config.yml

version: 2.1

orbs:
  hmpps: ministryofjustice/hmpps@8
  slack: circleci/slack@4.12.5

parameters:
  alerts-slack-channel:
    type: string
    default: hmpps_tech_alerts_security

  releases-slack-channel:
    type: string
    default: dps-releases

  node-version:
    type: string
    default: 20.8-browsers

jobs:
  build:
    executor:
      name: hmpps/node
      tag: << pipeline.parameters.node-version >>
    steps:
      - checkout
      - run:
          name: Update npm
          command: 'sudo npm install -g npm@latest'
      - restore_cache:
          key: dependency-cache-{{ checksum "package-lock.json" }}
      - run:
          name: Install Dependencies
          command: npm ci --no-audit
      - save_cache:
          key: dependency-cache-{{ checksum "package-lock.json" }}
          paths:
            - node_modules
            - ~/.cache
      - run:
          command: |
            npm run build
      - run: # Run linter after build because the integration test code depend on compiled typescript...
          name: Linter check
          command: npm run lint
      - persist_to_workspace:
          root: .
          paths:
            - node_modules
            - build
            - dist
            - assets/stylesheets

  unit_test:
    executor:
      name: hmpps/node
      tag: << pipeline.parameters.node-version >>
    steps:
      - checkout
      - restore_cache:
          key: dependency-cache-{{ checksum "package-lock.json" }}
      - run:
          name: unit tests
          command: npm run test:ci
      - store_test_results:
          path: test_results
      - store_artifacts:
          path: test_results/unit-test-reports.html

  integration_test:
    executor:
      name: hmpps/node
      tag: << pipeline.parameters.node-version >>
    steps:
      - checkout
      - attach_workspace:
          at: ~/app
      - run:
          name: Install missing OS dependency
          command: sudo apt-get install libxss1
      - restore_cache:
          key: dependency-cache-{{ checksum "package-lock.json" }}
      - run:
          name: Get wiremock
          command: curl -o wiremock.jar https://repo1.maven.org/maven2/org/wiremock/wiremock-standalone/3.3.1/wiremock-standalone-3.3.1.jar
      - run:
          name: Run wiremock
          command: java -jar wiremock.jar --port 9091
          background: true
      - run:
          name: Run the node app.
          command: npm run start-feature
          background: true
      - run:
          name: Wait for node app to start
          command: sleep 5
      - run:
          name: integration tests
          command: npm run int-test
      - store_test_results:
          path: test_results
      - store_artifacts:
          path: integration_tests/videos
      - store_artifacts:
          path: integration_tests/screenshots

workflows:
  version: 2
  build-test-and-deploy:
    jobs:
      - build:
          filters:
            tags:
              ignore: /.*/
      - unit_test:
          requires:
            - build
      - integration_test:
          requires:
            - build
      - hmpps/helm_lint:
          name: helm_lint
      - hmpps/build_docker:
          name: build_docker
          filters:
            branches:
              only:
                - main
      - hmpps/deploy_env:
          name: deploy_dev
          env: "dev"
          jira_update: true
          pipeline_id: <<pipeline.id>>
          pipeline_number: <<pipeline.number>>
          context: hmpps-common-vars
          filters:
            branches:
              only:
                - main
          requires:
            - helm_lint
            - unit_test
            - integration_test
            - build_docker
          helm_timeout: 5m
      - request-preprod-approval:
          type: approval
          requires:
            - deploy_dev
      - hmpps/deploy_env:
          name: deploy_preprod
          env: "preprod"
          jira_update: true
          jira_env_type: staging
          pipeline_id: <<pipeline.id>>
          pipeline_number: <<pipeline.number>>
          context:
            - hmpps-common-vars
            - hmpps-audit-poc-ui-preprod
          requires:
            - request-preprod-approval
          helm_timeout: 5m
      - request-prod-approval:
          type: approval
          requires:
            - deploy_preprod
      - hmpps/deploy_env:
          name: deploy_prod
          env: "prod"
          jira_update: true
          jira_env_type: production
          pipeline_id: <<pipeline.id>>
          pipeline_number: <<pipeline.number>>
          slack_notification: true
          slack_channel_name: << pipeline.parameters.releases-slack-channel >>
          context:
            - hmpps-common-vars
            - hmpps-audit-poc-ui-prod
          requires:
            - request-prod-approval
          helm_timeout: 5m
  security:
    triggers:
      - schedule:
          cron: "30 5 * * 1-5"
          filters:
            branches:
              only:
                - main
    jobs:
      - hmpps/npm_outdated:
          slack_channel: << pipeline.parameters.alerts-slack-channel >>
          context:
            - hmpps-common-vars
      - hmpps/npm_security_audit:
          slack_channel: << pipeline.parameters.alerts-slack-channel >>
          context:
            - hmpps-common-vars
      - hmpps/trivy_latest_scan:
          slack_channel: << pipeline.parameters.alerts-slack-channel >>
          context:
            - hmpps-common-vars
      - hmpps/veracode_pipeline_scan:
          slack_channel: << pipeline.parameters.alerts-slack-channel >>
          context:
            - veracode-credentials
            - hmpps-common-vars
  security-weekly:
    triggers:
      - schedule:
          cron: "0 5 * * 1"
          filters:
            branches:
              only:
                - main
    jobs:
      - hmpps/veracode_policy_scan:
          slack_channel: << pipeline.parameters.alerts-slack-channel >>
          context:
            - veracode-credentials
            - hmpps-common-vars