cloudbuild.yaml

timeout: 60m
steps:
  # We need to unshallow the clone so Sentry can get the history; except that
  # this is a private repository, and the FETCH step has thrown the keys away
  # already.  Install a deploy key, known_hosts and swap the URL around to the
  # ssh one, so we can unshallow.
  - id: "set up SSH"
    name: "gcr.io/cloud-builders/git"
    secretEnv: ["_SSH_KEY"]
    entrypoint: "bash"
    args:
      - -c
      - |
        echo "$$_SSH_KEY" >> /root/.ssh/id_ed25519
        chmod 400 /root/.ssh/id_ed25519
        cp .github/known_hosts /root/.ssh/known_hosts
    volumes:
      - name: "ssh"
        path: /root/.ssh
  - id: "set origin URL"
    name: gcr.io/cloud-builders/git
    args:
      - "remote"
      - "set-url"
      - "origin"
      - "git@github.com:CAVaccineInventory/vial"
  - id: "git fetch --unshallow"
    name: gcr.io/cloud-builders/git
    args: ["fetch", "--unshallow"]
    volumes:
      - name: "ssh"
        path: /root/.ssh

  # Tell Sentry about the release; we need to use `/bin/sh` as the entrypoint to
  # allow the $_SENTRY_TOKEN injection at runtime.
  - id: "sentry releases new"
    name: getsentry/sentry-cli
    entrypoint: /bin/sh
    args:
      - "-c"
      - |
        sentry-cli --auth-token=$$_SENTRY_TOKEN \
            releases --org=vaccinateca \
            new --project=vial ${COMMIT_SHA}
    secretEnv: ["_SENTRY_TOKEN"]
  # Also tell it the commits that it has
  - id: "sentry releases set-commits"
    name: getsentry/sentry-cli
    entrypoint: /bin/sh
    args:
      - "-c"
      - |
        sentry-cli --auth-token=$$_SENTRY_TOKEN \
          releases --org=vaccinateca \
          set-commits --auto ${COMMIT_SHA}
    secretEnv: ["_SENTRY_TOKEN"]

  # Pull the previous image, as a starting point
  - id: "fetch previous image"
    name: gcr.io/cloud-builders/docker
    entrypoint: bash
    args: ["-c", "docker pull ${_IMAGE_NAME}:latest || exit 0"]

  # See Dockerfile; build and tag the image, using the cache in the last step.
  # We build the COMMIT_SHA into the image, so it knows what version it is.
  - id: "build image"
    name: "gcr.io/cloud-builders/docker"
    args:
      - build
      - "--build-arg"
      - "COMMIT_SHA=$COMMIT_SHA"
      - "-t"
      - "${_IMAGE_NAME}:${COMMIT_SHA}"
      - "-t"
      - "${_IMAGE_NAME}:latest"
      - "--cache-from"
      - "${_IMAGE_NAME}:latest"
      - .

  # Start up a postgres for tests
  - id: "start postgres"
    name: "gcr.io/cloud-builders/docker"
    args:
      - "run"
      - "-d"
      - "--network=cloudbuild"
      - "-e"
      - "POSTGRES_HOST_AUTH_METHOD=trust"
      - "-e"
      - "POSTGRES_USER=postgres"
      - "-e"
      - "POSTGRES_PASSWORD=postgres"
      - "-e"
      - "POSTGRES_DB=vaccinate"
      - "--name"
      - "vaccinate-db"
      - "postgis/postgis:13-3.1"
  - id: "wait for postgres"
    name: "jwilder/dockerize"
    args: ["dockerize", "-timeout=60s", "-wait=tcp://vaccinate-db:5432"]

  - id: "test image"
    name: "gcr.io/cloud-builders/docker"
    args:
      - "run"
      - "-t"
      - "--network=cloudbuild"
      - "-e"
      - "DJANGO_SECRET_KEY=1"
      - "-e"
      - "SOCIAL_AUTH_AUTH0_SECRET="
      - "-e"
      - "DATABASE_URL=postgres://postgres:postgres@vaccinate-db:5432/vaccinate"
      - "${_IMAGE_NAME}:latest"
      - "pytest"
      - "-vv"

  - id: "stop postgres"
    name: "gcr.io/cloud-builders/docker"
    args: ["rm", "--force", "vaccinate-db"]

  # Push the commit-sha tag (but not `latest` tag), so we can deploy it
  - id: "push image"
    name: "gcr.io/cloud-builders/docker"
    args: ["push", "${_IMAGE_NAME}:${COMMIT_SHA}"]

  # Apply the database migrations to the live database; exec-wrapper does
  # nothing other than standing up a cloud_sql_proxy at the same path as Cloud
  # Run/AppEngine, then exec'ing inside the image.  Because this needs access to
  # secrets, pass in the GCLOUD_SETTINGS_NAME.
  - id: "apply migrations"
    name: "gcr.io/google-appengine/exec-wrapper"
    args:
      [
        "-i",
        "${_IMAGE_NAME}:${COMMIT_SHA}",
        "-s",
        "${_CLOUDSQL_INSTANCE}",
        "-e",
        "GCLOUD_SETTINGS_NAME=${_GCLOUD_SETTINGS_NAME}",
        "--",
        "python",
        "manage.py",
        "migrate",
      ]

  # Finalize the Sentry release, timestamp for deploy duration
  - id: "sentry releases finalize"
    name: getsentry/sentry-cli
    entrypoint: /bin/sh
    args:
      - "-c"
      - |
        sentry-cli --auth-token=$$_SENTRY_TOKEN \
            releases --org=vaccinateca \
            finalize ${COMMIT_SHA}
    secretEnv: ["_SENTRY_TOKEN"]
  - id: "sentry timestamp"
    name: getsentry/sentry-cli
    entrypoint: /bin/sh
    args: ["-c", "date +%s > /timestamp/build"]
    volumes:
      - name: "timestamp"
        path: /timestamp

  # Deploy the new code.
  - id: "cloud-sdk run services update"
    name: gcr.io/google.com/cloudsdktool/cloud-sdk
    args:
      - run
      - services
      - update
      - "${_SERVICE_NAME}-${_DEPLOY}"
      - "--platform=managed"
      - "--image=${_IMAGE_NAME}:${COMMIT_SHA}"
      - "--labels=commit-sha=${COMMIT_SHA},gcb-build-id=${BUILD_ID},deploy=${_DEPLOY}"
      - "--region=${_DEPLOY_REGION}"
      - "--set-env-vars=DEPLOY=${_DEPLOY}"
      - "--set-env-vars=GCLOUD_SETTINGS_NAME=${_GCLOUD_SETTINGS_NAME}"
      - "--set-env-vars=RUNNING_IN_GCLOUD=1"
      - "--set-cloudsql-instances=${_CLOUDSQL_INSTANCE}"
      - "--service-account=${_DEPLOY}@django-vaccinateca.iam.gserviceaccount.com"
    entrypoint: gcloud

  # Tell Sentry about the deploy
  - id: "sentry releases deploys new"
    name: getsentry/sentry-cli
    entrypoint: /bin/sh
    args:
      - "-c"
      # TODO --started=....unix...
      - |
        sentry-cli --auth-token=$$_SENTRY_TOKEN \
            releases --org=vaccinateca \
            deploys ${COMMIT_SHA} new \
            --env=${_DEPLOY} --started=$(cat /timestamp/build)
    volumes:
      - name: "timestamp"
        path: /timestamp
    secretEnv: ["_SENTRY_TOKEN"]

  # Tell honeycomb about the deploy
  - id: "honeycomb tag"
    name: gcr.io/cloud-builders/gcloud
    entrypoint: "bash"
    args:
      [
        "./scripts/cd/honeytag.sh",
        "vial-$_DEPLOY",
        "Deploy $SHORT_SHA",
        "https://github.com/CAVaccineInventory/vial/commits/$COMMIT_SHA",
      ]

options:
  dynamic_substitutions: true

availableSecrets:
  secretManager:
    - versionName: projects/373178984669/secrets/sentry-release-token/versions/latest
      env: _SENTRY_TOKEN
    - versionName: projects/373178984669/secrets/github-deploy/versions/latest
      env: _SSH_KEY

substitutions:
  _SERVICE_NAME: vaccinate
  _GCR_HOSTNAME: us.gcr.io
  _IMAGE_NAME: "${_GCR_HOSTNAME}/${PROJECT_ID}/${_SERVICE_NAME}"

  _DEPLOY: staging
  _DEPLOY_REGION: us-west2
  _DB_INSTANCE_NAME: "${_DEPLOY}"
  _GCLOUD_SETTINGS_NAME: "django-${_DEPLOY}-env"
  _CLOUDSQL_INSTANCE: "${PROJECT_ID}:${_DEPLOY_REGION}:${_DB_INSTANCE_NAME}"

# As the final step, this updates the `latest` image tag, once the deploy is
# complete.
images:
  - "${_IMAGE_NAME}:latest"