speckle-server/.circleci/config.yml

version: 2.1

orbs:
  snyk: snyk/snyk@2.0.3
  codecov: codecov/codecov@5.0.3

aliases:
  - &docker-base-image
    docker:
      - image: cimg/base:2024.02

  - &docker-node-image
    docker:
      - image: cimg/node:22.6.0

  - &docker-node-image-w-browsers
    docker:
      - image: cimg/node:22.6.0-browsers

  - &yarn
    run:
      name: Install Dependencies
      command: YARN_ENABLE_HARDENED_MODE=0 PUPPETEER_SKIP_DOWNLOAD=true PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 yarn

  - &filters-allow-all
    tags:
      # run tests for any commit on any branch, including any tags
      only: /.*/

  - &ignored
    branches:
      ignore: /.*/
    tags:
      ignore: /.*/

  - &branches-special
    - main
    - /^hotfix.*$/
    - /^testing\d*$/

workflows:
  test-build:
    jobs:
      - vulnerability-scan:
          context:
            - snyk
          filters:
            branches:
              only:
                - main
                - hotfix*

      - get-version:
          filters: *filters-allow-all

      - docker-build-postgres-container:
          context: &build-context
            - github-readonly-public-repos
            - docker-hub
          filters: *filters-allow-all
          requires:
            - get-version

      - test-server-multiregion:
          context:
            - speckle-server-licensing
            - stripe-integration
            - speckle-server-codecov
          filters: *filters-allow-all
          requires:
            - docker-build-postgres-container

      - test-server:
          context:
            - speckle-server-licensing
            - stripe-integration
            - speckle-server-codecov
          filters: *ignored
          requires:
            - docker-build-postgres-container

      - test-server-no-ff:
          filters: *ignored
          requires:
            - docker-build-postgres-container

      - test-frontend-2:
          filters: *ignored

      - test-viewer:
          filters: *ignored

      - test-objectsender:
          filters: *ignored

      - test-shared:
          filters: *ignored

      - test-preview-service:
          filters: *ignored

      - test-ui-components:
          filters: *ignored

      - ui-components-chromatic:
          context:
            - chromatic-ui-components
          filters: *ignored

      - deployment-testing-approval:
          type: approval
          filters: *ignored

      #FIXME uncomment when nix https://search.nixos.org/packages?channel=24.05&show=tilt&from=0&size=50&sort=relevance&type=packages&query=tilt supports tilt >v0.33.12 which includes docker compose up --wait flag
      # - deployment-test-docker-compose:
      #     filters: &filters-deployment-testing
      #       tags:
      #         # run tests for any commit on any branch, including any tags
      #         only: /.*/
      #     requires:
      #       - get-version
      #       - deployment-testing-approval
      #       - docker-build-server
      #       - docker-build-frontend
      #       - docker-build-frontend-2
      #       - docker-build-previews
      #       - docker-build-webhooks
      #       - docker-build-file-imports
      #       - docker-build-test-container
      #       - docker-build-monitor-container
      #       - docker-build-docker-compose-ingress

      - deployment-test-helm-chart:
          filters: *ignored
          requires:
            - get-version
            - deployment-testing-approval
            - docker-build-server
            - docker-build-frontend-2
            - docker-build-previews
            - docker-build-webhooks
            - docker-build-file-imports
            - docker-build-test-container
            - docker-build-monitor-container

      - pre-commit:
          filters: *ignored

      - lint-and-prettier:
          filters: *ignored

      - docker-build-server:
          context: *build-context
          filters: *ignored
          requires:
            - get-version

      - docker-build-frontend-2:
          context: *build-context
          filters: *ignored
          requires:
            - get-version

      - docker-build-webhooks:
          context: *build-context
          filters: *ignored
          requires:
            - get-version

      - docker-build-file-imports:
          context: *build-context
          filters: *ignored
          requires:
            - get-version

      - docker-build-previews:
          context: *build-context
          filters: *ignored
          requires:
            - get-version

      - docker-build-test-container:
          context: *build-context
          filters: *ignored
          requires:
            - get-version

      - docker-build-monitor-container:
          context: *build-context
          filters: *ignored
          requires:
            - get-version

      - docker-build-docker-compose-ingress:
          context: *build-context
          filters: *ignored
          requires:
            - get-version

      - docker-publish-server:
          context: &docker-hub-context
            - docker-hub
          filters: *ignored
          requires:
            - docker-build-server
            - get-version
            - pre-commit
            - lint-and-prettier
            - test-frontend-2
            - test-viewer
            - test-objectsender
            - test-shared
            - test-server
            - test-server-no-ff
            - test-server-multiregion
            - test-preview-service

      - docker-publish-frontend-2:
          context: *docker-hub-context
          filters: *ignored
          requires:
            - docker-build-frontend-2
            - get-version
            - pre-commit
            - lint-and-prettier
            - test-frontend-2
            - test-viewer
            - test-objectsender
            - test-shared
            - test-server
            - test-server-no-ff
            - test-server-multiregion
            - test-preview-service

      - docker-publish-frontend-2-sourcemaps:
          context:
            - github-readonly-public-repos
            - datadog-sourcemaps-publish
          filters: *ignored
          requires:
            - get-version

      - docker-publish-webhooks:
          context: *docker-hub-context
          filters: *ignored
          requires:
            - docker-build-webhooks
            - get-version
            - pre-commit
            - lint-and-prettier
            - test-frontend-2
            - test-viewer
            - test-objectsender
            - test-shared
            - test-server
            - test-server-no-ff
            - test-server-multiregion
            - test-preview-service

      - docker-publish-file-imports:
          context: *docker-hub-context
          filters: *ignored
          requires:
            - docker-build-file-imports
            - get-version
            - pre-commit
            - lint-and-prettier
            - test-frontend-2
            - test-viewer
            - test-objectsender
            - test-shared
            - test-server
            - test-server-no-ff
            - test-server-multiregion
            - test-preview-service

      - docker-publish-previews:
          context: *docker-hub-context
          filters: *ignored
          requires:
            - docker-build-previews
            - get-version
            - pre-commit
            - lint-and-prettier
            - test-frontend-2
            - test-viewer
            - test-objectsender
            - test-shared
            - test-server
            - test-server-no-ff
            - test-server-multiregion
            - test-preview-service

      - docker-publish-test-container:
          context: *docker-hub-context
          filters: *ignored
          requires:
            - docker-build-test-container
            - get-version
            - pre-commit
            - lint-and-prettier
            - test-frontend-2
            - test-viewer
            - test-objectsender
            - test-shared
            - test-server
            - test-server-no-ff
            - test-server-multiregion
            - test-preview-service

      - docker-publish-postgres-container:
          context: *docker-hub-context
          filters: *ignored
          requires:
            - docker-build-monitor-container
            - get-version
            - pre-commit
            - test-server
            - test-server-no-ff
            - test-server-multiregion

      - docker-publish-monitor-container:
          context: *docker-hub-context
          filters: *ignored
          requires:
            - docker-build-monitor-container
            - get-version
            - pre-commit
            - lint-and-prettier
            - test-frontend-2
            - test-viewer
            - test-objectsender
            - test-shared
            - test-server
            - test-server-no-ff
            - test-server-multiregion
            - test-preview-service

      - docker-publish-docker-compose-ingress:
          context: *docker-hub-context
          filters: *ignored
          requires:
            - docker-build-docker-compose-ingress
            - get-version
            - pre-commit
            - test-frontend-2
            - test-viewer
            - test-objectsender
            - test-shared
            - test-server
            - test-server-no-ff
            - test-server-multiregion
            - test-preview-service

      - publish-helm-chart:
          filters: *ignored
          requires:
            # - deployment-test-docker-compose #FIXME uncomment when nix https://search.nixos.org/packages?channel=24.05&show=tilt&from=0&size=50&sort=relevance&type=packages&query=tilt supports tilt >v0.33.12 which includes docker compose up --wait flag
            - deployment-test-helm-chart
            - docker-publish-docker-compose-ingress
            - docker-publish-file-imports
            - docker-publish-frontend-2
            - docker-publish-monitor-container
            - docker-publish-previews
            - docker-publish-server
            - docker-publish-test-container
            - docker-publish-webhooks
            - get-version

      - publish-helm-chart-oci:
          filters: *ignored
          context:
            - docker-hub
          requires:
            # - deployment-test-docker-compose #FIXME uncomment when nix https://search.nixos.org/packages?channel=24.05&show=tilt&from=0&size=50&sort=relevance&type=packages&query=tilt supports tilt >v0.33.12 which includes docker compose up --wait flag
            - deployment-test-helm-chart
            - docker-publish-docker-compose-ingress
            - docker-publish-file-imports
            - docker-publish-frontend-2
            - docker-publish-monitor-container
            - docker-publish-previews
            - docker-publish-server
            - docker-publish-test-container
            - docker-publish-webhooks
            - get-version

      - publish-npm:
          filters: *ignored
          context:
            - npm-registry
          requires:
            - get-version
            - test-server
            - test-server-no-ff
            - test-server-multiregion
            - test-ui-components
            - test-frontend-2
            - test-viewer
            - test-objectsender
            - test-shared
            - test-preview-service

      - publish-viewer-sandbox-cloudflare-pages:
          filters: *ignored
          context:
            - cloudflare-pages-edit
          requires:
            - test-viewer

jobs:
  get-version:
    <<: *docker-base-image
    working_directory: &work-dir /tmp/ci
    steps:
      - checkout
      - run: mkdir -p workspace
      - run:
          name: set version
          command: |
            echo "export IMAGE_VERSION_TAG=$(.circleci/get_version.sh)" >> workspace/env-vars
      - run: cat workspace/env-vars >> $BASH_ENV
      - run: echo "IMAGE_VERSION_TAG=${IMAGE_VERSION_TAG}"
      - persist_to_workspace:
          root: workspace
          paths:
            - env-vars

  lint-and-prettier:
    <<: *docker-node-image
    resource_class: xlarge
    working_directory: *work-dir
    steps:
      - checkout
      - run:
          name: Install Hardened Dependencies
          command: YARN_ENABLE_HARDENED_MODE=1 PUPPETEER_SKIP_DOWNLOAD=true PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 yarn
      - run:
          name: Build public packages
          command: yarn build:public
      - run:
          name: Lint everything
          command: yarn eslint:projectwide
      - run:
          name: Run prettier check
          command: yarn prettier:check
      - run:
          name: Check JSON Schema is up to date
          command: |
            yarn helm:jsonschema:generate
            git diff --exit-code

  pre-commit:
    parameters:
      config_file:
        default: ./.pre-commit-config.yaml
        description: Optional, path to pre-commit config file.
        type: string
    docker:
      - image: speckle/pre-commit-runner:latest
    resource_class: large
    working_directory: *work-dir
    steps:
      - checkout
      - restore_cache:
          name: Restore pre-commit & Yarn Package cache
          keys:
            - cache-pre-commit--{{ checksum "<<parameters.config_file>>" }}
      - run:
          name: Install pre-commit hooks
          command: pre-commit install-hooks --config <<parameters.config_file>>
      - save_cache:
          key: cache-pre-commit--{{ checksum "<<parameters.config_file>>" }}
          paths:
            - ~/.cache/pre-commit
      - run:
          name: Run pre-commit
          command: pre-commit run --all-files --config <<parameters.config_file>>
      - run:
          command: git --no-pager diff
          name: git diff
          when: on_fail

  test-server: &test-server-job
    docker:
      - image: cimg/node:22.6.0
      - image: cimg/redis:7.2.4
      - image: 'speckle/speckle-postgres'
        environment:
          POSTGRES_DB: speckle2_test
          POSTGRES_PASSWORD: speckle
          POSTGRES_USER: speckle
        command: -c 'max_connections=1000'
      - image: 'minio/minio'
        command: server /data --console-address ":9001"
        # environment:

    resource_class: large
    environment:
      NODE_ENV: test
      DATABASE_URL: 'postgres://speckle:speckle@127.0.0.1:5432/speckle2_test'
      PGDATABASE: speckle2_test
      POSTGRES_MAX_CONNECTIONS_SERVER: 20
      PGUSER: speckle
      SESSION_SECRET: 'keyboard cat'
      STRATEGY_LOCAL: 'true'
      CANONICAL_URL: 'http://127.0.0.1:3000'
      S3_ENDPOINT: 'http://127.0.0.1:9000'
      S3_ACCESS_KEY: 'minioadmin'
      S3_SECRET_KEY: 'minioadmin'
      S3_BUCKET: 'speckle-server'
      S3_CREATE_BUCKET: 'true'
      REDIS_URL: 'redis://127.0.0.1:6379'
      S3_REGION: '' # optional, defaults to 'us-east-1'
      FRONTEND_ORIGIN: 'http://127.0.0.1:8081'
      ENCRYPTION_KEYS_PATH: 'test/assets/automate/encryptionKeys.json'
      ENABLE_ALL_FFS: 'true'
      RATELIMITER_ENABLED: 'false'
    steps:
      - checkout
      - *yarn
      - run:
          name: Build public packages
          command: yarn build:public
      - run:
          name: Wait for dependencies to start
          command: 'dockerize -wait tcp://localhost:5432 -wait tcp://localhost:6379 -timeout 1m'
      - run:
          command: cp .env.test-example .env.test
          working_directory: 'packages/server'
      - run:
          name: 'Run tests'
          # Extra formatting to get timestamps on each line in CI (for profiling purposes)
          command: |
            GREP_FLAG=""

            if [ "$RUN_TESTS_IN_MULTIREGION_MODE" == "true" ]; then
              GREP_FLAG="--grep @multiregion"
            fi

            yarn test:report $GREP_FLAG --color=always | while IFS= read -r line; do echo -e "$(date +%T.%3N) > $line"; done
          working_directory: 'packages/server'
          no_output_timeout: 30m
      - codecov/upload:
          files: packages/server/coverage/lcov.info
      - store_test_results:
          path: packages/server/reports

      # - store_artifacts:
      # path: packages/server/coverage/lcov-report
      # destination: package/server/coverage

  test-server-no-ff:
    <<: *test-server-job
    environment:
      NODE_ENV: test
      DATABASE_URL: 'postgres://speckle:speckle@127.0.0.1:5432/speckle2_test'
      PGDATABASE: speckle2_test
      POSTGRES_MAX_CONNECTIONS_SERVER: 20
      PGUSER: speckle
      SESSION_SECRET: 'keyboard cat'
      STRATEGY_LOCAL: 'true'
      CANONICAL_URL: 'http://127.0.0.1:3000'
      S3_ENDPOINT: 'http://127.0.0.1:9000'
      S3_ACCESS_KEY: 'minioadmin'
      S3_SECRET_KEY: 'minioadmin'
      S3_BUCKET: 'speckle-server'
      S3_CREATE_BUCKET: 'true'
      REDIS_URL: 'redis://127.0.0.1:6379'
      S3_REGION: '' # optional, defaults to 'us-east-1'
      FRONTEND_ORIGIN: 'http://127.0.0.1:8081'
      ENCRYPTION_KEYS_PATH: 'test/assets/automate/encryptionKeys.json'
      DISABLE_ALL_FFS: 'true'
      RATELIMITER_ENABLED: 'false'

  test-server-multiregion:
    <<: *test-server-job
    docker:
      - image: cimg/node:22.6.0
      - image: cimg/redis:7.2.4
      - image: 'speckle/speckle-postgres'
        environment:
          POSTGRES_DB: speckle2_test
          POSTGRES_PASSWORD: speckle
          POSTGRES_USER: speckle
        command: -c 'max_connections=1000' -c 'wal_level=logical'
      - image: 'speckle/speckle-postgres'
        environment:
          POSTGRES_DB: speckle2_test
          POSTGRES_PASSWORD: speckle
          POSTGRES_USER: speckle
        command: -c 'max_connections=1000' -c 'port=5433' -c 'wal_level=logical'
      - image: 'speckle/speckle-postgres'
        environment:
          POSTGRES_DB: speckle2_test
          POSTGRES_PASSWORD: speckle
          POSTGRES_USER: speckle
        command: -c 'max_connections=1000' -c 'port=5434' -c 'wal_level=logical'
      - image: 'minio/minio'
        command: server /data --console-address ":9001" --address "0.0.0.0:9000"
      - image: 'minio/minio'
        command: server /data --console-address ":9021" --address "0.0.0.0:9020"
      - image: 'minio/minio'
        command: server /data --console-address ":9041" --address "0.0.0.0:9040"
    environment:
      # Same as test-server:
      NODE_ENV: test
      DATABASE_URL: 'postgres://speckle:speckle@127.0.0.1:5432/speckle2_test'
      PGDATABASE: speckle2_test
      POSTGRES_MAX_CONNECTIONS_SERVER: 50
      PGUSER: speckle
      SESSION_SECRET: 'keyboard cat'
      STRATEGY_LOCAL: 'true'
      CANONICAL_URL: 'http://127.0.0.1:3000'
      S3_ENDPOINT: 'http://127.0.0.1:9000'
      S3_ACCESS_KEY: 'minioadmin'
      S3_SECRET_KEY: 'minioadmin'
      S3_BUCKET: 'speckle-server'
      S3_CREATE_BUCKET: 'true'
      REDIS_URL: 'redis://127.0.0.1:6379'
      S3_REGION: '' # optional, defaults to 'us-east-1'
      FRONTEND_ORIGIN: 'http://127.0.0.1:8081'
      ENCRYPTION_KEYS_PATH: 'test/assets/automate/encryptionKeys.json'
      FF_BILLING_INTEGRATION_ENABLED: 'true'
      # These are the only different env keys:
      MULTI_REGION_CONFIG_PATH: '../../.circleci/multiregion.test-ci.json'
      FF_GATEKEEPER_MODULE_ENABLED: 'true'
      FF_WORKSPACES_MODULE_ENABLED: 'true'
      FF_WORKSPACES_MULTI_REGION_ENABLED: 'true'
      FF_MOVE_PROJECT_REGION_ENABLED: 'true'
      RUN_TESTS_IN_MULTIREGION_MODE: true
      RATELIMITER_ENABLED: 'false'

  test-frontend-2:
    <<: *docker-node-image-w-browsers
    resource_class: xlarge
    steps:
      - checkout
      - *yarn
      - run:
          name: Build public packages
          command: yarn build:public
      - run:
          name: Lint everything
          command: yarn lint:ci
          working_directory: 'packages/frontend-2'

  test-viewer:
    <<: *docker-node-image-w-browsers
    resource_class: large
    steps:
      - checkout
      - *yarn
      - run:
          name: Build public packages
          command: yarn build:public
      - run:
          name: Lint viewer
          command: yarn lint:ci
          working_directory: 'packages/viewer'
      - run:
          name: Run tests
          command: yarn test
          working_directory: 'packages/viewer'
      - run:
          name: Lint viewer-sandbox
          command: yarn lint:ci
          working_directory: 'packages/viewer-sandbox'
      - run:
          name: Build viewer-sandbox
          command: yarn build
          working_directory: 'packages/viewer-sandbox'

  test-preview-service:
    docker:
      - image: cimg/node:22.6.0-browsers
      - image: cimg/postgres:16.4@sha256:2e4f1a965bdd9ba77aa6a0a7b93968c07576ba2a8a7cf86d5eb7b31483db1378
        environment:
          POSTGRES_DB: preview_service_test
          POSTGRES_PASSWORD: preview_service_test
          POSTGRES_USER: preview_service_test
    resource_class: large
    environment: {}
    steps:
      - checkout
      - *yarn
      - run:
          name: Build public packages
          command: yarn build:public
      - run:
          name: Lint everything
          command: yarn lint:ci
          working_directory: 'packages/preview-service'
      - run:
          name: Copy .env.example to .env
          command: |
            #!/usr/bin/env bash
            cp packages/preview-service/.env.example packages/preview-service/.env
            sed -i~ '/^PG_CONNECTION_STRING=/s/=.*/="postgres:\/\/preview_service_test:preview_service_test@127.0.0.1:5432\/preview_service_test"/' packages/preview-service/.env
      - run:
          name: Run tests
          command: yarn test
          working_directory: 'packages/preview-service'

  test-shared:
    <<: *docker-node-image-w-browsers
    resource_class: medium+
    steps:
      - checkout
      - *yarn
      - run:
          name: Lint
          command: yarn lint:ci
          working_directory: 'packages/shared'
      - run:
          name: Run tests (all FFs)
          command: ENABLE_ALL_FFS=1 yarn test:ci
          working_directory: 'packages/shared'
      - run:
          name: Run tests (no FFs)
          command: DISABLE_ALL_FFS=1 yarn test:ci
          working_directory: 'packages/shared'
      - codecov/upload:
          files: packages/shared/coverage/coverage-final.json
      - run:
          name: Build
          command: yarn build
          working_directory: 'packages/shared'
      - run:
          name: Ensure ESM import works
          command: node ./e2e/testEsm.mjs
          working_directory: 'packages/shared'
      - run:
          name: Ensure CJS require works
          command: node ./e2e/testCjs.cjs
          working_directory: 'packages/shared'

  test-objectsender:
    <<: *docker-node-image-w-browsers
    resource_class: large
    steps:
      - checkout
      - *yarn
      - run:
          name: Build public packages
          command: yarn build:public
      - run:
          name: Run tests
          command: yarn test:ci
          working_directory: 'packages/objectsender'
      - store_artifacts:
          path: 'packages/objectsender/coverage'

  test-ui-components:
    <<: *docker-node-image-w-browsers
    resource_class: xlarge
    steps:
      - checkout
      - run:
          name: Install Dependencies
          command: YARN_ENABLE_HARDENED_MODE=0 PUPPETEER_SKIP_DOWNLOAD=true yarn
      - run:
          name: Build public packages
          command: yarn build:public
      - run:
          name: Lint tailwind theme
          command: yarn lint:ci
          working_directory: 'packages/tailwind-theme'
      - run:
          name: Lint ui components
          command: yarn lint:ci
          working_directory: 'packages/ui-components'
      - run:
          name: Lint component nuxt package
          command: yarn lint:ci
          working_directory: 'packages/ui-components-nuxt'
      - run:
          name: Test via Storybook
          command: yarn storybook:test:ci
          working_directory: 'packages/ui-components'

  ui-components-chromatic:
    <<: *docker-node-image
    resource_class: medium+
    steps:
      - checkout
      - *yarn
      - run:
          name: Build shared packages
          command: yarn build:public
      - run:
          name: Run chromatic
          command: yarn chromatic
          working_directory: 'packages/ui-components'

  vulnerability-scan:
    # snyk can undertake most types of scans through GitHub integration
    # which does not require integration with the CI
    # but it is not possible to scan npm/yarn package.json
    # because it requires node_modules
    # therefore this scanning has to be triggered via the cli
    <<: *docker-node-image
    resource_class: large
    working_directory: *work-dir
    steps:
      - checkout
      - *yarn
      - snyk/scan:
          additional-arguments: --yarn-workspaces  --strict-out-of-sync=false
          fail-on-issues: false

  deployment-test-docker-compose:
    machine:
      image: ubuntu-2204:2024.05.1
      docker_layer_caching: true
    resource_class: large
    working_directory: *work-dir
    steps:
      - checkout
      - attach_workspace:
          at: /tmp/ci/workspace
      # create the nix folder with permissive write permissions
      - run: |
          sudo mkdir /nix
          sudo chmod 777 /nix
      - restore_cache:
          name: Restore nix cache
          keys:
            - nix-{{ checksum "./tests/deployment/docker-compose/docker-compose-shell.nix" }}
      - run:
          name: Install the nix package manager
          command: |
            sh <(curl -L https://nixos.org/nix/install) --daemon --yes
            echo "source /etc/bashrc" >> "${BASH_ENV}"
      - run:
          name: Initialize nix shell
          command: |
            nix-shell --run "echo Here, a nix shell for you" ./tests/deployment/docker-compose/docker-compose-shell.nix
      - save_cache:
          key: nix-{{ checksum "./tests/deployment/docker-compose/docker-compose-shell.nix" }}
          paths:
            - /nix
      - run: cat workspace/env-vars >> $BASH_ENV
      - run: nix-shell --run "LOAD_DOCKER='true' tilt ci --file ./tests/deployment/docker-compose/Tiltfile" ./tests/deployment/helm/docker-compose-shell.nix

  deployment-test-helm-chart:
    machine:
      image: ubuntu-2204:2024.01.1
      docker_layer_caching: true
    resource_class: large
    working_directory: *work-dir
    steps:
      - checkout
      - attach_workspace:
          at: /tmp/ci/workspace
      # create the nix folder with permissive write permissions
      - run: |
          sudo mkdir /nix
          sudo chmod 777 /nix
      - restore_cache:
          name: Restore nix cache
          keys:
            - nix-{{ checksum "./tests/deployment/helm/helm-chart-shell.nix" }}
      - run:
          name: Install the nix package manager
          command: |
            sh <(curl -L https://nixos.org/nix/install) --daemon --yes
            echo "source /etc/bashrc" >> "${BASH_ENV}"
      - run:
          name: Initialize nix shell
          command: |
            nix-shell \
            --run "echo Here, a nix shell for you" \
            ./tests/deployment/helm/helm-chart-shell.nix
      - save_cache:
          key: nix-{{ checksum "./tests/deployment/helm/helm-chart-shell.nix" }}
          paths:
            - /nix
      - run: cat workspace/env-vars >> $BASH_ENV
      - run: echo "export KUBECONFIG=$(pwd)/.kube/config" >> "${BASH_ENV}"
      - run: echo "${KUBECONFIG}"
      - run:
          name: Template Speckle Server Helm Chart
          command: |
            nix-shell \
            --run "helm template speckle-server ./utils/helm/speckle-server" \
            ./tests/deployment/helm/helm-chart-shell.nix
      - run:
          name: Add 127.0.0.1 domains to /etc/hosts
          command: |
            sudo tee -a /etc/hosts \<<<'127.0.0.1 speckle.internal'
            cat /etc/hosts
      - run:
          name: Change directory permissions to allow kind to create directories
          command: |
            mkdir -p "./minio-data"
            if [ "$(stat -f "%A" "./minio-data")" != "775" ]; then
              echo "🔐 We need 'sudo' to set permissions on minio-data directory to 775"
              sudo chmod 775 "./minio-data"
            fi
            mkdir -p "./postgres-data"
            if [ "$(stat -f "%A" "./postgres-data")" != "775" ]; then
              echo "🔐 We need 'sudo' to set permissions on postgres-data directory to 775"
              sudo chmod 775 "./postgres-data"
            fi
      - run:
          name: Deploy Kubernetes (kind) cluster
          command: |
            nix-shell \
            --run "ctlptl apply --filename ./tests/deployment/helm/cluster-config.yaml" \
            ./tests/deployment/helmhelm-chart-shell.nix
      - run:
          name: Deploy Kubernetes resources to cluster
          command: |
            nix-shell \
            --run "LOAD_DOCKER='true' tilt ci --file ./tests/deployment/helm/Tiltfile --context kind-speckle-server --timeout 10m" \
            ./tests/deployment/helm/helm-chart-shell.nix

  docker-build: &build-job
    <<: *docker-base-image
    resource_class: medium
    working_directory: *work-dir
    steps:
      - checkout
      - attach_workspace:
          at: /tmp/ci/workspace
      - run: cat workspace/env-vars >> $BASH_ENV
      - setup_remote_docker:
          version: default
          docker_layer_caching: true
      - run:
          name: Build and Push
          command: ./.circleci/build.sh

  docker-build-server:
    <<: *build-job
    environment:
      SPECKLE_SERVER_PACKAGE: server

  docker-build-frontend-2:
    <<: *build-job
    resource_class: xlarge
    environment:
      SPECKLE_SERVER_PACKAGE: frontend-2

  docker-publish-frontend-2-sourcemaps:
    <<: *docker-node-image
    resource_class: xlarge
    working_directory: *work-dir
    environment:
      SPECKLE_SERVER_PACKAGE: frontend-2
    steps:
      - checkout
      - attach_workspace:
          at: /tmp/ci/workspace
      - run: cat workspace/env-vars >> $BASH_ENV
      - setup_remote_docker:
          version: default
          docker_layer_caching: true
      - run:
          name: Build and Publish sourcemaps
          command: ./.circleci/build_publish_fe2_sourcemaps.sh

  docker-build-previews:
    <<: *build-job
    environment:
      SPECKLE_SERVER_PACKAGE: preview-service

  docker-build-webhooks:
    <<: *build-job
    environment:
      SPECKLE_SERVER_PACKAGE: webhook-service

  docker-build-file-imports:
    <<: *build-job
    environment:
      SPECKLE_SERVER_PACKAGE: fileimport-service

  docker-build-test-container:
    <<: *build-job
    environment:
      FOLDER: utils
      SPECKLE_SERVER_PACKAGE: test-deployment

  docker-build-postgres-container:
    <<: *build-job
    environment:
      FOLDER: utils
      SPECKLE_SERVER_PACKAGE: postgres

  docker-build-monitor-container:
    <<: *build-job
    environment:
      SPECKLE_SERVER_PACKAGE: monitor-deployment

  docker-build-docker-compose-ingress:
    <<: *build-job
    environment:
      FOLDER: utils
      SPECKLE_SERVER_PACKAGE: docker-compose-ingress

  docker-publish: &publish-job
    <<: *docker-base-image
    resource_class: medium
    working_directory: *work-dir
    steps:
      - checkout
      - attach_workspace:
          at: /tmp/ci/workspace
      - run: cat workspace/env-vars >> $BASH_ENV
      - setup_remote_docker:
          version: default
          docker_layer_caching: true
      - run:
          name: Publish
          command: ./.circleci/publish.sh

  docker-publish-server:
    <<: *publish-job
    environment:
      SPECKLE_SERVER_PACKAGE: server

  docker-publish-frontend-2:
    <<: *publish-job
    environment:
      SPECKLE_SERVER_PACKAGE: frontend-2

  docker-publish-previews:
    <<: *publish-job
    environment:
      SPECKLE_SERVER_PACKAGE: preview-service

  docker-publish-webhooks:
    <<: *publish-job
    environment:
      SPECKLE_SERVER_PACKAGE: webhook-service

  docker-publish-file-imports:
    <<: *publish-job
    environment:
      SPECKLE_SERVER_PACKAGE: fileimport-service

  docker-publish-test-container:
    <<: *publish-job
    environment:
      FOLDER: utils
      SPECKLE_SERVER_PACKAGE: test-deployment

  docker-publish-postgres-container:
    <<: *publish-job
    environment:
      FOLDER: utils
      SPECKLE_SERVER_PACKAGE: postgres

  docker-publish-monitor-container:
    <<: *publish-job
    environment:
      SPECKLE_SERVER_PACKAGE: monitor-deployment

  docker-publish-docker-compose-ingress:
    <<: *publish-job
    environment:
      FOLDER: utils
      SPECKLE_SERVER_PACKAGE: docker-compose-ingress

  publish-npm:
    <<: *docker-node-image
    working_directory: *work-dir
    resource_class: large
    steps:
      - checkout
      - attach_workspace:
          at: /tmp/ci/workspace
      - run: cat workspace/env-vars >> $BASH_ENV
      - *yarn
      - run:
          name: auth to npm as Speckle
          command: |
            echo "npmRegistryServer: https://registry.npmjs.org/" >> .yarnrc.yml
            echo "npmAuthToken: ${NPM_TOKEN}" >> .yarnrc.yml
      - run:
          name: try login to npm
          command: yarn npm whoami
      - run:
          name: build public packages
          command: yarn workspaces foreach -ptvW --no-private run build
      - run:
          name: bump all versions
          # bump all versions in dependency tree order but not in parallel
          command: yarn workspaces foreach -tvW version $IMAGE_VERSION_TAG
      - run:
          name: publish to npm
          command: 'yarn workspaces foreach -pvW --no-private npm publish --access public'

  publish-helm-chart:
    docker:
      - image: cimg/python:3.12.1
    working_directory: *work-dir
    steps:
      - checkout
      - attach_workspace:
          at: /tmp/ci/workspace
      - run: cat workspace/env-vars >> $BASH_ENV
      - add_ssh_keys:
          fingerprints:
            - '4d:68:70:66:49:97:ba:8b:8c:55:96:df:3d:be:6e:05'
      - run:
          name: Publish Helm Chart
          command: ./.circleci/publish_helm_chart.sh

  publish-helm-chart-oci:
    docker:
      - image: speckle/pre-commit-runner:latest
    working_directory: *work-dir
    steps:
      - checkout
      - attach_workspace:
          at: /tmp/ci/workspace
      - run: cat workspace/env-vars >> $BASH_ENV
      - run:
          name: Publish Helm Chart
          command: ./.circleci/publish_helm_chart_oci.sh

  publish-viewer-sandbox-cloudflare-pages:
    <<: *docker-node-image
    working_directory: *work-dir
    resource_class: large
    steps:
      - checkout
      - *yarn
      - run:
          name: Build public packages
          command: yarn build:public
      - run:
          name: Lint viewer-sandbox
          command: yarn lint:ci
          working_directory: 'packages/viewer-sandbox'
      - run:
          name: Build viewer-sandbox
          command: yarn build
          working_directory: 'packages/viewer-sandbox'
      - run:
          name: Publish Viewer Sandbox to Cloudflare Pages
          command: ./.circleci/publish_cloudflare_pages.sh
          environment:
            CLOUDFLARE_PAGES_PROJECT_NAME: viewer
            VIEWER_SANDBOX_DIR_PATH: packages/viewer-sandbox