[damned-lies] feat: add .gitlab-ci.yml to build runtime only

[Guillaume Bernard <gbernard src gnome org>]

commit 40abab8dd7c49b18f3c9a3a494131da5810545d5
Author: Guillaume Bernard <associations guillaume-bernard fr>
Date:   Mon May 9 15:06:21 2022 +0200

    feat: add .gitlab-ci.yml to build runtime only

 .gitlab-ci.yml | 113 +++++++++++++++++++++++++++++++++++++++------------------
 1 file changed, 78 insertions(+), 35 deletions(-)
---
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 5d76232d..c68138db 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,9 +1,13 @@
 stages:
+  # Build all artefacts that are used in the following jobs
+  - pre_build
+  # Build all artefacts that may be published or put to production
   - build
   - test
+  # Pre deploy tasks such as building production images, etc.
+  - pre_deploy
   - deploy
 
-
 workflow:
   rules:
     # A merge request pipeline
@@ -15,17 +19,63 @@ workflow:
     - when: always
 
 
-.debian-based-job:
-  image: python:buster
+variables:
+  # The canonical name of the runtime image, that is used to build production and to
+  # run some jobs. It is written without any tag.
+  RUNTIME_CANONICAL_IMAGE_NAME: "damned-lies-runtime"
+  # The runtime image hosted on Gitlab
+  RUNTIME_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/damned-lies-runtime:${CI_COMMIT_REF_NAME}-latest"
+
+# A job that runs on the runtime image (the one that is used the build the
+# production container should inherit from this template.
+.job-on-runtime-image:
+    image: "${RUNTIME_IMAGE_NAME}"
+    before_script:
+      - pip install -r requirements.txt
+
+# A job that builds an image using buildah should inherit from this template
+.job-on-buildah:
+  image: quay.io/buildah/stable:latest
+  variables:
+    # Specific to buildah
+    STORAGE_DRIVER: vfs
+    BUILDAH_FORMAT: docker
   before_script:
-    - apt update -qq
-    - apt install -y -qq libicu-dev python3-icu python3-aeidon gettext intltool itstool yelp-tools yelp-xsl 
gnome-doc-utils
-    - pip install -r requirements.txt
+    - buildah login --username "${CI_REGISTRY_USER}" --password "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
 
 
+##############################################################################
+###################             Pre Build                  ###################
+##############################################################################
+
+build_damned_lies_runtime:
+  extends: .job-on-buildah
+  stage: pre_build
+  variables:
+    # References for the build script
+    CURRENT_VCS_REF_NAME: "${CI_COMMIT_REF_NAME}"
+    BUILT_IMAGE_NAME: "${RUNTIME_CANONICAL_IMAGE_NAME}:${CI_COMMIT_REF_NAME}-latest"
+  script:
+    - ./containers/build_buildah_runtime.sh
+    - buildah tag "${BUILT_IMAGE_NAME}" "${RUNTIME_IMAGE_NAME}"
+    - buildah push "${RUNTIME_IMAGE_NAME}"
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "schedule"
+      when: always
+    - if: $CI_PIPELINE_SOURCE == "web"
+      when: always
+    - if: $CI_PIPELINE_SOURCE == "trigger"
+      when: always
+    - when: manual
+      allow_failure: true
+
+
+##############################################################################
+###################               Build                    ###################
+##############################################################################
 pages:
   stage: build
-  extends: .debian-based-job
+  extends: .job-on-runtime-image
   script:
     - pip install -r ./docs/requirements.txt
     - make -C docs html
@@ -37,16 +87,18 @@ pages:
     expire_in: "5 days"
   rules:
     # Run the job on the default branch only.
-    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+    - if: $CI_COMMIT_BRANCH == "${CI_DEFAULT_BRANCH}"
       when: always
       allow_failure: false
     - when: never
       allow_failure: true
 
-
+##############################################################################
+###################               Test                     ###################
+##############################################################################
 test:
   stage: test
-  extends: .debian-based-job
+  extends: .job-on-runtime-image
   script:
     - pip install coverage
     - python manage.py compile-trans --settings=damnedlies.settings_tests
@@ -73,7 +125,7 @@ test:
 static-analysis:prospector:
   extends:
     - .static-analysis
-    - .debian-based-job
+    - .job-on-runtime-image
   script:
     - pip install prospector[with_pyroma,with_bandit]
     - prospector | tee prospector.txt
@@ -105,7 +157,7 @@ static-analysis:flake8:
 
 code-string-changes:
   stage: test
-  extends: .debian-based-job
+  extends: .job-on-runtime-image
   variables:
     TRANSLATION_DIFF_PO_FILENAME: translation_diff.po
   script:
@@ -123,27 +175,18 @@ code-string-changes:
       - "${TRANSLATION_DIFF_PO_FILENAME}"
     when: on_failure
 
-
-.deploy-instance:
-  image: alpine
-  stage: deploy
-  before_script:
-    - apk --no-cache add curl
-
-
-deploy:stable:
-  extends: .deploy-instance
-  script:
-    - curl -X POST $OSCP_WEBHOOK_PROD
-  rules:
-    - if: '$CI_COMMIT_BRANCH == "master"'
-      when: on_success
-
-
-deploy:devel:
-  extends: .deploy-instance
+##############################################################################
+###################             Pre Deploy                 ###################
+##############################################################################
+build_damned_lies_production:
+  extends: .job-on-buildah
+  stage: pre_deploy
+  variables:
+    # References for the build script
+    CURRENT_VCS_REF_NAME: "${CI_COMMIT_REF_NAME}"
+    BUILT_IMAGE_NAME: "damned-lies-production:${CI_COMMIT_REF_NAME}"
+    IMAGE_TAG: "${CI_REGISTRY_IMAGE}/damned-lies-production:${CI_COMMIT_REF_NAME}-latest"
   script:
-    - curl -X POST $OSCP_WEBHOOK_TESTING
-  rules:
-    - if: '$CI_COMMIT_BRANCH == "develop"'
-      when: on_success
+    - ./containers/production/build_buildah_production.sh
+    - buildah tag "${BUILT_IMAGE_NAME}" "${IMAGE_TAG}"
+    - buildah push "${IMAGE_TAG}"