docs/standards/mcp/templates/drone/service-docker.yaml

---
kind: pipeline
type: docker
name: build-and-deploy-service

platform:
  os: linux
  arch: arm64

workspace:
  path: /drone/src

volumes:
  - name: dockersock
    host:
      path: /var/run/docker.sock

steps:
  - name: fetch-tags
    image: docker:24
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - apk add --no-cache git
      - git fetch --tags
      - |
        LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null | tr -d '\n')
        echo "Latest Git tag fetched: $LATEST_TAG"

        echo "$LATEST_TAG" > /drone/src/LATEST_TAG.txt

        IMAGE_TAG=$(cat /drone/src/LATEST_TAG.txt | tr -d '\n')
        echo "Image tag read from file: $IMAGE_TAG"

        if [ -z "$IMAGE_TAG" ]; then
          echo "No git tags found! Cannot continue."
          exit 1
        fi

  - name: check-version
    image: alpine:3.20
    commands:
      - VERSION=$(cat VERSION 2>/dev/null | tr -d '\n')
      - echo "tag=$DRONE_TAG version=$VERSION"
      - |
        if [ -z "$VERSION" ]; then
          echo "VERSION file missing or empty; add it (see versioning standard)."
          exit 1
        fi
      - |
        if [ "$DRONE_TAG" != "$VERSION" ]; then
          echo "Tag '$DRONE_TAG' does not match VERSION '$VERSION'; refusing to deploy."
          exit 1
        fi

  - name: check-remote-image
    image: docker:24
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - IMAGE_TAG=$(cat /drone/src/LATEST_TAG.txt | tr -d '\n')
      - echo "Checking if aetos/<app>:$IMAGE_TAG exists on remote Docker..."
      - echo "Existing Docker tags for aetos/<app>:"
      - docker images --format "{{.Repository}}:{{.Tag}}" | grep "^aetos/<app>" || echo "(none)"
      - |
        if docker image inspect aetos/<app>:$IMAGE_TAG > /dev/null 2>&1; then
          echo "Docker image aetos/<app>:$IMAGE_TAG already exists; skipping build"
          exit 78
        else
          echo "Docker image aetos/<app>:$IMAGE_TAG not found; proceeding to build..."
        fi

  - name: quality-gate
    image: python:3.13-slim
    environment:
      PIP_REPO_URL:
        from_secret: PIP_REPO_URL
      PIP_USERNAME:
        from_secret: PIP_USERNAME
      PIP_PASSWORD:
        from_secret: PIP_PASSWORD
    commands:
      - pip install --upgrade pip
      - |
        if [ -z "$PIP_REPO_URL" ] || [ -z "$PIP_USERNAME" ] || [ -z "$PIP_PASSWORD" ]; then
          echo "PIP_REPO_URL / PIP_USERNAME / PIP_PASSWORD are not set" >&2
          exit 1
        fi
      - AUTH_URL="https://$PIP_USERNAME:$PIP_PASSWORD@$(echo "$PIP_REPO_URL" | sed -E 's|^[a-zA-Z]+://||; s|/*$||')/simple"
      - pip install --index-url "$AUTH_URL" --extra-index-url https://pypi.org/simple/ -r requirements.txt
      - pip install black ruff mypy
      - echo "Running quality gate..."
      - python -m black --check .
      - python -m ruff check .
      - python -m mypy .
      - python -m pytest

  - name: build-image
    image: docker:24
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    environment:
      PIP_REPO_URL:
        from_secret: PIP_REPO_URL
      PIP_USERNAME:
        from_secret: PIP_USERNAME
      PIP_PASSWORD:
        from_secret: PIP_PASSWORD
    commands:
      - IMAGE_TAG=$(cat /drone/src/LATEST_TAG.txt | tr -d '\n')
      - echo "Building Docker image aetos/<app>:$IMAGE_TAG ..."
      - |
        docker build \
          --network=host \
          --build-arg PIP_REPO_URL="$PIP_REPO_URL" \
          --build-arg PIP_USERNAME="$PIP_USERNAME" \
          --build-arg PIP_PASSWORD="$PIP_PASSWORD" \
          -t aetos/<app>:$IMAGE_TAG \
          -t aetos/<app>:latest \
          /drone/src

  - name: push-image
    image: docker:24
    environment:
      REGISTRY_HOST:
        from_secret: REGISTRY_HOST
      REGISTRY_USER:
        from_secret: REGISTRY_USER
      REGISTRY_PASS:
        from_secret: REGISTRY_PASS
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - IMAGE_TAG=$(cat /drone/src/LATEST_TAG.txt | tr -d '\n')
      - echo "Logging into registry $REGISTRY_HOST ..."
      - echo "$REGISTRY_PASS" | docker login $REGISTRY_HOST -u "$REGISTRY_USER" --password-stdin
      - echo "Tagging images with registry prefix..."
      - docker tag aetos/<app>:$IMAGE_TAG $REGISTRY_HOST/aetos/<app>:$IMAGE_TAG
      - docker tag aetos/<app>:$IMAGE_TAG $REGISTRY_HOST/aetos/<app>:latest
      - echo "Pushing aetos/<app>:$IMAGE_TAG ..."
      - docker push $REGISTRY_HOST/aetos/<app>:$IMAGE_TAG
      - echo "Pushing aetos/<app>:latest ..."
      - docker push $REGISTRY_HOST/aetos/<app>:latest

  - name: stop-old
    image: docker:24
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - echo "Stopping old container..."
      - docker rm -f <app> || true

  - name: run-container
    image: docker:24
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    environment:
      <ENV_VAR>:
        from_secret: <ENV_VAR>
    commands:
      - IMAGE_TAG=$(cat /drone/src/LATEST_TAG.txt | tr -d '\n')
      - echo "Starting container aetos/<app>:$IMAGE_TAG ..."
      - |
        docker run -d \
          --name <app> \
          -p <host-port>:<container-port> \
          --add-host private-pi:192.168.1.111 \
          --restart always \
          -e <ENV_VAR>=$<ENV_VAR> \
          aetos/<app>:$IMAGE_TAG

trigger:
  event:
    - tag