config.yml

# Immuni CircleCI configuration.
# Copyright (C) 2020 Presidenza del Consiglio dei Ministri.
# Please refer to the AUTHORS file for more information.
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <https://www.gnu.org/licenses/>.

version: 2.1

# Shared settings
settings:
  xcode: &xcode_version
    xcode: "13.0.0"

# Custom commands
commands:
  build:
    description: Perform a build of the Immuni iOS application.
    steps:
      - run:
          name: "[build] Compile and archive"
          command: |
            fastlane ios build \
            configuration:$BUILD_CONFIGURATION \
            distribution_method:$DISTRIBUTION_METHOD \
            signing:$SIGNING_PROFILE
      - run:
          name: "[build] Archive build products"
          working_directory: Products
          command: |
            zip -r Immuni-${BUILD_CONFIGURATION}.zip Immuni.xcarchive

            # Remove xcarchive to avoid storing it as a plain directory among the build artifacts
            rm -rf Immuni.xcarchive
      - run:
          name: "[build] Create GitHub release"
          command: |
            RELEASE_NAME="Immuni-${APP_VERSION}build${BUILD_NUMBER}"

            # Use -soft to prevent release from being re-created if it already exists
            # This takes care of concurrency issues (the build would fail)
            ghr \
            -t $RELEASE_GITHUB_TOKEN \
            -u $CIRCLE_PROJECT_USERNAME \
            -r $CIRCLE_PROJECT_REPONAME \
            -c $CIRCLE_SHA1 \
            -n $RELEASE_NAME \
            -soft \
            $RELEASE_NAME Products | tee release_result

            if grep -q aborted release_result; then
              echo "A release with version $APP_VERSION and build number $BUILD_NUMBER already exists. Aborting."
              exit 1
            fi
      - store_artifacts:
          path: Products
      - run:
          name: "[build] Upload to App Store Connect"
          no_output_timeout: 30m
          command: |
            if [[ "${BUILD_KIND}" == "release" ]]; then
                fastlane ios upload_appstore
            else
                echo "This is not a production build, skipping the App Store Connect upload phase."
            fi

  check_build_kind:
    description: Check whether the commit should trigger a build or not.
    steps:
      - run:
          name: "[check] Identify build kind"
          command: |
            # Verify if it's a build commit
            GIT_MESSAGE=$(git log --pretty=%s | head -1 || true)

            if [[ ! $GIT_MESSAGE == *"#build"* ]]; then
              echo "Not a build commit. Stopping the execution of the build job."
              circleci-agent step halt
            fi

            # Check the build kind from the git message. The git message must contain either:
            # "#build-release" or "#build-dev", depending on the kind of build.
            BUILD_KIND="$(echo $GIT_MESSAGE | sed -n -E 's/^.*#build-(release|dev).*$/\1/p')"

            if [[ -z "${BUILD_KIND}" ]]; then
                echo "Unrecognized build kind; valid types are: dev, release."
                circleci-agent step halt
            fi

            # Make it available for the rest of the pipeline
            echo "export BUILD_KIND=$BUILD_KIND" >> $BASH_ENV

  check_release_branch:
    description: Verify if the commit of the build being released is on master.
    steps:
      - run:
          name: "[release] Stop if not executed on master"
          command: |
            # Verify if the commit belongs to master
            ON_MASTER=$(git branch --contains tags/$CIRCLE_TAG | grep '^. master$' || true)

            if [[ -z "${ON_MASTER}" ]]; then
              echo "Releases can only be tagged on master. Stopping the execution of the job."
              exit 1
            fi

  compute_release_changelog:
    description: Compute the release changelog based on conventional commits.
    steps:
      - run:
          name: "[release] Compute changelog"
          command: |
            # Uses conventional-changelog-cli to compute a semantic changelog

            # Configuration
            CHANGELOG_HEADER_LINES=8
            VERSION_REGEX='^v\([0-9]\+\.\?\)\+$'

            # Retrieve the tags associated with the previous release and the newly tagged release
            CURRENT_RELEASE_TAG=$CIRCLE_TAG
            PREVIOUS_RELEASE_TAG=$(git tag -l | grep $VERSION_REGEX | sort -nr | head -2 | tail -1)

            if [[ "${CURRENT_RELEASE_TAG}" == "${PREVIOUS_RELEASE_TAG}" ]]; then
                echo "This is the first release of the project; its changelog must be set manually."
                exit 1
            fi

            # Configure conventional-changelog
            sed "s/PREVIOUS_RELEASE_TAG/$PREVIOUS_RELEASE_TAG/g" CI/changelog_config.tpl > CI/changelog_config.js

            # Compute the changelog
            conventional-changelog -p angular -n CI/changelog_config.js > FULL_CHANGELOG.md

            # Skip the changelog header
            awk 'NF {p=1} p' \<<< "$(< FULL_CHANGELOG.md)" | tail -n +$CHANGELOG_HEADER_LINES > CHANGELOG.md

  install_ios_dependencies:
    description: Install CocoaPods iOS dependencies.
    steps:
      - run:
          name: "[cocoapods] Retrieve the Podfile.lock checksum"
          command: sed -n '/PODFILE CHECKSUM:/p' Podfile.lock > podfile_checksum
      - restore_cache:
          name: "[cocoapods] Restore the cache"
          keys:
            - 1-pods-{{ checksum "podfile_checksum" }}
            - 1-pods-
      - run:
          name: "[cocoapods] Install pods"
          command: pod install
      - save_cache:
          name: "[cocoapods] Save the cache"
          key: 1-pods-{{ checksum "podfile_checksum" }}
          paths:
            - ./Pods

  post_release_changelog:
    description: Update the changelog of the GitHub released that has been published on the store.
    steps:
      - run:
          name: "[release] Post changelog"
          command: |
            # Configuration
            FULL_REPO_NAME="$CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME"
            RELEASE_API="https://api.github.com/repos/$FULL_REPO_NAME/releases"
            RELEASE_REGEX='^Immuni-\([0-9]\+\.\?\)\+build[0-9]\+$'

            # Retrieve the existing release. Note: if multiple exist for the same commit,
            # we take the latest.
            MATCHING_TAG=$(git tag --points-at tags/$CIRCLE_TAG | grep $RELEASE_REGEX | sort -nr | head -1 || true)

            if [[ -z "${MATCHING_TAG}" ]]; then
                echo "No GitHub release associated with this version, halting."
                exit 1
            fi

            RELEASE_ID=$(curl -H "Authorization: token $RELEASE_GITHUB_TOKEN" $RELEASE_API/tags/$MATCHING_TAG -s | jq -r '.id')

            # Edit changelog
            curl \
            --request PATCH \
            --header "Authorization: token $RELEASE_GITHUB_TOKEN" \
            --data "`jq -n --arg msg "$(cat CHANGELOG.md)" '{body: $msg}'`" \
            $RELEASE_API/$RELEASE_ID

  prepare_xcode_project:
    description: Prepare the Xcode project for compilation.
    steps:
      - run:
          name: "[xcode_setup] Configure build kind"
          command: |
            # Ensure the startup script exists
            touch $BASH_ENV

            # Configure build kind
            if [[ "${BUILD_KIND}" == "dev" ]]; then
              export BUILD_CONFIGURATION="Debug"
              export DISTRIBUTION_METHOD="development"
              export SIGNING_PROFILE="development"
            else
              echo "export EXCLUDE_DEV_TOOLING='1'" >> $BASH_ENV
              export BUILD_CONFIGURATION="Release"
              export DISTRIBUTION_METHOD="app-store"
              export SIGNING_PROFILE="appstore"
            fi

            echo "Performing $BUILD_CONFIGURATION build for $DISTRIBUTION_METHOD."
            echo "export BUILD_CONFIGURATION=$BUILD_CONFIGURATION" >> $BASH_ENV
            echo "export DISTRIBUTION_METHOD=$DISTRIBUTION_METHOD" >> $BASH_ENV
            echo "export SIGNING_PROFILE=$SIGNING_PROFILE" >> $BASH_ENV
      - run:
          name: "[xcode_setup] Retrieve the app version"
          command: |
            APP_VERSION=$(cat version)

            echo "Semantic version for this build is $APP_VERSION"
            echo "export APP_VERSION=$APP_VERSION" >> $BASH_ENV
      - run:
          name: "[xcode_setup] Configure Xcode project"
          command: CI_MODE=1 make immuni
      - run:
          name: "[xcode_setup] Increment the build number"
          command: |
            # Use the CircleCI workflow number as the build number.
            # This guarantees a unique, monotonically increasing build number.s
            BUILD_NUMBER=$CIRCLE_BUILD_NUM

            fastlane run increment_build_number build_number:$BUILD_NUMBER

            echo "export BUILD_NUMBER=$BUILD_NUMBER" >> $BASH_ENV
            echo "Build number for this build is $BUILD_NUMBER"

  setup_ci:
    description: Configure the continuous integration.
    steps:
      - run:
          name: "[ci_setup] Configure Fastlane for CircleCI"
          command: |
            fastlane run setup_circle_ci
            echo "export KEYCHAIN_NAME=fastlane_tmp_keychain" >> $BASH_ENV
      - run:
          name: "[ci_setup] Install homebrew dependencies"
          command: HOMEBREW_NO_AUTO_UPDATE=1 brew install xcodegen swiftgen ghr

  setup_code_signing:
    description: Install the necessary signing certificates and provisioning profiles.
    steps:
      - run:
          name: "[code_signing] Install signing certificate and provisioning profile"
          command: |
            if [[ "${SIGNING_PROFILE}" == "appstore" ]]; then
              echo $APPSTORE_PROVISIONING_PROFILE | base64 --decode > profile.mobileprovision
              echo $APPSTORE_SIGNING_CERTIFICATE | base64 --decode > signing_certificate.p12
              export SIGNING_CERTIFICATE_PASSWORD=$APPSTORE_SIGNING_CERTIFICATE_PASSWORD
            else
              echo $DEVELOPMENT_PROVISIONING_PROFILE | base64 --decode > profile.mobileprovision
              echo $DEVELOPMENT_SIGNING_CERTIFICATE | base64 --decode > signing_certificate.p12
              export SIGNING_CERTIFICATE_PASSWORD=$DEVELOPMENT_SIGNING_CERTIFICATE_PASSWORD
            fi

            # Install signing certificate
            fastlane run import_certificate \
            certificate_path:signing_certificate.p12 \
            certificate_password:$SIGNING_CERTIFICATE_PASSWORD \
            keychain_name:$KEYCHAIN_NAME

            # Install provisioning profile
            fastlane run install_provisioning_profile path:profile.mobileprovision

  setup_linux:
    description: Configure the Linux environment.
    steps:
      - run:
          name: "[setup_linux] Install curl"
          command: apt-get update && apt-get install -y curl
      - run:
          name: "[setup_linux] Resolve Python 2.7 conflict with Swift"
          command: |
            # There is a bug with the installation of Python on top of the official Swift Linux Docker image
            # See https://forums.swift.org/t/lldb-install-precludes-installing-python-in-image/24040
            mv /usr/lib/python2.7/site-packages /usr/lib/python2.7/dist-packages
            ln -s dist-packages /usr/lib/python2.7/site-packages

  setup_pr_tools:
    description: Configure the pull requests environment.
    steps:
      - restore_cache:
          name: "[pr_setup] Restore Linux binaries dependency cache"
          keys:
            - 2-linux-bin-pr-tools
      - run:
          name: "[pr_setup] Install swiftlint and swiftformat"
          command: |
            if [ ! -f $HOME/bin/swiftformat ]; then
              # Setup Mint package manager for Swift
              git clone https://github.com/yonaskolb/Mint.git
              cd Mint

              # Pin Mint revision to address issue with 0.15 on non-Apple platforms
              git checkout 7b9920fd94bf67c81f2616b0c359a0243f06b767
              make

              # Install swiftlint - pinned at 0.39.2 for compatibility
              mint install realm/SwiftLint@0.39.2

              # Install swiftformat – note that 0.48.12 is not compatible with Mint
              mint install nicklockwood/SwiftFormat@0.48.13

              mkdir $HOME/bin
              cp /usr/local/bin/swiftformat $HOME/bin
            fi
      - save_cache:
          name: "[pr_setup] Save Linux binaries dependency cache"
          key: 2-linux-bin-pr-tools
          paths:
            - /root/bin
      - run:
          name: "[pr_setup] Move swiftformat binary"
          command: cp $HOME/bin/swiftformat /usr/local/bin/swiftformat
      - run:
          name: "[pr_setup] Install danger"
          command: |
            # Setup certificates
            apt-get update && apt-get install libgnutls30

            # Install Node.js 16.x and npm
            curl -sSL https://deb.nodesource.com/setup_16.x | bash -
            apt-get install -y nodejs

            ## Install the Yarn package manager
            curl -sSL https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
            echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list
            apt-get update && apt-get install yarn

            # Install Danger
            yarn install --dev

  setup_release_tools:
    description: Configure the release environment.
    steps:
      - run:
          name: "[release_setup] Install dependencies"
          command: sudo npm install -g conventional-changelog-cli

jobs:
  build:
    macos:
      <<: *xcode_version
    resource_class: medium
    steps:
      - checkout:
          name: "[build] Checkout the code"
      - check_build_kind
      - setup_ci
      - prepare_xcode_project
      - setup_code_signing
      - install_ios_dependencies
      - build

  pr_check:
    docker:
      - image: swift:5.1-bionic
    resource_class: small
    steps:
      - run:
          name: "[pr_check] Stop job if DANGER_GITHUB_API_TOKEN is missing"
          command: |
            if [[ -z "${DANGER_GITHUB_API_TOKEN}" ]]; then
                circleci-agent step halt
            fi
      - run:
          name: "[pr_check] Stop job if not running in PR"
          command: |
            if [[ -z "${CIRCLE_PULL_REQUEST}" ]]; then
                circleci-agent step halt
            fi
      - checkout:
          name: "[pr_check] Checkout the code"
      - setup_linux
      - setup_pr_tools
      - run:
          name: "[pr_check] Run danger"
          command: yarn danger ci

  release:
    docker:
      - image: cimg/node:12.16
    resource_class: small
    steps:
      - checkout:
          name: "[release] Checkout the code"
      - check_release_branch
      - setup_release_tools
      - compute_release_changelog
      - post_release_changelog

  scheduler:
    docker:
      - image: swift:5.1-bionic
    resource_class: small
    steps:
      - checkout
      - setup_linux
      - run:
          name: "[scheduler] Initialize scheduler submodule"
          command: git submodule update --init
      - run:
          name: "[scheduler] Initialize Python runtime"
          command: |
            gpg --keyserver keyserver.ubuntu.com --recv 6A755776
            gpg --export --armor 6A755776 | apt-key add -
            cat \<<EOF > /etc/apt/sources.list.d/deadsnakes.list
            deb http://ppa.launchpad.net/deadsnakes/ppa/ubuntu bionic main
            EOF
            apt-get update
            apt-get install -y python3.10-minimal python3.10-distutils
            curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
            python3.10 get-pip.py
      - run:
          name: "[scheduler] Setup project path"
          command: echo "export PROJECT_PATH=$(pwd)" >> $BASH_ENV
      - setup_pr_tools
      - restore_cache:
          name: "[scheduler] Restore Python Cache"
          keys:
            - pip-packages-v4-{{ .Branch }}-{{ checksum "scheduler/poetry.lock" }}
            - pip-packages-v4-{{ .Branch }}-
            - pip-packages-v4-
      - run:
          name: "[scheduler] Configure poetry"
          command: |
            pip3 install poetry
            poetry config virtualenvs.in-project true
      - run:
          name: "[scheduler] Install dependencies"
          working_directory: scheduler
          command: poetry install --no-ansi
      - save_cache:
          name: "[scheduler] Save Python Cache"
          paths:
            - ~/.cache/pip
            - scheduler/.venv
          key: pip-packages-v4-{{ .Branch }}-{{ checksum "scheduler/poetry.lock" }}
      - run:
          name: "[scheduler] Configure scheduler"
          command: |
            mv scheduler_config.json scheduler/config.json
      - run:
          name: "[scheduler] Run scheduler"
          working_directory: scheduler
          no_output_timeout: 120m
          command: |
            export REPOSITORY="${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}"
            poetry run python scheduler.py

workflows:
  version: 2
  build:
    # Do not run when the pipeline has been scheduled
    when:
      not:
        equal: [ scheduled_pipeline, << pipeline.trigger_source >> ]
    jobs:
      - build:
          context: ios
          filters:
            branches:
              ignore:
                - /pull\/.+/
  pr_check:
    # Do not run when the pipeline has been scheduled
    when:
      not:
        equal: [ scheduled_pipeline, << pipeline.trigger_source >> ]
    jobs:
      - pr_check:
          context: danger
  release:
    # Do not run when the pipeline has been scheduled
    when:
      not:
        equal: [ scheduled_pipeline, << pipeline.trigger_source >> ]
    jobs:
      - release:
          context: ios
          filters:
            branches:
              ignore: /.*/
            tags:
              only: /^v(?:[0-9]+\.?)+$/
  scheduler:
    # The cron execution and the target branch are specified by the pipeline configuration in the project settings
    when:
      and:
        - equal: [ scheduled_pipeline, << pipeline.trigger_source >> ]
        - equal: [ "Scheduler", << pipeline.schedule.name >> ]
    jobs:
      - scheduler:
          context: scheduler