<commit_before>Parameters:
  GitHubRepo:
    Type: String
    Default: MPContribs
  GitHubBranch:
    Type: String
    Default: master
  GitHubToken:
    Type: String
    NoEcho: true
  GitHubUser:
    Type: String
    Default: materialsproject
  GitHubRepoKong:
    Type: String
    Default: kong-oidc-consumer
  GitHubBranchKong:
    Type: String
    Default: kong1.4
  GitHubUserKong:
    Type: String
    Default: tschaume
  GitHubRepoKonga:
    Type: String
    Default: konga
  GitHubBranchKonga:
    Type: String
    Default: mpcontribs
  GitHubUserKonga:
    Type: String
    Default: tschaume
  GitHubRepoMPWeb:
    Type: String
    Default: web
  GitHubBranchMPWeb:
    Type: String
    Default: release
  GitHubRepoMPWebApi:
    Type: String
    Default: api
  GitHubBranchMPWebApi:
    Type: String
    Default: release
  MongoHost:
    Type: String
    NoEcho: true
  PipelineName:
    Type: String
    Default: materialsproject
  EnvironmentName:
    Type: String
    Default: prod
  NetworkNumber:
    Type: String
    Default: '0'
    Description: number to control CIDR block for VPC (192.168.{NetworkNumber}.<256IPs>)
  DBPassword:
    NoEcho: 'true'
    Description: The database admin account password
    Type: String
    MinLength: '8'
  CertificateArn:
    Type: String
    Description: ARN of the Amazon Certificate Manager SSL certificate to use for this app
  KongaAdminUsername:
    Type: String
    MinLength: '5'
  KongaAdminEmail:
    Type: String
  KongaAdminFirstname:
    Type: String
  KongaAdminLastname:
    Type: String
  KongaAdminPassword:
    NoEcho: 'true'
    Type: String
  AwsAccessKeyId:
    NoEcho: 'true'
    Type: String
  AwsSecretAccessKey:
    NoEcho: 'true'
    Type: String
  SnsAdminTopicArn:
    Type: String
  MapiKey:
    NoEcho: 'true'
    Type: String
    Description: API key for MPRester to build formulae lookup table
  DdApiKey:
    NoEcho: 'true'
    Type: String
    Description: DataDog API Key
  DdAppKey:
    NoEcho: 'true'
    Type: String
    Description: DataDog APP Key
  DdAcctId:
    NoEcho: 'true'
    Type: String
    Description: DataDog's AWS Account ID
  DdExtId:
    NoEcho: 'true'
    Type: String
    Description: DataDog External ID


Metadata:
  cfn-lint:
    config:
      ignore_checks:
      - E3030
      - E3001

Resources:
  # Create the ECR respository to hold built docker images
  Repository:
    Type: AWS::ECR::Repository
    DeletionPolicy: Retain

  # A role used to give CodeBuild permission to access code,
  # build it, and upload the build results to ECR
  CodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess'
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource: !Sub arn:aws:iam::${AWS::AccountId}:role/EKSRole
                Effect: Allow
                Action:
                  - sts:AssumeRole
              - Resource: '*'
                Effect: Allow
                Action:
                  - eks:Describe*
              - Resource: "*"
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - ecr:GetAuthorizationToken
              - Resource: !Sub arn:aws:s3:::${ArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:GetObjectVersion
              - Resource: !Sub arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/${Repository}
                Effect: Allow
                Action:
                  - ecr:GetDownloadUrlForLayer
                  - ecr:BatchGetImage
                  - ecr:BatchCheckLayerAvailability
                  - ecr:PutImage
                  - ecr:InitiateLayerUpload
                  - ecr:UploadLayerPart
                  - ecr:CompleteLayerUpload
              - Resource: '*'
                Effect: Allow
                Action:
                  - ec2:CreateNetworkInterface
                  - ec2:DescribeDhcpOptions
                  - ec2:DescribeNetworkInterfaces
                  - ec2:DeleteNetworkInterface
                  - ec2:DescribeSubnets
                  - ec2:DescribeSecurityGroups
                  - ec2:DescribeVpcs
                  - ec2:CreateNetworkInterfacePermission

  # Role used to give CodePipeline to release a build.
  CodePipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              # Allow codepipeline to put artifacts in the S3 bucket
              # as well as get artifacts back out of it.
              - Resource:
                  - !Sub arn:aws:s3:::${ArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
              # Allow codepipeline to build code builds
              # Allow codepipeline to deploy cloudformation stacks
              - Resource: "*"
                Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                  - iam:PassRole
                  - cloudformation:CreateChangeSet
                  - cloudformation:CreateStack
                  - cloudformation:CreateUploadBucket
                  - cloudformation:DeleteStack
                  - cloudformation:Describe*
                  - cloudformation:List*
                  - cloudformation:UpdateStack
                  - cloudformation:ValidateTemplate
                  - cloudformation:ExecuteChangeSet

  # CloudFormation deployment role. This role is passed by CodeBuild to
  # CloudFormation to use when setting up the application resources
  CloudFormationDeployRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: deploy-stack
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "iam:*"
                  - "ec2:*"
                  - "ecs:*"
                  - "elasticloadbalancing:*"
                  - "autoscaling:*"
                  - "logs:*"
                  - "application-autoscaling:*"
                  - "cloudwatch:*"
                  - "route53:*"
                  - "rds:*"
                  - "kms:*"
                  - "eks:*"
                  - "elasticache:*"
                Resource: "*"

  # While the build is in progress we need a place to store artifacts
  ArtifactBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain

  # Datadog Integration
  # https://docs.datadoghq.com/integrations/amazon_web_services/?tab=allpermissions#setup
  DatadogAWSIntegrationRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              AWS: !Sub ${DdAcctId}
            Condition:
              StringEquals:
                sts:ExternalId: !Sub ${DdExtId}
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess'
        - 'arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess'
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource: '*'
                Effect: Allow
                Action:
                  - budgets:ViewBudget
                  - ecs:Describe*
                  - ecs:List*
                  - elasticache:Describe*
                  - elasticache:List*
                  - rds:Describe*
                  - rds:List*
                  - route53:List*
                  - s3:GetBucketLogging
                  - s3:GetBucketLocation
                  - s3:GetBucketNotification
                  - s3:GetBucketTagging
                  - s3:ListAllMyBuckets
                  - s3:PutBucketNotification
                  - sns:List*
                  - sns:Publish

  DatadogAWSIntegrationResource:
    Type: 'Datadog::Integrations::AWS'
    Properties:
      AccountID: !Sub ${AWS::AccountId}
      RoleName: !Ref DatadogAWSIntegrationRole
      HostTags:
        - !Sub "pipeline:${PipelineName}"
        - !Sub "env:${EnvironmentName}"
      DatadogCredentials:
        ApiKey: !Sub ${DdApiKey}
        ApplicationKey: !Sub ${DdAppKey}

  # This is the definition of how to build the code in the repository
  CodeBuildProjectKong:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                docker: 18
            pre_build:
              commands:
                - $(aws ecr get-login --no-include-email)
                - TAG="$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)"
                - IMAGE_URI="${REPOSITORY_URI}:${PREFIX}-${TAG}"
            build:
              commands:
                - docker build --tag "${IMAGE_URI}-kong" .
            post_build:
              commands:
                - docker push "${IMAGE_URI}-kong"
                - printf '{"ImageUri":"%s"}' "${IMAGE_URI}-kong" > build-kong.json
          artifacts:
            files:
                - build-kong.json
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: REPOSITORY_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${Repository}
          - Name: PREFIX
            Value: !Sub ${PipelineName}-${EnvironmentName}
      Cache:
        Type: LOCAL
        Modes: # You can specify one or more cache mode,
          - LOCAL_CUSTOM_CACHE
          - LOCAL_DOCKER_LAYER_CACHE
          - LOCAL_SOURCE_CACHE
      Name: !Sub ${AWS::StackName}-kong
      ServiceRole: !Ref CodeBuildServiceRole

  CodeBuildProjectKonga:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                docker: 18
            pre_build:
              commands:
                - $(aws ecr get-login --no-include-email)
                - TAG="$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)"
                - IMAGE_URI="${REPOSITORY_URI}:${PREFIX}-${TAG}"
            build:
              commands:
                - docker build --tag "${IMAGE_URI}-konga" .
            post_build:
              commands:
                - docker push "${IMAGE_URI}-konga"
                - printf '{"ImageUri":"%s"}' "${IMAGE_URI}-konga" > build-konga.json
          artifacts:
            files:
                - build-konga.json
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: REPOSITORY_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${Repository}
          - Name: PREFIX
            Value: !Sub ${PipelineName}-${EnvironmentName}
      Cache:
        Type: LOCAL
        Modes: # You can specify one or more cache mode,
          - LOCAL_CUSTOM_CACHE
          - LOCAL_DOCKER_LAYER_CACHE
          - LOCAL_SOURCE_CACHE
      Name: !Sub ${AWS::StackName}-konga
      ServiceRole: !Ref CodeBuildServiceRole

  CodeBuildProjectMPContribs:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                docker: 18
            pre_build:
              commands:
                - $(aws ecr get-login --no-include-email)
                - TAG="$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)"
                - IMAGE_URI="${ECR_URI}/${REPOSITORY}:${PREFIX}-${TAG}"
            build:
              commands:
                - docker build --tag "${IMAGE_URI}-portal" mpcontribs-portal
                - docker build --tag "${IMAGE_URI}-api" --build-arg MAPI_KEY=${MAPI_KEY} mpcontribs-api
                - docker build --tag "${IMAGE_URI}-gateway" mpcontribs-sidecars/kernel_gateway
                - docker build --tag "${IMAGE_URI}-chrome" mpcontribs-sidecars/chrome
                - docker build --tag "${IMAGE_URI}-datadog" mpcontribs-sidecars/datadog-agent
            post_build:
              commands:
                - docker push "${IMAGE_URI}-portal"
                - docker push "${IMAGE_URI}-api"
                - docker push "${IMAGE_URI}-gateway"
                - docker push "${IMAGE_URI}-chrome"
                - docker push "${IMAGE_URI}-datadog"
                - printf '{"Tag":"%s"}' "${TAG}" > tag.json
          artifacts:
            files:
                - tag.json
      Environment:
        ComputeType: BUILD_GENERAL1_MEDIUM
        Image: aws/codebuild/standard:2.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: ECR_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com
          - Name: REPOSITORY
            Value: !Sub ${Repository}
          - Name: PREFIX
            Value: !Sub ${PipelineName}-${EnvironmentName}
          - Name: MAPI_KEY
            Value: !Ref 'MapiKey'
      Cache:
        Type: LOCAL
        Modes: # You can specify one or more cache mode,
          - LOCAL_CUSTOM_CACHE
          - LOCAL_DOCKER_LAYER_CACHE
          - LOCAL_SOURCE_CACHE
      Name: !Sub ${AWS::StackName}-MPContribs
      ServiceRole: !Ref CodeBuildServiceRole

  CodeBuildProjectMPWeb:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          env:
            parameter-store:
              build_ssh_key: "build_ssh_key"
          phases:
            install:
              runtime-versions:
                docker: 18
            pre_build:
              commands:
                - $(aws ecr get-login --no-include-email)
                - TAG="$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)"
                - IMAGE_URI="${REPOSITORY_URI}:${PREFIX}-${TAG}"
                - mkdir -p ~/.ssh
                - echo "$build_ssh_key" > ~/.ssh/id_rsa
                - chmod 600 ~/.ssh/id_rsa
                #- eval "$(ssh-agent -s)"
                #- ssh-add ~/.ssh/id_rsa
                - ssh-keygen -F github.com || ssh-keyscan github.com >> ~/.ssh/known_hosts
                - git config --global url."<EMAIL>:".insteadOf "https://github.com/"
                - git init
                - git remote add origin <EMAIL>:materialsproject/web.git
                - git fetch
                - git checkout -tf origin/release
                - git submodule init
                - git submodule update --recursive  # TODO check api branch
            build:
              commands:
                - docker build --tag "${IMAGE_URI}-mpweb" .
            post_build:
              commands:
                - docker push "${IMAGE_URI}-mpweb"
                - printf '{"ImageUri":"%s"}' "${IMAGE_URI}-mpweb" > build-mpweb.json
          artifacts:
            files:
                - build-mpweb.json
      Environment:
        ComputeType: BUILD_GENERAL1_MEDIUM
        Image: aws/codebuild/standard:2.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: REPOSITORY_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${Repository}
          - Name: PREFIX
            Value: !Sub ${PipelineName}-${EnvironmentName}
      Cache:
        Type: LOCAL
        Modes: # You can specify one or more cache mode,
          - LOCAL_CUSTOM_CACHE
          - LOCAL_DOCKER_LAYER_CACHE
          - LOCAL_SOURCE_CACHE
      Name: !Sub ${AWS::StackName}-mpweb
      ServiceRole: !Ref CodeBuildServiceRole

  CodeBuildProjectMPWebApi:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                docker: 18
            pre_build:
              commands:
                - $(aws ecr get-login --no-include-email)
                - TAG="$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)"
                - IMAGE_URI="${REPOSITORY_URI}:${PREFIX}-${TAG}"
            build:
              commands:
                - docker build --tag "${IMAGE_URI}-mpwebapi" .
            post_build:
              commands:
                - docker push "${IMAGE_URI}-mpwebapi"
                - printf '{"ImageUri":"%s"}' "${IMAGE_URI}-mpwebapi" > build-mpwebapi.json
          artifacts:
            files:
                - build-mpwebapi.json
      Environment:
        ComputeType: BUILD_GENERAL1_MEDIUM
        Image: aws/codebuild/standard:2.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: REPOSITORY_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${Repository}
          - Name: PREFIX
            Value: !Sub ${PipelineName}-${EnvironmentName}
      Cache:
        Type: LOCAL
        Modes: # You can specify one or more cache mode,
          - LOCAL_CUSTOM_CACHE
          - LOCAL_DOCKER_LAYER_CACHE
          - LOCAL_SOURCE_CACHE
      Name: !Sub ${AWS::StackName}-mpwebapi
      ServiceRole: !Ref CodeBuildServiceRole


  # This pipeline defines the steps to build, deploy, and release the application
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: !Sub ${PipelineName}-${EnvironmentName}
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
      Stages:

        # First we have to pull the source code from the Github repository.
        - Name: Source<commit_msg>cfn: codebuild 4.0<commit_after>Parameters:
  GitHubRepo:
    Type: String
    Default: MPContribs
  GitHubBranch:
    Type: String
    Default: master
  GitHubToken:
    Type: String
    NoEcho: true
  GitHubUser:
    Type: String
    Default: materialsproject
  GitHubRepoKong:
    Type: String
    Default: kong-oidc-consumer
  GitHubBranchKong:
    Type: String
    Default: kong1.4
  GitHubUserKong:
    Type: String
    Default: tschaume
  GitHubRepoKonga:
    Type: String
    Default: konga
  GitHubBranchKonga:
    Type: String
    Default: mpcontribs
  GitHubUserKonga:
    Type: String
    Default: tschaume
  GitHubRepoMPWeb:
    Type: String
    Default: web
  GitHubBranchMPWeb:
    Type: String
    Default: release
  GitHubRepoMPWebApi:
    Type: String
    Default: api
  GitHubBranchMPWebApi:
    Type: String
    Default: release
  MongoHost:
    Type: String
    NoEcho: true
  PipelineName:
    Type: String
    Default: materialsproject
  EnvironmentName:
    Type: String
    Default: prod
  NetworkNumber:
    Type: String
    Default: '0'
    Description: number to control CIDR block for VPC (192.168.{NetworkNumber}.<256IPs>)
  DBPassword:
    NoEcho: 'true'
    Description: The database admin account password
    Type: String
    MinLength: '8'
  CertificateArn:
    Type: String
    Description: ARN of the Amazon Certificate Manager SSL certificate to use for this app
  KongaAdminUsername:
    Type: String
    MinLength: '5'
  KongaAdminEmail:
    Type: String
  KongaAdminFirstname:
    Type: String
  KongaAdminLastname:
    Type: String
  KongaAdminPassword:
    NoEcho: 'true'
    Type: String
  AwsAccessKeyId:
    NoEcho: 'true'
    Type: String
  AwsSecretAccessKey:
    NoEcho: 'true'
    Type: String
  SnsAdminTopicArn:
    Type: String
  MapiKey:
    NoEcho: 'true'
    Type: String
    Description: API key for MPRester to build formulae lookup table
  DdApiKey:
    NoEcho: 'true'
    Type: String
    Description: DataDog API Key
  DdAppKey:
    NoEcho: 'true'
    Type: String
    Description: DataDog APP Key
  DdAcctId:
    NoEcho: 'true'
    Type: String
    Description: DataDog's AWS Account ID
  DdExtId:
    NoEcho: 'true'
    Type: String
    Description: DataDog External ID


Metadata:
  cfn-lint:
    config:
      ignore_checks:
      - E3030
      - E3001

Resources:
  # Create the ECR respository to hold built docker images
  Repository:
    Type: AWS::ECR::Repository
    DeletionPolicy: Retain

  # A role used to give CodeBuild permission to access code,
  # build it, and upload the build results to ECR
  CodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess'
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource: !Sub arn:aws:iam::${AWS::AccountId}:role/EKSRole
                Effect: Allow
                Action:
                  - sts:AssumeRole
              - Resource: '*'
                Effect: Allow
                Action:
                  - eks:Describe*
              - Resource: "*"
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - ecr:GetAuthorizationToken
              - Resource: !Sub arn:aws:s3:::${ArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:GetObjectVersion
              - Resource: !Sub arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/${Repository}
                Effect: Allow
                Action:
                  - ecr:GetDownloadUrlForLayer
                  - ecr:BatchGetImage
                  - ecr:BatchCheckLayerAvailability
                  - ecr:PutImage
                  - ecr:InitiateLayerUpload
                  - ecr:UploadLayerPart
                  - ecr:CompleteLayerUpload
              - Resource: '*'
                Effect: Allow
                Action:
                  - ec2:CreateNetworkInterface
                  - ec2:DescribeDhcpOptions
                  - ec2:DescribeNetworkInterfaces
                  - ec2:DeleteNetworkInterface
                  - ec2:DescribeSubnets
                  - ec2:DescribeSecurityGroups
                  - ec2:DescribeVpcs
                  - ec2:CreateNetworkInterfacePermission

  # Role used to give CodePipeline to release a build.
  CodePipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              # Allow codepipeline to put artifacts in the S3 bucket
              # as well as get artifacts back out of it.
              - Resource:
                  - !Sub arn:aws:s3:::${ArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
              # Allow codepipeline to build code builds
              # Allow codepipeline to deploy cloudformation stacks
              - Resource: "*"
                Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                  - iam:PassRole
                  - cloudformation:CreateChangeSet
                  - cloudformation:CreateStack
                  - cloudformation:CreateUploadBucket
                  - cloudformation:DeleteStack
                  - cloudformation:Describe*
                  - cloudformation:List*
                  - cloudformation:UpdateStack
                  - cloudformation:ValidateTemplate
                  - cloudformation:ExecuteChangeSet

  # CloudFormation deployment role. This role is passed by CodeBuild to
  # CloudFormation to use when setting up the application resources
  CloudFormationDeployRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: deploy-stack
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "iam:*"
                  - "ec2:*"
                  - "ecs:*"
                  - "elasticloadbalancing:*"
                  - "autoscaling:*"
                  - "logs:*"
                  - "application-autoscaling:*"
                  - "cloudwatch:*"
                  - "route53:*"
                  - "rds:*"
                  - "kms:*"
                  - "eks:*"
                  - "elasticache:*"
                Resource: "*"

  # While the build is in progress we need a place to store artifacts
  ArtifactBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain

  # Datadog Integration
  # https://docs.datadoghq.com/integrations/amazon_web_services/?tab=allpermissions#setup
  DatadogAWSIntegrationRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              AWS: !Sub ${DdAcctId}
            Condition:
              StringEquals:
                sts:ExternalId: !Sub ${DdExtId}
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess'
        - 'arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess'
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource: '*'
                Effect: Allow
                Action:
                  - budgets:ViewBudget
                  - ecs:Describe*
                  - ecs:List*
                  - elasticache:Describe*
                  - elasticache:List*
                  - rds:Describe*
                  - rds:List*
                  - route53:List*
                  - s3:GetBucketLogging
                  - s3:GetBucketLocation
                  - s3:GetBucketNotification
                  - s3:GetBucketTagging
                  - s3:ListAllMyBuckets
                  - s3:PutBucketNotification
                  - sns:List*
                  - sns:Publish

  DatadogAWSIntegrationResource:
    Type: 'Datadog::Integrations::AWS'
    Properties:
      AccountID: !Sub ${AWS::AccountId}
      RoleName: !Ref DatadogAWSIntegrationRole
      HostTags:
        - !Sub "pipeline:${PipelineName}"
        - !Sub "env:${EnvironmentName}"
      DatadogCredentials:
        ApiKey: !Sub ${DdApiKey}
        ApplicationKey: !Sub ${DdAppKey}

  # This is the definition of how to build the code in the repository
  CodeBuildProjectKong:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                docker: 18
            pre_build:
              commands:
                - $(aws ecr get-login --no-include-email)
                - TAG="$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)"
                - IMAGE_URI="${REPOSITORY_URI}:${PREFIX}-${TAG}"
            build:
              commands:
                - docker build --tag "${IMAGE_URI}-kong" .
            post_build:
              commands:
                - docker push "${IMAGE_URI}-kong"
                - printf '{"ImageUri":"%s"}' "${IMAGE_URI}-kong" > build-kong.json
          artifacts:
            files:
                - build-kong.json
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:4.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: REPOSITORY_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${Repository}
          - Name: PREFIX
            Value: !Sub ${PipelineName}-${EnvironmentName}
      Cache:
        Type: LOCAL
        Modes: # You can specify one or more cache mode,
          - LOCAL_CUSTOM_CACHE
          - LOCAL_DOCKER_LAYER_CACHE
          - LOCAL_SOURCE_CACHE
      Name: !Sub ${AWS::StackName}-kong
      ServiceRole: !Ref CodeBuildServiceRole

  CodeBuildProjectKonga:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                docker: 18
            pre_build:
              commands:
                - $(aws ecr get-login --no-include-email)
                - TAG="$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)"
                - IMAGE_URI="${REPOSITORY_URI}:${PREFIX}-${TAG}"
            build:
              commands:
                - docker build --tag "${IMAGE_URI}-konga" .
            post_build:
              commands:
                - docker push "${IMAGE_URI}-konga"
                - printf '{"ImageUri":"%s"}' "${IMAGE_URI}-konga" > build-konga.json
          artifacts:
            files:
                - build-konga.json
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:4.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: REPOSITORY_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${Repository}
          - Name: PREFIX
            Value: !Sub ${PipelineName}-${EnvironmentName}
      Cache:
        Type: LOCAL
        Modes: # You can specify one or more cache mode,
          - LOCAL_CUSTOM_CACHE
          - LOCAL_DOCKER_LAYER_CACHE
          - LOCAL_SOURCE_CACHE
      Name: !Sub ${AWS::StackName}-konga
      ServiceRole: !Ref CodeBuildServiceRole

  CodeBuildProjectMPContribs:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                docker: 18
            pre_build:
              commands:
                - $(aws ecr get-login --no-include-email)
                - TAG="$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)"
                - IMAGE_URI="${ECR_URI}/${REPOSITORY}:${PREFIX}-${TAG}"
            build:
              commands:
                - docker build --tag "${IMAGE_URI}-portal" mpcontribs-portal
                - docker build --tag "${IMAGE_URI}-api" --build-arg MAPI_KEY=${MAPI_KEY} mpcontribs-api
                - docker build --tag "${IMAGE_URI}-gateway" mpcontribs-sidecars/kernel_gateway
                - docker build --tag "${IMAGE_URI}-chrome" mpcontribs-sidecars/chrome
                - docker build --tag "${IMAGE_URI}-datadog" mpcontribs-sidecars/datadog-agent
            post_build:
              commands:
                - docker push "${IMAGE_URI}-portal"
                - docker push "${IMAGE_URI}-api"
                - docker push "${IMAGE_URI}-gateway"
                - docker push "${IMAGE_URI}-chrome"
                - docker push "${IMAGE_URI}-datadog"
                - printf '{"Tag":"%s"}' "${TAG}" > tag.json
          artifacts:
            files:
                - tag.json
      Environment:
        ComputeType: BUILD_GENERAL1_MEDIUM
        Image: aws/codebuild/standard:4.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: ECR_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com
          - Name: REPOSITORY
            Value: !Sub ${Repository}
          - Name: PREFIX
            Value: !Sub ${PipelineName}-${EnvironmentName}
          - Name: MAPI_KEY
            Value: !Ref 'MapiKey'
      Cache:
        Type: LOCAL
        Modes: # You can specify one or more cache mode,
          - LOCAL_CUSTOM_CACHE
          - LOCAL_DOCKER_LAYER_CACHE
          - LOCAL_SOURCE_CACHE
      Name: !Sub ${AWS::StackName}-MPContribs
      ServiceRole: !Ref CodeBuildServiceRole

  CodeBuildProjectMPWeb:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          env:
            parameter-store:
              build_ssh_key: "build_ssh_key"
          phases:
            install:
              runtime-versions:
                docker: 18
            pre_build:
              commands:
                - $(aws ecr get-login --no-include-email)
                - TAG="$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)"
                - IMAGE_URI="${REPOSITORY_URI}:${PREFIX}-${TAG}"
                - mkdir -p ~/.ssh
                - echo "$build_ssh_key" > ~/.ssh/id_rsa
                - chmod 600 ~/.ssh/id_rsa
                #- eval "$(ssh-agent -s)"
                #- ssh-add ~/.ssh/id_rsa
                - ssh-keygen -F github.com || ssh-keyscan github.com >> ~/.ssh/known_hosts
                - git config --global url."git@<EMAIL>:".insteadOf "https://github.com/"
                - git init
                - git remote add origin <EMAIL>@github.<EMAIL>:materialsproject/web.git
                - git fetch
                - git checkout -tf origin/release
                - git submodule init
                - git submodule update --recursive  # TODO check api branch
            build:
              commands:
                - docker build --tag "${IMAGE_URI}-mpweb" .
            post_build:
              commands:
                - docker push "${IMAGE_URI}-mpweb"
                - printf '{"ImageUri":"%s"}' "${IMAGE_URI}-mpweb" > build-mpweb.json
          artifacts:
            files:
                - build-mpweb.json
      Environment:
        ComputeType: BUILD_GENERAL1_MEDIUM
        Image: aws/codebuild/standard:4.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: REPOSITORY_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${Repository}
          - Name: PREFIX
            Value: !Sub ${PipelineName}-${EnvironmentName}
      Cache:
        Type: LOCAL
        Modes: # You can specify one or more cache mode,
          - LOCAL_CUSTOM_CACHE
          - LOCAL_DOCKER_LAYER_CACHE
          - LOCAL_SOURCE_CACHE
      Name: !Sub ${AWS::StackName}-mpweb
      ServiceRole: !Ref CodeBuildServiceRole

  CodeBuildProjectMPWebApi:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                docker: 18
            pre_build:
              commands:
                - $(aws ecr get-login --no-include-email)
                - TAG="$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)"
                - IMAGE_URI="${REPOSITORY_URI}:${PREFIX}-${TAG}"
            build:
              commands:
                - docker build --tag "${IMAGE_URI}-mpwebapi" .
            post_build:
              commands:
                - docker push "${IMAGE_URI}-mpwebapi"
                - printf '{"ImageUri":"%s"}' "${IMAGE_URI}-mpwebapi" > build-mpwebapi.json
          artifacts:
            files:
                - build-mpwebapi.json
      Environment:
        ComputeType: BUILD_GENERAL1_MEDIUM
        Image: aws/codebuild/standard:4.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: REPOSITORY_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${Repository}
          - Name: PREFIX
            Value: !Sub ${PipelineName}-${EnvironmentName}
      Cache:
        Type: LOCAL
        Modes: # You can specify one or more cache mode,
          - LOCAL_CUSTOM_CACHE
          - LOCAL_DOCKER_LAYER_CACHE
          - LOCAL_SOURCE_CACHE
      Name: !Sub ${AWS::StackName}-mpwebapi
      ServiceRole: !Ref CodeBuildServiceRole


  # This pipeline defines the steps to build, deploy, and release the application
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: !Sub ${PipelineName}-${EnvironmentName}
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
      Stages:

        # First we have to pull the source code from the Github repository.
        - Name: Source
{'fraction_non_alphanumeric': 0.08952563042579578, 'fraction_numerical': 0.007957833815626291, 'mean_word_length': 1.554279680591302, 'pattern_counts': {'":': 10, '<': 10, '<?xml version=': 0, '>': 26, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1975734', 'n_tokens_mistral': 11292, 'n_tokens_neox': 10695, 'n_words': 2345}