Merge branch 'feat/support-parallel-matrix' into 'main'

To implement the **dynamic way**, your deployment script shall simply generate a `environment_url.txt` file in the working directory, containing only

the dynamically generated url. When detected by the template, it will use it as the newly deployed environment url.

### Multiple environments support

The GCP template allows deploying multiple environments in parallel. Use cases of this include:

- monorepo, where a single Git repository might host several separate deployable components or apps,

- multi-instances deployment of the same application.

This feature can be enabled using the [parallel matrix jobs](https://docs.gitlab.com/ee/ci/yaml/#parallelmatrix)

pattern at the `.aws-env-base` job level (this is the top parent job of all deployment jobs). 

Environments namespacing is ensured by the `GCP_ENVIRONMENT_NAMESPACE` variable (must start with a slash `/`).

Here is the example of the `.gitlab-ci.yml` file for a project deploying both a frontend and a backend applications:

```yaml

.gcp-env-base:

  parallel:

    matrix:

      - GCP_ENVIRONMENT_NAMESPACE: "/front"

        # GCP deployment scripts are located in the ./front/ directory

        AWS_SCRIPTS_DIR: "front"

      - GCP_ENVIRONMENT_NAMESPACE: "/back"

        # GCP deployment scripts are located in the ./back/ directory

        AWS_SCRIPTS_DIR: "back"

# ⚠ on_stop must be unset when defining parallel:matrix environments

# see: https://gitlab.com/gitlab-org/gitlab/-/issues/332247

gcp-review:

  environment:

    on_stop: null

```

The above configuration will deploy 2 environments on each pipeline:

- on feature branches: `review/front/$CI_COMMIT_REF_NAME` and `review/back/$CI_COMMIT_REF_NAME`

- on the integration branch: `integration/front` and `integration/back` 

- on the production branch: `staging/front` and `staging/back` (and finally `production/front` and `production/back`)

### Deployment output variables

Each deployment job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ci/yaml/artifacts_reports/#artifactsreportsdotenv)):

You may also add and propagate your own custom variables, by pushing them to the `gcloud.env` file in your [deployment script](#deployment-and-cleanup-scripts).

> [!important]

> If [multiple environments](#multiple-environments-support) are configured, the output variables are prefixed with a 

> sluggified value of the `GCP_ENVIRONMENT_NAMESPACE` variable (stripped of punctuation characters and converted to lowercase):

> 

> * `<namespace_slug>_environment_type`: set to the type of environment (`review`, `integration`, `staging` or `production`),

> * `<namespace_slug>_environment_name`: the application name (see below),

> * `<namespace_slug>_environment_url`: set to the environment URL (whether determined statically or dynamically).

> 

> The output dotenv file will be `gcloud.env.<namespace_slug>` instead, and the dynamic variable `${environment_namespace}` can be used in your scripts and manifests to access the contextual value of `<namespace_slug>`.

## Configuration reference

### Secrets management

| :lock: `GCP_KEY_FILE`    | Default [Service Account key file](https://cloud.google.com/bigquery/docs/authentication/service-account-file) | _none_ |

| `base-app-name` / `GCP_BASE_APP_NAME` | Base application name                  | `$CI_PROJECT_NAME` ([see GitLab doc](https://docs.gitlab.com/ci/variables/predefined_variables/)) |

| `environment-url` / `GCP_ENVIRONMENT_URL`    | Default environments url _(only define for static environment URLs declaration)_<br/>_supports late variable expansion (ex: `https://%{environment_name}.gcloud.acme.com`)_ | _none_ |

| `environment-namespace` / `GCP_ENVIRONMENT_NAMESPACE` | Extra [GitLab environments](https://docs.gitlab.com/ci/environments/) namespace _(only required when deploying [multiple environments](#multiple-environments-support))_<br/>:warning: must start with a slash `/` | _none_ |

| `scripts-dir` / `GCP_SCRIPTS_DIR` | Directory where Google Cloud scripts (deploy & cleanup) are located | `.` _(root project dir)_ |

### Review environments configuration

      "type": "url",

      "description": "The default environments url _(only define for static environment URLs declaration)_\n\n_supports late variable expansion (ex: `https://%{environment_name}.gcloud.acme.com`)_"

    },

    {

      "name": "GCP_ENVIRONMENT_NAMESPACE",

      "description": "Extra [GitLab environments](https://docs.gitlab.com/ci/environments/) namespace _(only required when deploying multiple environments)_\n\n:warning: must start with a slash `/`",

      "advanced": true

    },

    {

      "name": "GCP_SCRIPTS_DIR",

      "description": "Directory where Google Cloud scripts (deploy & cleanup) are located",

  GCP_PROD_OIDC_PROVIDER: $[[ inputs.prod-oidc-provider ]]

  GCP_PROD_OIDC_ACCOUNT: $[[ inputs.prod-oidc-account ]]

.gcp-base:

.gcp-env-base:

  id_tokens:

    GCP_JWT:

      aud: "$GCP_OIDC_AUD"

        _supports late variable expansion (ex: `https://%{environment_name}.gcloud.acme.com`)_

      default: ''

    environment-namespace:

      description: |-

        Extra [GitLab environments](https://docs.gitlab.com/ci/environments/) namespace _(only required when deploying multiple environments)_

        :warning: must start with a slash `/`

      default: ''

    scripts-dir:

      description: Directory where Google Cloud scripts (deploy & cleanup) are located

      default: .

  GCP_WORKLOAD_IDENTITY_PROVIDER: $[[ inputs.workload-identity-provider ]]

  GCP_SERVICE_ACCOUNT: $[[ inputs.service-account ]]

  GCP_ENVIRONMENT_URL: $[[ inputs.environment-url ]]

  GCP_ENVIRONMENT_NAMESPACE: $[[ inputs.environment-namespace ]]

  GCP_REVIEW_PROJECT: $[[ inputs.review-project ]]

  GCP_REVIEW_APP_NAME: $[[ inputs.review-app-name ]]

  GCP_REVIEW_ENVIRONMENT_URL: $[[ inputs.review-environment-url ]]

    export environment_name=${ENV_APP_NAME:-${GCP_BASE_APP_NAME}${ENV_APP_SUFFIX}}

    export gcp_project_id=$ENV_PROJECT

    environment_url=${ENV_URL:-$GCP_ENVIRONMENT_URL}

    environment_namespace=$(echo "$GCP_ENVIRONMENT_NAMESPACE" | tr -d '[:punct:]' | tr '[:upper:]' '[:lower:]')

    export environment_namespace

    # backwards compatibility

    export env=$environment_type

    log_info "--- \$gcp_project_id: \\e[33;1m${gcp_project_id}\\e[0m"

    # unset any upstream deployment env & artifacts

    rm -f gcloud.env

    rm -f gcloud.env*

    rm -f environment_url.txt

    deployscript=$(ls -1 "$GCP_SCRIPTS_DIR/gcp-deploy-${environment_type}.sh" 2>/dev/null || ls -1 "$GCP_SCRIPTS_DIR/gcp-deploy.sh" 2>/dev/null || echo "")

    else

      echo "$environment_url" > environment_url.txt

    fi

    echo -e "environment_type=$environment_type\\nenvironment_name=$environment_name\\nenvironment_url=$environment_url" >> gcloud.env

    chmod 644 environment_url.txt gcloud.env

    prefix="${environment_namespace:+${environment_namespace}_}"

    dotenvfile="gcloud.env${environment_namespace:+.${environment_namespace}}"

    {

      echo "${prefix}environment_type=${environment_type}"

      echo "${prefix}environment_name=${environment_name}"

      echo "${prefix}environment_url=${environment_url}"

    } >> "$dotenvfile"

    chmod 644 environment_url.txt "$dotenvfile"

  }

  # environment cleanup function

  before_script:

    - !reference [.gcp-scripts]

    - install_ca_certs "${CUSTOM_CA_CERTS:-$DEFAULT_CA_CERTS}"

    - gcp_auth

# Deploy job prototype

# Environment job prototype (base for both deploy and cleanup jobs)

# Can be extended to define a concrete environment

#

# @arg ENV_TYPE      : environment type

# @arg ENV_APP_SUFFIX: env-specific application suffix

# @arg ENV_PROJECT   : env-specific GCP Project ID

# @arg ENV_KEY_FILE  : env-specific GCP API key file (JSON)

# @arg ENV_URL       : env-specific application url

.gcp-deploy:

.gcp-env-base:

  extends: .gcp-base

  stage: deploy

  variables:

    ENV_APP_SUFFIX: "-$CI_ENVIRONMENT_SLUG"

  before_script:

    - !reference [.gcp-base, before_script]

    - gcp_auth

  environment:

    name: ${ENV_TYPE}${GCP_ENVIRONMENT_NAMESPACE}

  resource_group: ${ENV_TYPE}${GCP_ENVIRONMENT_NAMESPACE}

# Deploy job prototype

# Can be extended to define a concrete environment

# @arg ENV_URL       : env-specific application url

.gcp-deploy:

  extends: .gcp-env-base

  script:

    - gcp_deploy

  artifacts:

    paths:

      - environment_url.txt

    reports:

      dotenv: gcloud.env

      dotenv: gcloud.env*

  environment:

    url: "$environment_url" # can be either static or dynamic

# @arg ENV_PROJECT   : env-specific GCP Project ID

# @arg ENV_KEY_FILE  : env-specific GCP API key file (JSON)

.gcp-cleanup:

  extends: .gcp-base

  stage: deploy

  extends: .gcp-env-base

  # force no dependencies

  dependencies: []

  variables:

    ENV_APP_SUFFIX: "-$CI_ENVIRONMENT_SLUG"

  script:

    - gcp_delete

  environment:

    ENV_KEY_FILE: "$GCP_REVIEW_KEY_FILE"

    ENV_URL: "${GCP_REVIEW_ENVIRONMENT_URL}"

  environment:

    name: review/$CI_COMMIT_REF_NAME

    name: ${ENV_TYPE}${GCP_ENVIRONMENT_NAMESPACE}/${CI_COMMIT_REF_NAME}

    # ⚠ on_stop must be unset when defining parallel:matrix environments

    # see: https://gitlab.com/gitlab-org/gitlab/-/issues/332247

    on_stop: gcp-cleanup-review

    auto_stop_in: "$GCP_REVIEW_AUTOSTOP_DURATION"

  resource_group: review/$CI_COMMIT_REF_NAME

  resource_group: ${ENV_TYPE}${GCP_ENVIRONMENT_NAMESPACE}/${CI_COMMIT_REF_NAME}

  rules:

    # exclude tags

    - if: $CI_COMMIT_TAG

    ENV_KEY_FILE: "$GCP_REVIEW_KEY_FILE"

    ENV_URL: "${GCP_REVIEW_ENVIRONMENT_URL}"

  environment:

    name: review/$CI_COMMIT_REF_NAME

    name: ${ENV_TYPE}${GCP_ENVIRONMENT_NAMESPACE}/${CI_COMMIT_REF_NAME}

    action: stop

  resource_group: review/$CI_COMMIT_REF_NAME

  resource_group: ${ENV_TYPE}${GCP_ENVIRONMENT_NAMESPACE}/${CI_COMMIT_REF_NAME}

  rules:

    # exclude tags

    - if: $CI_COMMIT_TAG

    ENV_OIDC_ACCOUNT: "$GCP_INTEG_OIDC_ACCOUNT"

    ENV_KEY_FILE: "$GCP_INTEG_KEY_FILE"

    ENV_URL: "${GCP_INTEG_ENVIRONMENT_URL}"

  environment:

    name: integration

  resource_group: integration

  rules:

    # exclude if $GCP_INTEG_PROJECT not set

    - if: '$GCP_INTEG_PROJECT == null || $GCP_INTEG_PROJECT == ""'

    ENV_OIDC_ACCOUNT: "$GCP_STAGING_OIDC_ACCOUNT"

    ENV_KEY_FILE: "$GCP_STAGING_KEY_FILE"

    ENV_URL: "${GCP_STAGING_ENVIRONMENT_URL}"

  environment:

    name: staging

  resource_group: staging

  rules:

    # exclude if $GCP_STAGING_PROJECT not set

    - if: '$GCP_STAGING_PROJECT == null || $GCP_STAGING_PROJECT == ""'

    ENV_OIDC_ACCOUNT: "$GCP_PROD_OIDC_ACCOUNT"

    ENV_KEY_FILE: "$GCP_PROD_KEY_FILE"

    ENV_URL: "${GCP_PROD_ENVIRONMENT_URL}"

  environment:

    name: production

  resource_group: production

  rules:

    # exclude non-production branches

    - if: '$CI_COMMIT_REF_NAME !~ $PROD_REF'