pipeline.yml

---
shared:
  - &azure-environment-params
    AZURE_ENVIRONMENT:                    AzureCloud
    AZURE_TENANT_ID:                      ((cpi_azure_credentials_json.tenant_id))
    AZURE_SUBSCRIPTION_ID:                ((cpi_azure_credentials_json.subscription_id))
    AZURE_CLIENT_ID:                      ((cpi_azure_credentials_json.client_id))
    AZURE_CLIENT_SECRET:                  ((cpi_azure_credentials_json.client_secret))
    AZURE_CERTIFICATE: |
      ((bosh-azure-cpi/cpi_certificate_auth.private_key))
      ((bosh-azure-cpi/cpi_certificate_auth.certificate))

  - &create-bats-environment
    put: environment
    tags: [azure]
    params:
      delete_on_failure: true
      generate_random_name: true
      terraform_source: pipelines/azure/assets/terraform

  - &create-az-bats-environment
    put: environment
    tags: [azure]
    params:
      delete_on_failure: true
      generate_random_name: true
      terraform_source: bosh-cpi-src/ci/assets/terraform/az_bats

  - &destroy-bats-environment
    put: environment
    tags: [azure]
    params:
      action: destroy
      env_name_file: environment/name
      terraform_source: pipelines/azure/assets/terraform
    get_params:
      action: destroy

  - &destroy-az-bats-environment
    put: environment
    tags: [azure]
    params:
      action: destroy
      env_name_file: environment/name
      terraform_source: bosh-cpi-src/ci/assets/terraform/az_bats
    get_params:
      action: destroy

  - &prepare-director
    task: prepare-director
    file: pipelines/shared/tasks/prepare-director.yml
    image: bosh-integration-registry-image
    params: &prepare-director-params
      INFRASTRUCTURE:     azure
      DIRECTOR_VARS_FILE:  |
        subscription_id: ((cpi_azure_credentials_json.subscription_id))
        tenant_id: ((cpi_azure_credentials_json.tenant_id))
        client_id: ((cpi_azure_credentials_json.client_id))
        client_secret: ((cpi_azure_credentials_json.client_secret))
        dns_recursor_ip: 8.8.8.8

  - &load-current-ruby-version-using-load_var
    load_var: ruby_version
    file: "bosh-cpi-src/src/bosh_azure_cpi/.ruby-version"
    format: raw
    reveal: true

  - &deploy-director
    task: deploy-director
    tags: [azure]
    file: pipelines/shared/tasks/deploy-director.yml
    image: bosh-integration-registry-image
    params:
      RUBY_VERSION: ((.:ruby_version))


  - &run-bats
    task: run-bats
    tags: [azure]
    file: pipelines/shared/tasks/run-bats.yml
    image: bosh-integration-registry-image
    params: &run-bats-params
      INFRASTRUCTURE:                     azure
      STEMCELL_NAME:                      bosh-azure-hyperv-ubuntu-jammy-go_agent
      BAT_INFRASTRUCTURE:                 azure
      BAT_RSPEC_FLAGS:                    "--tag ~raw_ephemeral_storage"
      RUBY_VERSION: ((.:ruby_version))

  - &run-az-bats
    task: run-az-bats
    tags: [azure]
    file: bosh-cpi-src/ci/tasks/run-az-bats.yml
    params: &run-az-bats-params
      INFRASTRUCTURE:                     azure
      STEMCELL_NAME:                      bosh-azure-hyperv-ubuntu-jammy-go_agent
      BAT_INFRASTRUCTURE:                 azure
      BAT_RSPEC_FLAGS:                    "--tag ~raw_ephemeral_storage"
      AZURE_BATS_ZONE:                    "1"

  - &teardown
    task: teardown
    tags: [azure]
    image: bosh-integration-registry-image
    file: pipelines/shared/tasks/teardown.yml
    params:
      RUBY_VERSION: ((.:ruby_version))


  - &create-integration-environment
    put: environment
    tags: [azure]
    params:
      delete_on_failure: true
      generate_random_name: true
      terraform_source: bosh-cpi-src/ci/assets/terraform/integration

  - &destroy-integration-environment
    put: environment
    tags: [azure]
    params:
      action: destroy
      env_name_file: environment/name
      terraform_source: bosh-cpi-src/ci/assets/terraform/integration
    get_params:
      action: destroy

  - &upload-stemcell
    task: upload-stemcell
    tags: [azure]
    file: bosh-cpi-src/ci/tasks/upload-stemcell.yml
    params: &upload-stemcell-params
      <<: *azure-environment-params

  - &run-integration
    task: run-integration
    tags: [azure]
    file: bosh-cpi-src/ci/tasks/run-integration.yml
    params: &run-integration-params
      <<: *azure-environment-params
      SSH_PUBLIC_KEY: ((bosh-azure-cpi/integration_vm_keypair.public_key))

  - &run-integration-windows
    task: run-integration-windows
    tags: [azure]
    file: bosh-cpi-src/ci/tasks/run-integration-windows.yml
    params: &run-integration-windows-params
      <<: *run-integration-params

  - &ensure-cleanup
    task: ensure-cleanup
    tags: [azure]
    file: bosh-cpi-src/ci/tasks/ensure-cleanup.yml
    params:
      <<: *azure-environment-params

jobs:
  - name: unit-specs
    plan:
    - in_parallel:
      - get: bosh-cpi-src
        resource: bosh-cpi-src-in
        trigger: true
      - get: bosh-integration-registry-image
    - task: run-unit-specs
      tags: [ azure ]
      file: bosh-cpi-src/ci/tasks/run-unit-specs.yml
      image: bosh-integration-registry-image

  - name: integration-unmanaged-disks
    serial: true
    serial_groups: [integration-unmanaged-disks]
    plan:
      - in_parallel:
        - {get: bosh-cpi-src,     trigger: true, resource: bosh-cpi-src-in,        passed: [unit-specs]}
        - {get: stemcell,         trigger: false, resource: azure-ubuntu-stemcell, tags: [azure]}
      - <<: *create-integration-environment
      - do:
        - <<: *upload-stemcell
        - <<: *run-integration
          params:
            <<: *run-integration-params
            AZURE_USE_MANAGED_DISKS: false
        ensure:
          do:
            - <<: *destroy-integration-environment
          ensure:
            do:
              - <<: *ensure-cleanup

  - name: integration-managed-disks
    serial: true
    serial_groups: [integration-managed-disks]
    plan:
      - in_parallel:
        - {get: bosh-cpi-src,     trigger: true, resource: bosh-cpi-src-in,        passed: [unit-specs]}
        - {get: stemcell,         trigger: false, resource: azure-ubuntu-stemcell, tags: [azure]}
      - <<: *create-integration-environment
      - do:
        - <<: *upload-stemcell
        - <<: *run-integration
          params:
            <<: *run-integration-params
            AZURE_USE_MANAGED_DISKS: true
        ensure:
          do:
            - <<: *destroy-integration-environment
          ensure:
            do:
              - <<: *ensure-cleanup

  - name: integration-windows-unmanaged-disks
    serial: true
    serial_groups: [integration-windows-unmanaged-disks]
    plan:
      - in_parallel:
        - {get: bosh-cpi-src,     trigger: true, resource: bosh-cpi-src-in,        passed: [unit-specs]}
        - {get: stemcell,         trigger: false, resource: azure-windows-stemcell, tags: [azure]}
      - <<: *create-integration-environment
      - do:
        - <<: *upload-stemcell
          params:
            <<: *azure-environment-params
            IS_HEAVY_STEMCELL: false
        - <<: *run-integration-windows
          params:
            <<: *run-integration-windows-params
            AZURE_USE_MANAGED_DISKS: false
        ensure:
          do:
            - <<: *destroy-integration-environment
          ensure:
            do:
              - <<: *ensure-cleanup

  - name: integration-windows-managed-disks
    serial: true
    serial_groups: [integration-windows-managed-disks]
    plan:
      - in_parallel:
        - {get: bosh-cpi-src,     trigger: true, resource: bosh-cpi-src-in,        passed: [unit-specs]}
        - {get: stemcell,         trigger: false, resource: azure-windows-stemcell, tags: [azure]}
      - <<: *create-integration-environment
      - do:
        - <<: *upload-stemcell
          params:
            <<: *azure-environment-params
            IS_HEAVY_STEMCELL: false
        - <<: *run-integration-windows
          params:
            <<: *run-integration-windows-params
            AZURE_USE_MANAGED_DISKS: true
        ensure:
          do:
            - <<: *destroy-integration-environment
          ensure:
            do:
              - <<: *ensure-cleanup

  - name: bats-unmanaged-disks
    serial: true
    serial_groups: [bats-unmanaged-disks]
    plan:
      - in_parallel:
        - get: bosh-release
          resource: bosh-release
        - get: bosh-cpi-src
          resource: bosh-cpi-src-in
          passed: [unit-specs]
          trigger: true
        - get: stemcell
          trigger: true
          resource: azure-ubuntu-stemcell
          tags: [azure]
        - get: bosh-deployment
        - get: pipelines
        - get: bats
        - get: bosh-integration-registry-image
      - task: build-candidate
        file: bosh-cpi-src/ci/tasks/build-candidate.yml
      - <<: *create-bats-environment
      - do:
        - <<: *prepare-director
          params:
            <<: *prepare-director-params
            OPTIONAL_OPS_FILE: |
              -o pipelines/shared/assets/ops/remove-hm.yml
              -o bosh-deployment/external-ip-not-recommended.yml
        - do:
          - <<: *load-current-ruby-version-using-load_var
          - <<: *deploy-director
          - <<: *run-bats
          ensure:
            do:
              - <<: *teardown
        ensure:
          do:
            - <<: *destroy-bats-environment
          ensure:
            do:
              - <<: *ensure-cleanup

  - name: bats-managed-disks
    serial: true
    serial_groups: [bats-managed-disks]
    plan:
      - in_parallel:
        - get: bosh-release
          resource: bosh-release
        - get: bosh-cpi-src
          resource: bosh-cpi-src-in
          passed: [unit-specs]
          trigger: true
        - get: stemcell
          resource: azure-ubuntu-stemcell
          tags: [azure]
        - get: bosh-deployment
        - get: pipelines
        - get: bats
        - get: bosh-integration-registry-image
      - task: build-candidate
        file: bosh-cpi-src/ci/tasks/build-candidate.yml
      - <<: *create-az-bats-environment
      - do:
        - <<: *prepare-director
          params:
            <<: *prepare-director-params
            OPTIONAL_OPS_FILE: |
              -o pipelines/shared/assets/ops/remove-hm.yml
              -o bosh-deployment/external-ip-not-recommended.yml
              -o bosh-deployment/azure/use-managed-disks.yml
        - do:
          - <<: *load-current-ruby-version-using-load_var
          - <<: *deploy-director
          - <<: *run-az-bats
          ensure:
            do:
              - <<: *teardown
        ensure:
          do:
            - <<: *destroy-az-bats-environment
          ensure:
            do:
              - <<: *ensure-cleanup

  - name: cleanup-leftover-environments
    serial_groups:
      - integration-unmanaged-disks
      - integration-managed-disks
      - integration-windows-unmanaged-disks
      - integration-windows-managed-disks
      - bats-unmanaged-disks
      - bats-managed-disks
    plan:
      - in_parallel:
          - get: bosh-integration-registry-image
          - get: bosh-azure-cpi-release
            resource: bosh-cpi-src-in
          - get: daily
            trigger: true
      - task: cleanup-leftover-environments
        file: bosh-azure-cpi-release/ci/tasks/cleanup-leftover-environments.yml
        image: bosh-integration-registry-image

  - name: release-fan-in
    plan:
      - get: bosh-cpi-src-in
        trigger: true
        passed:
        - integration-unmanaged-disks
        - integration-managed-disks
        - integration-windows-unmanaged-disks
        - integration-windows-managed-disks
        - bats-unmanaged-disks
        - bats-managed-disks

  - name: bump-major
    serial_groups: [ version ]
    plan:
    - put: release-version-semver
      params:
        bump: major

  - name: bump-minor
    serial_groups: [ version ]
    plan:
    - put: release-version-semver
      params:
        bump: minor

  - name: bump-patch
    serial_groups: [ version ]
    plan:
    - put: release-version-semver
      params:
        bump: patch

  - name: automatically-release-new-patch
    serial_groups: [ version ]
    plan:
    - in_parallel:
      - get: bosh-cpi-src-in
        trigger: true
        passed:
        - release-fan-in
      - get: bosh-shared-ci
      - get: version
        resource: release-version-semver
      - get: bosh-security-scanner-registry-image
    - try:
        task: check-for-updated-vendored-packages
        file: bosh-shared-ci/tasks/release/check-for-updated-vendored-packages.yml
        image: bosh-security-scanner-registry-image
        input_mapping:
          input_repo: bosh-cpi-src-in
        params:
          PACKAGES: [azure-cpi-ruby-3.3]
    - try:
        task: check-for-patched-cves
        file: bosh-shared-ci/tasks/release/check-for-patched-cves.yml
        image: bosh-security-scanner-registry-image
        input_mapping:
          input_repo: bosh-cpi-src-in
        params:
          SEVERITY: CRITICAL,HIGH
    - task: ensure-cve-checker-succeeded
      file: bosh-shared-ci/tasks/release/ensure-task-succeeded.yml
      image: bosh-security-scanner-registry-image
      input_mapping:
        task-output-folder: patched_cves
    - try:
        task: check-needs-release
        config:
          platform: linux
          image_resource:
            type: docker-image
            source: {repository: alpine}
          inputs:
          - name: release-notes
          run:
            path: /bin/sh
            args:
            - -c
            - |
              if [ -f release-notes/needs-release ]; then
                echo "## Release Notes"
                echo "${release-notes/release-notes.md}"
                exit 0
              else
                echo "No release needed"
                exit 1
              fi
        on_success:
          do:
          - put: release-notes
            params:
              file: release-notes/release-notes.md
          - put: release-version-semver
            params:
              bump: patch

  - name: promote-candidate
    old_name: promote-candidate-major
    plan:
      - in_parallel:
        - get: bosh-cpi-src
          resource: bosh-cpi-src-in
          passed:
          - release-fan-in
        - get: release-version-semver
          trigger: true
        - get: release-notes
        - get: bosh-shared-ci
      - task: promote
        file: bosh-shared-ci/tasks/release/create-final-release.yml
        input_mapping:
          release_repo: bosh-cpi-src
          version: release-version-semver
        params:
          GIT_USER_NAME: CI Bot
          GIT_USER_EMAIL: bots@cloudfoundry.org
          PRIVATE_YML: |
            ---
            blobstore:
              provider: gcs
              options:
                credentials_source: static
                json_key: '((cloud-foundry-gcp-credentials))'
      - put: bosh-cpi-src-out
        params: {repository: release_repo, rebase: true, tag: release_metadata/tag-name}
      - put: bosh-azure-cpi-release-github-release
        params:
          name: release_metadata/tag-name
          tag: release_metadata/tag-name
          body: release-notes/release-notes
          commitish: bosh-cpi-src-out/.git/ref
          generate_release_notes: true
      - put: release-notes
        params:
          file: release_metadata/empty-file

  - name: bump-deps
    plan:
    - in_parallel:
      - get: bosh-cpi-src
        resource: bosh-cpi-src-in
      - get: ruby-release
      - get: bosh-ruby-release-registry-image
      - get: bosh-integration-registry-image
      - get: weekly
        trigger: true
    - task: bump-gems
      image: bosh-ruby-release-registry-image
      file: ruby-release/ci/tasks/shared/bump-gems.yml
      input_mapping:
        input-repo: bosh-cpi-src
      output_mapping:
        output-repo: bosh-cpi-src
      params:
        GEM_DIRS: src/bosh_azure_cpi
        GIT_USER_NAME: CI Bot
        GIT_USER_EMAIL: bots@cloudfoundry.org
        PACKAGE: ruby-3.3
        VENDOR: true
    - task: run-unit-specs
      tags: [ azure ]
      file: bosh-cpi-src/ci/tasks/run-unit-specs.yml
      image: bosh-integration-registry-image
    - put: bosh-cpi-src-out
      params:
        repository: bosh-cpi-src
        rebase: true

  - name: bump-bosh-packages
    plan:
    - in_parallel:
      - get: bosh-cpi-src
        resource: bosh-cpi-src-in
      - get: ruby-release
        trigger: true
      - get: bosh-ecosystem-concourse-image
      - get: bosh-integration-registry-image
    - task: bump-ruby-package
      image: bosh-ecosystem-concourse-image
      file: ruby-release/ci/tasks/shared/bump-ruby-package.yml
      input_mapping:
        bosh-release: bosh-cpi-src
      output_mapping:
        bosh-release: bosh-cpi-src
      params:
        GIT_USER_NAME: CI Bot
        GIT_USER_EMAIL: cf-bosh-eng@pivotal.io
        PACKAGE: ruby-3.3
        PACKAGE_PREFIX: azure-cpi
        PRIVATE_YML: |
          ---
          blobstore:
            provider: gcs
            options:
              credentials_source: static
              json_key: '((cloud-foundry-gcp-credentials))'
        RUBY_VERSION_PATH: src/bosh_azure_cpi/.ruby-version
    - task: run-unit-specs
      tags: [ azure ]
      file: bosh-cpi-src/ci/tasks/run-unit-specs.yml
      image: bosh-integration-registry-image
    - put: bosh-cpi-src-out
      params:
        repository: bosh-cpi-src
        rebase: true

resource_types:
  - name: terraform_type
    type: docker-image
    source:
      repository: ljfranklin/terraform-resource

  - name: semver
    type: docker-image
    source:
      repository: concourse/semver-resource
      tag: 1.6

  - name: gcs
    type: registry-image
    source:
      repository: frodenas/gcs-resource
      username: ((docker.username))
      password: ((docker.password))

resources:
  - name: bosh-shared-ci
    type: git
    source:
      uri: git@github.com:cloudfoundry/bosh-shared-ci.git
      private_key: ((github_deploy_key_bosh-shared-ci.private_key))

  - name: bosh-integration-registry-image
    type: registry-image
    source:
      repository: bosh/integration
      username: ((docker.username))
      password: ((docker.password))

  - name: bosh-cpi-src-in
    type: git
    source:
      uri: https://github.com/cloudfoundry/bosh-azure-cpi-release.git
      branch: master
      ignore_paths:
        - .final_builds/**/*.yml
        - releases/**/*.yml
  - name: bosh-cpi-src-out
    type: git
    source:
      uri: git@github.com:cloudfoundry/bosh-azure-cpi-release.git
      branch: master
      private_key: ((github_deploy_key_bosh-azure-cpi-release.private_key))
  - name: release-version-semver
    type: semver
    source:
      driver: git
      branch: release-semver
      file: VERSION
      uri: git@github.com:cloudfoundry/bosh-azure-cpi-release.git
      private_key: ((github_deploy_key_bosh-azure-cpi-release.private_key))
      initial_version: '50.0.0'
  - name: release-notes
    type: gcs
    source:
      versioned_file: release-notes
      bucket: bosh-azure-cpi-blobs
      json_key: ((cloud-foundry-gcp-credentials))
  - name: bosh-azure-cpi-release-github-release
    type: github-release
    source:
      owner: cloudfoundry
      repository: bosh-azure-cpi-release
      access_token: ((github_public_repo_token))
  - name: environment
    type: terraform_type
    source:
      backend_type: gcs
      backend_config:
        bucket: bosh-azure-cpi-blobs
        prefix: terraform
        credentials: ((cloud-foundry-gcp-credentials))
      vars:
        location:              eastus2
        azure_environment:     AzureCloud
        azure_subscription_id: ((cpi_azure_credentials_json.subscription_id))
        azure_client_id:       ((cpi_azure_credentials_json.client_id))
        azure_client_secret:   ((cpi_azure_credentials_json.client_secret))
        azure_tenant_id:       ((cpi_azure_credentials_json.tenant_id))
        resource_group_prefix: azurecpi
  - name: pipelines
    type: git
    source:
      uri: https://github.com/cloudfoundry-incubator/bosh-cpi-certification
      branch: master
  - name: bosh-release
    type: bosh-io-release
    source:
      repository: cloudfoundry/bosh
  - name: azure-ubuntu-stemcell
    type: bosh-io-stemcell
    source:
      name: bosh-azure-hyperv-ubuntu-jammy-go_agent
  - name: azure-windows-stemcell
    type: bosh-io-stemcell
    source:
      name: bosh-azure-hyperv-windows2019-go_agent
  - name: bats
    type: git
    source:
      uri: https://github.com/cloudfoundry/bosh-acceptance-tests.git
      branch: master
  - name: bosh-deployment
    type: git
    source:
      uri: https://github.com/cloudfoundry/bosh-deployment
      branch: master
  - name: bosh-ruby-release-registry-image
    type: registry-image
    source:
      repository: bosh/ruby-release
      username: ((docker.username))
      password: ((docker.password))
  - name: ruby-release
    type: git
    source:
      uri: https://github.com/cloudfoundry/bosh-package-ruby-release.git
  - name: bosh-ecosystem-concourse-image
    type: registry-image
    source:
      repository: bosh/bosh-ecosystem-concourse
      username: ((docker.username))
      password: ((docker.password))
  - name: bosh-security-scanner-registry-image
    type: registry-image
    source:
      repository: bosh/security-scanner
      username: ((docker.username))
      password: ((docker.password))
  - name: weekly
    type: time
    source:
      start: 3:00 -0700
      stop: 4:30 -0700
      days: [ Saturday ]
  - name: daily
    type: time
    source:
      interval: 24h