extension-workshop/.circleci/config.yml

version: 2.1

references:
  build_container: &build_container
    docker:
      - image: cimg/node:16.19
    working_directory: ~/extension-workshop

  restore_build_cache: &restore_build_cache
    restore_cache:
      keys:
        - yarn-packages-{{ checksum "yarn.lock" }}

  run_yarn_install: &run_yarn_install
    run:
      name: Install Dependencies
      command: yarn install --immutable

  save_build_cache: &save_build_cache
    save_cache:
      key: yarn-packages-{{ checksum "yarn.lock" }}
      paths:
        - ~/.cache/yarn

  run_build_test: &run_build_test
    run:
      name: test
      command: yarn run test-ci

  persist_build_workspace: &persist_build_workspace
    persist_to_workspace:
      root: ./
      paths:
        - ./*

  deploy_container: &deploy_container
    docker:
      - image: cimg/python:3.11-node

  attach_deploy_workspace: &attach_deploy_workspace
    attach_workspace:
      at: .

  run_install_aws_cli: &run_install_aws_cli
    run:
      name: Install AWS CLI
      command: |
        pip install --upgrade pip
        pip install --upgrade awscli        
jobs:
  build-unpublished:
    <<: *build_container
    steps:
      - checkout
      - *restore_build_cache
      - *run_yarn_install
      - *save_build_cache
      - *run_build_test
      - run:
          name: Eleventy build unpublished
          environment:
            ELEVENTY_ENV: production
          command: yarn build:unpublished
          no_output_timeout: 15m
      - *persist_build_workspace

  build:
    <<: *build_container
    steps:
      - checkout
      - *restore_build_cache
      - *run_yarn_install
      - *save_build_cache
      - *run_build_test
      - run:
          name: Eleventy build
          environment:
            ELEVENTY_ENV: production
          command: yarn build:production
          no_output_timeout: 15m
      - *persist_build_workspace

  # unpublished contents (commits to the master branch) only deployed to -dev.
  deploy-unpublished:
    <<: *deploy_container
    steps:
      - *attach_deploy_workspace
      - *run_install_aws_cli
      - run:
          name: firefox extension workshop deployment (unpublished)
          command: |
            AWS_ACCESS_KEY_ID="${DEV_AWS_ACCESS_KEY_ID}"                 \
            AWS_SECRET_ACCESS_KEY="${DEV_AWS_SECRET_ACCESS_KEY}"         \
            DISTRIBUTION_ID="${DEV_DISTRIBUTION_ID}"                     \
            EXTENSION_WORKSHOP_BUCKET="${DEV_EXTENSION_WORKSHOP_BUCKET}" \
            ./.utils/deploy.sh

            AWS_ACCESS_KEY_ID="${DEV_AWS_ACCESS_KEY_ID}"                 \
            AWS_SECRET_ACCESS_KEY="${DEV_AWS_SECRET_ACCESS_KEY}"         \
            EXTENSION_WORKSHOP_BUCKET="${DEV_EXTENSION_WORKSHOP_BUCKET}" \
            ./.utils/setup-object-redirection.sh

            AWS_ACCESS_KEY_ID="${DEV_AWS_ACCESS_KEY_ID}"                 \
            AWS_SECRET_ACCESS_KEY="${DEV_AWS_SECRET_ACCESS_KEY}"         \
            DISTRIBUTION_ID="${DEV_DISTRIBUTION_ID}"                     \
            EXTENSION_WORKSHOP_BUCKET="${DEV_EXTENSION_WORKSHOP_BUCKET}" \
            ./.utils/circleci/invalidate-cloudfront-cache.sh            

  # tags matching specific format are deployed to either stage or prod.
  # note that batch regexp support is limited: it doesn't support non-capturing
  # groups or \d character class.
  deploy:
    <<: *deploy_container
    steps:
      - *attach_deploy_workspace
      - *run_install_aws_cli
      - run:
          name: firefox extension workshop deployment
          command: |
            if [[ "$CIRCLE_TAG" =~ ^20[0-9]{2}\.[0-9]{2}\.[0-9]{2}(-[0-9]+)?-stage$ ]] ; then
              AWS_ACCESS_KEY_ID="${STAGE_AWS_ACCESS_KEY_ID}"                 \
              AWS_SECRET_ACCESS_KEY="${STAGE_AWS_SECRET_ACCESS_KEY}"         \
              DISTRIBUTION_ID="${STAGE_DISTRIBUTION_ID}"                     \
              EXTENSION_WORKSHOP_BUCKET="${STAGE_EXTENSION_WORKSHOP_BUCKET}" \
              ./.utils/deploy.sh

              AWS_ACCESS_KEY_ID="${STAGE_AWS_ACCESS_KEY_ID}"                 \
              AWS_SECRET_ACCESS_KEY="${STAGE_AWS_SECRET_ACCESS_KEY}"         \
              EXTENSION_WORKSHOP_BUCKET="${STAGE_EXTENSION_WORKSHOP_BUCKET}" \
              ./.utils/setup-object-redirection.sh

              AWS_ACCESS_KEY_ID="${STAGE_AWS_ACCESS_KEY_ID}"                 \
              AWS_SECRET_ACCESS_KEY="${STAGE_AWS_SECRET_ACCESS_KEY}"         \
              DISTRIBUTION_ID="${STAGE_DISTRIBUTION_ID}"                     \
              EXTENSION_WORKSHOP_BUCKET="${STAGE_EXTENSION_WORKSHOP_BUCKET}" \
              ./.utils/circleci/invalidate-cloudfront-cache.sh
            elif [[ "$CIRCLE_TAG" =~ ^20[0-9]{2}\.[0-9]{2}\.[0-9]{2}(-[0-9]+)?$ ]] ; then
              ./.utils/deploy.sh
              ./.utils/setup-object-redirection.sh
              ./.utils/circleci/invalidate-cloudfront-cache.sh
            else
              echo "Unrecognized tag: \`${CIRCLE_TAG}'. A good tag example is 2022.08.03, or 2022.08.03-stage" 1>&2
              exit 1
            fi            

# Per https://github.com/mozilla/extension-workshop/issues/191,
# https://github.com/mozilla/extension-workshop/issues/192 and
# https://github.com/mozilla/extension-workshop/issues/1236
# Our current CircleCI workflow is the following:
# * Push master to dev environment with --unpublished switch.
# * Push tags that end with "-stage" to stage environment.
# * Push normal tags to production environment.
# * No branch is pushed to any environment.
# * All branches will be built to surface any errors if any early.
workflows:
  version: 2
  build-test-and-deploy:
    jobs:
      - build-unpublished
      - deploy-unpublished:
          requires:
            - build-unpublished
          filters:
            branches:
              only: master
      - build:
          # The filter in this step matches what's used for "deploy" step.
          # Also note that the tags filter is needed because "CircleCI does
          # not run workflows for tags unless you explicitly specify tag
          # filters. Additionally, if a job requires any other jobs (directly
          # or indirectly), you must specify tag filters for those jobs".
          filters:
            branches:
              ignore: /.*/
            tags:
              # match tags such as "2022.03.08" or "2022.03.08-1", with or
              # without a -stage suffix.
              only: /^20[0-9]{2}\.[0-9]{2}\.[0-9]{2}(-[0-9]+)?(-stage)?$/
      - deploy:
          requires:
            - build
          filters:
            branches:
              ignore: /.*/
            tags:
              # match tags such as "2022.03.08" or "2022.03.08-1", with or
              # without a -stage suffix.
              only: /^20[0-9]{2}\.[0-9]{2}\.[0-9]{2}(-[0-9]+)?(-stage)?$/