.gitlab-ci.yml

# Secrets should never be versioned.
include:
  - template: Security/Secret-Detection.gitlab-ci.yml


stages:
  - prepare
  - test
  - build
  - publish

variables:
  DOCKER_IMAGE_NAME: 'cytomine/core'
  ENTRYPOINT_SCRIPTS_VERSION: '1.3.0'
  GRADLE_VERSION: '7.2-jdk17-alpine'
  OPENJDK_VERSION: '17-slim-bullseye'

  # cache gradle working directory
  GRADLE_USER_HOME: /cache/.gradle
  POSTGRES_USER: docker
  POSTGRES_PASSWORD: docker
  POSTGRES_DB: docker
  POSTGIS_VERSION: "15-3.3-alpine-1.2.0"
  MONGO_INITDB_ROOT_USERNAME: mongoadmin
  MONGO_INITDB_ROOT_PASSWORD: secret
  MONGO_INITDB_DATABASE: cytomine
  DOCKERHUB_CORE_REPO: cytomine/core
  DOCKER_TMP_IMAGE_NAME: $CI_PIPELINE_ID:latest
  DOCKER_TMP_JAR_IMAGE_NAME: $CI_PIPELINE_ID-jar-builder:latest

# variable to register in project:
# - DOCKERHUB_URL: url of dockerhub (e.g. docker.io)
# - DOCKERHUB_USER: cytomine username on dockerhub
# - DOCKERHUB_PASSWORD: cytomine password on dockerhub
# - SCRIPTS_REPO_ACCESS_TOKEN_NAME: access token name for docker-entrypoint-scripts repo
# - SCRIPTS_REPO_ACCESS_TOKEN_VALUE: access token value for docker-entrypoint-scripts repo
# - SCRIPTS_REPO_URL: git url (no scheme/protocol) of the docker-entrypoint-scripts repo

default:
  tags:
    - docker

workflow:
  rules:
    # Avoid the pipeline to be triggered for merge request event, because it would be a duplicated event when
    #  a push is made on a branch that has an open merge request linked (as suggested in the default GitLab workflow)
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      when: never

    - if: $CI_COMMIT_TAG != null
      variables:
        IS_OPEN_SOURCE_RELEASE_CANDIDATE: "true"
    #- if: $CI_COMMIT_TAG != null && $CI_COMMIT_TAG =~ /^ce-.*$/
    #  variables:
    #    IS_OPEN_SOURCE_RELEASE_CANDIDATE: "true"
    #- if: $CI_COMMIT_TAG == null || $CI_COMMIT_REF_NAME !~ /^ce-.*$/
    #  variables:
    #    IS_OPEN_SOURCE_RELEASE_CANDIDATE: "false"
    - when: always

lint-dockerfiles:
  stage: prepare
  image: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/hadolint/hadolint:latest-alpine
  # Uncomment to silent some warnings if needed
  #variables:
  #  HADOLINT_OPT: --ignore DL3008
  script:
    - hadolint ${HADOLINT_OPT} docker/Dockerfile
  rules:
    - changes:
        - docker/Dockerfile
      when: always

    # If the Dockerfile has not been changed, this job can be skipped
    - when: never
      allow_failure: true

make-version-name:
  stage: prepare
  # regex check does not work with /bin/sh because of parenthesis so we need /bin/bash here
  image: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/bash:5.2.15-alpine3.16
  script:
    #- if [[ "$CI_COMMIT_REF_NAME" =~ ^refs/tags/ ]] then
    #    echo "CM_VERSION=$CI_COMMIT_TAG" > .env;
    #  else
    #    echo "CM_VERSION=$CI_COMMIT_SHORT_SHA-$(date '+%Y%m%d%H%M%S')-SNAPSHOT" > .env;
    #  fi

    # TODO: reuse the tag regexp common job/rule
    - | # If no tag has been pushed ($CI_COMMIT_TAG is empty), name it as SNAPSHOT
      if [ -z $CI_COMMIT_TAG ]; then
        echo "CM_VERSION=$CI_COMMIT_BRANCH" > .env
      else
        # Else use the tag
        echo "CM_VERSION=$CI_COMMIT_TAG" > .env
      fi
    - cat .env
  artifacts:
    reports:
      dotenv: .env

run-junit:
  stage: test
  image: gradle:7.4.2-jdk17-alpine
  services:
    - alias: postgres
      name: cytomine/postgis:${POSTGIS_VERSION}
    - alias: mongodb
      name: mongo:4.4.18-focal
    - alias: rabbitmq
      name: rabbitmq:3.10
  script:
    - export GRADLE_USER_HOME=$GRADLE_USER_HOME
    - sed -i -- "s/localhost:5432/postgres:5432/g" src/test/resources/application.yml
    - "sed -i -- 's/host: localhost/host: mongodb/g' src/test/resources/application.yml"
    # test log too large for gitlab if executed at 'debug' log level
    - sed -i -- "s/name=\"be.cytomine\" level=\"debug\"/name=\"be.cytomine\" level=\"info\"/g" src/test/resources/logback-test.xml
    - gradle :test --no-daemon
  artifacts:
    reports:
      junit: build/test-results/test/**/TEST-*.xml
      # TODO integrate code coverage

#build-jar:
#  stage: build
#  image: docker:latest
#  rules:
#    - if: $CI_COMMIT_TAG
#  needs:
#    # no dependence on junit tests success. This allow for build
#    # stage jobs to run in parallel with tests. If test fails,
#    # publish jobs are aborted
#    - job: make-version-name
#      artifacts: true
#  script:
#    - docker build --build-arg CORE_VERSION=$CM_VERSION -t $DOCKER_TMP_JAR_IMAGE_NAME -f docker/Dockerfile --target jar-builder .
#    - docker run --name $CI_PIPELINE_ID-builder-container -t $DOCKER_TMP_JAR_IMAGE_NAME
#    - mkdir -p build/libs/
#    - docker cp $CI_PIPELINE_ID-builder-container:/app/build/libs/cytomine.jar build/libs/cytomine-$CM_VERSION.jar
#  after_script:
#    - docker rm $CI_PIPELINE_ID-builder-container || true
#    - docker rmi $DOCKER_TMP_JAR_IMAGE_NAME
#  artifacts:
#    when: on_success
#    expire_in: never
#    paths:
#      - build/libs/cytomine-*.jar

#build-docker-image:
#  stage: build
#  image: docker:latest
#  needs:
#    - job: build-jar
#      artifacts: false
#    - job: make-version-name
#      artifacts: true
#  rules:
#    - if: $CI_COMMIT_TAG
#  script:
#    - docker build --build-arg CORE_VERSION=$CM_VERSION -t $DOCKER_TMP_IMAGE_NAME -f docker/Dockerfile .
#
#publish-docker-image:
#  stage: publish
#  image: docker:latest
#  needs:
#    - job: build-docker-image
#      artifacts: false  # artifact are in docker cache (is it a safe assumption in a multi-runner env ?)
#    - job: run-junit
#      artifacts: false
#    - job: make-version-name
#      artifacts: true
#  rules:
#    - if: $CI_COMMIT_TAG
#  script:
#    - |
#      if [ $IS_OPEN_SOURCE_RELEASE_CANDIDATE = "true" ]; then
#        export DOCKER_IMAGE_NAME=cytomine/core
#        export TARGET_CI_REGISTRY=$DOCKERHUB_URL
#        export TARGET_CI_REGISTRY_USER=$DOCKERHUB_USER
#        export TARGET_CI_REGISTRY_PASSWORD=$DOCKERHUB_PASSWORD
#      else
#        export DOCKER_IMAGE_NAME=$CI_REGISTRY_IMAGE
#        export TARGET_CI_REGISTRY=$CI_REGISTRY
#        export TARGET_CI_REGISTRY_USER=$CI_REGISTRY_USER
#        export TARGET_CI_REGISTRY_PASSWORD=$CI_REGISTRY_PASSWORD
#      fi
#    - echo "Target > registry:$TARGET_CI_REGISTRY user:$TARGET_CI_REGISTRY_USER"
#    - docker login -u $TARGET_CI_REGISTRY_USER -p $TARGET_CI_REGISTRY_PASSWORD $TARGET_CI_REGISTRY
#    - export DOCKER_IMAGE_NAME_FULL=$DOCKER_IMAGE_NAME:$CM_VERSION
#    - docker tag $DOCKER_TMP_IMAGE_NAME $DOCKER_IMAGE_NAME_FULL
#    - docker push $DOCKER_IMAGE_NAME_FULL
#  after_script:
#    # cleaning up images
#    - docker rmi $DOCKER_IMAGE_NAME_FULL $DOCKER_TMP_IMAGE_NAME


build-push-docker-image:
  stage: build
  image: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/docker:latest
  needs:
    - job: make-version-name
      artifacts: true
  rules:
    - if: $CI_COMMIT_TAG
  script:
    - echo "Log in to Gitlab docker registry"
    - mkdir -p ~/.docker
    - echo ${DOCKER_AUTH_CONFIG} > ~/.docker/config.json

    - echo "Build the docker image ${DOCKER_IMAGE_NAME}:${CM_VERSION}"
    - |
      docker build \
        --build-arg CORE_VERSION=${CM_VERSION} \
        --build-arg CORE_REVISION=${CI_COMMIT_SHORT_SHA} \
        --build-arg ENTRYPOINT_SCRIPTS_VERSION=${ENTRYPOINT_SCRIPTS_VERSION} \
        --build-arg GRADLE_VERSION=${GRADLE_VERSION} \
        --build-arg OPENJDK_VERSION=${OPENJDK_VERSION} \
        -t ${DOCKER_IMAGE_NAME}:${CM_VERSION} \
        -t ${DOCKER_IMAGE_NAME}:latest \
        -f docker/Dockerfile \
        .

    # Use credential helper (see https://docs.docker.com/engine/reference/commandline/login/#credentials-store)
    - mkdir -p $HOME/.docker && echo $DOCKER_HUB_AUTH_CONFIG > $HOME/.docker/config.json
    - echo "Registry credentials configured at $HOME/.docker/config.json"

    - echo "Pushing docker image ${DOCKER_IMAGE_NAME}:${CM_VERSION} and ${DOCKER_IMAGE_NAME}:latest"
    - docker push ${DOCKER_IMAGE_NAME}:${CM_VERSION}
    - docker push ${DOCKER_IMAGE_NAME}:latest
    - echo "Successfully pushed docker image ${DOCKER_IMAGE_NAME}:${CM_VERSION} and ${DOCKER_IMAGE_NAME}:latest"


#publish-jar:
#  stage: publish
#  image: alpine:latest
#  rules:
#    - if: $CI_COMMIT_TAG
#  needs:
#    - job: make-version-name
#      artifacts: true
#    - job: build-jar
#      artifacts: true
#    - job: run-junit
#      artifacts: false
#  script:
#    - echo "TODO upload somehwere"