config.yml

version: 2.1

orbs:
  aws-s3: circleci/aws-s3@1.0.11
  owasp: entur/owasp@0.0.10

executors:
  default:
    docker:
      - image: mattermost/mattermost-build-webapp:20200829_node-10.22
    resource_class: "xlarge"

aliases:
  - &restore_cache
    restore_cache:
      key: dependencies-{{ .Branch }}-{{ checksum "package-lock.json" }}-5
  - &save_cache
    save_cache:
      key: dependencies-{{ .Branch }}-{{ checksum "package-lock.json" }}-5
      paths:
        - ~/mattermost/mattermost-webapp/node_modules

jobs:
  install:
    executor:
      name: default
    working_directory: ~/mattermost/mattermost-webapp
    steps:
      - checkout
      - run: |
          npm ci
          cd node_modules/mattermost-redux && npm i && npm run build
      - *save_cache

  check-deps:
    parameters:
      cve_data_directory:
        type: string
        default: "~/.owasp/dependency-check-data"
    working_directory: ~/mattermost/mattermost-webapp
    executor: owasp/default
    environment:
      version_url: "https://jeremylong.github.io/DependencyCheck/current.txt"
      executable_url: "https://dl.bintray.com/jeremy-long/owasp/dependency-check-VERSION-release.zip"
    steps:
      - checkout
      - run:
          name: Link dependency cache
          command: |
            sudo mkdir /root/mattermost
            sudo ln -s ~/mattermost/mattermost-webapp /root/mattermost/mattermost-webapp; sudo chmod 777 /root
      - *restore_cache
      - run:
          name: Adjust permissions
          command: sudo chown -R `id -nu`:`id -ng` node_modules
      - run:
          name: Checkout config
          command: cd .. && git clone https://github.com/mattermost/security-automation-config
      - run:
          name: Install Go
          command: sudo apt-get update && sudo apt-get install golang
      - owasp/with_commandline:
          steps:
            # Taken from https://github.com/entur/owasp-orb/blob/master/src/%40orb.yml#L349-L361
            - owasp/generate_cache_keys:
                cache_key: commmandline-default-cache-key-v6
            - owasp/restore_owasp_cache
            - run:
                name: Update OWASP Dependency-Check Database
                command: |
                  if ! ~/.owasp/dependency-check/bin/dependency-check.sh --data << parameters.cve_data_directory >> --updateonly; then
                    # Update failed, probably due to a bad DB version; delete cached DB and try again
                    rm -rv ~/.owasp/dependency-check-data/*.db
                    ~/.owasp/dependency-check/bin/dependency-check.sh --data << parameters.cve_data_directory >> --updateonly
                  fi
            - owasp/store_owasp_cache:
                cve_data_directory: <<parameters.cve_data_directory>>
            - run:
                name: Run OWASP Dependency-Check Analyzer
                command: |
                  ~/.owasp/dependency-check/bin/dependency-check.sh \
                    --data << parameters.cve_data_directory >> --format ALL --noupdate --enableExperimental \
                    --propertyfile ../security-automation-config/dependency-check/dependencycheck.properties \
                    --suppression ../security-automation-config/dependency-check/suppression.xml \
                    --suppression ../security-automation-config/dependency-check/suppression.$CIRCLE_PROJECT_REPONAME.xml \
                    --scan './**/*' || true
            - owasp/collect_reports:
                persist_to_workspace: false
      - run:
          name: Post results to Mattermost
          command: go run ../security-automation-config/dependency-check/post_results.go

  lint:
    executor:
      name: default
    working_directory: ~/mattermost/mattermost-webapp
    steps:
      - checkout
      - *restore_cache
      - run: |
          npm run check

  i18n-check:
    executor:
      name: default
    working_directory: ~/mattermost/mattermost-webapp
    steps:
      - checkout
      - *restore_cache
      - run: |
          cp i18n/en.json /tmp/en.json
          mkdir -p /tmp/fake-mobile-dir/assets/base/i18n/
          echo '{}' > /tmp/fake-mobile-dir/assets/base/i18n/en.json

          npm run mmjstool -- i18n extract-webapp --webapp-dir . --mobile-dir /tmp/fake-mobile-dir
          diff /tmp/en.json i18n/en.json
          # Address weblate behavior which does not remove whole translation item when translation string is set to empty
          npm run mmjstool -- i18n clean-empty --webapp-dir . --mobile-dir /tmp/fake-mobile-dir --check

          rm -rf tmp

  type-check:
    executor:
      name: default
    working_directory: ~/mattermost/mattermost-webapp
    steps:
      - checkout
      - *restore_cache
      - run: |
          npm run check-types

  test:
    executor:
      name: default
    working_directory: ~/mattermost/mattermost-webapp
    steps:
      - checkout
      - *restore_cache
      - run: npm run test-ci
      - store_test_results:
          path: build/

  build:
    executor:
      name: default
    resource_class: xlarge
    working_directory: ~/mattermost/mattermost-webapp
    steps:
      - checkout
      - *restore_cache
      - run: |
          node --version
          npm version
          make package-ci
      - store_artifacts:
          path: ~/mattermost/mattermost-webapp/mattermost-webapp.tar.gz
      - persist_to_workspace:
          root: ~/mattermost
          paths:
            - mattermost-webapp/mattermost-webapp.tar.gz

  build-storybook:
    executor:
      name: default
    working_directory: ~/mattermost/mattermost-webapp
    steps:
      - checkout
      - *restore_cache
      - run: npm run build-storybook
      - store_artifacts:
          path: ~/mattermost/mattermost-webapp/storybook-static
      - persist_to_workspace:
          root: ~/mattermost
          paths:
            - mattermost-webapp/storybook-static

  upload-storybook:
    docker:
      - image: circleci/python:3.6
    working_directory: ~/mattermost/mattermost-webapp
    steps:
      - attach_workspace:
          at: ~/mattermost/
      - aws-s3/sync:
          from: storybook-static
          to: s3:https://alpha-storybook.mattermost.com/$(echo "${CIRCLE_BRANCH}" | sed 's/pull\//PR-/g')/
          arguments: --cache-control no-cache
      - aws-s3/sync:
          from: storybook-static
          to: s3:https://alpha-storybook.mattermost.com/commit/${CIRCLE_SHA1}/
          arguments: --cache-control no-cache

  upload-s3:
    docker:
      - image: circleci/python:3.6
    working_directory: ~/mattermost/mattermost-webapp
    steps:
      - attach_workspace:
          at: ~/mattermost/
      - aws-s3/copy:
          from: mattermost-webapp.tar.gz
          to: s3:https://pr-builds.mattermost.com/${CIRCLE_PROJECT_REPONAME}/$(echo "${CIRCLE_BRANCH}" | sed 's/pull\//PR-/g')/
          arguments: --cache-control no-cache
      - aws-s3/copy:
          from: mattermost-webapp.tar.gz
          to: s3:https://pr-builds.mattermost.com/${CIRCLE_PROJECT_REPONAME}/commit/${CIRCLE_SHA1}/
          arguments: --cache-control no-cache

  prepare-docker-build:
    working_directory: ~/mattermost/mattermost-webapp
    docker:
      - image: circleci/python:3.6
    steps:
      - attach_workspace:
          at: ~/mattermost/
      - run:
          command: |
            curl -f -o server.tar.gz https://pr-builds.mattermost.com/mattermost-server/$(echo "${CIRCLE_BRANCH}" | sed 's/pull\//PR-/g')/mattermost-enterprise-linux-amd64.tar.gz || curl -f -o server.tar.gz https://releases.mattermost.com/mattermost-platform/master/mattermost-enterprise-linux-amd64.tar.gz

            tar xf server.tar.gz
            rm -rf mattermost/client
            tar xf mattermost-webapp.tar.gz
            mv client mattermost/client
            tar -zcf mattermost-enterprise-linux-amd64.tar.gz mattermost/
      - store_artifacts:
          path: ~/mattermost/mattermost-webapp/mattermost-enterprise-linux-amd64.tar.gz
      - aws-s3/copy:
          from: ~/mattermost/mattermost-webapp/mattermost-enterprise-linux-amd64.tar.gz
          to: s3:https://pr-builds.mattermost.com/${CIRCLE_PROJECT_REPONAME}/commit/${CIRCLE_SHA1}/
          arguments: --cache-control no-cache

  build-docker:
    working_directory: ~/mattermost/
    docker:
      - image: circleci/buildpack-deps:stretch
    steps:
      - attach_workspace:
          at: ~/mattermost/
      - setup_remote_docker
      - run:
          command: |
            export TAG="${CIRCLE_SHA1:0:7}"

            git clone https://github.com/mattermost/mattermost-server.git

            cd mattermost-server
            export MM_PACKAGE=https://pr-builds.mattermost.com/${CIRCLE_PROJECT_REPONAME}/commit/${CIRCLE_SHA1}/mattermost-enterprise-linux-amd64.tar.gz
            docker build --build-arg MM_PACKAGE=$MM_PACKAGE -t mattermost/mattermost-enterprise-edition:${TAG} build
            echo $DOCKER_PASSWORD | docker login --username $DOCKER_USERNAME --password-stdin
            docker push mattermost/mattermost-enterprise-edition:${TAG}

workflows:
  version: 2
  untagged-build:
    jobs:
      - install
      - check-deps:
          context: sast-webhook
          requires:
            - install
      - lint:
          requires:
            - install
      - i18n-check:
          requires:
            - install
      - type-check:
          requires:
            - install
      - build:
          requires:
            - install
      - upload-s3:
          context: mattermost-ci-pr-builds-s3
          requires:
            - build
      - prepare-docker-build:
          context: mattermost-ci-pr-builds-s3
          requires:
            - upload-s3
      - build-docker:
          context: matterbuild-docker
          requires:
            - prepare-docker-build
      - build-storybook:
          requires:
            - build
      - upload-storybook:
          context: mattermost-s3-storybook-alpha
          requires:
            - build-storybook
      - test:
          requires:
            - type-check
            - i18n-check
            - lint