mdm-ordinis/.gitlab-ci.yml

# =============================================================
# Ordinis — build & push images.
# Runner mirror'ит Docker Hub (DOCKER_AUTH_CONFIG в runner config),
# поэтому image: repo.nstart.cloud/library/maven:... работает напрямую.
# Все образы пушатся в repo.nstart.cloud/terravault/ — единый registry
# для всех кластеров (staging 161, prod 142, локальный dev).
# =============================================================

stages:
  - test
  - build
  - publish
  - trigger-deploy

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
  MAVEN_CLI_OPTS: "-B -ntp --batch-mode"
  IMAGE_TAG: $CI_COMMIT_REF_SLUG-$CI_COMMIT_SHORT_SHA
  REGISTRY: repo.nstart.cloud
  IMAGE_REPO: terravault
  DOCKER_BUILDKIT: "1"

cache:
  key:
    files: ["pom.xml"]
  paths:
    - .m2/repository

# Default retry для всех jobs — runner image pull mirror flaky
default:
  retry:
    max: 2
    when:
      - runner_system_failure
      - stuck_or_timeout_failure
      - script_failure

# ─── TEST ──────────────────────────────────────
maven-test:
  stage: test
  image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
  script:
    - mvn $MAVEN_CLI_OPTS verify
  artifacts:
    when: always
    reports:
      junit: '**/target/surefire-reports/TEST-*.xml'
    expire_in: 1 week

# ─── BUILD (Maven jars) ────────────────────────
maven-package:
  stage: build
  image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
  script:
    - mvn $MAVEN_CLI_OPTS package -DskipTests
  artifacts:
    paths:
      - "**/target/*.jar"
      - ordinis-migrations/src/main/resources/db/changelog/**
    expire_in: 1 day

# ─── PUBLISH (Docker images) ───────────────────
.docker_base:
  stage: publish
  image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0
  services:
    - name: repo.nstart.cloud/library/docker:29.1.2-dind
      alias: docker
      command: ["--tls=false"]
  variables:
    DOCKER_HOST: tcp://docker:2375
    DOCKER_TLS_CERTDIR: ""
    DOCKER_BUILDKIT: "1"

# Build & push в repo.nstart.cloud (corp Harbor) — единый registry для всех окружений.
# DinD должен быть готов когда запускается script. Wait-loop защищает от race.
.publish_script: &publish_script |
  for i in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 1; done
  echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
  IMG="$REGISTRY/$IMAGE_REPO/$SVC"
  docker build -f "$DOCKERFILE" \
    -t "$IMG:$IMAGE_TAG" -t "$IMG:latest" -t "$IMG:$CI_COMMIT_REF_SLUG" \
    --build-arg BUILDKIT_INLINE_CACHE=1 \
    "$BUILD_CONTEXT"
  docker push "$IMG:$IMAGE_TAG"
  docker push "$IMG:latest"
  docker push "$IMG:$CI_COMMIT_REF_SLUG"

docker-app:
  extends: .docker_base
  needs: [maven-package]
  variables:
    SVC: ordinis-app
    DOCKERFILE: ordinis-app/Dockerfile
    BUILD_CONTEXT: .
  script:
    - *publish_script

docker-read-api:
  extends: .docker_base
  needs: [maven-package]
  variables:
    SVC: ordinis-read-api
    DOCKERFILE: ordinis-read-api/Dockerfile
    BUILD_CONTEXT: .
  script:
    - *publish_script

docker-projection-writer:
  extends: .docker_base
  needs: [maven-package]
  variables:
    SVC: ordinis-projection-writer
    DOCKERFILE: ordinis-projection-writer/Dockerfile
    BUILD_CONTEXT: .
  script:
    - *publish_script

docker-migrations:
  extends: .docker_base
  needs: [maven-package]
  variables:
    SVC: ordinis-migrations
    DOCKERFILE: ordinis-migrations/Dockerfile
    BUILD_CONTEXT: ordinis-migrations/
  script:
    - *publish_script

# Admin UI — независимый от Maven (Node build), но публикуется в тот же registry.
docker-admin-ui:
  extends: .docker_base
  needs: []
  variables:
    SVC: ordinis-admin-ui
    DOCKERFILE: ordinis-admin-ui/Dockerfile
    BUILD_CONTEXT: ordinis-admin-ui/
  script:
    - *publish_script
  rules:
    - changes: ["ordinis-admin-ui/**/*"]
    - if: '$CI_COMMIT_BRANCH == "main"'

# ─── TRIGGER DEPLOY (downstream pipeline) ──────
# GitLab quirk: variables: в trigger job НЕ интерполируются от upstream global
# variables напрямую — `$IMAGE_TAG` передавался как литерал. Workaround:
# resolve-tag job записывает значение в dotenv artifact, тогда оно становится
# job-level variable trigger job'а и interpolation работает.

resolve-tag:
  stage: trigger-deploy
  image: repo.nstart.cloud/library/alpine:3.20
  needs: [maven-package]
  script:
    - echo "RESOLVED_IMAGE_TAG=$IMAGE_TAG" > resolved.env
    - cat resolved.env
  artifacts:
    reports:
      dotenv: resolved.env

trigger-deploy-staging:
  stage: trigger-deploy
  needs: [resolve-tag]
  trigger:
    project: 2-6/2-6-4/terravault/ordinis-infra
    branch: main
    strategy: depend
  variables:
    UPSTREAM_IMAGE_TAG: $RESOLVED_IMAGE_TAG
    DEPLOY_ENV: staging
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

trigger-deploy-prod:
  stage: trigger-deploy
  needs: [resolve-tag]
  trigger:
    project: 2-6/2-6-4/terravault/ordinis-infra
    branch: main
    strategy: depend
  variables:
    UPSTREAM_IMAGE_TAG: $RESOLVED_IMAGE_TAG
    DEPLOY_ENV: prod
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'
      when: manual