.cirrus.yml

# Due to the dependency on encrypted variables, this will only work in a
# specific repo
only_if: $CIRRUS_REPO_OWNER == 'anarazel' && $CIRRUS_REPO_NAME == 'pg-vm-images'

env:
  CIRRUS_LOG_TIMESTAMP: true

  # Prefix for image names
  PREFIX: pg-ci

  # See gcp_project_setup.txt for setup instructions
  GCP_PROJECT_MAIN: pg-ci-images
  GCP_PROJECT_DEV: pg-ci-images-dev

  # the following variables are chosen in .cirrus.star, based on the branch
  # being built etc
  # BRANCH_TYPE = dev|main
  # BUCKET = ${GCP_PROJECT_MAIN}-bucket or ${GCP_PROJECT_DEV}-bucket
  # GCP_PROJECT = $GCP_PROJECT_MAIN or $GCP_PROJECT_DEV
  # GCP_REGION
  # GCP_REPO


# central definition for the tasks interacting with gcp

# shared gcp auth
gcp_auth: &gcp_auth
  env:
    # image-builder@pg-ci-images-dev.iam.gserviceaccount.com
    GAC_DEV: ENCRYPTED[40c920fc0112638b1ada05929628f296b630db4252100f14ae966effc5bcd840d6cedeb3cbd96bc14ebbf35695bd43b1]
    # image-builder@pg-ci-images.iam.gserviceaccount.com
    GAC_MAIN: ENCRYPTED[0529fb776190443002786f8e413f98d09ca79170c5a1c5cf66dd076fb232f778c9c13679b2e9f697eeede64033c1a3dd]

# gcp auth for unixoid systems
gcp_auth_unix: &gcp_auth_unix
  <<: *gcp_auth

  env:
    GOOGLE_APPLICATION_CREDENTIALS: /gcp-service-account-${BRANCH_TYPE}.json

  gcp_main_key_file:
    path: /gcp-service-account-main.json
    variable_name: GAC_MAIN

  gcp_dev_key_file:
    path: /gcp-service-account-dev.json
    variable_name: GAC_DEV

  gcp_auth_script:
    - gcloud auth activate-service-account --key-file=${GOOGLE_APPLICATION_CREDENTIALS}
    - gcloud auth list

# gcp auth for windows
gcp_auth_win: &gcp_auth_win
  <<: *gcp_auth

  env:
    GOOGLE_APPLICATION_CREDENTIALS: c:/gcp-service-account-%BRANCH_TYPE%.json

  gcp_main_key_file:
    path: c:/gcp-service-account-main.json
    variable_name: GAC_MAIN

  gcp_dev_key_file:
    path: c:/gcp-service-account-dev.json
    variable_name: GAC_DEV

  gcp_auth_script:
    - gcloud auth activate-service-account --key-file=%GOOGLE_APPLICATION_CREDENTIALS%
    - gcloud auth list

# docker->gcp auth for unixoid systems
gcp_docker_auth_unix: &gcp_docker_auth_unix
  <<: *gcp_auth_unix
  gcp_docker_auth_script:
    - gcloud auth configure-docker --quiet $GCP_REGION-docker.pkg.dev

# docker->gcp  auth for windows systems
gcp_docker_auth_win: &gcp_docker_auth_win
  <<: *gcp_auth_win
  gcp_docker_auth_script:
    - gcloud auth configure-docker --quiet %GCP_REGION%-docker.pkg.dev


task:
  name: Clean up leftover running
  alias: cleanup-leftover-running

  container:
    dockerfile: docker/linux_debian_packer
    cpu: 0.5
    memory: 256Mi

  <<: *gcp_auth_unix

  cleanup_leftover_running_script:
    ./gcp_delete_leftover_running.py


task:
  name: 'Building VM Image: ${IMAGE_NAME}'
  alias: vmbuild-${TASK_NAME}
  matrix:
    - env:
        TASK_NAME: freebsd-13
        PACKERFILE: packer/freebsd.pkr.hcl

    - env:
        PACKERFILE: packer/linux_debian.pkr.hcl
        SCRIPTS: scripts/linux_debian_*

      matrix:
        - env:
            TASK_NAME: bookworm
        - env:
            TASK_NAME: bullseye
        - env:
            TASK_NAME: sid
        - env:
            TASK_NAME: sid-newkernel
        - env:
            TASK_NAME: sid-newkernel-uring

    - env:
        PACKERFILE: packer/windows.pkr.hcl
        SCRIPTS: scripts/windows*
        TASK_NAME: windows-ci

  env:
    IMAGE_NAME: ${PREFIX}-${TASK_NAME}

  depends_on: cleanup-leftover-running

  container:
    dockerfile: docker/linux_debian_packer
    cpu: 0.5
    memory: 256Mi

  skip: $CIRRUS_LAST_GREEN_CHANGE != '' && $CIRRUS_CRON != 'regular-rebuild' && !changesInclude('.cirrus.yml', 'docker/linux_debian_packer', $SCRIPTS, $PACKERFILE)
  allow_failures: $CIRRUS_TASK_NAME =~ '.*\[sid\].*'
  auto_cancellation: false

  <<: *gcp_auth_unix

  info_script:
    - packer --version

  export_date_script: |
    DATE=$(date --utc +'%Y-%m-%dt%H-%M-%S')
    echo "DATE=${DATE}" | tee -a $CIRRUS_ENV

  build_image_script: |
    packer build \
      -only "*.${TASK_NAME}" \
      -timestamp-ui \
      -force \
      -var "image_date=$DATE" \
      -var "image_name=${IMAGE_NAME}" \
      -var gcp_project=$GCP_PROJECT \
      "$PACKERFILE"

  make_image_public_script: |
    gcloud compute images add-iam-policy-binding \
      --project "$GCP_PROJECT" \
      --member=allAuthenticatedUsers \
      --role=roles/compute.imageUser \
      ${IMAGE_NAME}-${DATE}

    gcloud compute images update \
      --project "$GCP_PROJECT" \
      --family ${IMAGE_NAME} \
      ${IMAGE_NAME}-${DATE}


task:
  name: 'Building VM Image: ${IMAGE_NAME}'
  alias: vmbuild-${TASK_NAME}

  matrix:
    - env:
        PKRVARFILE: packer/openbsd.pkrvars.hcl
      matrix:
        - env:
            TASK_NAME: openbsd-vanilla
          depends_on:
            - cleanup-leftover-running
        - env:
            TASK_NAME: openbsd-postgres
          depends_on:
            - vmbuild-openbsd-vanilla

    - env:
        PKRVARFILE: packer/netbsd.pkrvars.hcl

      matrix:
        - env:
            TASK_NAME: netbsd-vanilla
          depends_on:
            - cleanup-leftover-running
        - env:
            TASK_NAME: netbsd-postgres
          depends_on:
            - vmbuild-netbsd-vanilla

  env:
    PACKERFILE: packer/netbsd_openbsd.pkr.hcl
    IMAGE_NAME: ${PREFIX}-${TASK_NAME}

  container:
    dockerfile: docker/linux_debian_packer
    cpu: 2
    memory: 4G

  skip: $CIRRUS_LAST_GREEN_CHANGE != '' && $CIRRUS_CRON != 'regular-rebuild' && !changesInclude('.cirrus.yml', 'docker/linux_debian_packer', 'files/bsd/*', 'scripts/bsd/*', $PACKERFILE, $PKRVARFILE)
  auto_cancellation: false

  <<: *gcp_auth_unix

  info_script:
    - packer --version

  export_date_script: |
    DATE=$(date --utc +'%Y-%m-%dt%H-%M-%S')
    echo "DATE=${DATE}" | tee -a $CIRRUS_ENV

  build_image_script: |
    export PACKER_LOG=1

    packer build \
      -only "*.${TASK_NAME}" \
      -timestamp-ui \
      -force \
      -var-file="${PKRVARFILE}" \
      -var "image_date=$DATE" \
      -var "image_name=${IMAGE_NAME}" \
      -var "prefix=${PREFIX}" \
      -var "bucket=$BUCKET" \
      -var gcp_project=$GCP_PROJECT \
      "$PACKERFILE"

  make_image_public_script: |
    gcloud compute images add-iam-policy-binding \
      --project "$GCP_PROJECT" \
      --member=allAuthenticatedUsers \
      --role=roles/compute.imageUser \
      ${IMAGE_NAME}-${DATE}

    gcloud compute images update \
      --project "$GCP_PROJECT" \
      --family ${IMAGE_NAME} \
      ${IMAGE_NAME}-${DATE}


# Clean up old images regularly - after a while the individually small cost
# starts adding up
#
# Leave old images around for two weeks, to allow recreating CI failures
# precisely.
task:
  name: Clean up old images

  container:
    dockerfile: docker/linux_debian_packer
    cpu: 0.5
    memory: 256Mi

  <<: *gcp_auth_unix

  cleanup_images_script:
    ./gcp_delete_old_images.py


task:
  name: 'Building Container Image: ${IMAGE}'
  alias: dockerbuild-${IMAGE}

  compute_engine_instance:
    image_project: cirrus-images
    image: family/docker-builder
    platform: linux
    cpu: 2
    memory: 8G
  matrix:
    - env:
        DOCKER_FILE: linux_debian_ci
        IMAGE: linux_debian_${DEBIAN_RELEASE}_ci
      matrix:
        - env:
            DEBIAN_RELEASE: bullseye
        - env:
            DEBIAN_RELEASE: bookworm

  skip: $CIRRUS_LAST_GREEN_CHANGE != '' && $CIRRUS_CRON != 'regular-rebuild' && !changesInclude('.cirrus.yml', 'scripts/linux_debian*', 'docker/linux_debian_ci')

  <<: *gcp_docker_auth_unix

  multibuilder_script:
    - docker buildx create --name multibuilder
    - docker buildx use multibuilder
    - docker buildx inspect --bootstrap

  # XXX: would be nicer to split into multiple steps, so that e.g. build vs
  # upload time are visible
  #
  # XXX: would be nice to test images before tagging them as available
  #
  # FIXME: disabled caching for now, there doesn't appear to be a good builtin
  # way of regenerating cached layers regularly.
  #    --cache-from type=registry,ref=$GCP_REPO/$IMAGE \
  #    --cache-to=type=inline \
  #
  # Disabled linux/arm64, fails currently due to reasons outside of our control
  build_script: |
    DATE=$(date --utc +'%Y-%m-%dt%H-%M-%S')

    docker buildx build \
      --platform linux/amd64 \
      --build-arg DATE=$DATE \
      --build-arg IMAGE_NAME=$IMAGE \
      --build-arg DEBIAN_RELEASE=$DEBIAN_RELEASE \
      --tag $GCP_REPO/$IMAGE:latest \
      --tag $GCP_REPO/$IMAGE:$DATE \
      -f docker/$DOCKER_FILE \
      --push \
      .

    docker buildx imagetools inspect $GCP_REPO/$IMAGE:latest


task:
  name: 'Testing Container Image: ${IMAGE_NAME}'
  matrix:
    - env:
        IMAGE_NAME: linux_debian_bullseye_ci
    - env:
        IMAGE_NAME: linux_debian_bookworm_ci
  depends_on:
    - dockerbuild-${IMAGE_NAME}
  container:
    image: $GCP_REPO/${IMAGE_NAME}:latest
  test_script:
    - uname -a
    - xsltproc --version
    - env

# Disabled linux/arm64, fails currently due to reasons outside of our control
# task:
#  name: 'Testing Arm Container Image: ${IMAGE_NAME}'
#   matrix:
#     - env:
#         IMAGE_NAME: linux_debian_bullseye_ci
#     - env:
#         IMAGE_NAME: linux_debian_bookworm_ci
#  depends_on:
#    - ${IMAGE_NAME}
#  arm_container:
#    image: $GCP_REPO/${IMAGE_NAME}:latest
#  test_script:
#    - uname -a
#    - xsltproc --version


task:
  name: 'Testing VM Image: ${PREFIX}-${IMAGE_NAME}'
  matrix:
    - env:
        IMAGE_NAME: netbsd-postgres
        PLATFORM: netbsd

    - env:
        IMAGE_NAME: openbsd-postgres
        PLATFORM: openbsd

  depends_on:
    - vmbuild-${PLATFORM}-postgres

  compute_engine_instance:
    image_project: $GCP_PROJECT
    image: family/${PREFIX}-${IMAGE_NAME}
    platform: ${PLATFORM}

  test_script:
    - uname -a
    - env


task:
  name: 'Testing VM Image: ${PREFIX}-${IMAGE_NAME}'
  env:
    IMAGE_NAME: windows-ci
  depends_on:
    - vmbuild-${IMAGE_NAME}
  compute_engine_instance:
    image_project: $GCP_PROJECT
    image: family/${PREFIX}-${IMAGE_NAME}
    platform: windows

  test_vs_script:
    - ver
    - set
    - where perl
    - perl --version
    - python --version
    - vcvarsall x64
    - bison --version
    - flex --version

  test_mingw_script:
    - C:\msys64\usr\bin\bash.exe -lc 'where perl'
    - C:\msys64\usr\bin\bash.exe -lc 'perl --version'
    - C:\msys64\usr\bin\bash.exe -lc 'bison --version'
    - C:\msys64\usr\bin\bash.exe -lc 'flex --version'