bitbucket-pipelines.yml

clone:
  depth: full

image: atlassian/default-image:2

definitions:

  export_image_env_vars: &export_image_env_vars |
    export IMAGE_TAGGED="${DOCKERHUB_REPO_OWNER}/loancalculator:bitbucket-$(git log -1 --pretty=%h)"
    export IMAGE_LATEST="${DOCKERHUB_REPO_OWNER}/loancalculator:bitbucket-latest"

  export_merkely_fingerprint_env_vars: &export_merkely_fingerprint_env_vars |
    export IMAGE_TAGGED="${DOCKERHUB_REPO_OWNER}/loancalculator:bitbucket-$(git log -1 --pretty=%h)"
    docker pull ${IMAGE_TAGGED}
    export SHA256=$(docker inspect --format='{{index .RepoDigests 0}}' ${IMAGE_TAGGED} | cut -d ':' -f 2)
    export MERKELY_FINGERPRINT="sha256://${SHA256}/${IMAGE_TAGGED}"
    export MERKELY_OWNER=compliancedb
    export MERKELY_PIPELINE=bitbucket-loancalculator

  export_merkely_pipeline_env_vars: &export_merkely_pipeline_env_vars
    export MERKELY_OWNER=compliancedb
    export MERKELY_PIPELINE=bitbucket-loancalculator
    export MERKELY_PIPE_PATH="${PWD}/Merkelypipe.json"

  steps:

    - step: &merkely-declare-pipeline
        name: Declare Merkely Pipeline
        services: [ docker ]
        script:
          - *export_merkely_pipeline_env_vars
          - pipe: docker://merkely/change:latest
            variables:
              MERKELY_COMMAND: declare_pipeline
              MERKELY_OWNER: ${MERKELY_OWNER}
              MERKELY_PIPELINE: ${MERKELY_PIPELINE}
              MERKELY_PIPE_PATH: ${MERKELY_PIPE_PATH}
              MERKELY_API_TOKEN: ${MERKELY_API_TOKEN}


    - step: &build-and-publish-docker-image
        name: Build and publish Docker image
        services: [ docker ]
        script:
          - *export_image_env_vars
          - docker build --file ${PWD}/Dockerfile --tag ${IMAGE_TAGGED} ${PWD}
          - docker tag ${IMAGE_TAGGED} ${IMAGE_LATEST}
          - echo ${DOCKERHUB_DEPLOY_TOKEN} | docker login --username ${DOCKERHUB_DEPLOY_USERNAME} --password-stdin
          - docker push ${IMAGE_TAGGED}
          - docker push ${IMAGE_LATEST}


    - step: &merkely-log-docker-image
        name: Log Docker image in Merkely
        services: [ docker ]
        script:
          - *export_merkely_fingerprint_env_vars
          - pipe: docker://merkely/change:latest
            variables:
              MERKELY_COMMAND: log_artifact
              MERKELY_FINGERPRINT: ${MERKELY_FINGERPRINT}
              MERKELY_IS_COMPLIANT: "TRUE"
              MERKELY_OWNER: ${MERKELY_OWNER}
              MERKELY_PIPELINE: ${MERKELY_PIPELINE}
              MERKELY_API_TOKEN: ${MERKELY_API_TOKEN}


    - step: &run-unit-tests
        name: Run units tests
        services: [ docker ]
        script:
          - *export_image_env_vars
          - docker run
            --name container
            --entrypoint ./entrypoint-unit_test.sh
            ${IMAGE_TAGGED}
          - mkdir -p build/test
          - docker cp container:/code/build/test/ ${PWD}/build
          - docker rm container
        artifacts:
          - build/test/**


    - step: &merkely-log-unit-test-results
        name: Log unit test results in Merkely
        services: [ docker ]
        script:
          - *export_merkely_fingerprint_env_vars
          - pipe: docker://merkely/change:latest
            variables:
              MERKELY_COMMAND: log_test
              MERKELY_FINGERPRINT: ${MERKELY_FINGERPRINT}
              MERKELY_EVIDENCE_TYPE: unit_test
              MERKELY_TEST_RESULTS_DIR: ${PWD}/build/test/
              MERKELY_OWNER: ${MERKELY_OWNER}
              MERKELY_PIPELINE: ${MERKELY_PIPELINE}
              MERKELY_API_TOKEN: ${MERKELY_API_TOKEN}


    - step: &run-security-tests
        name: Run security tests
        services: [ docker ]
        script:
          - *export_image_env_vars
          - mkdir -p build/security
          - docker run
              --rm
              --volume ${PWD}/build:/code/build
              --entrypoint ./entrypoint-security.sh
              ${IMAGE_TAGGED}
        artifacts:
          - build/security/**


    - step: &merkely-log-security-test-results
        name: Log security test results in Merkely
        services: [ docker ]
        script:
          - *export_merkely_fingerprint_env_vars
          - pipe: docker://merkely/change:latest
            variables:
              MERKELY_COMMAND: log_test
              MERKELY_FINGERPRINT: ${MERKELY_FINGERPRINT}
              MERKELY_EVIDENCE_TYPE: security
              MERKELY_TEST_RESULTS_DIR: ${PWD}/build/security/
              MERKELY_OWNER: ${MERKELY_OWNER}
              MERKELY_PIPELINE: ${MERKELY_PIPELINE}
              MERKELY_API_TOKEN: ${MERKELY_API_TOKEN}


    - step: &run-coverage-analysis
        name: Run coverage analysis
        services: [ docker ]
        script:
          - *export_image_env_vars
          - mkdir -p build/coverage
          - docker run
              --entrypoint ./entrypoint-coverage.sh
              --rm
              --volume ${PWD}/build:/code/build
              ${IMAGE_TAGGED}
        artifacts:
          - build/coverage/**


    - step: &merkely-log-coverage-analysis
        name: Log coverage analysis results in Merkely
        services: [ docker ]
        script:
          - source build/coverage/coverage_summary.sh
          - *export_merkely_fingerprint_env_vars
          - pipe: docker://merkely/change:latest
            variables:
              MERKELY_COMMAND: log_evidence
              MERKELY_FINGERPRINT: ${MERKELY_FINGERPRINT}
              MERKELY_EVIDENCE_TYPE: coverage
              MERKELY_IS_COMPLIANT: "TRUE"
              MERKELY_DESCRIPTION: ${COVERAGE_SUMMARY}
              MERKELY_OWNER: ${MERKELY_OWNER}
              MERKELY_PIPELINE: ${MERKELY_PIPELINE}
              MERKELY_API_TOKEN: ${MERKELY_API_TOKEN}


    - step: &deploy-to-staging
        name: Deploy to staging
        script:
          - echo YOUR DEPLOYMENT COMMAND HERE


    - step: &merkely-log-deployment-to-staging
        name: Log deployment to staging in Merkely
        services: [ docker ]
        script:
          - *export_merkely_fingerprint_env_vars
          - pipe: docker://merkely/change:latest
            variables:
              MERKELY_COMMAND: log_deployment
              MERKELY_FINGERPRINT: ${MERKELY_FINGERPRINT}
              MERKELY_DESCRIPTION: "Deployed to staging in bitbucket pipeline"
              MERKELY_ENVIRONMENT: staging
              MERKELY_OWNER: ${MERKELY_OWNER}
              MERKELY_PIPELINE: ${MERKELY_PIPELINE}
              MERKELY_API_TOKEN: ${MERKELY_API_TOKEN}


    - step: &merkely-request-approval-for-deployment
        name: Request approval for deployment in Merkely
        services: [ docker ]
        script:
          - *export_merkely_fingerprint_env_vars
          - pipe: docker://merkely/change:latest
            variables:
              MERKELY_COMMAND: request_approval
              MERKELY_FINGERPRINT: ${MERKELY_FINGERPRINT}
              MERKELY_OLDEST_SRC_COMMITISH: "origin/production"
              MERKELY_NEWEST_SRC_COMMITISH: ${BITBUCKET_COMMIT}
              MERKELY_DESCRIPTION: "Production release requested from bitbucket pipeline"
              MERKELY_SRC_REPO_ROOT: ${PWD}
              MERKELY_OWNER: ${MERKELY_OWNER}
              MERKELY_PIPELINE: ${MERKELY_PIPELINE}
              MERKELY_API_TOKEN: ${MERKELY_API_TOKEN}


    - step: &merkely-check-deployment-approved
        name: Trigger when deployment approved in Merkely
        services: [ docker ]
        trigger: manual
        script:
          - *export_merkely_fingerprint_env_vars
          - pipe: docker://merkely/change:latest
            variables:
              MERKELY_COMMAND: control_deployment
              MERKELY_FINGERPRINT: ${MERKELY_FINGERPRINT}
              MERKELY_OWNER: ${MERKELY_OWNER}
              MERKELY_PIPELINE: ${MERKELY_PIPELINE}
              MERKELY_API_TOKEN: ${MERKELY_API_TOKEN}


    - step: &deploy-to-production
        name: Deploy to Production
        script:
          - echo YOUR DEPLOYMENT COMMAND HERE


    - step: &merkely-log-deployment-to-production
        name: Log deploy to Production in Merkely
        services: [ docker ]
        script:
          - *export_merkely_fingerprint_env_vars
          - pipe: docker://merkely/change:latest
            variables:
              MERKELY_COMMAND: log_deployment
              MERKELY_FINGERPRINT: ${MERKELY_FINGERPRINT}
              MERKELY_DESCRIPTION: "Deployed to production in bitbucket pipeline"
              MERKELY_ENVIRONMENT: production
              MERKELY_OWNER: ${MERKELY_OWNER}
              MERKELY_PIPELINE: ${MERKELY_PIPELINE}
              MERKELY_API_TOKEN: ${MERKELY_API_TOKEN}


    - step: &update-tracking-branch
        name: Update tracking branch
        script:
          - git checkout --track origin/production
          - git merge ${BITBUCKET_COMMIT}
          - git push origin production


pipelines:
  branches:
    main:
      - step: *merkely-declare-pipeline
      - step: *build-and-publish-docker-image
      - step: *merkely-log-docker-image
      - step: *run-unit-tests
      - step: *merkely-log-unit-test-results
      - step: *run-security-tests
      - step: *merkely-log-security-test-results
      - step: *run-coverage-analysis
      - step: *merkely-log-coverage-analysis
      - step: *deploy-to-staging
      - step: *merkely-log-deployment-to-staging
      - step: *merkely-request-approval-for-deployment
      - step: *merkely-check-deployment-approved
      - step: *deploy-to-production
      - step: *merkely-log-deployment-to-production
      - step: *update-tracking-branch