feat(apim-apps): first commit

2026-06-29 14:22:37 +02:00
commit 7738a51d16
28 changed files with 1973 additions and 0 deletions
@@ -0,0 +1,19 @@
+{
+  "branches": ["main"],
+  "tagFormat": "${version}",
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    ["@semantic-release/changelog", {
+      "changelogFile": "CHANGELOG.md"
+    }],
+    ["@semantic-release/git", {
+      "assets": ["CHANGELOG.md"],
+      "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+    }],
+    ["@semantic-release/gitlab", {
+      "gitlabUrl": "${CI_SERVER_URL}",
+      "gitlabApiPathPrefix": "/api/v4"
+    }]
+  ]
+}
@@ -0,0 +1,179 @@
+# ── fix/* and feat/* branches — DEV only ─────────────────────────────────────
+#
+# dry-run runs automatically after lints pass.
+# apply is manual and requires dry-run to succeed first.
+
+dry-run:dev:branch:
+  extends: .dry-run-base
+  rules:
+    - if: $CI_COMMIT_BRANCH =~ /^(fix|feat)\/.+/
+  variables:
+    APIM_ENV: DEV
+  needs:
+    - lint:config-json
+    - lint:apps-yaml
+  environment:
+    name: DEV
+    action: prepare
+
+apply:dev:branch:
+  extends: .apply-base
+  rules:
+    - if: $CI_COMMIT_BRANCH =~ /^(fix|feat)\/.+/
+      when: manual
+  variables:
+    APIM_ENV: DEV
+  needs:
+    - dry-run:dev:branch
+  environment:
+    name: DEV
+
+# ── Tags — all environments (dry-run and apply are both manual) ───────────────
+#
+# Intended workflow per environment:
+#   1. Trigger dry-run manually to verify what will change.
+#   2. Once dry-run passes, apply becomes available — trigger it to deploy.
+
+# DEV
+dry-run:dev:
+  extends: .dry-run-base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+  variables:
+    APIM_ENV: DEV
+  environment:
+    name: DEV
+    action: prepare
+
+apply:dev:
+  extends: .apply-base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+  variables:
+    APIM_ENV: DEV
+  needs:
+    - dry-run:dev
+  environment:
+    name: DEV
+
+# REC
+dry-run:rec:
+  extends: .dry-run-base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+  variables:
+    APIM_ENV: REC
+  environment:
+    name: REC
+    action: prepare
+
+apply:rec:
+  extends: .apply-base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+  variables:
+    APIM_ENV: REC
+  needs:
+    - dry-run:rec
+  environment:
+    name: REC
+
+# FORM
+dry-run:form:
+  extends: .dry-run-base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+  variables:
+    APIM_ENV: FORM
+  environment:
+    name: FORM
+    action: prepare
+
+apply:form:
+  extends: .apply-base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+  variables:
+    APIM_ENV: FORM
+  needs:
+    - dry-run:form
+  environment:
+    name: FORM
+
+# PERFS
+dry-run:perfs:
+  extends: .dry-run-base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+  variables:
+    APIM_ENV: PERFS
+  environment:
+    name: PERFS
+    action: prepare
+
+apply:perfs:
+  extends: .apply-base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+  variables:
+    APIM_ENV: PERFS
+  needs:
+    - dry-run:perfs
+  environment:
+    name: PERFS
+
+# PREPROD
+dry-run:preprod:
+  extends: .dry-run-base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+  variables:
+    APIM_ENV: PREPROD
+  environment:
+    name: PREPROD
+    action: prepare
+
+apply:preprod:
+  extends: .apply-base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+  variables:
+    APIM_ENV: PREPROD
+  needs:
+    - dry-run:preprod
+  environment:
+    name: PREPROD
+
+# PROD
+dry-run:prod:
+  extends: .dry-run-base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+  variables:
+    APIM_ENV: PROD
+  environment:
+    name: PROD
+    action: prepare
+
+apply:prod:
+  extends: .apply-base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+  variables:
+    APIM_ENV: PROD
+  needs:
+    - dry-run:prod
+  environment:
+    name: PROD
@@ -0,0 +1,27 @@
+variables:
+  MANIFEST: apps.yaml
+  CONFIG: config.json
+  UV_CACHE_DIR: .uv-cache
+
+# ── Base templates ────────────────────────────────────────────────────────────
+
+.uv-base:
+  image: ghcr.io/astral-sh/uv:python3.13-alpine
+  cache:
+    key: uv-${CI_COMMIT_REF_SLUG}
+    paths:
+      - ${UV_CACHE_DIR}/
+  before_script:
+    - uv sync --frozen
+
+.dry-run-base:
+  extends: .uv-base
+  stage: dry-run
+  script:
+    - uv run python apim_apps.py --dry-run --env "$APIM_ENV"
+
+.apply-base:
+  extends: .uv-base
+  stage: apply
+  script:
+    - uv run python apim_apps.py --env "$APIM_ENV"
@@ -0,0 +1,24 @@
+# Runs on: main, fix/*, feat/*
+# Validates config.json and apps.yaml syntax before any deployment.
+
+lint:config-json:
+  extends: .uv-base
+  stage: lint
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $CI_COMMIT_BRANCH =~ /^(fix|feat)\/.+/
+  script:
+    - >
+      uv run python -c
+      "import json, sys; json.load(open('${CONFIG}')); print('${CONFIG}: OK')"
+
+lint:apps-yaml:
+  extends: .uv-base
+  stage: lint
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $CI_COMMIT_BRANCH =~ /^(fix|feat)\/.+/
+  script:
+    - >
+      uv run python -c
+      "import yaml; yaml.safe_load(open('${MANIFEST}')); print('${MANIFEST}: OK')"
@@ -0,0 +1,27 @@
+# Runs on: main only — after lints pass.
+# Analyses conventional commits and publishes a GitLab release + CHANGELOG.
+#
+# Required CI/CD variable:
+#   SEMANTIC_RELEASE_TOKEN — project/personal access token with api + write_repository scope.
+#   (CI_JOB_TOKEN does not have the permissions needed to push tags and create releases.)
+
+release:
+  stage: release
+  image: node:lts-alpine
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+  needs:
+    - lint:config-json
+    - lint:apps-yaml
+  variables:
+    GITLAB_TOKEN: $SEMANTIC_RELEASE_TOKEN
+  before_script:
+    - npm install --no-save
+        semantic-release
+        @semantic-release/commit-analyzer
+        @semantic-release/release-notes-generator
+        @semantic-release/changelog
+        @semantic-release/git
+        @semantic-release/gitlab
+  script:
+    - npx semantic-release --config .cicd/.releaserc.json