version: 2.1

config_blocks:
  only_tags: &only_tags
    filters:
      branches:
        ignore: /.*/
      tags:
        only: /^v[0-9]+(\.[0-9]+)*$/
#  ---------------- SLACK CONFIG BLOCK ----------------
  slack_channel: &slack_channel deployments #slack channel for notifications

  slack_basic_fail: &slack_basic_fail #on fail
    - slack/notify:
        channel: *slack_channel
        event: fail
        template: basic_fail_1

  slack_basic_success: &slack_basic_success #on success
    - slack/notify:
        channel: *slack_channel
        event: pass
        template: basic_success_1

  slack_success_deploy: &slack_success_deploy #success tag deploy
    - slack/notify:
        channel: *slack_channel
        event: pass
        template: success_tagged_deploy_1
# -----------------------------------------------------------------

orbs:
  aws-cli: circleci/aws-cli@3.1
  slack: circleci/slack@4.9.3

jobs:
  semgrep-scan:
    parameters:
      repo_path:
        type: string
        default: aflorithmic/apiaudio-python
      semgrep_deployment_id:
        type: integer
        default: 283
    environment:
      SEMGREP_REPO_NAME: << parameters.repo_path >>
      SEMGREP_REPO_URL: << pipeline.project.git_url >>
      SEMGREP_BRANCH: << pipeline.git.branch >>
    docker:
      - image: returntocorp/semgrep-agent:v1
    steps:
      - checkout
      - run:
          name: "Semgrep scan"
          command: |
            python -m semgrep_agent \
              --publish-deployment << parameters.semgrep_deployment_id >> \
              --publish-token $SEMGREP_APP_TOKEN
      #  It runs on every commit and probably will annoy us too much.
      # - <<: *slack_basic_fail
      # - <<: *slack_success_deploy

  pip-publish:
    docker:
      - image: cimg/python:3.8
    environment:
      TRIGGER_TAG: << pipeline.git.tag >>
    steps:
      - checkout
      - run:
          name: publish tag that triggered the pipeline
          command: |
            pip3 install twine wheel
            python3 setup.py sdist bdist_wheel
            python3 -m twine upload --username $PIPY_USERNAME --password $PIPY_PASSWORD dist/* --verbose
      - <<: *slack_basic_fail
      - <<: *slack_success_deploy

  update-ssm:
    environment:
      TRIGGER_TAG: << pipeline.git.tag >>
    executor: aws-cli/default
    steps:
      - aws-cli/setup:
          profile-name: versionUpdate
      - run:
          name: update SSM parameter with latest SDK version
          command: |
            aws ssm get-parameter --name /sdk/latest_versions > ssm.json
            NEW_VALUE=$(cat ssm.json | python3 -c 'import json,sys,os;obj=json.loads(sys.stdin.read());obj=json.loads(obj["Parameter"]["Value"]);obj["python"]=os.environ["TRIGGER_TAG"][1:];print(json.dumps(obj))')
            echo $NEW_VALUE
            aws ssm put-parameter --name /sdk/latest_versions --type "String" --value "$NEW_VALUE" --overwrite
      - <<: *slack_basic_fail
      - <<: *slack_success_deploy

workflows:
  semgrep-scan:
    jobs:
      - semgrep-scan:
          context: aws

  version-update:
    jobs:
      - pip-publish:
          context: aws
          <<: *only_tags

      - update-ssm:
          <<: *only_tags
          context: aws
          requires:
            - pip-publish
