.gitlab-ci.yml

---
include:
  - template: 'Workflows/Branch-Pipelines.gitlab-ci.yml'
  - project: 'security/container-scanning'
    file: '.ESnet-container-scan.yml'
  - component: $CI_SERVER_FQDN/ht/cicd-common/aap-run@v0.2.0
    inputs:
      aap_host:  $AAP_HOST
      aap_token: $AAP_TOKEN
  - component: $CI_SERVER_FQDN/ht/cicd-common/harbor-cve@v0.2.0
    inputs:
      harbor_host:    $HSITE
      harbor_user:    $HUSER_CVE
      harbor_token:   $HTOKEN_CVE
      harbor_project: $CI_PROJECT_NAMESPACE

workflow:
  name: '$SN_HW_APP_NAME - $SN_HW_GROUP/$SN_HW_REPO ($SN_HW_BRANCH) $SN_HW_BOARD'

stages:
  - pull_sn_hw
  - build
  - test
  - push
  - review
  - trigger_downstream

variables:
  # These variables may be overridden by manual pipeline runs or from triggered
  # pipelines from other repos.
  SMARTNIC_DPDK_IMAGE_URI:
    value: wharf.es.net/ht/smartnic-dpdk-docker:57593-gfd1ea53b
    description: smartnic-dpdk-docker image to use as basis for DPDK builds
  LABTOOLS_IMAGE_URI:
    value: wharf.es.net/ht/xilinx-labtools-docker:62879-gc43e5fb5
    description: xilinx-labtools-docker image to use when deploying the sn-stack HW services
  SN_HW_GROUP:
    value: ht
    description: group namespace for hwapi artifact
  SN_HW_REPO:
    value: esnet-smartnic-ht
    description: repo name for hwapi artifact
  SN_HW_BRANCH:
    value: main
    description: branch for hwapi artifact
  SN_HW_API_JOB:
    value: hwapi_au280
    description: job for hwapi artifact
  SN_HW_BOARD:
    value: au280
    description: board type for hwapi artifact
  SN_HW_APP_NAME:
    value: esnet-smartnic-ht
    description: app name for hwapi artifact

pull_sn_hw:
  stage: pull_sn_hw
  image: ubuntu:focal
  variables:
    ESNET_SMARTNIC_HWAPI_URL: "$CI_API_V4_URL/projects/$SN_HW_GROUP%2F$SN_HW_REPO/jobs/artifacts/$SN_HW_BRANCH/download?job_token=$CI_JOB_TOKEN&job=$SN_HW_API_JOB"
    GIT_SUBMODULE_STRATEGY: none
  before_script:
    - apt update -y
    - ln -fs /usr/share/zoneinfo/UTC /etc/localtime
    - apt install -y --no-install-recommends wget ca-certificates
  script:
    - echo "$SN_HW_APP_NAME $SN_HW_BOARD"
    - echo "Downloading smartnic hwapi"
    - mkdir -p ./sn-hw/
    - |
      wget \
        --no-verbose \
        --trust-server-names \
        --content-disposition \
        --directory-prefix=./sn-hw \
        $ESNET_SMARTNIC_HWAPI_URL
    - |
      cat <<_EOF >> hwapi.env
      SN_HW_GROUP=$SN_HW_GROUP
      SN_HW_REPO=$SN_HW_REPO
      SN_HW_BRANCH=$SN_HW_BRANCH
      SN_HW_APP_NAME=$SN_HW_APP_NAME
      SN_HW_COMMIT=$SN_HW_COMMIT
      _EOF
    - ls sn-hw/*.zip | sed -re 's/^[^\.]+\.([a-zA-Z0-9]+)\..*$/SN_HW_BOARD=\1/' >> hwapi.env
    - ls sn-hw/*.zip | sed -re 's/^.*\.([0-9]+)\.zip$/SN_HW_VER=\1/' >> hwapi.env
    - cat hwapi.env
  artifacts:
    name: "artifacts.$CI_PROJECT_NAME.$CI_JOB_NAME.$CI_PIPELINE_ID"
    paths:
      - sn-hw
    expire_in: 3 month
    reports:
      dotenv:
        hwapi.env
  needs: []

package:
  stage: build
  image: docker:26.1
  services:
    - docker:26.1-dind
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
    PUBLISH_URI: $HSITE/$CI_PROJECT_NAMESPACE/$CI_PROJECT_NAME:$CI_PIPELINE_ID-g$CI_COMMIT_SHORT_SHA
    SN_FW_GROUP: ${CI_PROJECT_NAMESPACE}
    SN_FW_REPO: ${CI_PROJECT_NAME}
    SN_FW_BRANCH: ${CI_COMMIT_BRANCH}
    # Copy HW_APP_NAME into FW_APP_NAME
    SN_FW_APP_NAME: ${SN_HW_APP_NAME}
    SN_FW_VER: ${CI_PIPELINE_ID}
    SN_FW_COMMIT: ${CI_COMMIT_SHORT_SHA}
    SN_FW_PIPELINE_ID: ${CI_PIPELINE_ID}
    SN_FW_API_JOB: ${CI_JOB_NAME}
  before_script:
    # Install bash and GNU find (with full regex support).
    - apk add bash findutils
  script:
    # Set up the build environment
    - |
      cat <<_EOF > .env
      SMARTNIC_DPDK_IMAGE_URI=${SMARTNIC_DPDK_IMAGE_URI}
      LABTOOLS_IMAGE_URI=${LABTOOLS_IMAGE_URI}
      SN_HW_GROUP=${SN_HW_GROUP}
      SN_HW_REPO=${SN_HW_REPO}
      SN_HW_BRANCH=${SN_HW_BRANCH}
      SN_HW_BOARD=${SN_HW_BOARD}
      SN_HW_APP_NAME=${SN_HW_APP_NAME}
      SN_HW_VER=${SN_HW_VER}
      SN_HW_COMMIT=${SN_HW_COMMIT}
      SN_FW_GROUP=${SN_FW_GROUP}
      SN_FW_REPO=${SN_FW_REPO}
      SN_FW_BRANCH=${SN_FW_BRANCH}
      SN_FW_APP_NAME=${SN_FW_APP_NAME}
      SN_FW_VER=${SN_FW_VER}
      SN_FW_COMMIT=${SN_FW_COMMIT}
      _EOF
    - cat .env

    # Setup the HW application test directory.
    - ./build-setup-hw-test.sh

    # Auth to external registry
    - docker login -u "$HUSER" -p "$HTOKEN" "$HSITE"

    # Build the container image
    - ./build.sh $PUBLISH_URI$TAG_SUFFIX

    # Push to external registry
    - docker push $PUBLISH_URI$TAG_SUFFIX

    # Capture this job's ID for downstream triggered pipelines
    - |
      cat <<_EOF >> fwapi.env
      SN_FW_GROUP=${SN_FW_GROUP}
      SN_FW_REPO=${SN_FW_REPO}
      SN_FW_BRANCH=${SN_FW_BRANCH}
      SN_FW_APP_NAME=${SN_FW_APP_NAME}
      SN_FW_VER=${SN_FW_VER}
      SN_FW_PIPELINE_ID=${SN_FW_PIPELINE_ID}
      SN_FW_API_JOB=${SN_FW_API_JOB}
      SN_FW_API_JOB_NUMBER=$CI_JOB_ID
      SN_FW_COMMIT=${SN_FW_COMMIT}
      SMARTNIC_FW_IMAGE_URI=$PUBLISH_URI$TAG_SUFFIX
      _EOF
    - cat fwapi.env
  timeout: 10m
  artifacts:
    name: "artifacts.$CI_PROJECT_NAME.$SN_HW_BOARD.$SN_HW_APP_NAME.$CI_JOB_NAME.$CI_PIPELINE_ID"
    paths:
      - sn-stack
    expire_in: 3 month
    reports:
      dotenv:
        fwapi.env
  needs:
    - pull_sn_hw
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
    - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
      variables:
        TAG_SUFFIX: -dev

pull_cve_allowlist:
  extends: .harbor_cve_allowlist

container_scanning:
  variables:
    CS_REGISTRY_USER: $HUSER_RO
    CS_REGISTRY_PASSWORD: $HTOKEN_RO
    CS_IMAGE: $SMARTNIC_FW_IMAGE_URI
  # use 'dependencies' here rather than 'needs' since the gitlab container scanning
  # include sets 'dependencies: []' which takes precedence over 'needs'
  dependencies:
    - pull_cve_allowlist
    - package

ftap:
  extends: .aap_run
  stage: review
  environment:
    name: review/${GL_ENV_NAME}
    url: ssh://${AAP_LIMIT}
    action: start
  parallel:
    matrix:
      # Set GL_ENV_NAME to <hostname>/<card_number>/<extra>
      #   e.g. ftap-ht1/1/foo
      # Keep it short since it shows up in the UI

      - GL_ENV_NAME: ftap-ht1/1
        SYSTEM_HW_BOARD: au280
        AAP_LIMIT: ftap-ht1.es.net
        #EXTRA_VAR_STACK_UNIQUE: 0
        #EXTRA_VAR_STACK_HW_TARGET_SERIAL: ""
        #EXTRA_VAR_STACK_FPGA_PCIE_DEV: "0000:d8:00"

      - GL_ENV_NAME: ftap-ht2/1
        SYSTEM_HW_BOARD: au55c
        AAP_LIMIT: ftap-ht2.es.net
        #EXTRA_VAR_STACK_UNIQUE: 0
        #EXTRA_VAR_STACK_HW_TARGET_SERIAL: ""
        #EXTRA_VAR_STACK_FPGA_PCIE_DEV: "0000:d8:00"

      - GL_ENV_NAME: ftap-ht3/1
        SYSTEM_HW_BOARD: au280
        AAP_LIMIT: ftap-ht3.es.net
        #EXTRA_VAR_STACK_UNIQUE: 0
        #EXTRA_VAR_STACK_HW_TARGET_SERIAL: ""
        #EXTRA_VAR_STACK_FPGA_PCIE_DEV: "0000:d8:00"

      - GL_ENV_NAME: ftap-ht4/1
        SYSTEM_HW_BOARD: au280
        AAP_LIMIT: ftap-ht4.es.net
        #EXTRA_VAR_STACK_UNIQUE: 0
        #EXTRA_VAR_STACK_HW_TARGET_SERIAL: ""
        #EXTRA_VAR_STACK_FPGA_PCIE_DEV: "0000:d8:00"

  variables:
    AAP_JOB_TEMPLATE: 641
    #
    # AAP Job Template Overrides
    #   See here for more overrides: https://gitlab.es.net/ht/cicd-common/-/blob/main/README.md?ref_type=heads#aap-run
    #
    #AAP_SCM_BRANCH: testing
    #AAP_VERBOSITY: 3

    #
    # Extra variables provided to the playbook
    #   EXTRA_VARS is an optional JSON dictionary evaluated *first*
    #     NOTE: keys are *not* converted to lower case in this dictionary.  Use this if you need upper case keys.
    #
    #   EXTRA_VAR_name/EXTRA_VAR_NAME is a string which will be merged into the extra_vars dictionary as
    #       "name": "value"
    #     and will *override* matching keys found in the EXTRA_VARS dictionary
    #     NOTE: keys like "NAME" or "NaMe" will be converted to lower case before merging
    #
    # EXTRA_VARS: '{ "foo": "bar", "xyzzy": "${SOME_GITLAB_VARIABLE}" }'
    # EXTRA_VAR_FOO: "baz"

    EXTRA_VAR_JOBID: ${SN_FW_API_JOB_NUMBER}
  rules:
    - if: ($SN_HW_BOARD != $SYSTEM_HW_BOARD)
      when: never
    - if: ($SN_HW_BOARD == $SYSTEM_HW_BOARD)
      when: manual
      allow_failure: true
  needs:
    - package

ejfat:
  extends: .aap_run
  stage: review
  environment:
    name: review/${GL_ENV_NAME}
    url: ssh://${AAP_LIMIT}
    action: start
  parallel:
    matrix:
      # Set GL_ENV_NAME to <hostname>/<card_number>/<extra>
      #   e.g. node3/1/alpha
      # Keep it short since it shows up in the UI

      # node2.fpga.es.net
      - GL_ENV_NAME: node2/0/dev
        SYSTEM_HW_BOARD: au280
        AAP_LIMIT: node2.fpga.es.net
        EXTRA_VAR_STACK_UNIQUE: 0
        EXTRA_VAR_STACK_HW_TARGET_SERIAL: "21760201R001A"
        EXTRA_VAR_STACK_FPGA_PCIE_DEV: "0000:c1:00"

      - GL_ENV_NAME: node2/1/dev
        SYSTEM_HW_BOARD: au280
        AAP_LIMIT: node2.fpga.es.net
        EXTRA_VAR_STACK_UNIQUE: 1
        EXTRA_VAR_STACK_HW_TARGET_SERIAL: "21760204S003A"
        EXTRA_VAR_STACK_FPGA_PCIE_DEV: "0000:81:00"

      - GL_ENV_NAME: node2/2/dev
        SYSTEM_HW_BOARD: au280
        AAP_LIMIT: node2.fpga.es.net
        EXTRA_VAR_STACK_UNIQUE: 2
        EXTRA_VAR_STACK_HW_TARGET_SERIAL: "21760201R008A"
        EXTRA_VAR_STACK_FPGA_PCIE_DEV: "0000:a1:00"

      - GL_ENV_NAME: node2/3/dev
        SYSTEM_HW_BOARD: au280
        AAP_LIMIT: node2.fpga.es.net
        EXTRA_VAR_STACK_UNIQUE: 3
        EXTRA_VAR_STACK_HW_TARGET_SERIAL: "21760201R009A"
        EXTRA_VAR_STACK_FPGA_PCIE_DEV: "0000:41:00"

      - GL_ENV_NAME: node2/4/dev
        SYSTEM_HW_BOARD: au280
        AAP_LIMIT: node2.fpga.es.net
        EXTRA_VAR_STACK_UNIQUE: 4
        EXTRA_VAR_STACK_HW_TARGET_SERIAL: "21760201R00HA"
        EXTRA_VAR_STACK_FPGA_PCIE_DEV: "0000:01:00"

      # node3.fpga.es.net
      - GL_ENV_NAME: node3/1/alpha
        SYSTEM_HW_BOARD: au280
        AAP_LIMIT: node3.fpga.es.net
        EXTRA_VAR_STACK_UNIQUE: 1
        EXTRA_VAR_STACK_HW_TARGET_SERIAL: "21760204S019A"
        EXTRA_VAR_STACK_FPGA_PCIE_DEV: "0000:a1:00"

      - GL_ENV_NAME: node3/2/beta
        SYSTEM_HW_BOARD: au280
        AAP_LIMIT: node3.fpga.es.net
        EXTRA_VAR_STACK_UNIQUE: 2
        EXTRA_VAR_STACK_HW_TARGET_SERIAL: "21760201R014A"
        EXTRA_VAR_STACK_FPGA_PCIE_DEV: "0000:81:00"

  variables:
    AAP_JOB_TEMPLATE: 635
    #
    # AAP Job Template Overrides
    #   See here for more overrides: https://gitlab.es.net/ht/cicd-common/-/blob/main/README.md?ref_type=heads#aap-run
    #
    #AAP_SCM_BRANCH: testing
    #AAP_VERBOSITY: 3

    #
    # Extra variables provided to the playbook
    #   EXTRA_VARS is an optional JSON dictionary evaluated *first*
    #     NOTE: keys are *not* converted to lower case in this dictionary.  Use this if you need upper case keys.
    #
    #   EXTRA_VAR_name/EXTRA_VAR_NAME is a string which will be merged into the extra_vars dictionary as
    #       "name": "value"
    #     and will *override* matching keys found in the EXTRA_VARS dictionary
    #     NOTE: keys like "NAME" or "NaMe" will be converted to lower case before merging
    #
    # EXTRA_VARS: '{ "foo": "bar", "xyzzy": "${SOME_GITLAB_VARIABLE}" }'
    # EXTRA_VAR_FOO: "baz"

    EXTRA_VAR_JOBID: ${SN_FW_API_JOB_NUMBER}
    EXTRA_VAR_STACK_ROOT_PATH: /usr/local/ejfat/${EXTRA_VAR_STACK_UNIQUE}
  rules:
    - if: ($SN_HW_BOARD != $SYSTEM_HW_BOARD) && ($SN_HW_APP_NAME == 'udplb')
      when: never
    - if: ($SN_HW_BOARD == $SYSTEM_HW_BOARD) && ($SN_HW_APP_NAME == 'udplb')
      when: manual
      allow_failure: true
  needs:
    - package

.trigger_sw:
  stage: trigger_downstream
  # Make sure the downstream pipeline doesn't inherit any of the global env vars from this project
  # Note: entirely disabling global variable inheritance appears to make global vars unavailable for
  #       even the rules evaluation for *this* trigger job
  inherit:
    variables:
      - SN_HW_APP_NAME
      - SN_FW_GROUP
      - SN_FW_REPO
      - SN_FW_PIPELINE_ID
      - SN_FW_API_JOB
      - SN_HW_BOARD
  variables:
    SN_FW_GROUP: ${SN_FW_GROUP}
    SN_FW_REPO: ${SN_FW_REPO}
    SN_FW_PIPELINE_ID: ${SN_FW_PIPELINE_ID}
    SN_FW_API_JOB: ${SN_FW_API_JOB}
    SN_HW_BOARD: ${SN_HW_BOARD}
  rules:
    # Compare HW_APP_NAME to HW_EXPECTED_APP_NAME here since the dynamically computed FW_APP_NAME is not visible to the rules section
    - if: ($CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH) && ($SN_HW_APP_NAME == $SN_HW_EXPECTED_APP_NAME)
    - if: ($CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH) && ($SN_HW_APP_NAME == $SN_HW_EXPECTED_APP_NAME)
      when: manual
      allow_failure: true

trigger_sw_ht:
  extends: .trigger_sw
  variables:
    SN_HW_EXPECTED_APP_NAME: esnet-smartnic-ht
    SN_SW_APP_NAME: hightouch
  trigger:
    project: ht/hightouch-xilinx
    branch: main
  needs:
    - package

trigger_sw_demo:
  extends: .trigger_sw
  variables:
    SN_HW_EXPECTED_APP_NAME: p4_only
    SN_SW_APP_NAME: demo
  trigger:
    project: ht/esnet-smartnic-sw-demo
    branch: main
  needs:
    - package