.drone.yaml

---
kind: pipeline
name: Build Image
type: kubernetes

platform:
  os: linux
  arch: amd64

environment:
  APP_NAME: ukvi-evisa
  UAT_ENV: sas-web-messengers-uat
  GIT_REPO: UKHomeOffice/evisa-web-messenger
  HOF_CONFIG: hof-services-config/Ukimmigration-Support-Webchat
  BRANCH_ENV: sas-web-messengers-branch
  STG_ENV: sas-web-messengers-stg
  PROD_ENV: sas-web-messengers-prod
  PRODUCTION_URL: ukvi-evisa-support-webchat.homeoffice.gov.uk
  IMAGE_URL: 340268328991.dkr.ecr.eu-west-2.amazonaws.com
  IMAGE_REPO: so/evisa-web-messenger
  NON_PROD_AVAILABILITY: Mon-Fri 00:00-23:59 Europe/London
  READY_FOR_TEST_DELAY: 20s

include_default_branch: &include_default_branch
  include:
    - main

include_all_branches: &include_all_branches
  include:
    - main
    - feature/*
    - fix/*

trigger:
  branch:
    <<: *include_all_branches

node_image: &node_image
  pull: if-not-exists
  image: node:24.18.0-alpine3.24@sha256:4ba75f835bb8802193e4c114572113d4b26f95f6f094f4b5229d2a77773e0afc

lint: &lint
  pull: if-not-exists
  image: node:24.18.0-alpine3.24@sha256:4ba75f835bb8802193e4c114572113d4b26f95f6f094f4b5229d2a77773e0afc
  commands:
    - yarn lint:ci

unit_tests: &unit_tests
  pull: if-not-exists
  image: node:24.18.0-alpine3.24@sha256:4ba75f835bb8802193e4c114572113d4b26f95f6f094f4b5229d2a77773e0afc
  commands:
    - yarn run test:unit

sonar_scanner: &sonar_scanner
  pull: always
  image: quay.io/ukhomeofficedigital/sonar-scanner:latest
  commands:
    - sonar-scanner -Dproject.settings=./sonar-project.properties

github_app_token_step: &github_app_token_step
  pull: if-not-exists
  image: alpine:3.21
  volumes:
    - name: dockersock
      path: /root/.dockersock
  commands:
    - apk add --no-cache bash curl jq openssl
    - test -n "$GITHUB_APP_ID" || (echo "Missing GITHUB_APP_ID secret." && exit 1)
    - test -n "$GITHUB_APP_PRIVATE_KEY" || (echo "Missing GITHUB_APP_PRIVATE_KEY secret." && exit 1)
    - test -n "$GITHUB_APP_INSTALLATION_ID" || (echo "Missing GITHUB_APP_INSTALLATION_ID secret." && exit 1)
    - test -n "$OUTPUT_TOKEN_FILE" || (echo "Missing OUTPUT_TOKEN_FILE." && exit 1)
    - bash bin/generate_github_app_token.sh

github_app_token_secrets_ukho: &github_app_token_secrets_ukho
  GITHUB_APP_ID:
    from_secret: hof_ukho_gh_app_id
  GITHUB_APP_PRIVATE_KEY:
    from_secret: hof_ukho_gh_app_pk
  GITHUB_APP_INSTALLATION_ID:
    from_secret: hof_ukho_gh_app_install_id

github_app_token_secrets_hof: &github_app_token_secrets_hof
  GITHUB_APP_ID:
    from_secret: HOF_GH_APP_ID
  GITHUB_APP_PRIVATE_KEY:
    from_secret: HOF_GH_APP_PK
  GITHUB_APP_INSTALLATION_ID:
    from_secret: HOF_GH_APP_INSTALL_ID

clone_repos_step: &clone_repos_step
  image: alpine/git
  volumes:
    - name: dockersock
      path: /root/.dockersock
  commands:
    - test -s "$CLONE_TOKEN_FILE" || (echo "$CLONE_TOKEN_MISSING_MESSAGE" && exit 1)
    - export GITHUB_TOKEN="$(cat "$CLONE_TOKEN_FILE")"
    - git clone https://x-access-token:$${GITHUB_TOKEN}@github.com/UKHomeOfficeForms/hof-services-config.git
    - if [ "${CLONE_REPOS_PRUNE:-false}" = "true" ]; then find hof-services-config/* | grep -v $HOF_CONFIG | grep -v 'infrastructure' | xargs rm -rf; fi
    - rm -f "$CLONE_TOKEN_FILE"

steps:
  - name: generate_github_app_token_for_clone
    <<: *github_app_token_step
    environment:
      <<: *github_app_token_secrets_hof
      OUTPUT_TOKEN_FILE: /root/.dockersock/github_app_token_for_clone.txt
    when:
      branch:
        <<: *include_all_branches
      event: [push, pull_request]

  - name: clone_repos
    <<: *clone_repos_step
    environment:
      CLONE_TOKEN_FILE: /root/.dockersock/github_app_token_for_clone.txt
      CLONE_TOKEN_MISSING_MESSAGE: Missing GitHub App token file for clone step.
      CLONE_REPOS_PRUNE: "true"
    when:
      branch:
        <<: *include_all_branches
      event: [push, pull_request]
    depends_on:
      - generate_github_app_token_for_clone

  - name: scan_base_image_os
    pull: always
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/trivy/client:latest
    resources:
      limits:
        cpu: 1000
        memory: 1024Mi
    environment:
      IMAGE_NAME: node:24.18.0-alpine3.24@sha256:4ba75f835bb8802193e4c114572113d4b26f95f6f094f4b5229d2a77773e0afc
      SERVICE_URL: https://acp-trivy-helm.acp-trivy.svc.cluster.local:443
      SEVERITY: MEDIUM,HIGH,CRITICAL  --dependency-tree
      FAIL_ON_DETECTION: false
      IGNORE_UNFIXED: false
    volumes:
      - name: dockersock
        path: /root/.dockersock
    when:
      event: [push, pull_request]
  - name: lint
    <<: *node_image
    commands:
      - yarn install --frozen-lockfile
      - yarn lint
    when:
      branch:
        <<: *include_all_branches
      event: [push, pull_request]
  - name: unit_tests
    <<: *node_image
    commands:
      - yarn install --frozen-lockfile
      - yarn test
    when:
      branch:
        <<: *include_all_branches
      event: [push, pull_request]
    depends_on:
      - lint
  - name: sonar_scanner
    <<: *sonar_scanner
    when:
      branch:
        <<: *include_all_branches
      event: [push, pull_request]
  - name: build
    pull: if-not-exists
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/dind:latest
    commands:
      # wait for docker service to be up before running docker build
      - /usr/local/bin/wait
      - docker build -t so/evisa-web-messenger:$${DRONE_COMMIT_SHA} .
    volumes:
      - name: dockersock
        path: /var/run
    when:
      branch:
        <<: *include_all_branches
      event: [push, pull_request]
    depends_on:
      - unit_tests
  - name: push_ecr
    pull: if-not-exists
    image: plugins/ecr
    environment:
      AWS_REGION: eu-west-2
    settings:
      access_key:
        from_secret: AWS_ACCESS_KEY_ID
      secret_key:
        from_secret: AWS_SECRET_ACCESS_KEY
      repo: so/evisa-web-messenger
      registry: 340268328991.dkr.ecr.eu-west-2.amazonaws.com
      tags:
        - latest
        - ${DRONE_COMMIT_SHA}
    when:
      branch:
        <<: *include_all_branches
      event: [push, pull_request]
    depends_on:
      - build
  # Trivy Security Scannner
  - name: scan-node-packages
    pull: always
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/trivy/client:latest
    resources:
      limits:
        cpu: 1000
        memory: 1024Mi
    environment:
      IMAGE_NAME: so/evisa-web-messenger:${DRONE_COMMIT_SHA}
      SEVERITY: MEDIUM,HIGH,CRITICAL
      FAIL_ON_DETECTION: false
      IGNORE_UNFIXED: false
    when:
      event:
      - pull_request
      - push
    depends_on:
      - build
      
  - name: deploy_to_branch
    pull: if-not-exists
    image: quay.io/ukhomeofficedigital/kd:v1.14.0
    environment:
      KUBE_SERVER:
        from_secret: KUBE_SERVER_DEV
      KUBE_TOKEN:
        from_secret: KUBE_TOKEN_DEV
    volumes:
      - name: dockersock
        path: /root/.dockersock
    commands:
      - bin/deploy.sh $${BRANCH_ENV}
    when:
      branch:
        <<: *include_all_branches
      event: pull_request
    depends_on:
      - clone_repos
      - push_ecr

  # Run playwright tests against the pull request branch environment
  - name: e2e_tests
    pull: if-not-exists
    image: mcr.microsoft.com/playwright:v1.60.0-noble
    volumes:
      - name: dockersock
        path: /root/.dockersock
    commands:
      - yarn playwright install --with-deps
      - yarn install --frozen-lockfile
      - test -s /root/.dockersock/branch_url.txt || (echo "Missing deployed branch URL at /root/.dockersock/branch_url.txt" && exit 1)
      - CI=true PLAYWRIGHT_BASE_URL="https://$(cat /root/.dockersock/branch_url.txt)" yarn test:e2e
    when:
      branch:
        <<: *include_all_branches
      event: pull_request
    depends_on:
      - deploy_to_branch

  # Generate short-lived GitHub App installation token for report publishing
  - name: generate_github_app_token
    <<: *github_app_token_step
    environment:
      <<: *github_app_token_secrets_ukho
      OUTPUT_TOKEN_FILE: /root/.dockersock/github_app_token.txt
    when:
      branch:
        <<: *include_all_branches
      event: pull_request
    depends_on:
      - e2e_tests

  # Upload Playwright HTML report for PR and comment a download link
  - name: publish_e2e_report_to_pr
    pull: if-not-exists
    image: alpine:3.21
    volumes:
      - name: dockersock
        path: /root/.dockersock
    commands:
      - apk add --no-cache bash curl jq zip
      - test -n "$DRONE_PULL_REQUEST" || (echo "Missing DRONE_PULL_REQUEST. This step only supports pull_request builds." && exit 1)
      - export DRONE_REPO="$${DRONE_REPO:-$GIT_REPO}"
      - test -n "$DRONE_REPO" || (echo "Missing repository slug (DRONE_REPO/GIT_REPO)." && exit 1)
      - test -s /root/.dockersock/github_app_token.txt || (echo "Missing GitHub App token file from generate_github_app_token step." && exit 1)
      - export GITHUB_APP_TOKEN="$(cat /root/.dockersock/github_app_token.txt)"
      - bash bin/publish_e2e_test_report.sh
      - rm -f /root/.dockersock/github_app_token.txt
    when:
      branch:
        <<: *include_all_branches
      event: pull_request
    depends_on:
      - generate_github_app_token

  # Deploy to Master UAT environment
  - name: deploy_to_uat
    pull: if-not-exists
    image: quay.io/ukhomeofficedigital/kd:v1.14.0
    environment:
      KUBE_SERVER:
        from_secret: KUBE_SERVER_DEV
      KUBE_TOKEN:
        from_secret: KUBE_TOKEN_DEV
    commands:
      - sh bin/deploy.sh $${UAT_ENV}
    when:
      branch:
        <<: *include_default_branch
      event: push
    depends_on:
      - push_ecr
  # Get pull request branch so correct PR UAT environment is torn down in the tear_down_branch step that follows
  - name: get_pr_branch
    pull: if-not-exists
    image: drone/cli:alpine@sha256:14409f7f7247befb9dd2effdb2f61ac40d1f5fbfb1a80566cf6f2f8d21f3be11
    environment:
      DRONE_SERVER:
        from_secret: drone_server
      DRONE_TOKEN:
        from_secret: drone_token
    volumes:
      - name: dockersock
        path: /root/.dockersock
    commands:
      - drone build info $GIT_REPO $DRONE_BUILD_NUMBER --format {{.Message}} | grep -o '[^ ]\+$' -m1 | sed 's|UKHomeOffice/||g' | tr '[:upper:]' '[:lower:]' | tr '/' '-' > /root/.dockersock/branch_name.txt
    when:
      branch:
        <<: *include_default_branch
      event: push
  # Tear down pull request UAT environment
  - name: tear_down_branch
    pull: if-not-exists
    image: quay.io/ukhomeofficedigital/kd:v1.14.0
    environment:
      KUBE_SERVER:
        from_secret: KUBE_SERVER_DEV
      KUBE_TOKEN:
        from_secret: KUBE_TOKEN_DEV
    volumes:
      - name: dockersock
        path: /root/.dockersock
    commands:
      - bin/deploy.sh tear_down
    when:
      branch:
        <<: *include_default_branch
      event: push
    depends_on:
      - get_pr_branch
      - deploy_to_uat

  - name: generate_github_app_token_for_clone_stg
    <<: *github_app_token_step
    environment:
      <<: *github_app_token_secrets_hof
      OUTPUT_TOKEN_FILE: /root/.dockersock/github_app_token_for_clone_stg.txt
    when:
      target: STG
      event: promote

  - name: clone_repos_stg
    <<: *clone_repos_step
    environment:
      CLONE_TOKEN_FILE: /root/.dockersock/github_app_token_for_clone_stg.txt
      CLONE_TOKEN_MISSING_MESSAGE: Missing GitHub App token file for STG clone step.
    when:
      target: STG
      event: promote
    depends_on:
      - generate_github_app_token_for_clone_stg

  - name: deploy_to_stg
    pull: if-not-exists
    image: quay.io/ukhomeofficedigital/kd:v1.14.0
    environment:
      KUBE_SERVER:
        from_secret: KUBE_SERVER_PROD
      KUBE_TOKEN:
        from_secret: KUBE_TOKEN_PROD
    commands:
      - bin/deploy.sh $${STG_ENV}
    when:
      target: STG
      event: promote
    depends_on:
      - clone_repos_stg
      
  # Checks a build being promoted has passed, is on master which effectively means a healthy build on Staging
  - name: sanity_check_build_prod
    pull: if-not-exists
    image: drone/cli:alpine@sha256:14409f7f7247befb9dd2effdb2f61ac40d1f5fbfb1a80566cf6f2f8d21f3be11
    environment:
      DRONE_SERVER:
        from_secret: drone_server
      DRONE_TOKEN:
        from_secret: drone_token
    commands:
      - bin/sanity_check_build.sh
    when:
      target: PROD
      event: promote

  - name: generate_github_app_token_for_clone_prod
    <<: *github_app_token_step
    environment:
      <<: *github_app_token_secrets_hof
      OUTPUT_TOKEN_FILE: /root/.dockersock/github_app_token_for_clone_prod.txt
    when:
      target: PROD
      event: promote
    depends_on:
      - sanity_check_build_prod

  - name: clone_repos_prod
    <<: *clone_repos_step
    environment:
      CLONE_TOKEN_FILE: /root/.dockersock/github_app_token_for_clone_prod.txt
      CLONE_TOKEN_MISSING_MESSAGE: Missing GitHub App token file for PROD clone step.
    when:
      target: PROD
      event: promote
    depends_on:
      - generate_github_app_token_for_clone_prod

  # Deploy to Production environment
  - name: deploy_to_prod
    pull: if-not-exists
    image: quay.io/ukhomeofficedigital/kd:v1.14.0
    environment:
      KUBE_SERVER:
        from_secret: KUBE_SERVER_PROD
      KUBE_TOKEN:
        from_secret: KUBE_TOKEN_PROD
    commands:
      - bin/deploy.sh $${PROD_ENV}
    when:
      target: PROD
      event: promote
    depends_on:
      - clone_repos_prod

  - name: generate_github_app_token_for_clone_cron
    <<: *github_app_token_step
    environment:
      <<: *github_app_token_secrets_hof
      OUTPUT_TOKEN_FILE: /root/.dockersock/github_app_token_for_clone_cron.txt
    when:
      cron: security_scans
      event: cron

  # CRON job steps that runs security scans using Trivy
  - name: cron_clone_repos
    <<: *clone_repos_step
    environment:
      CLONE_TOKEN_FILE: /root/.dockersock/github_app_token_for_clone_cron.txt
      CLONE_TOKEN_MISSING_MESSAGE: Missing GitHub App token file for CRON clone step.
    when:
      cron: security_scans
      event: cron
    depends_on:
      - generate_github_app_token_for_clone_cron

  - name: cron_build_image
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/dind
    commands:
      # wait for docker service to be up before running docker build
      - /usr/local/bin/wait
      - docker build --no-cache -t so/evisa-web-messenger:${DRONE_COMMIT_SHA} .
    volumes:
      - name: dockersock
        path: /var/run
    when:
      cron: security_scans
      event: cron

  - name: cron_trivy_scan_image_os
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/trivy/client:latest
    pull: always
    environment:
      IMAGE_NAME: node:24.18.0-alpine3.24@sha256:4ba75f835bb8802193e4c114572113d4b26f95f6f094f4b5229d2a77773e0afc
      SEVERITY: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --dependency-tree
      FAIL_ON_DETECTION: true
      IGNORE_UNFIXED: false
      ALLOW_CVE_LIST_FILE: hof-services-config/infrastructure/trivy/.trivyignore.yaml
    when:
      cron: security_scans
      event: cron
    depends_on:
      - cron_clone_repos

  - name: cron_trivy_scan_node_packages
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/trivy/client:latest
    pull: always
    environment:
        IMAGE_NAME: so/evisa-web-messenger:${DRONE_COMMIT_SHA}
        SERVICE_URL: https://acp-trivy-helm.acp-trivy.svc.cluster.local:443
        SEVERITY: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --dependency-tree
        FAIL_ON_DETECTION: false
        IGNORE_UNFIXED: false
    when:
      cron: security_scans
      event: cron
      status:
        - success
        - failure
    depends_on:
      - cron_build_image
      - cron_clone_repos
 
  # Slack notification upon a CRON job fail
  # CRON job step that tears down our pull request UAT environments
  - name: cron_tear_down
    pull: if-not-exists
    image: quay.io/ukhomeofficedigital/kd:v1.14.0
    environment:
      KUBE_SERVER:
        from_secret: kube_server_dev
      KUBE_TOKEN:
        from_secret: kube_token_dev
    commands:
      - bin/clean_up.sh $${BRANCH_ENV}
    when:
      cron: security_scans
      event: cron
      status:
        - success
        - failure
    depends_on:
      - cron_build_image
      - cron_clone_repos

  - name: cron_notify_slack_security_scans
    pull: if-not-exists
    image: plugins/slack
    settings:
      failure: ignore
      template: "CRON Job {{build.deployTo}} of eVisa Web Messenger has {{build.status}} - <{{build.link}}|#{{build.number}}> {{#success build.status}}\n  :thumbsup: :thumbsup: :thumbsup:\n{{else}}\n  :x: :x: :x:\n{{/success}} Author: {{build.author}}\n\nDuration: {{since job.started}}\n\nJob: <{{build.link}}|#{{build.number}}>\n\nCommit: {{build.commit}}\n"
      webhook:
        from_secret: slack_webhook
    when:
      cron: security_scans
      event: cron
      status:
        - failure
    depends_on:
      - cron_trivy_scan_image_os
      - cron_trivy_scan_node_packages

services:
  - name: docker
    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/dind

volumes:
  - name: dockersock
    temp: {}