@leverege/build-tools 1.8.4

package/src/circleate

@@ -0,0 +1,549 @@
+#!/bin/bash
+if [ -z "$1" ]; then
+  echo "   Usage: repo type <ui/server/lib>"
+  exit 1
+fi
+
+if [ "$1" != "server" ] && [ "$1" != "ui" ] && [ "$1" != "lib" ]; then
+  echo "   Only ui, server, or lib accepted currently"
+  exit 1
+fi
+
+repo_type=$1
+
+check_circle_config(){
+  if [ -d "./.circleci" ];
+  then
+    printf "\nThere is an existing CircleCI config, do you want to override?\n\n"
+    printf "Hit return to continue or ^C to exit\n\n"; read ANS
+    rm -rf ./.circleci
+  fi
+
+  mkdir -p ./.circleci
+}
+
+strip_undefined() {
+  local result="$1"
+  [ "$1" == "undefined" ] && result=""
+  printf "$result"
+}
+
+create_circle_config(){
+  echo "Creating the CircleCI config file"
+  cd .circleci
+  if [ "$repo_type" = "server" ]; then
+    create_server_config
+  elif [ "$repo_type" = "lib" ]; then
+    create_lib_config
+  else
+    create_ui_config
+  fi
+}
+
+create_server_config(){
+  cat<<EOCIRCLE > config.yml
+version: 2.1
+orbs:
+  gcp-gcr: circleci/gcp-gcr@0.0.1
+  anchore: anchore/anchore-engine@1.2.0
+executors:
+  default:
+    description: >
+      A debian-based machine executor.
+    machine: true
+  anchore_engine:
+    description: Machine runner with anchore engine default environment variables set.
+    parameters:
+      anchore_engine_version:
+        description: Version of anchore-engine container to run (recommended to keep default value)
+        type: string
+        default: "v0.3.2"
+    environment:
+      ANCHORE_CLI_USER: admin
+      ANCHORE_CLI_PASS: foobar
+      ANCHORE_CLI_SSL_VERIFY: 'n'
+      ANCHORE_VERSION: << parameters.anchore_engine_version >>
+    machine:
+      image: circleci/classic:201808-01
+jobs:
+  docker-scan:
+    # runs anchore image scan for vulnerabilities
+    executor: anchore/anchore_engine
+    steps:
+      - attach_workspace:
+          at: ~/project
+      - run:
+          name: build container
+          command: 'docker build -t "\${CIRCLE_PROJECT_REPONAME}:ci" ~/project/docker/'
+      - anchore/analyze_local_image:
+          image_name: '\${CIRCLE_PROJECT_REPONAME}:ci'
+          timeout: '500'
+          policy_failure: true
+      - anchore/parse_reports
+
+  gcr:
+    # gcr build docker image and pushes to gcr
+    executor: default
+    steps: 
+      - attach_workspace:
+          at: ~/project
+      - run: |
+          echo "export CONTAINER_NAME=\$(cat ~/project/container_name)" >> \$BASH_ENV
+          echo "export PACKAGE_VERSION=\$(cat ~/project/package_version)" >> \$BASH_ENV
+      - gcp-gcr/gcr-auth
+      - gcp-gcr/build-image:
+          image: \$CONTAINER_NAME
+          tag: \$PACKAGE_VERSION
+          path-to-dockerfile: docker
+      - gcp-gcr/push-image:
+          image: \$CONTAINER_NAME
+          tag: \$PACKAGE_VERSION
+
+  smoke-test:
+    # smoke test checks for license, security, and linting
+    docker: 
+      - image: circleci/node:10.14.1
+    steps:
+      - checkout
+      - restore_cache:
+          key: dependency-cache-{{ checksum "package.json" }}
+      - run:
+          name: Setup @leverege Token
+          command: echo \${NPMRC} > ~/.npmrc
+      - run: npm install
+
+      - save_cache:
+          key: dependency-cache-{{ checksum "package.json" }}
+          paths:
+            - ./node_modules
+
+      - run: 
+          name: Check for vulnerabilities
+          command: npm run vuln
+
+      - run:
+          name: Check for LICENSE and README files
+          command: npm run pkglint
+
+      - run:
+          name: Check for license violations (e.g. GPL)
+          command: |
+            npm install license-checker
+            npm run licenseCheck
+
+      - run: 
+          name: Lint and save results
+          command: npm run lint-ci
+
+      - store_test_results:
+          path: reports
+
+  coverage:
+    # coverage runs tests, generates coverage, and saves docs
+    docker:
+      - image: circleci/node:10.14.1
+      # IF YOU NEED ANY OF THESE, UNCOMMENT TO USE
+      # - image: redis
+      # - image: circleci/mysql:5.7
+      #   environment: 
+      #     MYSQL_USER: root
+      #     MYSQL_ROOT_PASSWORD: root
+      #     MYSQL_ALLOW_EMPTY_PASSWORD: true
+      #     MYSQL_HOST: 127.0.0.1
+      # - image: nsqio/nsq
+      #   command: /nsqlookupd -broadcast-address localhost:4160 -tcp-address 0.0.0.0:4160 -http-address 0.0.0.0:4161
+
+      # - image: nsqio/nsq
+      #   command: >
+      #     /nsqd
+      #     -broadcast-address localhost:4150
+      #     -tcp-address 0.0.0.0:4150
+      #     -http-address 0.0.0.0:4151
+      #     -lookupd-tcp-address localhost:4160
+
+    steps:
+      - checkout
+      - restore_cache:
+          key: dependency-cache-{{ checksum "package.json" }}
+
+      - run:
+          name: Setup @leverege Token
+          command: echo \${NPMRC} > ~/.npmrc
+
+      - run: npm install
+
+      # UNCOMMENT IF YOU NEED DECRYPTING SECRETS
+      # - run: 
+      #     name: Load secrets
+      #     command: npm run decrypt
+
+      - run:
+          name: Run Tests and Generate Code Coverage
+          command: npm run coverage
+
+      - run: 
+          name: Generate docs
+          command: |
+            npm install jsdoc 
+            npm run docs
+   
+      - store_artifacts:
+          path: coverage
+          prefix: coverage
+
+      - store_artifacts:
+          path: docs
+          prefix: docs
+
+  build:
+    # build should make dist image and prepare docker file
+    docker:
+      - image: circleci/node:10.14.1
+
+    steps:
+      - checkout
+      - restore_cache:
+          key: dependency-cache-{{ checksum "package.json" }}
+
+      - run:
+          name: Setup @leverege Token
+          command: |
+            echo \${NPMRC} > ~/.npmrc
+            echo \${NPMRC} > ~/.npmrc.ro
+
+      - run: npm install
+
+      - run: 
+          name: Determine version number and container name
+          command: |
+            PACKAGE_VERSION=\$(node -p "require('./package.json').version")
+            container="\`node -p \"require('./package.json').leverege.container\"\`"
+            if [ "\$container" == "undefined" ];
+            then
+              container=\$CIRCLE_PROJECT_REPONAME
+            fi
+
+            echo v\${PACKAGE_VERSION} > package_version
+            echo "export PACKAGE_VERSION=v\${PACKAGE_VERSION}" >> \$BASH_ENV
+            echo \${container} > container_name
+      - run: 
+          name: Create Dockerfile and build dist directory
+          command: npm run dockerize \$PACKAGE_VERSION
+
+      - persist_to_workspace:
+          root: ~/project
+          paths:
+            - dist/*
+            - docker/*
+            - package_version
+            - container_name
+            - package*json
+
+workflows:
+  version: 2.1
+  test-build-deploy:
+    jobs:
+      - smoke-test:
+          context: npm
+      - coverage:
+          context: npm 
+          requires:
+            - smoke-test
+      - build:
+          context: npm
+          filters:
+            branches:
+              only: master
+          requires:
+            - smoke-test
+      - docker-scan:
+          filters:
+            branches:
+              only: master
+          requires:
+            - smoke-test
+            - coverage
+            - build
+      - gcr:
+          context: google
+          filters:
+            branches:
+              only: master
+          requires:
+            - smoke-test
+            - build
+            - coverage
+            - docker-scan
+EOCIRCLE
+}
+
+create_lib_config(){
+  cat<<EOCIRCLE > config.yml
+version: 2.1
+jobs:
+  smoke-test:
+    # smoke test checks for license, security, and linting
+    docker: 
+      - image: circleci/node:10.14.1
+    steps:
+      - checkout
+      - restore_cache:
+          key: dependency-cache-{{ checksum "package.json" }}
+      - run:
+          name: Setup @leverege Token
+          command: echo \${NPMRC} > ~/.npmrc
+      - run: npm install
+
+      - save_cache:
+          key: dependency-cache-{{ checksum "package.json" }}
+          paths:
+            - ./node_modules
+
+      - run: 
+          name: Check for vulnerabilities
+          command: npm run vuln
+
+      - run:
+          name: Check for LICENSE and README files
+          command: npm run pkglint
+
+      - run:
+          name: Check for license violations (e.g. GPL)
+          command: |
+            npm install license-checker
+            npm run licenseCheck
+
+      - run: 
+          name: Lint and save results
+          command: npm run lint-ci
+
+      - store_test_results:
+          path: reports
+
+  coverage:
+    # coverage runs tests, generates coverage, and saves docs
+    docker:
+      - image: circleci/node:10.14.1
+      # IF YOU NEED ANY OF THESE, UNCOMMENT TO USE
+      # - image: redis
+      # - image: circleci/mysql:5.7
+      #   environment: 
+      #     MYSQL_USER: root
+      #     MYSQL_ROOT_PASSWORD: root
+      #     MYSQL_ALLOW_EMPTY_PASSWORD: true
+      #     MYSQL_HOST: 127.0.0.1
+      # - image: nsqio/nsq
+      #   command: /nsqlookupd -broadcast-address localhost:4160 -tcp-address 0.0.0.0:4160 -http-address 0.0.0.0:4161
+
+      # - image: nsqio/nsq
+      #   command: >
+      #     /nsqd
+      #     -broadcast-address localhost:4150
+      #     -tcp-address 0.0.0.0:4150
+      #     -http-address 0.0.0.0:4151
+      #     -lookupd-tcp-address localhost:4160
+
+    steps:
+      - checkout
+      - restore_cache:
+          key: dependency-cache-{{ checksum "package.json" }}
+
+      - run:
+          name: Setup @leverege Token
+          command: echo \${NPMRC} > ~/.npmrc
+
+      - run: npm install
+
+      # UNCOMMENT IF YOU NEED DECRYPTING SECRETS
+      # - run: 
+      #     name: Load secrets
+      #     command: npm run decrypt
+      
+      - run:
+          name: Run Tests and Generate Code Coverage
+          command: npm run coverage
+
+      - run: 
+          name: Generate docs
+          command: |
+            npm install jsdoc 
+            npm run docs
+   
+      - store_artifacts:
+          path: coverage
+          prefix: coverage
+
+      - store_artifacts:
+          path: docs
+          prefix: docs
+
+  # publish:
+  #  # publish the package to npm registry - CURRENTLY DISABLED
+
+workflows:
+  version: 2.1
+  test-build-deploy:
+    jobs:
+      - smoke-test:
+          context: npm
+      - coverage:
+          context: npm 
+          requires:
+            - smoke-test
+      # - publish:
+      #     context: npm
+      #     filters:
+      #       branches:
+      #         only: master
+      #     requires:
+      #       - smoke-test
+      #       - coverage
+EOCIRCLE
+}
+
+create_ui_config(){
+  # Determine URLs per environment
+  echo "Please provide the dev site URL"
+  read DEV_URL
+
+  echo "Please provide the prod site URL"
+  read PROD_URL
+
+  # Determine GCP project
+  echo "Please provide the dev GCP project id"
+  read DEV_PROJECT
+
+  echo "Please provide the prod GCP project id"
+  read PROD_PROJECT
+
+  # Build circle config based on variables
+  cat<<EOCIRCLE > config.yml
+version: 2.1
+orbs:
+  gcp-gcr: circleci/gcp-cli@1.0.4
+executors:
+  google:
+    description: The official Google docker container with gcloud SDK pre-installed
+    docker:
+      - image: google/cloud-sdk
+
+jobs:
+  gcs-dev:
+    executor: google
+    steps: 
+      - attach_workspace:
+          at: ~/project
+      # https://gist.github.com/DarrenN/8c6a5b969481725a4413
+      - run: |
+           echo "export PACKAGE_VERSION=v\$(grep -m1 version package.json | awk -F: '{ print \$2 }' | sed 's/[", ]//g')" >> \$BASH_ENV
+      - gcp-gcr/initialize
+      - run: |
+          gsutil mb gs://\$PACKAGE_VERSION.$DEV_URL
+          gsutil -m cp -r ./project/image/* gs://\$PACKAGE_VERSION.$DEV_URL
+          gsutil setmeta -h "Content-Encoding:gzip" gs://\$PACKAGE_VERSION.$DEV_URL/bundle.js
+          gsutil iam ch allUsers:objectViewer gs://$DEV_URL
+      - run: |
+          gsutil mb gs://$DEV_URL
+          gsutil -m rm gs://$DEV_URL/**
+          gsutil -m cp -r gs://\$PACKAGE_VERSION.$DEV_URL/* gs://$DEV_URL
+          gsutil setmeta -h "Content-Encoding:gzip" gs://$DEV_URL/bundle.js
+          gsutil iam ch allUsers:objectViewer gs://$DEV_URL
+
+  gcs-prod:
+    executor: google
+    steps: 
+      - attach_workspace:
+          at: ~/project
+      # https://gist.github.com/DarrenN/8c6a5b969481725a4413
+      - run: |
+           echo "export PACKAGE_VERSION=v\$(grep -m1 version package.json | awk -F: '{ print \$2 }' | sed 's/[", ]//g')" >> \$BASH_ENV
+      - gcp-gcr/initialize
+      - run: |
+          gsutil mb gs://\$PACKAGE_VERSION.$PROD_URL
+          gsutil -m cp -r ./project/image/* gs://\$PACKAGE_VERSION.$PROD_URL
+          gsutil setmeta -h "Content-Encoding:gzip" gs://\$PACKAGE_VERSION.$PROD_URL/bundle.js
+          gsutil iam ch allUsers:objectViewer gs://$PROD_URL
+      - run: |
+          gsutil mb gs://$PROD_URL
+          gsutil -m rm gs://$PROD_URL/**
+          gsutil -m cp -r gs://\$PACKAGE_VERSION.$PROD_URL/* gs://$PROD_URL
+          gsutil setmeta -h "Content-Encoding:gzip" gs://$PROD_URL/bundle.js
+          gsutil iam ch allUsers:objectViewer gs://$PROD_URL
+
+  build:
+    docker:
+      - image: circleci/node:10.14.1
+    steps:
+      - checkout
+      - restore_cache:
+          key: dependency-cache-{{ checksum "package.json" }}
+
+      - run:
+          name: Setup @leverege Token
+          command: echo \${NPMRC} > ~/.npmrc
+
+      - run: npm install
+
+      - save_cache:
+          key: dependency-cache-{{ checksum "package.json" }}
+          paths:
+            - ./node_modules
+
+      - run: 
+          name: Install license-checker
+          command: npm install license-checker
+
+      - run:
+          name: Check for license violations (e.g. GPL)
+          command: npm run licenseCheck
+
+      - run:
+          name: Bundle using webpack
+          command: |
+            npm run clean
+            npm run build
+            rm -fr ./image
+            mkdir ./image
+            cp -fr ./dist/* ./image/
+            gzip ./image/bundle.js
+            mv ./image/bundle.js.gz ./image/bundle.js
+
+      - persist_to_workspace:
+          root: ~/project
+          paths:
+            - image/*
+            - package.json
+
+workflows:
+  version: 2.1
+  build-deploy-dev:
+    jobs:
+      - build:
+          context: npm 
+      - gcs-dev:
+          context: $DEV_PROJECT
+          filters:
+            branches:
+              only: /release-.*/
+          requires:
+            - build
+  build-deploy-prod:
+    jobs:
+      - build:
+          context: npm
+          filters:
+            branches:
+              only: master
+      - gcs-prod:
+          context: $PROD_PROJECT
+          filters:
+            branches:
+              only: master
+          requires:
+            - build
+
+EOCIRCLE
+}
+
+check_circle_config
+create_circle_config

package/src/decrypt-secrets

@@ -0,0 +1,91 @@
+#!/bin/bash
+display_usage() { 
+  echo "This script decrypts files using Google KMS." 
+  echo -e "\nInputs: .env.enc and secrets.tar.gz.enc (if it exists) \n" 
+} 
+
+install_gcloud() {
+  install () {
+    # Set sudo to work whether logged in as root user or non-root user
+    if [[ $EUID == 0 ]]; then export SUDO=""; else export SUDO="sudo"; fi
+
+    # Create an environment variable for the correct distribution
+    if [[ $(command -v lsb_release) == "" ]]; then
+      $SUDO apt-get update && $SUDO apt-get -y install lsb-release
+      export CLOUD_SDK_REPO="cloud-sdk-$(lsb_release -c -s)"
+    else
+      export CLOUD_SDK_REPO="cloud-sdk-$(lsb_release -c -s)"
+    fi
+
+    # Add the Google Cloud SDK distribution URI as a package source
+    echo "deb http://packages.cloud.google.com/apt $CLOUD_SDK_REPO main" | $SUDO tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
+
+    # Import the Google Cloud public key
+    if [[ $(command -v curl) == "" ]]; then
+      $SUDO apt-get update && $SUDO apt-get -y install curl
+      curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | $SUDO apt-key add -
+    else
+      curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | $SUDO apt-key add -
+    fi
+
+    # Update and install the Cloud SDK
+    $SUDO apt-get update && $SUDO apt-get -y install google-cloud-sdk
+  }
+
+  if grep 'docker\|lxc' /proc/1/cgroup; then
+    if [[ $(command -v gcloud) == "" ]]; then
+      install
+    else
+      echo "gcloud CLI is already installed."
+    fi
+  else
+    echo "----------------------------------------------------------------------------------------------------"
+    echo "this is a machine executor job, replacing default installation of gcloud CLI"
+    echo "----------------------------------------------------------------------------------------------------"
+    sudo rm -rf /opt/google-cloud-sdk
+    install
+  fi
+}
+
+initialize_gcloud() {
+  echo ${GCLOUD_SERVICE_KEY} > ${HOME}/gcloud-service-key.json
+
+  # Initialize gcloud CLI
+  gcloud auth activate-service-account --key-file=${HOME}/gcloud-service-key.json
+  gcloud --quiet config set project ${GOOGLE_PROJECT_ID}
+  gcloud --quiet config set compute/zone ${GOOGLE_COMPUTE_ZONE}
+}
+
+if [ "$1" == "-h" ]; then
+  display_usage
+  exit 1
+fi
+
+if [ "$CIRCLECI" == "true" ]; then
+  install_gcloud
+  initialize_gcloud
+fi
+
+
+if [ -f "secrets.tar.gz.enc" ]; then
+  # decrypt the secrets.tar.gz.enc
+  gcloud kms decrypt \
+    --project leverege-docker-images \
+    --key circle-ci \
+    --keyring build-tools \
+    --location us-east4 \
+    --plaintext-file secrets.tar.gz \
+    --ciphertext-file secrets.tar.gz.enc
+
+  # untar secrets.tar.gz
+  tar xvzf secrets.tar.gz
+fi
+
+# decrypt .env.enc file
+gcloud kms decrypt \
+  --project leverege-docker-images \
+  --key circle-ci \
+  --keyring build-tools \
+  --location us-east4 \
+  --plaintext-file .env \
+  --ciphertext-file .env.enc