config.yml

version: 2.1

orbs:
  hmpps: ministryofjustice/hmpps@8.2
  slack: circleci/slack@4.12.5
  mem: circleci/rememborb@0.0.2

parameters:
  alerts-slack-channel:
    type: string
    default: "hmpps-assessments-notifications"
  node-version:
    type: string
    default: 22.13-browsers

executors:
  e2e-executor:
    machine:
      image: ubuntu-2204:current
      resource_class: medium

jobs:
  build:
    executor:
      name: hmpps/node
      tag: << pipeline.parameters.node-version >>
    steps:
      - checkout
      - run:
          name: Update npm
          command: 'sudo npm install -g npm@latest'
      - restore_cache:
          keys:
            - dependency-cache-{{ checksum "package-lock.json" }}
      - run:
          name: Install Dependencies
          command: npm ci --no-audit
      - save_cache:
          key: dependency-cache-{{ checksum "package-lock.json" }}
          paths:
            - node_modules
            - ~/.cache
      - run:
          name: Linter check
          command: npm run lint
      - run:
          command: |
            npm run clean
            npm run build
      - persist_to_workspace:
          root: .
          paths:
            - node_modules
            - assets/stylesheets

  test:
    executor:
      name: hmpps/node
      tag: << pipeline.parameters.node-version >>
    steps:
      - checkout
      - restore_cache:
          keys:
            - dependency-cache-{{ checksum "package-lock.json" }}
      - run:
          name: unit tests
          command: npm run test
      - store_test_results:
          path: test-results
      - store_artifacts:
          path: test-results/unit-test-reports.html

  e2e_test:
    executor: e2e-executor
    parallelism: 2
    steps:
      - checkout
      - restore_cache:
          keys:
            - dependency-cache-{{ checksum "package-lock.json" }}
      - run:
          name: Move cached node_modules to project directory
          command: mv ~/app/node_modules ~/project
      - attach_workspace:
          at: ~/app
      - run:
          name: Extract saved container image
          command: docker load --input ~/app/docker_cache/build_image.tar
      - mem/recall:
          env_var: APP_VERSION
      - run:
          name: Stand up a test environment
          command: |
            export UI_IMAGE_TAG=$APP_VERSION
            make test-up
      - run:
          name: Clear the visual regression diffs directory
          command: rm -rf integration_tests/snapshots/diff
      - run:
          name: Run the end-to-end tests
          command: make e2e-ci
      - run:
          name: Check for visual regression diffs
          command: if test -d integration_tests/snapshots/diff; then exit 1; fi
      - run:
          name: Store container logs
          command: make save-logs OUTPUT_LOGS_DIR=~/docker-logs PROJECT_NAME="community-payback-assessment-test"
          when: on_fail
      - store_test_results:
          path: test_results
      - store_artifacts:
          path: integration_tests/videos
      - store_artifacts:
          path: integration_tests/screenshots
      - store_artifacts:
          path: integration_tests/snapshots/diff
      - store_artifacts:
          path: ~/docker-logs

workflows:
  version: 2
  build-test-and-deploy:
    jobs:
      - build:
          filters:
            tags:
              ignore: /.*/
      - test:
          requires:
            - build
      - hmpps/helm_lint:
          name: helm_lint_dev
          env: development
      - hmpps/helm_lint:
          name: helm_lint_preprod
          env: preprod
      - hmpps/helm_lint:
          name: helm_lint_prod
          env: prod
      - hmpps/build_docker:
          name: build_docker
          publish: false
          persist_container_image: true
          jira_update: true
          pipeline_id: << pipeline.id >>
          pipeline_number: << pipeline.number >>
          context: hmpps-common-vars
      - e2e_test:
          context: hmpps-common-vars
          requires:
            - build
            - build_docker
      - hmpps/publish_docker:
          name: publish_docker
          publish_latest_tag: true
          context: hmpps-common-vars
          requires:
            - test
            - e2e_test
          filters:
            branches:
              only:
                - main
      - hmpps/deploy_env:
          name: deploy_dev
          env: "development"
          chart_name: hmpps-risk-assessment-ui
          pipeline_id: << pipeline.id >>
          pipeline_number: << pipeline.number >>
          jira_update: true
          context:
            - hmpps-common-vars
          filters:
            branches:
              only:
                - main
          requires:
            - publish_docker
            - helm_lint_dev
            - helm_lint_preprod
            - helm_lint_prod
      - request-preprod-approval:
          type: approval
          requires:
            - deploy_dev
      - hmpps/deploy_env:
          name: deploy_preprod
          env: "preprod"
          pipeline_id: << pipeline.id >>
          pipeline_number: << pipeline.number >>
          jira_update: true
          context:
            - hmpps-common-vars
            - hmpps-assessments-preprod-live
          requires:
            - request-preprod-approval
      - request-prod-approval:
          type: approval
          requires:
            - deploy_preprod
      - hmpps/deploy_env:
          name: deploy_prod
          env: "prod"
          pipeline_id: << pipeline.id >>
          pipeline_number: << pipeline.number >>
          jira_update: true
          context:
            - hmpps-common-vars
            - hmpps-assessments-prod-live
          requires:
            - request-prod-approval

  security:
    triggers:
      - schedule:
          cron: "7 6 * * 1-5"
          filters:
            branches:
              only:
                - main
    jobs:
      - hmpps/npm_outdated:
          slack_channel: << pipeline.parameters.alerts-slack-channel >>
          context:
            - hmpps-common-vars
      - hmpps/npm_security_audit:
          slack_channel: << pipeline.parameters.alerts-slack-channel >>
          context:
            - hmpps-common-vars
      - hmpps/trivy_latest_scan:
          slack_channel: << pipeline.parameters.alerts-slack-channel >>
          context:
            - hmpps-common-vars
      - hmpps/veracode_pipeline_scan:
          slack_channel: << pipeline.parameters.alerts-slack-channel >>
          context:
            - veracode-credentials
            - hmpps-common-vars
  security-weekly:
    triggers:
      - schedule:
          cron: "50 5 * * 1"
          filters:
            branches:
              only:
                - main
    jobs:
      - hmpps/veracode_policy_scan:
          slack_channel: << pipeline.parameters.alerts-slack-channel >>
          context:
            - veracode-credentials
            - hmpps-common-vars