---
# Continuous delivery: deploy to the persistent CI stack on every push to main.
#
# Required GitHub Secrets (Settings → Secrets and variables → Actions → Secrets):
#   DATAROBOT_API_TOKEN  — DataRobot service account API key
#   PULUMI_ACCESS_TOKEN  — from https://app.pulumi.com/account/tokens
#
# Optional GitHub Variable (defaults to "ci" if not set):
#   PULUMI_STACK_CI_NAME — stack name for the CI environment (e.g. "ci", "prod")
#
# Pulumi Cloud uses PULUMI_ACCESS_TOKEN automatically — no explicit login step needed.

name: Deploy (CD)
on:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v5

      - name: Deploy
        working-directory: infra
        env:
          DATAROBOT_API_TOKEN: ${{ secrets.DATAROBOT_API_TOKEN }}
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
          PULUMI_STACK: ${{ vars.PULUMI_STACK_CI_NAME || 'ci' }}
        run: |
          uv sync --all-extras
          uv run pulumi stack select --create $PULUMI_STACK
          uv run pulumi up --yes

---
# PR preview deployment: manually triggered so you control when a PR stack is created.
# Go to: Actions → Deploy (PR Preview) → Run workflow → select your PR branch → enter stack name.
#
# Tip: use the PR number as the stack name (e.g. "pr-42") so it's easy to track and clean up.
#
# Required GitHub Secrets (Settings → Secrets and variables → Actions → Secrets):
#   DATAROBOT_API_TOKEN  — DataRobot service account API key
#   PULUMI_ACCESS_TOKEN  — from https://app.pulumi.com/account/tokens

name: Deploy (PR Preview)
on:
  workflow_dispatch:
    inputs:
      stack_name:
        description: "Stack name for this PR preview (e.g. 'pr-42')"
        required: true
        default: "pr-preview"
        type: string

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v5

      - name: Deploy PR Preview Stack
        working-directory: infra
        env:
          DATAROBOT_API_TOKEN: ${{ secrets.DATAROBOT_API_TOKEN }}
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
          PULUMI_STACK: ${{ github.event.inputs.stack_name }}
        run: |
          uv sync --all-extras
          uv run pulumi stack select --create $PULUMI_STACK
          uv run pulumi up --yes

---
# Manual stack destroy: triggered from the GitHub Actions UI (Actions → Destroy Stack → Run workflow).
# Use this to clean up review stacks after a PR is merged or closed.
#
# Required GitHub Secrets:
#   DATAROBOT_API_TOKEN  — DataRobot service account API key
#   PULUMI_ACCESS_TOKEN  — from https://app.pulumi.com/account/tokens

name: Destroy Stack
on:
  workflow_dispatch:
    inputs:
      stack_name:
        description: "Stack name to destroy (e.g. review-pr-42)"
        required: true
        type: string

permissions:
  contents: read

jobs:
  destroy:
    runs-on: ubuntu-latest
    env:
      # Bind input to an env var — prevents it from being interpolated directly into shell.
      PULUMI_STACK: ${{ github.event.inputs.stack_name }}
    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v5

      - name: Destroy Stack
        working-directory: infra
        env:
          DATAROBOT_API_TOKEN: ${{ secrets.DATAROBOT_API_TOKEN }}
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
        run: |
          uv sync --all-extras
          uv run pulumi stack select $PULUMI_STACK
          uv run pulumi destroy --yes
          uv run pulumi stack rm --yes

# CI/CD Setup

This directory contains GitHub Actions workflows for deploying to DataRobot using Pulumi Cloud.

## Workflows

| File | Trigger | What it does |
|------|---------|--------------|
| `cd.yml` | Automatic — every merge to `main` | Deploys `main` to the persistent CI stack |
| `deploy-pr.yml` | Manual — you choose branch and stack name | Deploys a preview stack from a PR branch |
| `destroy.yml` | Manual — you enter the stack name | Destroys a named Pulumi stack |

`cd.yml` is the only workflow that runs automatically. Everything else requires you to trigger it from the Actions tab.

## One-time setup

### 1. Create a Pulumi Cloud account

Sign up at [app.pulumi.com](https://app.pulumi.com) (free tier is sufficient for most projects).

Create an access token: click your **profile icon → Access Tokens → Create token**. Copy the token — you will need it in step 3.

### 2. Get a DataRobot API key

Ask your DataRobot admin to create a **service account** user (e.g. `ci-bot@your-org.com`) and generate an API key under **Developer Tools → API Key**. Using a service account instead of a personal API key prevents CI/CD from breaking when people leave the team.

> If you are just getting started, you can use your own personal API key temporarily and replace it later.

### 3. Add GitHub Secrets

Go to: **Settings → Secrets and variables → Actions → Secrets tab → New repository secret**

| Secret name | Where to get it |
|-------------|----------------|
| `DATAROBOT_API_TOKEN` | DataRobot → Developer Tools → API Key |
| `PULUMI_ACCESS_TOKEN` | Pulumi Cloud → Profile → Access Tokens |

Both secrets are required. The workflows will not run without them.

### 4. (Optional) Set a custom CI stack name

The `cd.yml` workflow deploys to a Pulumi stack named `ci` by default. To use a different name, add a repository variable:

**Settings → Secrets and variables → Actions → Variables tab → New repository variable**

| Variable name | Value |
|---------------|-------|
| `PULUMI_STACK_CI_NAME` | Your preferred stack name (e.g. `ci`, `prod`, `staging`) |

Skip this step if `ci` is fine.

## How to trigger deployments

**Automatic deploy (merge to main):**
`cd.yml` runs automatically every time code is merged to `main`. No action needed.

**Manual PR preview deploy:**
1. Open a PR and get ready to test it in a live environment.
2. Go to **Actions → Deploy (PR Preview)** in the GitHub UI.
3. Click **Run workflow**.
4. Select your PR branch from the dropdown.
5. Enter a stack name — tip: use the PR number (e.g. `pr-42`) so it's easy to track.
6. Click **Run workflow**. Each stack is isolated, so multiple PRs can have their own live environment.

**Destroy a stack (manual cleanup):**
1. Go to **Actions → Destroy Stack**.
2. Click **Run workflow → Run workflow**.
3. Enter the exact stack name you want to destroy (e.g. `pr-42` or `ci`).

> The CI stack (`ci`) is recreated automatically on the next merge to `main`. Destroy it only if you want to tear everything down.

---
version: '3'
dotenv:
  - .env
includes:
  react:
    taskfile: ./frontend_react/react_src/Taskfile.yaml
    dir: ./frontend_react/react_src/
tasks:
  install:
    desc: 📦 Install all dependencies
    cmds:
      - uv venv .venv
      - source .venv/bin/activate && uv pip install -r requirements.txt
      - task: react:install

  python-lint:
    desc: 🧹 Lint Python code
    cmds:
      - ruff format .
      - ruff check . --fix
      - mypy --pretty .

  python-lint-check:
    desc: 🧹 Check Python linting without fixes
    cmds:
      - ruff format --check .
      - ruff check .
      - mypy --pretty .

  lint:
    deps:
      - react:lint
      - python-lint
    desc: 🧹 Lint all code

  lint-check:
    deps:
      - react:lint-check
      - python-lint-check
    desc: 🧹 Check linting for all code

  test:
    deps:
      - react:test
    desc: 🧪 Run all tests

# CI/CD Workflow Examples

## Example 1: Set up GitLab CI/CD with review apps

**User request**: "Set up GitLab CI/CD for my application template with automated testing and manual review deployments"

**Agent workflow**:
1. Create `infra/scripts/` directory in project root: `mkdir -p infra`
2. Copy entire scripts directory: `cp -R <skill-path>/scripts infra/scripts`
3. Make scripts executable: `chmod +x infra/scripts/*.sh`
4. Copy CI/CD configs to standard locations:
   - GitLab: `cp infra/scripts/gitlab-ci.yml .gitlab-ci.yml`
   - GitHub: `cp infra/scripts/github-*.yml .github/workflows/`
5. Copy tasks from `infra/scripts/taskfile-snippets.yaml` to `infra/Taskfile.yaml`
   Then add an `includes` entry to the root `Taskfile.yml` pointing to `./infra/Taskfile.yaml` — **do NOT paste tasks directly into root Taskfile.yml**
6. Guide user to run `task infra:setup-github-secrets` or `task infra:setup-gitlab-vars`
7. If GitHub, guide user to run `task encrypt-secrets` to encrypt `.env` file
8. **Generate `infra/README.md`** tailored to GitLab + chosen Pulumi backend
9. Test pipeline with a sample PR/MR

## Example 2: Set up GitHub Actions with encrypted secrets

**User request**: "Configure GitHub Actions CI/CD with GPG-encrypted secrets and review deployments"

**Agent workflow**:
1. Create `infra/scripts/` directory: `mkdir -p infra && cp -R <skill-path>/scripts infra/scripts`
2. Make scripts executable: `chmod +x infra/scripts/*.sh`
3. Copy GitHub workflows: `cp infra/scripts/github-*.yml .github/workflows/`
4. Copy `infra/scripts/taskfile-snippets.yaml` to `infra/Taskfile.yaml`: `cp infra/scripts/taskfile-snippets.yaml infra/Taskfile.yaml`
   Add an `includes` entry for `./infra/Taskfile.yaml` to the root `Taskfile.yml` — **do NOT paste tasks directly into root Taskfile.yml**
5. Guide user to encrypt `.env` with `task infra:encrypt-secrets`
6. Guide user to set up GitHub secrets with `task infra:setup-github-secrets`
7. Add encrypted `.env.gpg` to repository
8. **Generate `infra/README.md`** tailored to GitHub Actions + chosen Pulumi backend
9. Test workflow with a sample pull request

## Example 3: Configure continuous delivery

**User request**: "Set up automatic deployment when changes are merged to main branch"

**Agent workflow**:
1. Add deployment job triggered on push to main branch
2. Configure Pulumi to use persistent stack name (e.g., "ci" or "prod")
3. Set up automatic stack selection and update
4. Configure deployment to run only on successful tests
5. Add deployment status notifications
6. Document the CD process for the team

#!/usr/bin/env bash
# Copyright (c) 2026 DataRobot, Inc. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# GPG decryption script for .env files
# Used for local development and testing CI/CD workflows

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"

echo "🔓 Decrypt .env.gpg file"
echo "========================"
echo ""

if [ ! -f "$REPO_ROOT/.env.gpg" ]; then
    echo "❌ Error: .env.gpg file not found in project root"
    echo "Run ./encrypt-secrets.sh first to create it"
    exit 1
fi

if [ -f "$REPO_ROOT/.env" ]; then
    echo "⚠️  Warning: .env already exists"
    read -p "Overwrite? (y/N): " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        echo "Aborted"
        exit 0
    fi
fi

echo "Enter your encryption passphrase:"
gpg --quiet --batch --yes --decrypt --output "$REPO_ROOT/.env" "$REPO_ROOT/.env.gpg"

if [ -f "$REPO_ROOT/.env" ]; then
    echo ""
    echo "✅ Successfully decrypted .env.gpg → .env"
    echo ""
    echo "⚠️  Remember: Never commit .env to git!"
    echo "   Make sure .env is in your .gitignore"
else
    echo "❌ Error: Decryption failed"
    echo "Check your passphrase and try again"
    exit 1
fi

#!/usr/bin/env bash
# Copyright (c) 2026 DataRobot, Inc. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# GPG encryption script for .env files
# Used for GitHub Actions secrets management
# See: https://docs.github.com/en/actions/security-for-github-actions/using-encrypted-secrets

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"

echo "🔒 Encrypt .env file with GPG"
echo "=============================="
echo ""

if [ ! -f "$REPO_ROOT/.env" ]; then
    echo "❌ Error: .env file not found in project root"
    echo "Create a .env file in the project root first with your secrets"
    exit 1
fi

if [ -f "$REPO_ROOT/.env.gpg" ]; then
    echo "⚠️  Warning: .env.gpg already exists"
    read -p "Overwrite? (y/N): " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        echo "Aborted"
        exit 0
    fi
fi

echo "Enter a strong passphrase for encryption:"
echo "(You'll need to add this to GitHub Secrets as CICD_SECRET_PASSPHRASE)"
echo ""

gpg --symmetric --cipher-algo AES256 --output "$REPO_ROOT/.env.gpg" "$REPO_ROOT/.env"

if [ -f "$REPO_ROOT/.env.gpg" ]; then
    echo ""
    echo "✅ Successfully encrypted .env → .env.gpg"
    echo ""
    echo "Next steps:"
    echo "1. Add .env.gpg to git:"
    echo "   git add .env.gpg"
    echo "   git commit -m 'Add encrypted secrets'"
    echo ""
    echo "2. Add the passphrase to GitHub:"
    echo "   - Go to Settings → Secrets and variables → Actions"
    echo "   - Create new secret: CICD_SECRET_PASSPHRASE"
    echo "   - Paste your passphrase as the value"
    echo ""
    echo "3. Ensure .env is in .gitignore (never commit plaintext secrets!)"
    echo ""
    echo "⚠️  IMPORTANT: Store your passphrase securely!"
    echo "   If you lose it, you'll need to re-encrypt with a new passphrase."
else
    echo "❌ Error: Encryption failed"
    exit 1
fi

---
# Example GitHub Actions continuous delivery workflow for DataRobot Application Templates
# Copy this to your repository as .github/workflows/cd.yml
#
# Triggers on every push to the default branch and deploys to the persistent CI stack.
# The stack name is controlled by the PULUMI_STACK_CI_NAME repository variable
# (set via: gh variable set PULUMI_STACK_CI_NAME --body 'ci').

name: Pulumi CD
on:
  push:
    branches:
      - main

# Restrict default permissions for all jobs — each job grants only what it needs.
permissions:
  contents: read

env:
  PULUMI_STACK: ${{ vars.PULUMI_STACK_CI_NAME || 'ci' }}

jobs:
  deploy:
    name: pulumi-deploy-ci-stack
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Decrypt Secrets
        run: |
          gpg --quiet --batch --yes --decrypt --passphrase="$CICD_SECRET_PASSPHRASE" --output .env .env.gpg
          # Load all .env variables into the GitHub Actions environment for subsequent steps
          grep -v '^#' .env | grep -v '^$' >> $GITHUB_ENV
        env:
          # Only this one secret needs to be stored in GitHub repository secrets
          CICD_SECRET_PASSPHRASE: ${{ secrets.CICD_SECRET_PASSPHRASE }}

      - uses: actions/setup-python@v5
        with:
          python-version: 3.12

      - name: Install Pulumi
        run: |
          curl -fsSL https://get.pulumi.com | sh
          echo "$HOME/.pulumi/bin" >> $GITHUB_PATH

      - name: Setup Project Dependencies
        run: |
          command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
          uv venv .venv
          source .venv/bin/activate
          uv pip install -r requirements.txt

      - name: Deploy CI Stack
        run: |
          source .venv/bin/activate
          export $(grep -v '^#' .env | xargs)
          # PULUMI_STACK selects the persistent CI stack; --create initialises it if it doesn't exist yet
          pulumi stack select --create $PULUMI_STACK
          pulumi up --yes
          echo "✅ Deployed CI stack: $PULUMI_STACK"

---
# Example GitHub Actions deployment workflow for DataRobot Application Templates
# Copy this to your repository as .github/workflows/deploy.yml

name: Pulumi Deployment
on:
  pull_request:
    types: [opened, synchronize, reopened]

# Restrict default permissions for all jobs — each job grants only what it needs.
permissions:
  contents: read

env:
  PULUMI_STACK: ${{ vars.PULUMI_STACK_REVIEW_NAME || 'review' }}-${{ github.event.number }}

jobs:
  # Test and lint job - runs first
  test:
    name: test-and-lint
    runs-on: ubuntu-latest
    # Skip entirely for fork PRs — secrets are withheld by GitHub for forks anyway,
    # but this makes the intent explicit and avoids wasting CI minutes.
    if: github.event.pull_request.head.repo.full_name == github.repository
    steps:
      - uses: actions/checkout@v4

      - name: Decrypt Secrets
        run: |
          gpg --quiet --batch --yes --decrypt --passphrase="$CICD_SECRET_PASSPHRASE" --output .env .env.gpg
          # Load all .env variables into the GitHub Actions environment for subsequent steps
          grep -v '^#' .env | grep -v '^$' >> $GITHUB_ENV
        env:
          # Only this one secret needs to be stored in GitHub repository secrets
          CICD_SECRET_PASSPHRASE: ${{ secrets.CICD_SECRET_PASSPHRASE }}

      - uses: actions/setup-python@v5
        with:
          python-version: 3.12

      - name: Install Task
        run: pip install go-task-bin

      - name: Install Dependencies
        run: task install

      - name: Lint
        run: task lint-check

      - name: Test
        run: task test

  # Deployment job - runs after tests pass
  deploy:
    name: pulumi-deploy-stack
    runs-on: ubuntu-latest
    needs: test
    # Same fork guard as the test job above.
    if: github.event.pull_request.head.repo.full_name == github.repository
    permissions:
      contents: read # required for actions/checkout on private repos
      pull-requests: write # required for peter-evans/create-or-update-comment
    steps:
      - uses: actions/checkout@v4

      - name: Decrypt Secrets
        run: |
          gpg --quiet --batch --yes --decrypt --passphrase="$CICD_SECRET_PASSPHRASE" --output .env .env.gpg
          # Load all .env variables into the GitHub Actions environment for subsequent steps
          grep -v '^#' .env | grep -v '^$' >> $GITHUB_ENV
        env:
          # Only this one secret needs to be stored in GitHub repository secrets
          CICD_SECRET_PASSPHRASE: ${{ secrets.CICD_SECRET_PASSPHRASE }}

      - uses: actions/setup-python@v5
        with:
          python-version: 3.12

      - name: Install Pulumi
        run: |
          curl -fsSL https://get.pulumi.com | sh
          echo "$HOME/.pulumi/bin" >> $GITHUB_PATH

      - name: Setup Project Dependencies
        run: |
          command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
          uv venv .venv
          source .venv/bin/activate
          uv pip install -r requirements.txt

      - name: Plan Pulumi Update
        id: plan_pulumi_update
        run: |
          source .venv/bin/activate
          export $(grep -v '^#' .env | xargs)
          # PULUMI_STACK env var selects the stack; --create initialises it if it doesn't exist yet
          pulumi stack select --create $PULUMI_STACK
          pulumi up --yes
          # Store JSON output once and parse it for all values
          PULUMI_OUTPUT=$(pulumi stack output --json)
          APPLICATION_URL=$(echo "$PULUMI_OUTPUT" | jq -r 'to_entries[] | select(.key | startswith("Data Analyst Application")) | .value')
          DEPLOYMENT_URL=$(echo "$PULUMI_OUTPUT" | jq -r 'to_entries[] | select(.key | startswith("Generative Analyst Deployment")) | .value')
          APP_ID=$(echo "$PULUMI_OUTPUT" | jq -r '.DATAROBOT_APPLICATION_ID // empty')
          LLM_ID=$(echo "$PULUMI_OUTPUT" | jq -r '.LLM_DEPLOYMENT_ID // empty')
          echo "application_url=${APPLICATION_URL}" >> $GITHUB_OUTPUT
          echo "deployment_url=${DEPLOYMENT_URL}" >> $GITHUB_OUTPUT
          echo "app_id=${APP_ID}" >> $GITHUB_OUTPUT
          echo "llm_id=${LLM_ID}" >> $GITHUB_OUTPUT
          # PULUMI_ACCESS_TOKEN and all other secrets are sourced from .env.gpg above

      - name: Comment PR with App URL
        uses: peter-evans/create-or-update-comment@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          issue-number: ${{ github.event.number }}
          body: |
            # 🚀 Your application is ready!
            ## Application Info
            - **Application URL:** [${{ steps.plan_pulumi_update.outputs.application_url }}](${{ steps.plan_pulumi_update.outputs.application_url }})
            - **Application ID:** `${{ steps.plan_pulumi_update.outputs.app_id }}`
            ## LLM Deployment
            - **Deployment URL:** [${{ steps.plan_pulumi_update.outputs.deployment_url }}](${{ steps.plan_pulumi_update.outputs.deployment_url }})
            - **Deployment ID:** `${{ steps.plan_pulumi_update.outputs.llm_id }}`
            ### Pulumi Stack
            - **Stack Name:** `${{ env.PULUMI_STACK }}`

---
# Example GitHub Actions destroy workflow for DataRobot Application Templates
# Copy this to your repository as .github/workflows/destroy.yml
# This workflow allows manual destruction of review app stacks

name: Pulumi Stack Destroy
on:
  workflow_dispatch:
    inputs:
      stack_name:
        description: 'Stack name to destroy (e.g. github-pr-foobar-42)'
        required: true
        type: string

jobs:
  destroy:
    name: pulumi-destroy-stack
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      # Bind the user-supplied input to PULUMI_STACK so it is never interpolated
      # directly into the shell script (prevents script injection attacks).
      PULUMI_STACK: ${{ github.event.inputs.stack_name }}
    steps:
      - uses: actions/checkout@v4

      - name: Decrypt Secrets
        run: |
          gpg --quiet --batch --yes --decrypt --passphrase="$CICD_SECRET_PASSPHRASE" --output .env .env.gpg
          # Load all .env variables into the GitHub Actions environment for subsequent steps
          grep -v '^#' .env | grep -v '^$' >> $GITHUB_ENV
        env:
          # Only this one secret needs to be stored in GitHub repository secrets
          CICD_SECRET_PASSPHRASE: ${{ secrets.CICD_SECRET_PASSPHRASE }}

      - uses: actions/setup-python@v5
        with:
          python-version: 3.12

      - name: Install Pulumi
        run: |
          curl -fsSL https://get.pulumi.com | sh
          echo "$HOME/.pulumi/bin" >> $GITHUB_PATH

      - name: Setup Project Dependencies
        run: |
          command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
          uv venv .venv
          source .venv/bin/activate
          uv pip install -r requirements.txt

      - name: Destroy Pulumi Stack
        run: |
          source .venv/bin/activate
          # PULUMI_STACK env var identifies the stack for all commands
          pulumi destroy --yes
          pulumi stack rm --yes

---
# Example GitLab CI/CD configuration for DataRobot Application Templates
# Copy this to your repository root as .gitlab-ci.yml

image: cimg/python:3.11-node

variables:
  DATAROBOT_ENDPOINT: https://app.datarobot.com/api/v2
  FRONTEND_TYPE: react
  # ── Pulumi stack names ─────────────────────────────────────────────────────
  # Set PULUMI_STACK_CI_NAME and PULUMI_STACK_REVIEW_NAME as plain CI/CD
  # variables in GitLab (Settings → CI/CD → Variables) to override these
  # defaults.  Project variables always take precedence over the values below.
  PULUMI_STACK_REVIEW_NAME: review-mr
  PULUMI_STACK_CI_NAME: ci
  # ── Secrets ────────────────────────────────────────────────────────────────
  # Only one secret needs to be set in GitLab CI/CD settings:
  # CICD_SECRET_PASSPHRASE: "$CICD_SECRET_PASSPHRASE"  (GPG passphrase to decrypt .env.gpg)
  # ⚠️  CICD_SECRET_PASSPHRASE MUST be set as a "Protected variable" in GitLab so it is
  #     never exposed to pipelines triggered from forks.
  # All other secrets (DATAROBOT_API_TOKEN, PULUMI_ACCESS_TOKEN, LLM keys, etc.)
  # are stored in .env.gpg and sourced automatically in before_script.

before_script:
  # Decrypt .env.gpg and source all secrets — only CICD_SECRET_PASSPHRASE must be set in GitLab CI/CD settings
  - gpg --quiet --batch --yes --decrypt --passphrase="$CICD_SECRET_PASSPHRASE" --output .env .env.gpg
  - export $(grep -v '^#' .env | grep -v '^$' | xargs)
  - pip install go-task-bin
  - task install
  - source .venv/bin/activate

stages:
  - check
  - review
  - deploy
  - cleanup

# Linting stage - runs on every merge request from the same project (not forks)
lint:
  stage: check
  script:
    - task lint-check
  rules:
    - if: $CI_MERGE_REQUEST_ID && $CI_PROJECT_ID == $CI_MERGE_REQUEST_SOURCE_PROJECT_ID

# Testing stage - runs on every merge request from the same project (not forks)
test:
  stage: check
  script:
    - task test
  rules:
    - if: $CI_MERGE_REQUEST_ID && $CI_PROJECT_ID == $CI_MERGE_REQUEST_SOURCE_PROJECT_ID

# Review app deployment - manual trigger for MR validation (same-project MRs only)
review_app:
  stage: review
  variables:
    PULUMI_STACK: ${PULUMI_STACK_REVIEW_NAME}-${CI_MERGE_REQUEST_IID}
  script:
    # Install Pulumi
    - curl -fsSL https://get.pulumi.com | sh
    - export PATH="$HOME/.pulumi/bin:$PATH"
    # Login to Pulumi backend (DIY backend example using Azure Blob)
    - pulumi login --cloud-url "azblob://dr-ai-apps-pulumi"
    # Create the stack if it doesn't exist (PULUMI_STACK selects it for all subsequent commands)
    - pulumi stack select --create $PULUMI_STACK
    # Deploy the stack
    - pulumi up --yes
    - echo "Deploying review app for $PULUMI_STACK"
    # Get stack outputs and format for GitLab comment
    - STACK_OUTPUT="<br><br>$(pulumi stack output --shell)"
    - STACK_OUTPUT="${STACK_OUTPUT//$'\n'/<br>}"
    # Post comment to merge request with deployment info
    - |
      curl --header "PRIVATE-TOKEN: $GITLAB_API_TOKEN" \
         --data "body=Review Deployment: $STACK_OUTPUT" \
         "$CI_API_V4_URL/projects/$CI_PROJECT_ID/merge_requests/$CI_MERGE_REQUEST_IID/notes"
  rules:
    - if: $CI_MERGE_REQUEST_ID && $CI_PROJECT_ID == $CI_MERGE_REQUEST_SOURCE_PROJECT_ID
      when: manual

# Cleanup review app - manual trigger to destroy resources
destroy_review_app:
  stage: cleanup
  variables:
    PULUMI_STACK: ${PULUMI_STACK_REVIEW_NAME}-${CI_MERGE_REQUEST_IID}
  script:
    - curl -fsSL https://get.pulumi.com | sh
    - export PATH="$HOME/.pulumi/bin:$PATH"
    - pulumi login --cloud-url "azblob://dr-ai-apps-pulumi"
    # Destroy the stack (PULUMI_STACK identifies which stack to target)
    - pulumi destroy --yes
    # Remove the stack from Pulumi backend
    - pulumi stack rm --yes
    - echo "Destroyed $PULUMI_STACK stack"
  rules:
    - if: $CI_MERGE_REQUEST_ID && $CI_PROJECT_ID == $CI_MERGE_REQUEST_SOURCE_PROJECT_ID
      when: manual
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual
  needs:
    - job: review_app
      optional: true

# Continuous delivery - automatic deployment on merge to default branch
deploy_ci:
  stage: deploy
  variables:
    PULUMI_STACK: $PULUMI_STACK_CI_NAME
  script:
    - curl -fsSL https://get.pulumi.com | sh
    - export PATH="$HOME/.pulumi/bin:$PATH"
    - pulumi login --cloud-url "azblob://dr-ai-apps-pulumi"
    # Select stack, creating it if it doesn't exist yet
    - pulumi stack select --create $PULUMI_STACK
    - pulumi up --yes
    - echo "Deployed $PULUMI_STACK stack"
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: on_success

# Infrastructure and CI/CD Scripts

This directory contains all CI/CD and infrastructure-related scripts for the application template.

## Directory Structure

```
project-root/
├── infra/
│   ├── Taskfile.yaml               # ⚠️ CI/CD tasks go HERE (copy from infra/scripts/taskfile-snippets.yaml)
│   └── scripts/                    # CI/CD scripts directory
│       ├── setup-github-secrets.sh     # GitHub secrets setup (gh CLI)
│       ├── setup-gitlab-variables.sh   # GitLab variables setup (glab CLI)
│       ├── encrypt-secrets.sh          # Encrypt root .env → .env.gpg
│       ├── decrypt-secrets.sh          # Decrypt root .env.gpg → .env
│       ├── pulumi-setup.sh             # Pulumi backend configuration
│       ├── gitlab-ci.yml               # GitLab CI/CD template
│       ├── github-deploy.yml           # GitHub Actions deploy template
│       ├── github-destroy.yml          # GitHub Actions destroy template
│       ├── taskfile-snippets.yaml      # Source for infra/Taskfile.yaml (do NOT paste into root Taskfile.yml)
│       └── README.md                   # This file
├── .env                            # Secrets (never commit!)
├── .env.gpg                        # Encrypted secrets (commit this)
├── .gitlab-ci.yml                  # Copied from infra/scripts/gitlab-ci.yml
├── .github/
│   └── workflows/
│       ├── deploy.yml              # Copied from infra/scripts/github-deploy.yml
│       └── destroy.yml             # Copied from infra/scripts/github-destroy.yml
└── Taskfile.yml                    # Root Taskfile — ONLY add includes entry for infra/Taskfile.yaml
```

## Scripts Overview

### Secrets Management

#### `encrypt-secrets.sh`
Encrypts `../../.env` to `../../.env.gpg` using GPG for GitHub Actions.

**Usage:**
```bash
cd infra/scripts
./encrypt-secrets.sh
# Or from root: task encrypt-secrets
```

#### `decrypt-secrets.sh`
Decrypts `../../.env.gpg` to `../../.env` for local development.

**Usage:**
```bash
cd infra/scripts
./decrypt-secrets.sh
# Or from root: task decrypt-secrets
```

#### `setup-github-secrets.sh`
Interactive setup of GitHub repository secrets using `gh` CLI.

**Usage:**
```bash
cd infra/scripts
./setup-github-secrets.sh
# Or from root: task setup-github-secrets
```

**Prerequisites:**
- GitHub CLI installed: `brew install gh`
- Authenticated: `gh auth login`

#### `setup-gitlab-variables.sh`
Interactive setup of GitLab project variables using `glab` CLI.

**Usage:**
```bash
cd infra/scripts
./setup-gitlab-variables.sh
# Or from root: task setup-gitlab-vars
```

**Prerequisites:**
- GitLab CLI installed: `brew install glab`
- Authenticated: `glab auth login`

### Infrastructure Setup

#### `pulumi-setup.sh`
Interactive Pulumi backend configuration with support for:
- Pulumi Cloud
- Azure Blob Storage
- AWS S3
- Google Cloud Storage

**Usage:**
```bash
cd infra/scripts
./pulumi-setup.sh
```

### CI/CD Configuration Templates

#### `gitlab-ci.yml`
Complete GitLab CI/CD pipeline template with:
- Automated linting and testing
- Manual review app deployments
- Continuous delivery on merge to main
- Pulumi DIY backend support

**Setup:**
```bash
cp infra/scripts/gitlab-ci.yml .gitlab-ci.yml
```

#### `github-deploy.yml`
GitHub Actions deployment workflow with:
- Automated testing and linting
- PR-based review deployments
- GPG-encrypted secrets support
- PR comments with deployment URLs

**Setup:**
```bash
mkdir -p .github/workflows
cp infra/scripts/github-deploy.yml .github/workflows/deploy.yml
```

#### `github-destroy.yml`
GitHub Actions workflow for manual stack cleanup.

**Setup:**
```bash
cp infra/scripts/github-destroy.yml .github/workflows/destroy.yml
```

### Taskfile Integration

#### `taskfile-snippets.yaml`
Contains Task definitions to copy to `infra/Taskfile.yaml`.

> ⚠️ **Do NOT paste these tasks into the root `Taskfile.yml`.** Instead:
> 1. Copy this file: `cp infra/scripts/taskfile-snippets.yaml infra/Taskfile.yaml`
> 2. Add a single `includes` entry to the root `Taskfile.yml`:
>    ```yaml
>    includes:
>      infra:
>        taskfile: ./infra/Taskfile.yaml
>        dir: .
>    ```
> 3. Run tasks as: `task infra:encrypt-secrets`, `task infra:setup-github-secrets`, etc.

## Quick Start

### For GitLab

1. **Setup infrastructure:**
   ```bash
   cp infra/scripts/gitlab-ci.yml .gitlab-ci.yml
   ```

2. **Configure secrets:**
   ```bash
   task setup-gitlab-vars
   ```

3. **Push and test:**
   ```bash
   git add .gitlab-ci.yml
   git commit -m "Add GitLab CI/CD"
   git push
   ```

### For GitHub

1. **Setup infrastructure:**
   ```bash
   mkdir -p .github/workflows
   cp infra/scripts/github-deploy.yml .github/workflows/deploy.yml
   cp infra/scripts/github-destroy.yml .github/workflows/destroy.yml
   ```

2. **Encrypt secrets:**
   ```bash
   task encrypt-secrets
   git add .env.gpg
   ```

3. **Configure GitHub secrets:**
   ```bash
   task setup-github-secrets
   ```

4. **Push and test:**
   ```bash
   git add .github/ .env.gpg
   git commit -m "Add GitHub Actions CI/CD"
   git push
   ```

## File Locations

- **Secrets**: `.env` and `.env.gpg` are in the **project root**, not in `infra/`
- **Scripts**: All scripts are in `infra/scripts/` directory
- **CI/CD configs**: Copied from `infra/scripts/` to their standard locations (`.gitlab-ci.yml`, `.github/workflows/`)
- **Taskfile**: `infra/Taskfile.yaml` contains all CI/CD tasks. Root `Taskfile.yml` includes it via `includes: {infra: {taskfile: ./infra/Taskfile.yaml}}`

## Security Notes

- **Never commit `.env`** - Add to `.gitignore`
- **Do commit `.env.gpg`** - It's encrypted and safe
- **Store GPG passphrase** in GitHub Secrets as `CICD_SECRET_PASSPHRASE`
- **Mark GitLab variables** as "Masked" to hide in logs
- **Rotate credentials** regularly

## Troubleshooting

### Scripts won't run
```bash
chmod +x infra/scripts/*.sh
```

### Can't find .env
Make sure `.env` is in the project root, not in `infra/`

### GPG decryption fails
Ensure you're using the same passphrase used for encryption

### gh/glab commands fail
Make sure you're authenticated:
```bash
gh auth login    # GitHub
glab auth login  # GitLab
```

## Resources

- [DataRobot CI/CD Skill Documentation](../SKILL.md)
- [Task Documentation](https://taskfile.dev)
- [Pulumi Documentation](https://www.pulumi.com/docs/)
- [GitHub Actions](https://docs.github.com/actions)
- [GitLab CI/CD](https://docs.gitlab.com/ci/)

#!/usr/bin/env bash
# Copyright (c) 2026 DataRobot, Inc. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Pulumi setup script for DataRobot Application Templates
# This script helps initialize Pulumi with different backend options

set -euo pipefail

# Resolve the repo root (script lives at repo_root/infra/scripts/)
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
DOTENV="$REPO_ROOT/.env"

echo "🎯 DataRobot Application Template - Pulumi Setup"
echo "=================================================="
echo ""

# Detect existing stacks on a different backend and offer to migrate them.
# Must be called AFTER exporting any required cloud credentials to the environment
# but BEFORE calling `pulumi login` for the new backend.
migrate_stacks_if_needed() {
    local target_backend_url="$1"

    # Get the current backend URL from `pulumi whoami --verbose`
    local current_backend
    current_backend=$(pulumi whoami --verbose 2>/dev/null | grep "Backend URL:" | awk '{print $3}' || true)

    # Nothing to do if Pulumi isn't logged in or backend is already the target
    [[ -z "$current_backend" || "$current_backend" == "$target_backend_url" ]] && return 0

    # Collect Pulumi.<stackname>.yaml stack config files (skip the root Pulumi.yaml)
    local stack_files=()
    while IFS= read -r -d '' f; do
        stack_files+=("$f")
    done < <(find . -maxdepth 1 -name "Pulumi.*.yaml" -not -name "Pulumi.yaml" -print0 2>/dev/null)

    # No local stacks — nothing to migrate
    [[ ${#stack_files[@]} -eq 0 ]] && return 0

    echo ""
    echo "⚠️  Existing Pulumi stacks detected on a different backend"
    echo "   Current backend : $current_backend"
    echo "   Target backend  : $target_backend_url"
    echo ""
    echo "   Stacks found:"
    for f in "${stack_files[@]}"; do
        local sname
        sname=$(basename "$f" .yaml | sed 's/^Pulumi\.//')
        echo "     - $sname"
    done
    echo ""
    read -rp "Migrate these stacks to the new backend? [y/N]: " MIGRATE_CHOICE

    if [[ "$MIGRATE_CHOICE" != "y" && "$MIGRATE_CHOICE" != "Y" ]]; then
        echo "⏭️  Skipping stack migration"
        return 0
    fi

    # Export all stacks while still logged into the old backend
    local tmpdir
    tmpdir=$(mktemp -d)
    local stack_names=()

    for f in "${stack_files[@]}"; do
        local stack_name
        stack_name=$(basename "$f" .yaml | sed 's/^Pulumi\.//')
        stack_names+=("$stack_name")
        echo "   📤 Exporting stack '$stack_name' from $current_backend..."
        pulumi stack export --stack "$stack_name" --file "$tmpdir/$stack_name.json"
    done

    # Login to the new backend (cloud credentials must already be in the environment)
    pulumi login "$target_backend_url"

    # Import each stack into the new backend
    for stack_name in "${stack_names[@]}"; do
        echo "   📥 Importing stack '$stack_name' into $target_backend_url..."
        pulumi stack select --create "$stack_name"
        pulumi stack import --file "$tmpdir/$stack_name.json"
        echo "   ✅ Migrated stack: $stack_name"
    done

    rm -rf "$tmpdir"
    echo ""
    echo "✅ Stack migration complete"
}

# Function to setup Pulumi Cloud backend
setup_pulumi_cloud() {
    echo ""
    echo "🌐 Setting up Pulumi Cloud backend"
    echo "-----------------------------------"
    echo "1. Go to https://app.pulumi.com/account/tokens"
    echo "2. Create a new access token"
    echo "3. Enter the token below"
    echo ""
    local token_hint=""
    [[ -n "${PULUMI_ACCESS_TOKEN:-}" ]] && token_hint=" [already set, press Enter to keep]"
    read -rsp "Pulumi Access Token${token_hint}: " PULUMI_TOKEN
    echo ""
    PULUMI_TOKEN="${PULUMI_TOKEN:-${PULUMI_ACCESS_TOKEN:-}}"

    export PULUMI_ACCESS_TOKEN="$PULUMI_TOKEN"
    migrate_stacks_if_needed "https://api.pulumi.com"
    pulumi login
    echo "✅ Logged in to Pulumi Cloud"
}

# Function to setup Azure Blob backend
setup_azure_backend() {
    echo ""
    echo "☁️  Setting up Azure Blob Storage backend"
    echo "----------------------------------------"
    local acct_default="${AZURE_STORAGE_ACCOUNT:-}"
    local acct_hint=""
    [[ -n "$acct_default" ]] && acct_hint=" [$acct_default]"
    read -rp "Azure Storage Account${acct_hint}: " AZURE_ACCOUNT
    AZURE_ACCOUNT="${AZURE_ACCOUNT:-$acct_default}"

    read -rp "Azure Container Name: " AZURE_CONTAINER

    local key_hint=""
    [[ -n "${AZURE_STORAGE_KEY:-}" ]] && key_hint=" [already set, press Enter to keep]"
    read -rsp "Azure Storage Key${key_hint}: " AZURE_KEY
    echo ""
    AZURE_KEY="${AZURE_KEY:-${AZURE_STORAGE_KEY:-}}"

    export AZURE_STORAGE_ACCOUNT="$AZURE_ACCOUNT"
    export AZURE_STORAGE_KEY="$AZURE_KEY"

    migrate_stacks_if_needed "azblob://$AZURE_CONTAINER"
    pulumi login "azblob://$AZURE_CONTAINER"
    echo "✅ Logged in to Azure Blob backend"

    # Add to .env if it exists
    if [[ -f "$DOTENV" ]]; then
        echo "AZURE_STORAGE_ACCOUNT=$AZURE_ACCOUNT" >> "$DOTENV"
        echo "AZURE_STORAGE_KEY=$AZURE_KEY" >> "$DOTENV"
        echo "📝 Added Azure credentials to $DOTENV"
    fi
}

# Function to setup AWS S3 backend
setup_s3_backend() {
    echo ""
    echo "☁️  Setting up AWS S3 backend"
    echo "----------------------------"
    read -rp "S3 Bucket Name: " S3_BUCKET

    local aws_key_default="${AWS_ACCESS_KEY_ID:-}"
    local aws_key_hint=""
    [[ -n "$aws_key_default" ]] && aws_key_hint=" [$aws_key_default]"
    read -rp "AWS Access Key ID${aws_key_hint}: " AWS_KEY_ID
    AWS_KEY_ID="${AWS_KEY_ID:-$aws_key_default}"

    local aws_secret_hint=""
    [[ -n "${AWS_SECRET_ACCESS_KEY:-}" ]] && aws_secret_hint=" [already set, press Enter to keep]"
    read -rsp "AWS Secret Access Key${aws_secret_hint}: " AWS_SECRET
    echo ""
    AWS_SECRET="${AWS_SECRET:-${AWS_SECRET_ACCESS_KEY:-}}"

    export AWS_ACCESS_KEY_ID="$AWS_KEY_ID"
    export AWS_SECRET_ACCESS_KEY="$AWS_SECRET"

    migrate_stacks_if_needed "s3://$S3_BUCKET"
    pulumi login "s3://$S3_BUCKET"
    echo "✅ Logged in to S3 backend"

    # Add to .env if it exists
    if [[ -f "$DOTENV" ]]; then
        echo "AWS_ACCESS_KEY_ID=$AWS_KEY_ID" >> "$DOTENV"
        echo "AWS_SECRET_ACCESS_KEY=$AWS_SECRET" >> "$DOTENV"
        echo "📝 Added AWS credentials to $DOTENV"
    fi
}

# Function to create initial stack
create_stack() {
    echo ""
    echo "📚 Creating Pulumi stack"
    echo "------------------------"

    # List stacks already in the current backend
    local existing_stacks
    existing_stacks=$(pulumi stack ls --json 2>/dev/null \
        | python3 -c "import sys,json; [print(s['name']) for s in json.load(sys.stdin)]" 2>/dev/null \
        || true)

    if [[ -n "$existing_stacks" ]]; then
        echo "Existing stacks in current backend:"
        while IFS= read -r s; do
            echo "  - $s"
        done <<< "$existing_stacks"
        echo ""
    fi

    read -rp "Stack name (e.g., dev, staging, prod): " STACK_NAME

    # If the name already exists in the current backend, offer to just select it
    if echo "$existing_stacks" | grep -qx "$STACK_NAME" 2>/dev/null; then
        echo ""
        echo "✅ Stack '$STACK_NAME' found in the current backend"
        read -rp "Select and use it? [Y/n]: " USE_EXISTING
        if [[ "$USE_EXISTING" != "n" && "$USE_EXISTING" != "N" ]]; then
            pulumi stack select "$STACK_NAME"
            echo "✅ Selected existing stack: $STACK_NAME"
            return 0
        fi
    fi

    # Check for a local Pulumi.<name>.yaml that doesn't exist in the current backend yet
    local stack_config="Pulumi.${STACK_NAME}.yaml"
    if [[ -f "$stack_config" ]] && ! echo "$existing_stacks" | grep -qx "$STACK_NAME" 2>/dev/null; then
        echo ""
        echo "📄 Found local stack config '$stack_config' but no matching stack in the current backend"
        read -rp "Import an exported stack state file into the current backend? [y/N]: " IMPORT_CHOICE
        if [[ "$IMPORT_CHOICE" == "y" || "$IMPORT_CHOICE" == "Y" ]]; then
            read -rp "Path to exported state JSON file: " STATE_FILE
            if [[ -n "$STATE_FILE" && -f "$STATE_FILE" ]]; then
                pulumi stack select --create "$STACK_NAME"
                pulumi stack import --file "$STATE_FILE"
                echo "✅ Imported stack '$STACK_NAME' into current backend"
                return 0
            else
                echo "⚠️  State file not found — creating a fresh stack instead"
            fi
        fi
    fi

    pulumi stack select --create "$STACK_NAME"
    echo "✅ Created and selected stack: $STACK_NAME"

    echo ""
    echo "📋 Available commands:"
    echo "  pulumi up          - Deploy the stack"
    echo "  pulumi destroy     - Destroy the stack"
    echo "  pulumi stack ls    - List all stacks"
    echo "  pulumi stack output - View stack outputs"
}

# Configure CI/CD secrets and variables by running the appropriate setup script.
setup_cicd() {
    echo ""
    echo "🔐 Configure CI/CD secrets and variables"
    echo "-----------------------------------------"
    echo "1) GitHub Actions"
    echo "2) GitLab CI/CD"
    echo "3) Skip"
    read -rp "Selection [1-3]: " CICD_CHOICE

    case $CICD_CHOICE in
        1)
            bash "$SCRIPT_DIR/setup-github-secrets.sh"
            ;;
        2)
            bash "$SCRIPT_DIR/setup-gitlab-variables.sh"
            ;;
        3)
            echo "⏭️  Skipping — run setup-github-secrets.sh or setup-gitlab-variables.sh manually"
            ;;
        *)
            echo "❌ Invalid selection"
            ;;
    esac
}

# Main setup flow
main() {
    # Source .env so existing vars are available as defaults throughout setup
    if [[ -f "$DOTENV" ]]; then
        set -a
        # shellcheck source=/dev/null
        source "$DOTENV"
        set +a
    fi

    if ! command -v pulumi &> /dev/null; then
        echo "❌ Pulumi is not installed. Install it from https://www.pulumi.com/docs/install/ and re-run this script."
        exit 1
    fi

    echo ""
    echo "🔧 Choose Pulumi backend:"
    echo "1) Pulumi Cloud (recommended)"
    echo "2) Azure Blob Storage"
    echo "3) AWS S3"
    echo "4) Skip (already configured)"
    read -rp "Selection [1-4]: " BACKEND_CHOICE

    case $BACKEND_CHOICE in
        1)
            setup_pulumi_cloud
            ;;
        2)
            setup_azure_backend
            ;;
        3)
            setup_s3_backend
            ;;
        4)
            echo "⏭️  Skipping backend setup"
            ;;
        *)
            echo "❌ Invalid selection"
            exit 1
            ;;
    esac

    create_stack
    setup_cicd

    echo ""
    echo "🎉 Pulumi setup complete!"
    echo ""
    echo "Next steps:"
    echo "1. Run 'pulumi up' to deploy your application"
    echo "2. Push .env.gpg and your CI/CD workflow files to trigger your first pipeline"
}

# Run main function
main

#!/usr/bin/env bash
# Copyright (c) 2026 DataRobot, Inc. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Add secrets to GitHub repository using GitHub CLI
# Requires: gh CLI (https://cli.github.com/)

set -euo pipefail

echo "🔐 GitHub Secrets Setup"
echo "======================="
echo ""

# Check if gh is installed
if ! command -v gh &> /dev/null; then
    echo "❌ GitHub CLI (gh) not installed"
    echo ""
    echo "Install with:"
    echo "  macOS:   brew install gh"
    echo "  Linux:   See https://github.com/cli/cli#installation"
    echo ""
    exit 1
fi

# Check if authenticated
if ! gh auth status &> /dev/null; then
    echo "❌ Not authenticated with GitHub CLI"
    echo "Run: gh auth login"
    exit 1
fi

echo "✅ GitHub CLI authenticated"
echo ""

# Get repository (or use current)
REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner 2>/dev/null || echo "")
if [ -z "$REPO" ]; then
    read -rp "Enter repository (owner/repo): " REPO
fi

echo "Repository: $REPO"
echo ""

# Function to add a secret (masked)
add_secret() {
    local secret_name=$1
    local secret_description=$2
    local secret_value=""

    echo "📝 Setting up secret: $secret_name"
    echo "   $secret_description"

    read -rsp "   Enter value: " secret_value
    echo ""

    if [ -n "$secret_value" ]; then
        echo "$secret_value" | gh secret set "$secret_name" --repo "$REPO"
        echo "   ✅ Added $secret_name"
    else
        echo "   ⏭️  Skipped (empty value)"
    fi
    echo ""
}

# Function to add a plain (non-secret) Actions variable
add_variable() {
    local var_name=$1
    local var_description=$2
    local default_value=${3:-}
    local var_value=""

    echo "📝 Setting up variable: $var_name"
    echo "   $var_description"
    if [ -n "$default_value" ]; then
        read -rp "   Enter value [$default_value]: " var_value
        var_value="${var_value:-$default_value}"
    else
        read -rp "   Enter value: " var_value
    fi

    if [ -n "$var_value" ]; then
        gh variable set "$var_name" --body "$var_value" --repo "$REPO"
        echo "   ✅ Set $var_name=$var_value"
    else
        echo "   ⏭️  Skipped (empty value)"
    fi
    echo ""
}

# Add secrets
echo "─── Secrets (encrypted) ────────────────────────────────────────────────"
echo "This setup requires ONE secret."
echo "All other credentials (DATAROBOT_API_TOKEN, PULUMI_ACCESS_TOKEN, LLM keys, etc.)"
echo "are stored encrypted in .env.gpg and loaded automatically by the workflow."
echo ""

add_secret "CICD_SECRET_PASSPHRASE" "GPG passphrase for decrypting .env.gpg"

# Add plain CI/CD variables (not sensitive — visible in logs)
echo "─── Variables (plain text) ─────────────────────────────────────────────"
echo "Pulumi stack names are not secrets — they are plain Actions variables."
echo ""

add_variable "PULUMI_STACK_CI_NAME" \
    "Pulumi stack deployed on every merge to the default branch" \
    "ci"
add_variable "PULUMI_STACK_REVIEW_NAME" \
    "Pulumi stack name prefix for PR review apps (PR number appended automatically in the workflow)" \
    "review"

echo ""
echo "🎉 Secrets and variables setup complete!"
echo ""
echo "View all secrets:  gh secret list --repo $REPO"
echo "View all variables: gh variable list --repo $REPO"
echo ""
echo "Next steps:"
echo "1. Ensure your .env.gpg is committed to the repository"
echo "2. Push your .github/workflows to trigger actions"
echo "3. Test with a pull request"

#!/usr/bin/env bash
# Copyright (c) 2026 DataRobot, Inc. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Add variables to GitLab project using GitLab CLI
# Requires: glab CLI (https://gitlab.com/gitlab-org/cli)

set -euo pipefail

echo "🔐 GitLab CI/CD Variables Setup"
echo "================================"
echo ""

# Check if glab is installed
if ! command -v glab &> /dev/null; then
    echo "❌ GitLab CLI (glab) not installed"
    echo ""
    echo "Install with:"
    echo "  macOS:   brew install glab"
    echo "  Linux:   See https://gitlab.com/gitlab-org/cli#installation"
    echo ""
    exit 1
fi

# Check if authenticated
if ! glab auth status &> /dev/null; then
    echo "❌ Not authenticated with GitLab CLI"
    echo "Run: glab auth login"
    exit 1
fi

echo "✅ GitLab CLI authenticated"
echo ""

# Get project (or use current)
PROJECT=$(glab repo view --output json 2>/dev/null | jq -r '.path_with_namespace' || echo "")
if [ -z "$PROJECT" ]; then
    read -rp "Enter project (group/project): " PROJECT
fi

echo "Project: $PROJECT"
echo ""

# Function to add a variable
add_variable() {
    local var_name=$1
    local var_description=$2
    local var_value=""
    local mask_flag="--masked"  # Mask by default for security

    echo "📝 Setting up: $var_name"
    echo "   $var_description"

    read -rsp "   Enter value: " var_value
    echo ""

    if [ -n "$var_value" ]; then
        # GitLab CLI command to set variable
        glab variable set "$var_name" "$var_value" --scope="*" $mask_flag --repo "$PROJECT" 2>/dev/null || \
        glab variable update "$var_name" "$var_value" --scope="*" $mask_flag --repo "$PROJECT" 2>/dev/null
        echo "   ✅ Added $var_name"
    else
        echo "   ⏭️  Skipped (empty value)"
    fi
    echo ""
}

# Function to add a plain (non-masked) variable
add_plain_variable() {
    local var_name=$1
    local var_description=$2
    local default_value=${3:-}
    local var_value=""

    echo "📝 Setting up variable: $var_name"
    echo "   $var_description"
    if [ -n "$default_value" ]; then
        read -rp "   Enter value [$default_value]: " var_value
        var_value="${var_value:-$default_value}"
    else
        read -rp "   Enter value: " var_value
    fi

    if [ -n "$var_value" ]; then
        glab variable set "$var_name" "$var_value" --scope="*" --repo "$PROJECT" 2>/dev/null || \
        glab variable update "$var_name" "$var_value" --scope="*" --repo "$PROJECT" 2>/dev/null
        echo "   ✅ Set $var_name=$var_value"
    else
        echo "   ⏭️  Skipped (empty value)"
    fi
    echo ""
}

# Add variables
echo "─── Masked variables (secrets) ─────────────────────────────────────────"
echo "This setup requires ONE masked CI/CD variable for the GPG passphrase."
echo "All other credentials (DATAROBOT_API_TOKEN, PULUMI_ACCESS_TOKEN, LLM keys, etc.)"
echo "are stored encrypted in .env.gpg and loaded automatically by the pipeline."
echo ""

# Core variable: the GPG passphrase to decrypt .env.gpg
add_variable "CICD_SECRET_PASSPHRASE" "GPG passphrase for decrypting .env.gpg"

# GitLab API token for commenting on MRs (not in .env since it's GitLab-specific)
echo ""
echo "📝 GitLab API Token for MR comments"
echo "   Create at: https://gitlab.com/-/profile/personal_access_tokens"
echo "   Required scopes: api"
add_variable "GITLAB_API_TOKEN" "GitLab personal access token (for posting MR comments)"

# Add plain (non-masked) Pulumi stack name variables
echo ""
echo "─── Plain variables (not sensitive) ────────────────────────────────────"
echo "Pulumi stack names are not secrets — they are plain CI/CD variables."
echo ""

add_plain_variable "PULUMI_STACK_CI_NAME" \
    "Pulumi stack deployed on every merge to the default branch" \
    "ci"
add_plain_variable "PULUMI_STACK_REVIEW_NAME" \
    "Pulumi stack name prefix for MR review apps (MR IID appended automatically in the pipeline)" \
    "review"

echo ""
echo "🎉 Variables setup complete!"
echo ""
echo "View all variables:  glab variable list --repo $PROJECT"
echo "Manage in UI:        https://gitlab.com/$PROJECT/-/settings/ci_cd#js-cicd-variables-settings"
echo ""
echo "Next steps:"
echo "1. Ensure your .env.gpg is committed to the repository"
echo "2. Push your .gitlab-ci.yml to trigger pipelines"
echo "3. Test with a merge request"

---
# Taskfile snippets for CI/CD
# ⚠️  COPY THIS FILE TO infra/Taskfile.yaml — do NOT paste tasks into the root Taskfile.yml
#
# Step 1: cp infra/scripts/taskfile-snippets.yaml infra/Taskfile.yaml
# Step 2: Add this includes block to root Taskfile.yml (the ONLY change to root):
#
#   includes:
#     infra:
#       taskfile: ./infra/Taskfile.yaml
#       dir: ./infra
#
# Tasks are then run as: task infra:encrypt-secrets, task infra:setup-github-secrets, etc.
# Scripts referenced here are in infra/scripts/ and .env is assumed to be in project root (../../.env)

version: '3'

tasks:

  # ===========================================================================
  # Secrets Management Tasks
  # ===========================================================================

  encrypt-secrets:
    desc: 🔒 Encrypt .env file for GitHub Actions
    dir: scripts
    cmds:
      - ./encrypt-secrets.sh
    preconditions:
      - test -f ../../.env

  decrypt-secrets:
    desc: 🔓 Decrypt .env.gpg file for local use
    dir: scripts
    cmds:
      - ./decrypt-secrets.sh
    preconditions:
      - test -f ../../.env.gpg

  verify-secrets:
    desc: 🔍 Verify .env file has required variables
    cmds:
      - |
        REQUIRED_VARS="DATAROBOT_API_TOKEN DATAROBOT_ENDPOINT"
        MISSING=""
        for var in $REQUIRED_VARS; do
          if ! grep -q "^${var}=" ../.env 2>/dev/null; then
            MISSING="$MISSING $var"
          fi
        done
        if [ -n "$MISSING" ]; then
          echo "❌ Missing required variables:$MISSING"
          exit 1
        fi
        echo "✅ All required variables present"

  setup-github-secrets:
    desc: 🔐 Setup GitHub secrets interactively
    dir: scripts
    cmds:
      - ./setup-github-secrets.sh

  setup-gitlab-vars:
    desc: 🔐 Setup GitLab variables interactively
    dir: scripts
    cmds:
      - ./setup-gitlab-variables.sh

  # ===========================================================================
  # CI/CD Deployment Tasks
  # ===========================================================================

  pulumi-login-cloud:
    desc: 🌐 Login to Pulumi Cloud
    cmds:
      - pulumi login
    preconditions:
      - sh: command -v pulumi
        msg: "Pulumi not installed. Run: curl -fsSL https://get.pulumi.com | sh"

  pulumi-login-azure:
    desc: ☁️  Login to Azure Blob backend
    cmds:
      - pulumi login azblob://{{.CONTAINER}}
    vars:
      CONTAINER: '{{.CONTAINER | default "pulumi-state"}}'
    preconditions:
      - sh: command -v pulumi
        msg: "Pulumi not installed"
      - sh: test -n "$AZURE_STORAGE_ACCOUNT"
        msg: "AZURE_STORAGE_ACCOUNT not set"
      - sh: test -n "$AZURE_STORAGE_KEY"
        msg: "AZURE_STORAGE_KEY not set"

  pulumi-login-s3:
    desc: ☁️  Login to S3 backend
    cmds:
      - pulumi login s3://{{.BUCKET}}
    vars:
      BUCKET: '{{.BUCKET | default "pulumi-state"}}'
    preconditions:
      - sh: command -v pulumi
        msg: "Pulumi not installed"
      - sh: test -n "$AWS_ACCESS_KEY_ID"
        msg: "AWS_ACCESS_KEY_ID not set"

  pulumi-stack-create:
    desc: 📚 Create new Pulumi stack
    cmds:
      - pulumi stack select --create {{.STACK}}
    vars:
      STACK: '{{.STACK | default "dev"}}'
    preconditions:
      - sh: command -v pulumi
        msg: "Pulumi not installed"

  pulumi-deploy:
    desc: 🚀 Deploy with Pulumi
    cmds:
      - source .venv/bin/activate && pulumi up {{.FLAGS}}
    vars:
      FLAGS: '{{.FLAGS | default "--yes"}}'
    preconditions:
      - test -d .venv
      - sh: command -v pulumi
        msg: "Pulumi not installed"

  pulumi-destroy:
    desc: 🗑️  Destroy Pulumi stack
    cmds:
      - source .venv/bin/activate && pulumi destroy {{.FLAGS}}
    vars:
      FLAGS: '{{.FLAGS | default "--yes"}}'
    preconditions:
      - test -d .venv
      - sh: command -v pulumi
        msg: "Pulumi not installed"

  pulumi-output:
    desc: 📋 Show Pulumi stack outputs
    cmds:
      - pulumi stack output {{.FORMAT}}
    vars:
      FORMAT: '{{.FORMAT | default "--json"}}'

  # ===========================================================================
  # CI/CD Workflow Testing
  # ===========================================================================

  ci-test-local:
    desc: 🧪 Test CI pipeline locally
    cmds:
      - task: lint-check
      - task: test
      - echo "✅ CI checks passed"

  ci-simulate-deploy:
    desc: 🎭 Simulate GitHub Actions deployment locally
    cmds:
      - task: decrypt-secrets
      - task: install
      - task: ci-test-local
      - task: pulumi-deploy
      - echo "✅ Deployment simulation complete"

# =============================================================================
# Usage Examples
# =============================================================================
#
# Secrets management:
#   task infra:encrypt-secrets              # Encrypt .env for GitHub
#   task infra:decrypt-secrets              # Decrypt for local use
#   task infra:verify-secrets               # Check required vars
#
# Pulumi operations:
#   task infra:pulumi-login-cloud           # Login to Pulumi Cloud
#   task infra:pulumi-login-azure           # Login to Azure backend
#   task infra:pulumi-stack-create STACK=dev        # Create new stack
#   task infra:pulumi-deploy                # Deploy current stack
#   task infra:pulumi-deploy FLAGS="--preview-only" # Preview changes
#   task infra:pulumi-destroy               # Destroy current stack
#   task infra:pulumi-output                # Show outputs
#
# Testing CI/CD:
#   task infra:ci-test-local                # Run all CI checks
#   task infra:ci-simulate-deploy           # Simulate full deployment