oncall-engine/.drone.yml

---
kind: pipeline
type: docker
name: Build and Release

steps:
  - name: Build Plugin
    image: node:18.16.0-buster
    commands:
      - apt-get update
      - apt-get --assume-yes install jq
      - cd grafana-plugin/
      # yamllint disable rule:line-length
      - if [ -z "$DRONE_TAG" ]; then echo "No tag, not modifying version"; else jq ".version=\"${DRONE_TAG#v}\"" package.json > package.new && mv package.new package.json && jq '.version' package.json; fi
      # yamllint enable rule:line-length
      - yarn --network-timeout 500000
      - yarn build
      - ls ./

  - name: Sign and Package Plugin
    image: node:18.16.0-buster
    environment:
      GRAFANA_ACCESS_POLICY_TOKEN:
        from_secret: cloud_access_policy_token
    depends_on:
      - Build Plugin
    commands:
      - apt-get update
      - apt-get install zip
      - cd grafana-plugin
      - yarn sign
      - if [ ! -f dist/MANIFEST.txt ]; then echo "Sign failed, MANIFEST.txt not created, aborting." && exit 1; fi
      - mv dist grafana-oncall-app
      - zip -r grafana-oncall-app.zip ./grafana-oncall-app
      # yamllint disable rule:line-length
      - if [ -z "$DRONE_TAG" ]; then echo "No tag, skipping archive"; else cp grafana-oncall-app.zip grafana-oncall-app-${DRONE_TAG}.zip; fi
      # yamllint enable rule:line-length

  - name: Publish Plugin to GCS (release)
    image: plugins/gcs
    settings:
      acl: allUsers:READER
      source: grafana-plugin/ci/dist/grafana-oncall-app-${DRONE_TAG}.zip
      target: grafana-oncall-app/releases/grafana-oncall-app-${DRONE_TAG}.zip
      token:
        from_secret: gcs_oncall_publisher_key
    depends_on:
      - Sign and Package Plugin
    when:
      ref:
        - refs/tags/v*.*.*

  - name: Lint Backend
    image: python:3.11.4
    environment:
      DJANGO_SETTINGS_MODULE: settings.ci-test
    commands:
      - pip install $(grep "pre-commit==" engine/requirements-dev.txt)
      - pre-commit run isort --all-files
      - pre-commit run black --all-files
      - pre-commit run flake8 --all-files

  - name: Unit Test Backend
    image: python:3.11.4
    environment:
      RABBITMQ_URI: amqp://rabbitmq:rabbitmq@rabbit_test:5672
      DJANGO_SETTINGS_MODULE: settings.ci-test
      SLACK_CLIENT_OAUTH_ID: 1
    commands:
      - apt-get update && apt-get install -y netcat-traditional
      - cd engine/
      - pip install -r requirements.txt -r requirements-dev.txt
      - ./wait_for_test_mysql_start.sh && pytest
    depends_on:
      - rabbit_test

  - name: Image Tag
    image: alpine
    commands:
      - apk add --no-cache bash git sed
      - git fetch origin --tags
      - chmod +x ./tools/image-tag.sh
      - echo $(./tools/image-tag.sh)
      - echo $(./tools/image-tag.sh) > .tags
      # yamllint disable rule:line-length
      - if [ -z "$DRONE_TAG" ]; then echo "No tag, not modifying version"; else sed "0,/VERSION.*/ s/VERSION.*/VERSION = \"${DRONE_TAG}\"/g" engine/settings/base.py > engine/settings/base.temp && mv engine/settings/base.temp engine/settings/base.py; fi
      # yamllint enable rule:line-length
      - cat engine/settings/base.py | grep VERSION | head -1
    when:
      ref:
        - refs/heads/dev
        - refs/tags/v*.*.*

  - name: Build and Push Engine Docker Image Backend to GCR
    image: plugins/docker
    environment:
      # force docker to use buildkit feature, this will skip build stages that aren't required in
      # the final image (ie. dev & dev-enterprise)
      # https://github.com/docker/cli/issues/1134#issuecomment-406449342
      DOCKER_BUILDKIT: 1
    settings:
      repo: us.gcr.io/kubernetes-dev/oncall
      dockerfile: engine/Dockerfile
      context: engine/
      target: prod
      config:
        from_secret: gcr_admin
      build_args:
        - BUILDKIT_INLINE_CACHE=1
      cache_from:
        - grafana/oncall:latest
    depends_on:
      - Lint Backend
      - Unit Test Backend
      - Image Tag

  - name: Build and Push Engine Docker Image Backend to Dockerhub
    image: plugins/docker
    environment:
      # force docker to use buildkit feature, this will skip build stages that aren't required in
      # the final image (ie. dev & dev-enterprise)
      # https://github.com/docker/cli/issues/1134#issuecomment-406449342
      DOCKER_BUILDKIT: 1
    settings:
      repo: grafana/oncall
      dockerfile: engine/Dockerfile
      context: engine/
      target: prod
      password:
        from_secret: docker_password
      username:
        from_secret: docker_username
      build_args:
        - BUILDKIT_INLINE_CACHE=1
      cache_from:
        - grafana/oncall:latest
    depends_on:
      - Lint Backend
      - Unit Test Backend
      - Image Tag
    when:
      ref:
        - refs/heads/dev

# Services for Unit Test Backend
services:
  - name: rabbit_test
    image: rabbitmq:3.12.0
    environment:
      RABBITMQ_DEFAULT_USER: rabbitmq
      RABBITMQ_DEFAULT_PASS: rabbitmq

  - name: mysql_test
    image: mysql:8.0.32
    environment:
      MYSQL_DATABASE: oncall_local_dev
      MYSQL_ROOT_PASSWORD: local_dev_pwd

trigger:
  event:
    include:
      - tag
      - push
      - pull_request
  ref:
    include:
      - refs/heads/main
      - refs/heads/dev
      - refs/tags/v*.*.*

---
kind: pipeline
type: docker
name: OSS plugin release

steps:
  - name: build plugin
    image: node:18.16.0-buster
    commands:
      - apt-get update
      - apt-get --assume-yes install jq
      - cd grafana-plugin/
      # yamllint disable rule:line-length
      - if [ -z "$DRONE_TAG" ]; then echo "No tag, not modifying version"; else jq ".version=\"${DRONE_TAG#v}\"" package.json > package.new && mv package.new package.json && jq '.version' package.json; fi
      # yamllint enable rule:line-length
      - yarn --network-timeout 500000
      - yarn build
      - ls ./

  - name: sign and package plugin
    image: node:18.16.0-buster
    environment:
      GRAFANA_ACCESS_POLICY_TOKEN:
        from_secret: cloud_access_policy_token
    depends_on:
      - build plugin
    commands:
      - apt-get update
      - apt-get install zip
      - cd grafana-plugin
      - yarn sign
      - if [ ! -f dist/MANIFEST.txt ]; then echo "Sign failed, MANIFEST.txt not created, aborting." && exit 1; fi
      - mv dist grafana-oncall-app
      - zip -r grafana-oncall-app.zip ./grafana-oncall-app
      # yamllint disable rule:line-length
      - if [ -z "$DRONE_TAG" ]; then echo "No tag, skipping archive"; else cp grafana-oncall-app.zip grafana-oncall-app-${DRONE_TAG}.zip; fi
      # yamllint enable rule:line-length

  - name: publish plugin to grafana.com (release)
    image: curlimages/curl:7.73.0
    environment:
      GRAFANA_API_KEY:
        from_secret: gcom_plugin_publisher_api_key
    commands:
      # yamllint disable rule:line-length
      - 'curl -f -s -H "Authorization: Bearer $${GRAFANA_API_KEY}" -d "download[any][url]=https://storage.googleapis.com/grafana-oncall-app/releases/grafana-oncall-app-${DRONE_TAG}.zip" -d "download[any][md5]=$$(curl -sL https://storage.googleapis.com/grafana-oncall-app/releases/grafana-oncall-app-${DRONE_TAG}.zip | md5sum | cut -d'' '' -f1)" -d url=https://github.com/grafana/oncall/grafana-plugin https://grafana.com/api/plugins'
      # yamllint enable rule:line-length
    depends_on:
      - sign and package plugin

trigger:
  event:
    - promote
  target:
    - oss
  ref:
    - refs/tags/v*.*.*

---
kind: pipeline
type: docker
name: OSS engine release

steps:
  - name: set engine version
    image: alpine
    commands:
      - apk add --no-cache bash sed
      # yamllint disable rule:line-length
      - if [ -z "$DRONE_TAG" ]; then echo "No tag, not modifying version"; else sed "0,/VERSION.*/ s/VERSION.*/VERSION = \"${DRONE_TAG#v}\"/g" engine/settings/base.py > engine/settings/base.temp && mv engine/settings/base.temp engine/settings/base.py; fi
      # yamllint enable rule:line-length
      - cat engine/settings/base.py | grep VERSION | head -1

  - name: build and push docker image
    image: thegeeklab/drone-docker-buildx:24.1.0
    # From the docs (https://drone-plugin-index.geekdocs.de/plugins/drone-docker-buildx/) regarding privileged=true:
    #
    # Be aware that the this plugin requires privileged capabilities, otherwise the integrated
    # Docker daemon is not able to start.
    privileged: true
    environment:
      # force docker to use buildkit feature, this will skip build stages that aren't required in
      # the final image (ie. dev & dev-enterprise)
      # https://github.com/docker/cli/issues/1134#issuecomment-406449342
      DOCKER_BUILDKIT: 1
    settings:
      repo: grafana/oncall
      tags: latest,${DRONE_TAG}
      platforms: linux/arm64/v8,linux/amd64
      dockerfile: engine/Dockerfile
      target: prod
      context: engine/
      password:
        from_secret: docker_password
      username:
        from_secret: docker_username
      build_args:
        - BUILDKIT_INLINE_CACHE=1
      cache_from:
        - grafana/oncall:latest
    depends_on:
      - set engine version

  - name: merge helm release oss pr
    image: alpine
    environment:
      GITHUB_API_KEY:
        from_secret: github_api_token
    # Allow this step to fail as it's not critical to the build process and we don't want to block
    # the build promotion. If this step fails we can always merge the PR manually
    failure: ignore
    commands:
      # yamllint disable rule:line-length
      - apk add --no-cache curl jq
      # Step 1. Fetch PRs from GitHub's API that're open and have a particular head ref indicative of a helm release PR
      # API docs - https://docs.github.com/en/rest/pulls/pulls?apiVersion=2022-11-28#list-pull-requests
      # NOTE: ${DRONE_TAG:1} will slice off the "v" prefix from the tag
      - 'curl -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer $${GITHUB_API_KEY}" -H "X-GitHub-Api-Version: 2022-11-28" "https://api.github.com/repos/grafana/oncall/pulls?head=grafana:helm-release/$${DRONE_TAG:1}&state=open" > prs.json'
      - cat prs.json
      # Step 2. Extract the PR number from the first PR in the list to be able to pass that to the next API call
      - cat prs.json | jq -r ".[0].number" > pr_number.txt
      - cat pr_number.txt
      # Step 3. Merge the PR (https://docs.github.com/en/rest/pulls/pulls?apiVersion=2022-11-28#merge-a-pull-request)
      - 'cat pr_number.txt | xargs -r -I{pull_number} curl -L -X PUT -H "Accept: application/vnd.github+json" -H "Authorization: Bearer $${GITHUB_API_KEY}" -H "X-GitHub-Api-Version: 2022-11-28" "https://api.github.com/repos/grafana/oncall/pulls/{pull_number}/merge"'
      # yamllint enable rule:line-length
    depends_on:
      - build and push docker image

trigger:
  event:
    - promote
  target:
    - oss
  ref:
    - refs/tags/v*.*.*

---
# Secret for pulling docker images.
kind: secret
name: dockerconfigjson
get:
  path: secret/data/common/gcr
  name: .dockerconfigjson

---
# Secret for pushing docker images.
kind: secret
name: gcr_admin
get:
  path: infra/data/ci/gcr-admin
  name: .dockerconfigjson

---
# Slack webhook
get:
  name: slack-plugin
  path: infra/data/ci/oncall/drone
kind: secret
name: slack_webhook

---
# GCOM plugin publisher
get:
  name: gcom-plugin-publisher
  path: infra/data/ci/oncall/drone
kind: secret
name: gcom_plugin_publisher_api_key

---
# GCS bucket
get:
  name: gcs-oncall-drone-publisher
  path: infra/data/ci/oncall/drone
kind: secret
name: gcs_oncall_publisher_key

---
# Dockerhub
get:
  name: username
  path: infra/data/ci/docker_hub
kind: secret
name: docker_username

---
get:
  name: password
  path: infra/data/ci/docker_hub
kind: secret
name: docker_password

---
# Drone
get:
  name: machine-user-token
  path: infra/data/ci/drone
kind: secret
name: drone_token

---
# GitHub API token (only scoped to grafana/oncall + PR access)
get:
  name: github-api-token
  path: ci/data/repo/grafana/oncall/drone
kind: secret
name: github_api_token

---
# Secret for signing plugin
get:
  name: cloud_access_policy_token
  path: ci/data/repo/grafana/oncall/sign_plugin
kind: secret
name: cloud_access_policy_token

---
kind: signature
hmac: 5bf89aaec69ebec6d4489b6ef712f92d10ede5b242b88c8f62930d78ba780f7d

...