version: v1.0
name: App Policy

execution_time_limit:
  hours: 4

agent:
  machine:
    type: e1-standard-2
    os_image: ubuntu1804

global_job_config:
  secrets:
  - name: docker-hub
  prologue:
    commands:
      - echo $DOCKERHUB_PASSWORD | docker login --username "$DOCKERHUB_USERNAME" --password-stdin
      - checkout
      # Note that the 'cache restore' commands require that the "Build" block has been run. The "Build" block is what populates
      # the cache, therefore every block that requires the use of these cached items must make the "Build" block one of
      # it's dependencies.
      - 'cache restore go-pkg-cache-${SEMAPHORE_GIT_SHA}'
      - 'cache restore go-mod-cache-${SEMAPHORE_GIT_SHA}'
      - 'cache restore bin-${SEMAPHORE_GIT_SHA}'

blocks:
  - name: 'CI'
    dependencies: []
    task:
      jobs:
        - name: CI
          execution_time_limit:
            minutes: 30
          commands:
            - make ci
            - 'cache store bin-${SEMAPHORE_GIT_SHA} bin'
            - 'cache store go-pkg-cache-${SEMAPHORE_GIT_SHA} .go-pkg-cache'
            - 'cache store go-mod-cache-${SEMAPHORE_GIT_SHA} ${HOME}/go/pkg/mod/cache'

  - name: 'Push Images (non-PR builds only)'
    dependencies: ["CI"]
    skip:
      # Only run on branches, not PRs.
      when: "branch !~ '.+'"
    task:
      secrets:
        - name: quay-robot-calico+semaphoreci
        - name: docker
      prologue:
        commands:
          - echo $DOCKER_TOKEN | docker login --username "$DOCKER_USER" --password-stdin
          - echo $QUAY_TOKEN | docker login --username "$QUAY_USER" --password-stdin quay.io
      jobs:
        - name: Run CD
          execution_time_limit:
            minutes: 15
          commands:
            - export BRANCH_NAME=$SEMAPHORE_GIT_BRANCH
            - if [ -z "${SEMAPHORE_GIT_PR_NUMBER}" ]; then make cd CONFIRM=true; fi

promotions:
  # Run this manually via the semaphore UI if the cache is full
  - name: Clear Cache
    pipeline_file: clear_cache.yml
  # Run the pin update process in case there were a backlog of pin update requests
  - name: Update Pins
    pipeline_file: update_pins.yml
    auto_promote:
      # If the block has passed and the branch is for master or a release branch then run the pin updates. Note that
      # this doesn't try to restrict which release branches, as the presence of this auto promotion code means that
      # it can handle updating the pins in this fashion.
      when: "(result = 'passed') and ((branch = 'master') or (branch =~ '^release-v\d*\.\d*'))"
