.drone.yml

---
kind: pipeline
name: default
type: kubernetes

environment:
  APP_NAME: epp
  UAT_ENV: sas-epp-uat
  BRANCH_ENV: sas-epp-branch
  IMAGE_URL: 340268328991.dkr.ecr.eu-west-2.amazonaws.com
  IMAGE_REPO: sas/epp
  GIT_REPO: UKHomeOffice/explosives-precursors-poisons
  HOF_CONFIG: hof-services-config/Explosives_Precursors_Poisons
  NON_PROD_AVAILABILITY: Mon-Fri 08:00-23:00 Europe/London
  READY_FOR_TEST_DELAY: 20s

include_default_branch: &include_default_branch
  include:
    - master

include_default_and_feature_branches: &include_default_and_feature_branches
  include:
    - master
    - EPP-*
    
steps:
  - name: clone_repos
    pull: if-not-exists
    image: alpine/git
    environment:
      DRONE_GIT_USERNAME:
        from_secret: drone_git_username
      DRONE_GIT_TOKEN:
        from_secret: drone_git_token
    commands:
      - git clone https://$${DRONE_GIT_USERNAME}:$${DRONE_GIT_TOKEN}@github.com/UKHomeOfficeForms/hof-services-config.git
    when:
      branch:
        <<: *include_default_and_feature_branches
      event: [push, pull_request]

  # Trivy Security Scannner for scanning OS related vulnerabilities in Base image of Dockerfile
  - name: scan_base_image_os
    pull: always
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/trivy/client:latest
    resources:
      limits:
        cpu: 1000
        memory: 1024Mi
    environment:
      IMAGE_NAME: node:20.18.0-alpine3.20@sha256:d504f23acdda979406cf3bdbff0dff7933e5c4ec183dda404ed24286c6125e60
      SERVICE_URL: https://acp-trivy-helm.acp-trivy.svc.cluster.local:443
      SEVERITY: MEDIUM,HIGH,CRITICAL  --dependency-tree
      FAIL_ON_DETECTION: false
      IGNORE_UNFIXED: false
      ALLOW_CVE_LIST_FILE: hof-services-config/infrastructure/trivy/.trivyignore.yaml
    volumes:
      - name: dockersock
        path: /root/.dockersock
    when:
      event: [push, pull_request]
    depends_on:
      - clone_repos

  - name: build_image
    pull: if-not-exists
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/dind
    commands:
      - n=0; while [ "$n" -lt 60 ] && ! docker stats --no-stream >/dev/null 2>&1; do n=$(( n + 1 )); sleep 1; done
      - docker build --no-cache -t $${IMAGE_REPO}:$${DRONE_COMMIT_SHA} .
    volumes:
      - name: dockersock
        path: /var/run
    when:
      branch:
        <<: *include_default_and_feature_branches
      event: [push, pull_request]

  - name: image_to_ecr
    pull: if-not-exists
    image: plugins/ecr
    settings:
      access_key:
        from_secret: aws_access_key_id
      secret_key:
        from_secret: aws_secret_access_key
      region: eu-west-2
      repo: sas/epp
      registry: 340268328991.dkr.ecr.eu-west-2.amazonaws.com
      tags:
        - ${DRONE_COMMIT_SHA}
    when:
      branch:
        <<: *include_default_and_feature_branches
      event: [push, pull_request]

  # Trivy Security Scannner for scanning nodejs packages in Yarn
  - name: scan_node_packages
    pull: always
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/trivy/client:latest
    resources:
      limits:
        cpu: 1000
        memory: 1024Mi
    environment:
      IMAGE_NAME: sas/epp:${DRONE_COMMIT_SHA}
      SEVERITY: MEDIUM,HIGH,CRITICAL  --dependency-tree --format table
      FAIL_ON_DETECTION: false
      IGNORE_UNFIXED: false
      ALLOW_CVE_LIST_FILE: hof-services-config/infrastructure/trivy/.trivyignore.yaml
    volumes:
      - name: dockersock
        path: /root/.dockersock
    when:
      event: [push, pull_request]
    depends_on:
      - build_image

  - name: deploy_to_branch
    pull: if-not-exists
    image: quay.io/ukhomeofficedigital/kd:v1.18.0
    environment:
      KUBE_SERVER:
        from_secret: kube_server_dev
      KUBE_TOKEN:
        from_secret: kube_token_dev
    commands:
      - bin/deploy.sh $${BRANCH_ENV}
    when:
      branch:
        <<: *include_default_and_feature_branches
      event: pull_request
    depends_on:
      - clone_repos
      - image_to_ecr

services:
  - name: docker
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/dind

  # Redis session setup in background so ui integration tests can run
  - name: session
    image: redis
    volumes:
      - name: dockersock
        path: /var/run

volumes:
  - name: dockersock
    temp: {}

...