stage.test-app.pan.panter.cloud
1655
+ KUBE_NAMESPACE: |-
1656
+ pan-test-app-stage
1657
+ KUBE_APP_NAME: |-
1658
+ app
1659
+ KUBE_APP_NAME_PREFIX: ""
1660
+ RAILS_ENV: |-
1661
+ production
1662
+ _ALL_ENV_VAR_KEYS: |-
1663
+ ["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_BUILD_ID","BUILD_INFO_BUILD_TIME","BUILD_INFO_CURRENT_VERSION","ROOT_URL","HOST_INTERNAL","HOST_CANONICAL","ROOT_URL_INTERNAL","KUBE_NAMESPACE","KUBE_APP_NAME","KUBE_APP_NAME_PREFIX","SECRET_KEY_BASE","POSTGRESQL_PASSWORD","cloudsqlProxyCredentials","RAILS_ENV"]
1664
+ application:
1665
+ host: |-
1666
+ app.stage.test-app.pan.panter.cloud
1667
+ command: |-
1668
+ /cnb/process/web
1669
+ livenessProbe:
1670
+ httpGet:
1671
+ path: |-
1672
+ __health
1673
+ readinessProbe:
1674
+ httpGet:
1675
+ path: |-
1676
+ __health
1677
+ startupProbe:
1678
+ httpGet:
1679
+ path: |-
1680
+ __health
1681
+ worker:
1682
+ enabled: true
1683
+ command: |-
1684
+ launcher bundle exec rake jobs:work
1685
+ livenessProbe: false
1686
+ cloudsql:
1687
+ enabled: true
1688
+ dbUser: |-
1689
+ postgres
1690
+ instanceConnectionName: |-
1691
+ some-project-id:europe-west6:pan-test-app-stage
1692
+ proxyCredentials: |-
1693
+ $CL_stage_app_cloudsqlProxyCredentials
1694
+ fullDbName: |-
1695
+ app
1696
+ projectId: |-
1697
+ some-project-id
1698
+ jobs:
1699
+ db-migrate:
1700
+ hook: |-
1701
+ post-install,post-upgrade
1702
+ command: |-
1703
+ launcher bundle exec rake db:migrate
1704
+
1705
+ EOF
1706
+ ",
1707
+ "echo -e "\\e[0Ksection_end:$(date +%s):writeallvalues\\r\\e[0K"",
1708
+ "kubernetesCreateSecret",
1709
+ "kubernetesDeploy",
1710
+ "echo 'Uploading SBOM to Dependency Track'",
1711
+ "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-test-app/app" "https://app.stage.test-app.pan.panter.cloud" "__sbom.json" vex.json || true",
1712
+ "echo deployment successful 😻",
1713
+ "echo "CL_GITLAB_ENVIRONMENT_URL=https://app.stage.test-app.pan.panter.cloud" >> gitlab_environment.env",
1714
+ ],
1715
+ "stage": "deploy stage",
1716
+ "variables": {
1717
+ "KUBERNETES_CPU_REQUEST": "0.22",
1718
+ "KUBERNETES_MEMORY_LIMIT": "400Mi",
1719
+ "KUBERNETES_MEMORY_REQUEST": "200Mi",
1720
+ },
1721
+ },
1722
+ "app 🛑 Stop ⚠️ | prod ": {
1723
+ "allow_failure": true,
1724
+ "artifacts": {
1725
+ "reports": {
1726
+ "dotenv": "gitlab_environment.env",
1727
+ },
1728
+ },
1729
+ "environment": {
1730
+ "action": "stop",
1731
+ "name": "prod/app",
1732
+ "url": "$CL_GITLAB_ENVIRONMENT_URL",
1733
+ },
1734
+ "image": "path/to/docker/kubernetes:the-version",
1735
+ "interruptible": true,
1736
+ "needs": [],
1737
+ "retry": {
1738
+ "max": 2,
1739
+ "when": [
1740
+ "runner_system_failure",
1741
+ "stuck_or_timeout_failure",
1742
+ ],
1743
+ },
1744
+ "rules": [
1745
+ {
1746
+ "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+\\.([0-9]+|x)\\.x$/",
1747
+ "when": "on_success",
1748
+ },
1749
+ {
1750
+ "when": "manual",
1751
+ },
1752
+ ],
1753
+ "script": [
1754
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1755
+ "export ENV_SHORT="prod"",
1756
+ "export APP_DIR="."",
1757
+ "export ENV_TYPE="prod"",
1758
+ "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
1759
+ "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
1760
+ "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
1761
+ "export ROOT_URL="https://my-fancy-website.com"",
1762
+ "export HOST_INTERNAL="app.prod.test-app.pan.panter.cloud"",
1763
+ "export HOST_CANONICAL="app.prod.test-app.pan.panter.cloud"",
1764
+ "export ROOT_URL_INTERNAL="https://app.prod.test-app.pan.panter.cloud"",
1765
+ "export KUBE_NAMESPACE="pan-test-app-prod"",
1766
+ "export KUBE_APP_NAME="app"",
1767
+ "export KUBE_APP_NAME_PREFIX=""",
1768
+ "export SECRET_KEY_BASE="$CL_prod_app_SECRET_KEY_BASE"",
1769
+ "export POSTGRESQL_PASSWORD="$CL_prod_app_POSTGRESQL_PASSWORD"",
1770
+ "export cloudsqlProxyCredentials="$CL_prod_app_cloudsqlProxyCredentials"",
1771
+ "export RAILS_ENV="production"",
1772
+ "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"SECRET_KEY_BASE\\",\\"POSTGRESQL_PASSWORD\\",\\"cloudsqlProxyCredentials\\",\\"RAILS_ENV\\"]"",
1773
+ "export RELEASE_NAME="pan-test-app-prod-app"",
1774
+ "export HELM_EXPERIMENTAL_OCI="1"",
1775
+ "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-app"",
1776
+ "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
1777
+ "export HELM_ARGS=""",
1778
+ "export COMPONENT_NAME="app"",
1779
+ "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
1780
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1781
+ "kubectl config set-cluster "kube-pan-test-app-prod-app" --server="$CL_prod_app_KUBE_URL" --certificate-authority <(echo $CL_prod_app_KUBE_CA_PEM | base64 -d) --embed-certs=true",
1782
+ "kubectl config set-credentials "kube-pan-test-app-prod-app" --token="$CL_prod_app_KUBE_TOKEN"",
1783
+ "kubectl config set-context "kube-pan-test-app-prod-app" --cluster="kube-pan-test-app-prod-app" --user="kube-pan-test-app-prod-app" --namespace="pan-test-app-prod"",
1784
+ "kubectl config use-context "kube-pan-test-app-prod-app"",
1785
+ "kubernetesDelete",
1786
+ "echo 'Disabling component in Dependency Track'",
1787
+ "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-test-app/app" "https://my-fancy-website.com" || true",
1788
+ "echo "CL_GITLAB_ENVIRONMENT_URL=https://my-fancy-website.com" >> gitlab_environment.env",
1789
+ ],
1790
+ "stage": "stop prod",
1791
+ "variables": {
1792
+ "GIT_STRATEGY": "none",
1793
+ "KUBERNETES_CPU_REQUEST": "0.22",
1794
+ "KUBERNETES_MEMORY_LIMIT": "400Mi",
1795
+ "KUBERNETES_MEMORY_REQUEST": "200Mi",
1796
+ },
1797
+ },
1798
+ "app 🛑 Stop ⚠️ | stage ": {
1799
+ "allow_failure": true,
1800
+ "artifacts": {
1801
+ "reports": {
1802
+ "dotenv": "gitlab_environment.env",
1803
+ },
1804
+ },
1805
+ "environment": {
1806
+ "action": "stop",
1807
+ "name": "stage/app",
1808
+ "url": "$CL_GITLAB_ENVIRONMENT_URL",
1809
+ },
1810
+ "image": "path/to/docker/kubernetes:the-version",
1811
+ "interruptible": true,
1812
+ "needs": [],
1813
+ "retry": {
1814
+ "max": 2,
1815
+ "when": [
1816
+ "runner_system_failure",
1817
+ "stuck_or_timeout_failure",
1818
+ ],
1819
+ },
1820
+ "rules": [
1821
+ {
1822
+ "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+\\.([0-9]+|x)\\.x$/",
1823
+ "when": "on_success",
1824
+ },
1825
+ {
1826
+ "when": "manual",
1827
+ },
1828
+ ],
1829
+ "script": [
1830
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1831
+ "export ENV_SHORT="stage"",
1832
+ "export APP_DIR="."",
1833
+ "export ENV_TYPE="stage"",
1834
+ "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
1835
+ "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
1836
+ "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
1837
+ "export ROOT_URL="https://app.stage.test-app.pan.panter.cloud"",
1838
+ "export HOST_INTERNAL="app.stage.test-app.pan.panter.cloud"",
1839
+ "export HOST_CANONICAL="app.stage.test-app.pan.panter.cloud"",
1840
+ "export ROOT_URL_INTERNAL="https://app.stage.test-app.pan.panter.cloud"",
1841
+ "export KUBE_NAMESPACE="pan-test-app-stage"",
1842
+ "export KUBE_APP_NAME="app"",
1843
+ "export KUBE_APP_NAME_PREFIX=""",
1844
+ "export SECRET_KEY_BASE="$CL_stage_app_SECRET_KEY_BASE"",
1845
+ "export POSTGRESQL_PASSWORD="$CL_stage_app_POSTGRESQL_PASSWORD"",
1846
+ "export cloudsqlProxyCredentials="$CL_stage_app_cloudsqlProxyCredentials"",
1847
+ "export RAILS_ENV="production"",
1848
+ "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"SECRET_KEY_BASE\\",\\"POSTGRESQL_PASSWORD\\",\\"cloudsqlProxyCredentials\\",\\"RAILS_ENV\\"]"",
1849
+ "export RELEASE_NAME="pan-test-app-stage-app"",
1850
+ "export HELM_EXPERIMENTAL_OCI="1"",
1851
+ "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-app"",
1852
+ "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
1853
+ "export HELM_ARGS=""",
1854
+ "export COMPONENT_NAME="app"",
1855
+ "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
1856
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1857
+ "kubectl config set-cluster "kube-pan-test-app-stage-app" --server="$CL_stage_app_KUBE_URL" --certificate-authority <(echo $CL_stage_app_KUBE_CA_PEM | base64 -d) --embed-certs=true",
1858
+ "kubectl config set-credentials "kube-pan-test-app-stage-app" --token="$CL_stage_app_KUBE_TOKEN"",
1859
+ "kubectl config set-context "kube-pan-test-app-stage-app" --cluster="kube-pan-test-app-stage-app" --user="kube-pan-test-app-stage-app" --namespace="pan-test-app-stage"",
1860
+ "kubectl config use-context "kube-pan-test-app-stage-app"",
1861
+ "kubernetesDelete",
1862
+ "echo 'Disabling component in Dependency Track'",
1863
+ "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-test-app/app" "https://app.stage.test-app.pan.panter.cloud" || true",
1864
+ "echo "CL_GITLAB_ENVIRONMENT_URL=https://app.stage.test-app.pan.panter.cloud" >> gitlab_environment.env",
1865
+ ],
1866
+ "stage": "stop stage",
1867
+ "variables": {
1868
+ "GIT_STRATEGY": "none",
1869
+ "KUBERNETES_CPU_REQUEST": "0.22",
1870
+ "KUBERNETES_MEMORY_LIMIT": "400Mi",
1871
+ "KUBERNETES_MEMORY_REQUEST": "200Mi",
1872
+ },
1873
+ },
1874
+ "app 🧾 sbom | prod ": {
1875
+ "allow_failure": true,
1876
+ "artifacts": {
1877
+ "paths": [
1878
+ "__sbom.json",
1879
+ ],
1880
+ },
1881
+ "image": "aquasec/trivy:0.38.3",
1882
+ "interruptible": true,
1883
+ "needs": [],
1884
+ "retry": {
1885
+ "max": 2,
1886
+ "when": [
1887
+ "runner_system_failure",
1888
+ "stuck_or_timeout_failure",
1889
+ ],
1890
+ },
1891
+ "script": [
1892
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1893
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1894
+ "trivy fs --quiet --format cyclonedx --output "__sbom.json" .",
1895
+ ],
1896
+ "stage": "build",
1897
+ "variables": {},
1898
+ },
1899
+ "app 🧾 sbom | stage ": {
1900
+ "allow_failure": true,
1901
+ "artifacts": {
1902
+ "paths": [
1903
+ "__sbom.json",
1904
+ ],
1905
+ },
1906
+ "image": "aquasec/trivy:0.38.3",
1907
+ "interruptible": true,
1908
+ "needs": [],
1909
+ "retry": {
1910
+ "max": 2,
1911
+ "when": [
1912
+ "runner_system_failure",
1913
+ "stuck_or_timeout_failure",
1914
+ ],
1915
+ },
1916
+ "script": [
1917
+ "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
1918
+ "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
1919
+ "trivy fs --quiet --format cyclonedx --output "__sbom.json" .",
1920
+ ],
1921
+ "stage": "build",
1922
+ "variables": {},
1923
+ },
1924
+ },
1925
+ "stages": [
1926
+ "setup",
1927
+ "setup dev",
1928
+ "setup review",
1929
+ "setup stage",
1930
+ "setup prod",
1931
+ "test",
1932
+ "test dev",
1933
+ "test review",
1934
+ "test stage",
1935
+ "test prod",
1936
+ "build",
1937
+ "build dev",
1938
+ "build review",
1939
+ "build stage",
1940
+ "build prod",
1941
+ "deploy",
1942
+ "deploy dev",
1943
+ "deploy review",
1944
+ "deploy stage",
1945
+ "deploy prod",
1946
+ "verify",
1947
+ "verify dev",
1948
+ "verify review",
1949
+ "verify stage",
1950
+ "verify prod",
1951
+ "rollback",
1952
+ "rollback dev",
1953
+ "rollback review",
1954
+ "rollback stage",
1955
+ "rollback prod",
1956
+ "stop",
1957
+ "stop dev",
1958
+ "stop review",
1959
+ "stop stage",
1960
+ "stop prod",
1961
+ ],
1962
+ "variables": {
1963
+ "ARTIFACT_COMPRESSION_LEVEL": "fast",
1964
+ "CACHE_COMPRESSION_LEVEL": "fast",
1965
+ "FF_USE_FASTZIP": "true",
1966
+ "GIT_DEPTH": "1",
1967
+ "TRANSFER_METER_FREQUENCY": "5s",
1968
+ },
1969
+ "workflow": {
1970
+ "rules": [
1971
+ {
1972
+ "if": "$CI_COMMIT_TAG",
1973
+ },
1974
+ {
1975
+ "if": "$CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/",
1976
+ "when": "never",
1977
+ },
1978
+ {
1979
+ "if": "$CI_PIPELINE_SOURCE == "schedule"",
1980
+ "when": "never",
1981
+ },
1982
+ {
1983
+ "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+.([0-9]+|x).x$/",
1984
+ },
1985
+ {
1986
+ "if": "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH",
1987
+ },
1988
+ {
1989
+ "if": "$CI_MERGE_REQUEST_ID",
1990
+ },
1991
+ ],
1992
+ },
1993
+ },
1994
+ }
1995
+ `;