tasks

#!/bin/bash

set -Eeuo pipefail

RELEASER_VERSION="2.1.3"
DOCKER_OPS_VERSION="2.0.1"
SECRET_OPS_VERSION="0.8.0"

SECRET_OPS_FILE="ops/secret-ops"
SECRET_OPS_TAR_FILE="ops/secret-ops-${SECRET_OPS_VERSION}.tar.gz"
RELEASER_FILE="ops/releaser-${RELEASER_VERSION}"
DOCKER_OPS_FILE="ops/docker-ops-${DOCKER_OPS_VERSION}"

VAULT_ADDR="https://vault.kudulab.io:8200"

mkdir -p ops
if [[ ! -f $RELEASER_FILE ]];then
  wget --quiet -O $RELEASER_FILE https://github.com/kudulab/releaser/releases/download/${RELEASER_VERSION}/releaser
fi
source $RELEASER_FILE
if [[ ! -f $DOCKER_OPS_FILE ]];then
  wget --quiet -O $DOCKER_OPS_FILE https://github.com/kudulab/docker-ops/releases/download/${DOCKER_OPS_VERSION}/docker-ops
fi
source $DOCKER_OPS_FILE
if [[ ! -f $SECRET_OPS_TAR_FILE ]];then
  wget --quiet -O $SECRET_OPS_TAR_FILE https://github.com/kudulab/secret-ops/releases/download/${SECRET_OPS_VERSION}/secret-ops.tar.gz
  tar -xf $SECRET_OPS_TAR_FILE -C ops
fi
source $SECRET_OPS_FILE

image_name="kudulab/aws-dojo"
image_registry="dockerhub"
image_dir="./image"
imagerc_filename="imagerc"

function docker_login {
  if [ -n "$DOCKERHUB_TOKEN" ]; then
    echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
    return
  fi
  echo "Warning: docker environment variables not found: falling back to Vault for authentication." >&2
  vault_user_path=$USER
  if [ $vault_user_path == "go" ]; then
    vault_user_path="gocd"
  fi
  dockerhub_user=$(vault read -field=user secret/$vault_user_path/dockerhub)
  vault read -field=password secret/$vault_user_path/dockerhub | docker login --username $dockerhub_user --password-stdin
}

function setup_github_credentials {
  if [ -z "$GITHUB_CREDENTIALS" ]; then
    echo "Error: GITHUB_CREDENTIALS not set" >&2
    exit 1
  fi
  # GITHUB_CREDENTIALS should be in format of account-name:api-key

  # example HTTPS URL: https://github.com/user/repo.git
  # example SSH URL: git@github.com:user/repo.git
  OLD_URL=$(git remote get-url origin)
  NEW_URL=$(echo $OLD_URL | sed "s|git@github.com:|https://$GITHUB_CREDENTIALS@github.com/|g")
  git remote set-url origin $NEW_URL
  echo "GitHub new remote was set"
}

command="$1"
set +u
case "${command}" in
  set_version)
      set +u
      releaser::bump_changelog_version "$2" "$3"
      ;;
  verify_version)
      releaser::verify_release_ready
      ;;
  build_local)
      image_tag=$(git rev-parse HEAD)
      # build image and push to a test registry
      docker_ops::docker_build "${image_dir}" "${imagerc_filename}" "${image_name}" "${image_tag}" "${image_registry}"
      ;;
  build)
      docker_login
      ./tasks build_local
      docker_ops::push "${image_dir}" "${imagerc_filename}"
      ;;
  itest)
      docker_ops::ensure_pulled_image "${image_dir}" "${imagerc_filename}"
      echo "Testing image: ${KUDU_DOCKER_IMAGE_URL}"
      echo "DOJO_DOCKER_IMAGE=\"${KUDU_DOCKER_IMAGE_URL}\"" > ./Dojofile.to_be_tested
      echo "DOJO_IDENTITY_OUTER=\"$(pwd)/test/integration/identities/aws_secrets\"" >> ./Dojofile.to_be_tested
      echo "DOJO_WORK_OUTER=$(pwd)/test/integration/test_dojo_work" >> ./Dojofile.to_be_tested
      time bats "$(pwd)/test/integration/end_user"
      ;;
  example)
      docker_ops::ensure_pulled_image "${image_dir}" "${imagerc_filename}"
      echo "Testing image: ${KUDU_DOCKER_IMAGE_URL}"
      echo "DOJO_DOCKER_IMAGE=\"${KUDU_DOCKER_IMAGE_URL}\"" > ./Dojofile.example
      echo "DOJO_IDENTITY_OUTER=\"$(pwd)/test/integration/identities/aws_secrets\"" >> ./Dojofile.example
      echo "DOJO_WORK_OUTER=$(pwd)/test/integration/test_dojo_work" >> ./Dojofile.example
      dojo -c ./Dojofile.example
      ;;
  release)
      ./tasks verify_version
      setup_github_credentials
      releaser::git_tag_from_changelog
      ;;
  publish)
      docker_login
      version=$(releaser::get_last_version_from_whole_changelog "${changelog_file}")
      docker_ops::ensure_pulled_image "${image_dir}" "${imagerc_filename}"
      docker_ops::retag_push "${image_dir}"  "${imagerc_filename}" "${image_name}" "${version}" "${image_registry}"
      ;;
  generate_vault_token)
      vault_token=$(vault token create -orphan -ttl=48h -policy=gocd -field token -metadata gocd_renew=true)
      secured_token_gocd=$(secret_ops::encrypt_with_gocd_top "${vault_token}")
      echo "Generated token: ${vault_token} and encrypted by GoCD server"
      secret_ops::insert_vault_token_gocd_yaml "${secured_token_gocd}"
      ;;
  *)
      echo "Invalid command: '${command}'"
      exit 1
      ;;
esac