lts-nfsv3driver-v5.0.yml

---
#  This pipeline is set automatics, any none committed changes will be lost.
#
# To set the pipeline, run:
#    fly -t cryo set-pipeline -p lts-nfsv3driver-v5.0 -c lts-nfsv3driver-v5.0.yml
#
# ************************************
# Secrets we need to run this pipeline
# ************************************

#! this needs to come first, else all other vars can't be resolved.
#! cerberus creds are required to access the teams vault instance managed by cerberus. The creds have been created manually via the vault-cli targetting the teams cerberus vault. Example steps to create an approle are here: https://developer.hashicorp.com/vault/docs/auth/approle the required value for policies is `restricted-admin` the auth method is mounted on the standard path.

cerberus_secrets:
#! GitHub SSH Key is used to push git commits and accessing repositories. Added 2024-02-19
- &github_access_token ((github-tas-runtime-bot/access-token))
- &github_ssh_key ((github-tas-runtime-bot/private-key))

#! GitHub email and username are used to sign the commits and PRs for go module auto bumps. Added 2024-02-19
- &github_user App Platform Runtime Working Group CI Bot
- &github_email tas-runtime.pdl+tas-runtime-bot@broadcom.com

- &gcr_viewer_key  ((gcp-tas-runtime-service-account/config-json))

# **************
# End of secrets
# **************

groups:
- name: test
  jobs:
  - unit-test
  - security-scan
  - integration
  - merge-pr
- name: updates
  jobs:
  - bump-go-module

resource_types:
- name: pull-request
  type: docker-image
  source:
    repository: us-west2-docker.pkg.dev/mapbu-cryogenics/concourse-resources/pr-queue-resource
    username: _json_key
    password: *gcr_viewer_key

resources:
- name: nfsv3driver
  type: pull-request
  icon: source-pull
  source:
    repository: cloudfoundry/nfsv3driver
    base_branch: v5.0
    disable_forks: true
    access_token: *github_access_token

- name: nfsv3driver-read
  type: git
  icon: github
  source:
    uri: https://github.com/cloudfoundry/nfsv3driver
    branch: v5.0

- name: nfsv3driver-write
  type: git
  icon: git
  source:
    uri: git@github.com:cloudfoundry/nfsv3driver.git
    private_key: *github_ssh_key
    commit_filter:
      exclude:
      - ;resource comment; This resource is used exclusively for pushing new changes

- name: cryogenics-concourse-tasks
  type: git
  icon: github
  source:
    uri: git@github.com:pivotal/cryogenics-concourse-tasks.git
    private_key: ((tas-runtime-bot-cryo-deploy-key-for-pivotal-org/private_key))
    branch: main

- name: cfpersi-nfs-integration-tests
  type: registry-image
  source:
    repository: us-west2-docker.pkg.dev/mapbu-cryogenics/dockerhub-proxy-cache/cfpersi/nfs-integration-tests
    username: _json_key
    password: *gcr_viewer_key

- name: image-cryogenics-essentials
  icon: docker
  type: registry-image
  source:
    repository: us-west2-docker.pkg.dev/mapbu-cryogenics/essentials/cryo-essentials
    tag: latest
    username: _json_key
    password: *gcr_viewer_key

- name: persi-ci
  type: git
  icon: github
  source:
    uri: https://github.com/cloudfoundry/persi-ci.git
    branch: master

- name: mapfs
  type: git
  icon: github
  source:
    branch: master
    uri: git@github.com:cloudfoundry/mapfs.git
    private_key: *github_ssh_key

- name: docker_driver_integration_tests
  type: git
  icon: github
  source:
    branch: main
    uri: https://github.com/cloudfoundry/docker_driver_integration_tests

- name: once-a-week
  type: time
  icon: clock-outline
  source:
    days: [ Thursday ]

jobs:
- name: unit-test
  public: true
  plan:
  - in_parallel:
    - get: nfsv3driver
      trigger: true
    - get: image-cryogenics-essentials
  - task: build
    image: image-cryogenics-essentials
    file: nfsv3driver/scripts/ci/run_unit.build.yml

- name: security-scan
  plan:
  - in_parallel:
    - get: persi-ci
    - get: image-cryogenics-essentials
    - get: nfsv3driver
      trigger: true
      passed:
      - unit-test
  - task: build
    image: image-cryogenics-essentials
    file: persi-ci/scripts/ci/security-scan.build.yml
    params:
      PATHS: "./"
    input_mapping:
      release-dir: nfsv3driver

- name: integration
  serial: true
  plan:
  - in_parallel:
      fail_fast: true
      steps:
      - get: persi-ci
      - get: docker_driver_integration_tests
      - get: cfpersi-nfs-integration-tests
      - get: nfsv3driver
        passed:
        - unit-test
        trigger: true
      - get: mapfs
  - in_parallel:
      fail_fast: true
      steps:
      - task: run_docker_driver_integration_tests
        image: cfpersi-nfs-integration-tests
        file: nfsv3driver/scripts/ci/run_docker_driver_integration_tests.build.yml
        privileged: true
        params:
          TEST_PACKAGE: docker_driver_integration_tests/
      - task: run_docker_driver_lazy_unmount_integration_tests
        file: nfsv3driver/scripts/ci/run_docker_driver_integration_tests.build.yml
        image: cfpersi-nfs-integration-tests
        privileged: true
        params:
          TEST_PACKAGE: docker_driver_integration_tests/lazy_unmount
      - task: run_driver_broker_compatibility_tests
        file: nfsv3driver/scripts/ci/run_docker_driver_integration_tests.build.yml
        image: cfpersi-nfs-integration-tests
        privileged: true
        params:
          TEST_PACKAGE: docker_driver_integration_tests/compatibility

- name: merge-pr
  serial: true
  plan:
  - get: nfsv3driver
    trigger: true
    passed:
    - security-scan
    - integration
  - put: nfsv3driver
    params:
      merge: true
      repository: nfsv3driver

- name: bump-go-module
  plan:
  - in_parallel:
    - get: source-repo
      resource: nfsv3driver-read
    - get: cryogenics-concourse-tasks
    - get: image-cryogenics-essentials
    - get: once-a-week
      trigger: true
  - task: bump-go-module
    file: cryogenics-concourse-tasks/deps-automation/bump-go-module/task.yml
    image: image-cryogenics-essentials
    params:
      GIT_USERNAME: *github_user
      GIT_EMAIL: *github_email
      ROOT_DIRECTORIES: .
      BRANCH_PREFIX: v5.0-
  - try:
      load_var: go-module-update-branch
      file: destination-repo/.update-branch-name
      on_success:
        do:
        - put: nfsv3driver-write
          params:
            repository: destination-repo
            branch: &go-module-branch ((.:go-module-update-branch))
        - task: create-go-module-bump-pull-request
          file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
          image: image-cryogenics-essentials
          params:
            GH_TOKEN: *github_access_token
            BASE: v5.0
            BRANCH: *go-module-branch
            LABELS: dependencies
            TITLE: Bump go module ((.:go-module-update-branch))
            MESSAGE: |
              This is an automatically generated Pull Request from the Cryogenics CI Bot.

              I have detected a new version of a go module and automatically bumped
              it to benefit from the latest changes.

              If this does not look right, please reach out to the mapbu-cryogenics team.
          input_mapping:
            source-repo: nfsv3driver-write