.gitlab-ci.yml

include:
  - "deploy/gitlab/**.yml"

default:
  image: "${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-app-builder-debian@sha256:5776b7ff404573a51a03e680d556dbbd70b27d5e053001e2f7144fa553b41d70"

variables:
  CACHE_COMPRESSION_LEVEL: "fastest"
  FF_USE_FASTZIP: "true"
  FLUTTER_APP_PROJECT_DIR: "wallet_app"
  CARGO_HOME: "${CI_PROJECT_DIR}/.cargo"
  CARGO_INCREMENTAL: 0
  CARGO_PROFILE_TEST_DEBUG: "line-tables-only"
  APP_BUILD_OFFSET: 861

.env-ont:
  environment:
    name: ${K8S_CLUSTER}
    deployment_tier: development
    action: access

.env-demo:
  environment:
    name: ${K8S_DEMO_CLUSTER}
    deployment_tier: staging
    action: access

.env-ont-k8s:
  extends: .env-ont
  environment:
    action: start
    kubernetes:
      namespace: ${K8S_NAMESPACE}

.env-demo-k8s:
  extends: .env-demo
  environment:
    kubernetes:
      namespace: ${K8S_DEMO_NAMESPACE}

.env-macos-runner:
  before_script:
    - set -euo pipefail
    - kubectl config set-cluster s15m --server="$K8S_CLUSTER_SERVER"
    - kubectl config set-context s15m --cluster=s15m --namespace="$K8S_NAMESPACE"
    - kubectl config set-credentials macos-runner-service-account --token="$(echo "$MACOS_RUNNER_SERVICE_ACCOUNT_TOKEN_B64" | base64 -d)"
    - kubectl config set-context s15m --user=macos-runner-service-account
    - kubectl config use-context s15m

.default-branch:
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: never
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      variables:
        CACHE_POLICY: pull-push

.release-tag:
  before_script:
    - RELEASE_VERSION="$(echo $CI_COMMIT_TAG | grep -E '^v[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+$' | sed -E 's/^v//' || true)"
  rules:
    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
      variables:
        CACHE_POLICY: pull

.merge-request:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      variables:
        CACHE_POLICY: pull

.merge-request-manual:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      variables:
        CACHE_POLICY: pull
      when: manual
      # jobs that have "when: manual" in rules are non optional in Gitlab CI/CD
      allow_failure: true

.default-or-release:
  rules:
    - !reference [.default-branch, rules]
    - !reference [.release-tag, rules]

.default-or-merge-request:
  rules:
    - !reference [.default-branch, rules]
    - !reference [.merge-request, rules]

.default-or-release-or-merge-request:
  rules:
    - !reference [.default-or-release, rules]
    - !reference [.merge-request, rules]

.default-or-release-or-merge-request-manual:
  rules:
    - !reference [.default-or-release, rules]
    - !reference [.merge-request-manual, rules]

.ruby-cache:
  cache:
    key: ruby-${CI_COMMIT_REF_SLUG}
    paths:
      - "vendor/ruby"
  before_script:
    - ruby -v
    - bundle config set --local path "vendor/ruby"

.ruby-cache-macos:
  extends: .ruby-cache
  cache:
    key: ruby-macos-${CI_COMMIT_REF_SLUG}

test-flutter:
  rules: !reference [.default-or-release-or-merge-request, rules]
  image:
    name: "${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-app-builder-flutter@sha256:0826233b542eb8cf19bfff6585a67c43b93e1bd9463ae3a6e60f629acc3c4653"
  script:
    - set -euxo pipefail
    - flutter --version
    - (cd $FLUTTER_APP_PROJECT_DIR && flutter pub get --enforce-lockfile)
    - flutter analyze $FLUTTER_APP_PROJECT_DIR
    - (cd $FLUTTER_APP_PROJECT_DIR; flutter test --exclude-tags=golden --coverage --branch-coverage --coverage-path coverage/lcov.info --file-reporter "json:build/reports/test-results.json")
  artifacts:
    paths:
      - $FLUTTER_APP_PROJECT_DIR/coverage/lcov.info
      - $FLUTTER_APP_PROJECT_DIR/build/reports/test-results.json

test-flutter-ui:
  rules: !reference [.default-or-release-or-merge-request, rules]
  when: manual
  tags:
    - macos
  image: sonoma-wallet:0.1.3
  artifacts:
    name: "ui-test-failures"
    when: on_failure
    paths:
      - "**/failures/*.png"
  script:
    - set -euxo pipefail
    - flutter --version
    - (cd $FLUTTER_APP_PROJECT_DIR; flutter test --tags=golden)

# Checks .arb files for unused keys, indicating an update to Lokalise might be in order
verify-flutter-localizations:
  rules: !reference [.default-or-release-or-merge-request, rules]
  image:
    name: "${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-app-builder-flutter@sha256:0826233b542eb8cf19bfff6585a67c43b93e1bd9463ae3a6e60f629acc3c4653"
  script:
    - set -euxo pipefail
    - flutter --version
    - (cd $FLUTTER_APP_PROJECT_DIR; flutter pub get --enforce-lockfile)
    - (cd $FLUTTER_APP_PROJECT_DIR; dart run translations_cleaner list-unused-terms) # List any unused keys
    - (cd $FLUTTER_APP_PROJECT_DIR; dart run translations_cleaner list-unused-terms --abort-on-unused) # Fail if unused keys are found
  allow_failure: true # Only meant as a warning, our current workflow might introduce keys from other WIP MRs, which could cause false positives.

test-codegen:
  rules: !reference [.default-or-release-or-merge-request, rules]
  image:
    name: "${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-app-builder-flutter-rust@sha256:a220cb6b7f8161982d62dcb17e544ce09892c5f57564cd06f599d95d05e596fa"
  cache: !reference [.rust-cache, cache]
  script:
    - set -euxo pipefail
    - (cd $FLUTTER_APP_PROJECT_DIR && flutter pub get --enforce-lockfile)
    - cargo run --manifest-path wallet_core/flutter_rust_bridge_codegen/Cargo.toml --locked
    - (cd $FLUTTER_APP_PROJECT_DIR && flutter pub run build_runner build --delete-conflicting-outputs)
    - dart format wallet_app --line-length 120
    - git diff
    - if [ $(git diff --shortstat | wc -l) -gt 0 ]; then echo "Code generation results in different files!"; exit 1; fi

build-wallet-web:
  rules: !reference [.default-or-release-or-merge-request, rules]
  image:
    name: "$HARBOR_REGISTRY/$HARBOR_NLW_PROJECT/nl-wallet-app-builder-node@sha256:668558bdce476733f02766e5e393942eeb8420e1ba31def4c98e7326b12232bf"
  variables:
    VITE_HELP_BASE_URL: https://$EXTERNAL_HOSTNAME_PROD
  script:
    - set -euxo pipefail
    - (cd wallet_web; npm ci && npm run type-check && npm run coverage -- --run)
    - (cd wallet_web; CUSTOM_ELEMENT=false npm run build)
    - (cd wallet_web; EMPTY_OUTPUT_DIR=false CUSTOM_ELEMENT=true npm run build)
    - WALLET_WEB_SHA256_FILENAME=$(cat wallet_web/dist/nl-wallet-web.iife.js | openssl sha256 -binary | base64 | tr '/+' '_-' | tr -d '=\n') # url safe to prevent '/' to appear in filename
    - export WALLET_WEB_SHA256_FILENAME
    - WALLET_WEB_FILENAME="nl-wallet-web.${WALLET_WEB_SHA256_FILENAME}.iife.js"
    - export WALLET_WEB_FILENAME
    - cp wallet_web/dist/nl-wallet-web.iife.js wallet_core/mock_relying_party/assets/${WALLET_WEB_FILENAME}
    - export WALLET_WEB_SHA256=$(cat wallet_core/mock_relying_party/assets/${WALLET_WEB_FILENAME} | openssl sha256 -binary | base64)
    # take the sha256 hash of every JS files and format them accordingly
    - JS_HASHES=$(find wallet_core/mock_relying_party/assets -regex '.*\.js' -exec bash -c 'echo sha256-`openssl sha256 -binary "$1" | base64`' _ {} \; | tr '\n' ';' | sed "s/;$/'\n/; s/^/'/; s/;/' '/g")
    - CSP_SCRIPT_SRC_MRP=${JS_HASHES:-\'none\'}
    - export CSP_SCRIPT_SRC_MRP
    # take the sha256 hash of the inlined style and add it to the default directive
    - STYLE_INJECTED_HASH=$(echo \'sha256-`cat wallet_web/dist/style.css | tr -d "\n" | openssl sha256 -binary | base64`\')
    - CSP_STYLE_SRC_MRP="'self' ${STYLE_INJECTED_HASH}"
    - export CSP_STYLE_SRC_MRP
    - mkdir -p wallet_core/mock_relying_party/hashes
    - echo $CSP_SCRIPT_SRC_MRP | base64 > wallet_core/mock_relying_party/hashes/csp_script_src_mrp_base64.txt
    - echo $CSP_STYLE_SRC_MRP | base64 > wallet_core/mock_relying_party/hashes/csp_style_src_mrp_base64.txt
    - echo $WALLET_WEB_FILENAME > wallet_core/mock_relying_party/hashes/wallet_web_filename.txt
    - echo $WALLET_WEB_SHA256 > wallet_core/mock_relying_party/hashes/wallet_web_sha256.txt
  artifacts:
    paths:
      - wallet_web/dist
      - wallet_web/coverage
      - wallet_core/mock_relying_party/assets/nl-wallet-web.*
      - wallet_core/mock_relying_party/hashes/*.txt

.run-wp-migrations:
  needs:
    - job: build-wp-migrations-image
      artifacts: false
  variables:
    WALLET_PROVIDER_MIGRATIONS_IMAGE: ${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-provider-migrations:${CI_COMMIT_SHORT_SHA}
  script:
    - envsubst < deploy/kubernetes/wallet-provider-migration-job.yaml | kubectl apply -f -
    - kubectl wait --for=condition=complete --timeout=300s job -l app=wallet-provider-migrations

run-wp-migrations-ont:
  extends: [.env-ont-k8s, .run-wp-migrations]
  rules: !reference [.default-or-merge-request, rules]

run-wp-migrations-demo:
  extends: [.env-demo-k8s, .run-wp-migrations]
  rules: !reference [.release-tag, rules]

.deploy-wallet-provider:
  needs:
    - job: build-wallet-provider-image
      artifacts: false
  variables:
    WALLET_PROVIDER_IMAGE: ${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-provider:${CI_COMMIT_SHORT_SHA}
  script:
    - envsubst < deploy/kubernetes/servicemonitors.yaml | kubectl apply -f -
    - kubectl apply -f deploy/kubernetes/wallet-provider-configmap.yaml
    - envsubst < deploy/kubernetes/wallet-provider-deployment.yaml | kubectl apply -f -
    - envsubst < deploy/kubernetes/wallet-provider-ingress.yaml | kubectl apply -f -
    - kubectl apply -f deploy/kubernetes/wallet-provider-service.yaml
    - kubectl apply -f deploy/kubernetes/wallet-provider-network-policies.yaml
    - kubectl rollout status deployment/wallet-provider

deploy-wallet-provider-ont:
  extends: [.env-ont-k8s, .deploy-wallet-provider]
  rules: !reference [.default-or-merge-request, rules]
  needs:
    - !reference [.deploy-wallet-provider, needs]
    - job: run-wp-migrations-ont
      artifacts: false
  variables:
    WALLET_PROVIDER_EXTERNAL_HOSTNAME: $WALLET_PROVIDER_EXTERNAL_HOSTNAME_ONT
    WALLET_PROVIDER_INTERNAL_HOSTNAME: $WALLET_PROVIDER_INTERNAL_HOSTNAME_ONT

deploy-wallet-provider-demo:
  extends: [.env-demo-k8s, .deploy-wallet-provider]
  rules: !reference [.release-tag, rules]
  needs:
    - !reference [.deploy-wallet-provider, needs]
    - job: run-wp-migrations-demo
      artifacts: false
  variables:
    WALLET_PROVIDER_EXTERNAL_HOSTNAME: $WALLET_PROVIDER_EXTERNAL_HOSTNAME_DEMO
    WALLET_PROVIDER_INTERNAL_HOSTNAME: $WALLET_PROVIDER_INTERNAL_HOSTNAME_DEMO

.run-mrp-vs-migrations:
  needs:
    - job: build-ws-migrations-image
      artifacts: false
  variables:
    WALLET_SERVER_MIGRATION_IMAGE: ${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-server-migrations:${CI_COMMIT_SHORT_SHA}
  script:
    - envsubst < deploy/kubernetes/mrp-verification-server-migration-job.yaml | kubectl apply -f -
    - kubectl wait --for=condition=complete --timeout=300s job -l app=mrp-verification-server-migrations

run-mrp-vs-migrations-ont:
  extends: [.env-ont-k8s, .run-mrp-vs-migrations]
  rules: !reference [.default-or-merge-request, rules]

run-mrp-vs-migrations-demo:
  extends: [.env-demo-k8s, .run-mrp-vs-migrations]
  rules: !reference [.release-tag, rules]

.deploy-mock-relying-party:
  needs:
    - job: build-mock-relying-party-image
      artifacts: false
    - job: build-verification-server-image
      artifacts: false
    - job: build-wallet-web
      artifacts: true
  variables:
    MOCK_RELYING_PARTY_IMAGE: ${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-mock-relying-party:${CI_COMMIT_SHORT_SHA}
    MRP_VERIFICATION_SERVER_IMAGE: ${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-verification-server:${CI_COMMIT_SHORT_SHA}
    UNIVERSAL_LINK_BASE: "https://${UL_HOSTNAME}/deeplink/"
  script:
    - set -euxo pipefail
    - envsubst < deploy/kubernetes/brpproxy-deployment.yaml | kubectl apply -f -
    - kubectl apply -f deploy/kubernetes/brpproxy-service.yaml
    - WALLET_WEB_FILENAME=$(cat wallet_core/mock_relying_party/hashes/wallet_web_filename.txt)
    - export WALLET_WEB_FILENAME
    - WALLET_WEB_SHA256=$(cat wallet_core/mock_relying_party/hashes/wallet_web_sha256.txt)
    - export WALLET_WEB_SHA256
    - envsubst < deploy/kubernetes/mrp-verification-server-deployment.yaml | kubectl apply -f -
    - envsubst < deploy/kubernetes/mrp-verification-server-ingress.yaml | kubectl apply -f -
    - kubectl apply -f deploy/kubernetes/mrp-verification-server-service.yaml
    - kubectl apply -f deploy/kubernetes/mrp-verification-server-network-policies.yaml
    - kubectl rollout status deployment/mrp-verification-server
    - envsubst < deploy/kubernetes/mock-relying-party-deployment.yaml | kubectl apply -f -
    - CSP_SCRIPT_SRC_MRP=$(cat wallet_core/mock_relying_party/hashes/csp_script_src_mrp_base64.txt | base64 -d)
    - export CSP_SCRIPT_SRC_MRP
    - CSP_STYLE_SRC_MRP="$(cat wallet_core/mock_relying_party/hashes/csp_style_src_mrp_base64.txt | base64 -d)"
    - export CSP_STYLE_SRC_MRP
    - envsubst < deploy/kubernetes/mock-relying-party-ingress.yaml | kubectl apply -f -
    - kubectl apply -f deploy/kubernetes/mock-relying-party-service.yaml
    - kubectl rollout status deployment/mock-relying-party

deploy-mock-relying-party-ont:
  extends: [.env-ont-k8s, .deploy-mock-relying-party]
  rules: !reference [.default-or-merge-request, rules]
  needs:
    - !reference [.deploy-mock-relying-party, needs]
    - job: run-mrp-vs-migrations-ont
      artifacts: false
  variables:
    MOCK_RELYING_PARTY_EXTERNAL_HOSTNAME: $MOCK_RELYING_PARTY_EXTERNAL_HOSTNAME_ONT
    MRP_VERIFICATION_SERVER_INTERNAL_HOSTNAME: $MRP_VERIFICATION_SERVER_INTERNAL_HOSTNAME_ONT
    MRP_VERIFICATION_SERVER_EXTERNAL_HOSTNAME: $MRP_VERIFICATION_SERVER_EXTERNAL_HOSTNAME_ONT
    DIGID_CONNECTOR_EXTERNAL_HOSTNAME: $DIGID_CONNECTOR_EXTERNAL_HOSTNAME_ONT
    UL_HOSTNAME: $APP_EXTERNAL_HOSTNAME_ONT

deploy-mock-relying-party-demo:
  extends: [.env-demo-k8s, .deploy-mock-relying-party]
  needs:
    - !reference [.deploy-mock-relying-party, needs]
    - job: run-mrp-vs-migrations-demo
      artifacts: false
  rules: !reference [.release-tag, rules]
  variables:
    MOCK_RELYING_PARTY_EXTERNAL_HOSTNAME: $MOCK_RELYING_PARTY_EXTERNAL_HOSTNAME_DEMO
    MRP_VERIFICATION_SERVER_INTERNAL_HOSTNAME: $MRP_VERIFICATION_SERVER_INTERNAL_HOSTNAME_DEMO
    MRP_VERIFICATION_SERVER_EXTERNAL_HOSTNAME: $MRP_VERIFICATION_SERVER_EXTERNAL_HOSTNAME_DEMO
    DIGID_CONNECTOR_EXTERNAL_HOSTNAME: $DIGID_CONNECTOR_EXTERNAL_HOSTNAME_DEMO
    UL_HOSTNAME: $APP_EXTERNAL_HOSTNAME_DEMO

.run-pi-migrations:
  needs:
    - job: build-ws-migrations-image
      artifacts: false
  variables:
    PID_ISSUER_MIGRATION_IMAGE: ${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-server-migrations:${CI_COMMIT_SHORT_SHA}
  script:
    - envsubst < deploy/kubernetes/pid-issuer-migration-job.yaml | kubectl apply -f -
    - kubectl wait --for=condition=complete --timeout=300s job -l app=pid-issuer-migrations

run-pi-migrations-ont:
  extends: [.env-ont-k8s, .run-pi-migrations]
  rules: !reference [.default-or-merge-request, rules]

run-pi-migrations-demo:
  extends: [.env-demo-k8s, .run-pi-migrations]
  rules: !reference [.release-tag, rules]

.deploy-pid-issuer:
  needs:
    - job: build-pid-issuer-image
      artifacts: false
  variables:
    PID_ISSUER_IMAGE: ${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-pid-issuer:${CI_COMMIT_SHORT_SHA}
  script:
    - envsubst < deploy/kubernetes/pid-issuer-deployment.yaml | kubectl apply -f -
    - envsubst < deploy/kubernetes/pid-issuer-ingress.yaml | kubectl apply -f -
    - kubectl apply -f deploy/kubernetes/pid-issuer-service.yaml
    - kubectl apply -f deploy/kubernetes/pid-issuer-network-policies.yaml
    - kubectl rollout status deployment/pid-issuer

deploy-pid-issuer-ont:
  extends: [.env-ont-k8s, .deploy-pid-issuer]
  rules: !reference [.default-or-merge-request, rules]
  needs:
    - !reference [.deploy-pid-issuer, needs]
    - job: run-pi-migrations-ont
      artifacts: false
  variables:
    DIGID_CONNECTOR_EXTERNAL_HOSTNAME: $DIGID_CONNECTOR_EXTERNAL_HOSTNAME_ONT
    PID_ISSUER_EXTERNAL_HOSTNAME: $PID_ISSUER_EXTERNAL_HOSTNAME_ONT
    PID_ISSUER_INTERNAL_HOSTNAME: $PID_ISSUER_INTERNAL_HOSTNAME_ONT
    UL_HOSTNAME: $APP_EXTERNAL_HOSTNAME_ONT

deploy-pid-issuer-demo:
  extends: [.env-demo-k8s, .deploy-pid-issuer]
  needs:
    - !reference [.deploy-pid-issuer, needs]
    - job: run-pi-migrations-demo
      artifacts: false
  rules: !reference [.release-tag, rules]
  variables:
    DIGID_CONNECTOR_EXTERNAL_HOSTNAME: $DIGID_CONNECTOR_EXTERNAL_HOSTNAME_DEMO
    PID_ISSUER_EXTERNAL_HOSTNAME: $PID_ISSUER_EXTERNAL_HOSTNAME_DEMO
    PID_ISSUER_INTERNAL_HOSTNAME: $PID_ISSUER_INTERNAL_HOSTNAME_DEMO
    UL_HOSTNAME: $APP_EXTERNAL_HOSTNAME_DEMO

.deploy-gba-hc-converter:
  needs:
    - job: build-gba-hc-converter-image
      artifacts: false
  variables:
    CONVERTER_IMAGE: ${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-gba-hc-converter:${CI_COMMIT_SHORT_SHA}
  script:
    - kubectl create configmap nl-wallet-gba-hc-converter-xml-files --dry-run=client --from-file wallet_core/gba_hc_converter/resources/gba-v-responses -o yaml | kubectl apply -f -
    - kubectl create configmap nl-wallet-gba-hc-converter-zoek-xml --dry-run=client --from-file wallet_core/gba_hc_converter/resources/remote/bsn_zoeken_template.xml -o yaml | kubectl apply -f -
    - envsubst < deploy/kubernetes/${ENV}/gba-hc-converter-deployment.yaml | kubectl apply -f -
    - kubectl apply -f deploy/kubernetes/gba-hc-converter-network-policies.yaml
    - kubectl apply -f deploy/kubernetes/gba-hc-converter-service.yaml
    - kubectl apply -f deploy/kubernetes/gba-hc-converter-volume.yaml
    - kubectl rollout status deployment/gba-hc-converter

deploy-gba-hc-converter-ont:
  extends: [.env-ont-k8s, .deploy-gba-hc-converter]
  rules: !reference [.default-or-merge-request, rules]
  variables:
    ENV: ont

deploy-gba-hc-converter-demo:
  extends: [.env-demo-k8s, .deploy-gba-hc-converter]
  rules: !reference [.release-tag, rules]
  variables:
    ENV: demo

.deploy-preload-gba-v-pod:
  needs:
    - job: build-gba-fetch-image
      artifacts: false
  rules: !reference [.default-or-merge-request, rules]
  when: manual
  variables:
    GBA_FETCH_IMAGE: ${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-gba-fetch:${CI_COMMIT_SHORT_SHA}
  script:
    - kubectl create configmap nl-wallet-gba-hc-converter-zoek-xml --dry-run=client --from-file wallet_core/gba_hc_converter/resources/remote/bsn_zoeken_template.xml -o yaml | kubectl apply -f -
    - kubectl apply -f deploy/kubernetes/gba-hc-converter-volume.yaml
    - envsubst < deploy/kubernetes/${ENV}/preload-gba-v-data-pod.yaml | kubectl apply -f -

deploy-preload-gba-v-pod-ont:
  extends: [.env-ont-k8s, .deploy-preload-gba-v-pod]
  rules: !reference [.default-or-merge-request, rules]
  variables:
    ENV: ont

deploy-preload-gba-v-pod-demo:
  extends: [.env-demo-k8s, .deploy-preload-gba-v-pod]
  rules: !reference [.release-tag, rules]
  variables:
    ENV: demo

.run-encrypt-gba-v-testdata-job:
  needs:
    - job: build-gba-fetch-image
      artifacts: false
  rules: !reference [.default-or-merge-request, rules]
  when: manual
  variables:
    GBA_FETCH_IMAGE: ${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-gba-fetch:${CI_COMMIT_SHORT_SHA}
  script:
    - kubectl create configmap nl-wallet-gba-hc-converter-encrypt-script --dry-run=client --from-file wallet_core/gba_hc_converter/resources/remote/encrypt_all.sh -o yaml | kubectl apply -f -
    - envsubst < deploy/kubernetes/encrypt-gba-v-testdata-job.yaml | kubectl apply -f -
    - kubectl wait --for=condition=complete --timeout=300s job -l app=encrypt-gba-v-testdata

run-encrypt-gba-v-testdata-job-ont:
  extends: [.env-ont-k8s, .run-encrypt-gba-v-testdata-job]
  rules: !reference [.default-or-merge-request, rules]

run-encrypt-gba-v-testdata-job-demo:
  extends: [.env-demo-k8s, .run-encrypt-gba-v-testdata-job]
  rules: !reference [.release-tag, rules]

.deploy-gba-fetch-frontend:
  needs:
    - job: build-gba-fetch-frontend-image
      artifacts: false
  rules: !reference [.default-or-merge-request, rules]
  variables:
    GBA_FETCH_FRONTEND_IMAGE: ${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-gba-fetch-frontend:${CI_COMMIT_SHORT_SHA}
  script:
    - envsubst '$GBA_FETCH_FRONTEND_INTERNAL_HOSTNAME $K8S_NAMESPACE' < deploy/kubernetes/gba-fetch-frontend-ingress.yaml | kubectl apply -f -
    - kubectl apply -f deploy/kubernetes/gba-fetch-frontend-service.yaml
    - envsubst < deploy/kubernetes/${ENV}/gba-fetch-frontend-deployment.yaml | kubectl apply -f -

deploy-gba-fetch-frontend-ont:
  extends: [.env-ont-k8s, .deploy-gba-fetch-frontend]
  rules: !reference [.default-or-merge-request, rules]
  variables:
    ENV: ont
    GBA_FETCH_FRONTEND_INTERNAL_HOSTNAME: $GBA_FETCH_FRONTEND_INTERNAL_HOSTNAME_ONT

deploy-gba-fetch-frontend-demo:
  extends: [.env-demo-k8s, .deploy-gba-fetch-frontend]
  rules: !reference [.release-tag, rules]
  variables:
    ENV: demo
    GBA_FETCH_FRONTEND_INTERNAL_HOSTNAME: $GBA_FETCH_FRONTEND_INTERNAL_HOSTNAME_DEMO

build-sbom:
  rules: !reference [.default-branch, rules]
  image:
    name: "${HARBOR_REGISTRY}/${HARBOR_NLW_PROJECT}/nl-wallet-app-builder-cyclonedx@sha256:8216c77dcb0e2867776211d4c2980025d166d12fd8687acb232ef3cfbd95ad2c"
  script:
    ## Rust
    - cargo cyclonedx --spec-version 1.5 --manifest-path wallet_core/Cargo.toml --format json --override-filename bom
    - cargo cyclonedx --spec-version 1.5 --manifest-path wallet_core/flutter_rust_bridge_codegen/Cargo.toml --format json --override-filename bom
    - cargo cyclonedx --spec-version 1.5 --manifest-path wallet_core/uniffi-bindgen/Cargo.toml --format json --override-filename bom
    ## NPM
    - cd wallet_web
    - cyclonedx-npm --spec-version 1.5 --output-format json --output-file bom.json --package-lock-only
    # only keep bundled dependencies
    - jq '.components |= map(select(.properties|any(.name == "cdx:npm:package:bundled")))' bom.json > bom-bundled.json
    - mv bom-bundled.json bom.json
    - cd ..
    ## Flutter
    - cd wallet_app; cdxgen --spec-version 1.5 --type dart --output bom.json; cd -
    ## iOS
    # does not support json, so converting to it (we need it to be able to merge)
    - bundle install
    - cd wallet_app
    - flutter pub get --enforce-lockfile
    - flutter precache --ios
    - cd ios
    - bundle exec pod install --allow-root
    - cyclonedx-cocoapods # only supports spec version 1.4
    - cyclonedx convert --output-version v1_5 --input-file bom.xml --output-file bom.json
    - cd ../..
    ## Android
    - cd wallet_app/android/app; cdxgen --spec-version 1.5 --type gradle --output bom.json; cd -
    - cd wallet_core/platform_support/android/platform_support; cdxgen --spec-version 1.5 --type gradle --output bom.json; cd -
    # merge sboms into one (this doesn't work when using XML, because the cdxgen bom.xml is invalid)
    - cyclonedx merge --output-version v1_5 --input-files `find . -name bom.json` --output-file bom.json
    # converting it to xml does work
    - cyclonedx convert --output-version v1_5 --input-file bom.json --output-file bom.xml
  variables:
    LC_ALL: "C.UTF-8"
    LANG: "C.UTF-8"
  artifacts:
    when: always
    paths:
      - ./bom.xml
      - ./bom.json