.gitlab-ci.yml

# SPDX-FileCopyrightText: Magenta ApS <https://magenta.dk>
# SPDX-License-Identifier: MPL-2.0

stages:
  - sync
  - lint
  - build
  - test
  - coverage
  - prepare-release
  - release
  - deploy
  - docs

variables:
  IMAGE_SHA: ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHA}
  RELEASE_REGISTRY_IMAGE: index.docker.io/magentaaps/os2mo

  PRODUCT: os2mo
  COMPONENT: os2mo

  PYTEST_COV_MODULE: mora
  PYTEST_COV_FAIL_UNDER: 80

# Conditions
#############
# Global Conditions
.if-default-branch-refs: &if-default-branch-refs
  if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

.if-tag: &if-tag
  if: '$CI_COMMIT_TAG'

.if-tag-semver: &if-tag-semver
  if: '$CI_COMMIT_TAG =~ /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/'

.if-merge-request: &if-merge-request
  if: '$CI_MERGE_REQUEST_IID'

.if-schedule: &if-schedule
  if: '$CI_PIPELINE_SOURCE == "schedule"'

# Sync Conditions
.if-merge-request-labels-dont-interrupt: &if-merge-request-labels-dont-interrupt
  if: "$CI_MERGE_REQUEST_LABELS =~ /Pipeline::Sync::Don't Interrupt/"


####################
# Backend patterns #
####################
.backend-patterns: &backend-patterns
  - backend/**/*
  - docker/**/*
  - Dockerfile
  - pyproject.toml
  - poetry.lock
  - .gitlab-ci.yml


include:
  - local: ra-data-models/.gitlab-ci.yml
  - local: gitlab-ci-templates/integration-test-meta.v1.yml
  - project: labs/salt-automation
    file:
      - gitlab-ci-templates/common/no-interrupt-meta.v1.yml
      - gitlab-ci-templates/common/conventional-commits.v1.yml
      - gitlab-ci-templates/common/conventional-commits-changelog-meta.v1.yml
      - gitlab-ci-templates/python/pytest-meta.v1.yml
      - gitlab-ci-templates/common/docker-build-meta.v2.yml
      - gitlab-ci-templates/common/docker-release-meta.v1.yml
      - gitlab-ci-templates/common/config-updater-salt.v1.yml
      - gitlab-ci-templates/common/config-updater-flux.v1.yml
  - project: labs/salt-automation
    file: gitlab-ci-templates/common/pre-commit.v1.yml
    rules:
      - <<: *if-merge-request

# Workflow
###########
workflow:
  rules:
    - <<: *if-tag
      variables:
        # Override the IMAGE_SHA variable on tag pipelines to avoid both the default
        # branch pipeline and tag pipeline overriding each other's images arbitrarily when
        # they are both running at the same time on master.
        IMAGE_SHA: ${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}
    - <<: *if-default-branch-refs
    - <<: *if-merge-request

default:
  # All jobs are interruptible by default
  interruptible: true


# Sync
#######
Do not interrupt:
  extends: .do-not-interrupt
  rules:
    - <<: *if-default-branch-refs
    - <<: *if-tag
    - <<: *if-schedule
    - <<: *if-merge-request-labels-dont-interrupt
    - when: manual
      allow_failure: true


# Lint
#######
.lint-base:
  stage: lint
  needs: []
  # TODO: Individual lint rules for each file type using 'changes' patterns
  rules:
    - <<: *if-merge-request

Lint Dockerfiles:
  extends: .lint-base
  image: hadolint/hadolint:latest-alpine
  before_script:
    - apk add fd
  script:
    - echo "Running Hadolint, a Dockerfile linter"
    - echo "For more information about reported errors, visit the Hadolint wiki on https://github.com/hadolint/hadolint/wiki"
    # Run fd without exec arg to produce a list of files to be linted
    - fd Dockerfile
    # Run hadolint on every Dockerfile
    - fd Dockerfile --exec hadolint

Lint shell scripts:
  # TODO: Do this as part of pre-commit instead
  extends: .lint-base
  image: koalaman/shellcheck-alpine:latest
  before_script:
    - apk update
    - apk add git
  script:
    - git ls-files --exclude='*.sh' --ignored -c | xargs shellcheck


# Build
########
Fetch OS2mo Source Date:
  stage: build
  needs: []
  interruptible: true
  image: alpine:3
  before_script:
    - apk update
    - apk add git
  script:
    - git log -1 --pretty=%ct > SOURCE_DATE_EPOCH
  artifacts:
    paths:
      - SOURCE_DATE_EPOCH
    expire_in: 1 day
  rules:
    - <<: *if-schedule
      when: never
    - when: on_success

Build OS2mo:
  needs:
    - Fetch OS2mo Source Date
  extends:
    - .build-docker
  before_script:
    - !reference [.build-docker, before_script]
    - export BUILD_DOCKER_EXTRA_FLAGS="--build-arg=COMMIT_SHA=${CI_COMMIT_SHA} --build-arg=COMMIT_TAG=${CI_COMMIT_TAG} --reproducible --build-arg=SOURCE_DATE_EPOCH=$(cat SOURCE_DATE_EPOCH)"
  rules:
    - <<: *if-schedule
      when: never
    - when: on_success

Build OS2mo Keycloak:
  extends:
    - .build-docker
  variables:
    IMAGE_SHA: ${CI_REGISTRY_IMAGE}/keycloak:${CI_COMMIT_SHA}
  before_script:
    - export CONTEXT=${CI_PROJECT_DIR}/keycloak
    - export DOCKERFILE=${CONTEXT}/Dockerfile
  rules:
    - <<: *if-schedule
      when: never
    - when: on_success


# Tests
########
.test-base:
  stage: test
  variables:
    PYPROJECT_PREFIX: "backend/"
    HYPOTHESIS_PROFILE: "ci"
  rules:
    - <<: *if-merge-request
      changes: *backend-patterns

Unit-test:
  extends:
    - .test-base
    - .pytest
  variables:
    PYTEST_ADDOPTS: "-m 'not integration_test' --randomly-seed=$CI_PIPELINE_IID"

Integration-test:
  extends:
    - .test-base
    - .pytest
    - .variables:mo
  needs:
    - Build OS2mo
  parallel: 8
  image: $IMAGE_SHA
  variables:
    PYTEST_ADDOPTS: "-m 'integration_test' -p no:randomly --cov=oio_rest"  # TODO: enable randomness
  services:
    - !reference [.services:mo-backing, services]
  before_script:
    - !reference [.pytest, before_script]
    - !reference [.services:mo-backing, before_script]


Export coverage:
  extends:
    - .test-base
    - .export_coverage
  needs:
    - Unit-test
    - Integration-test

Check coverage:
  extends:
    - .test-base
    - .check_coverage
  needs:
    - Unit-test
    - Integration-test


# Release
##########

Release master:
  extends: .release-master

Release version:
  extends: .release-version

Release Keycloak master:
  extends: .release-master
  variables:
    CI_IMAGE: ${CI_REGISTRY_IMAGE}/keycloak:${CI_COMMIT_SHA}
    RELEASE_IMAGE: ${RELEASE_REGISTRY_IMAGE}-keycloak

Release Keycloak version:
  extends: .release-version
  variables:
    CI_IMAGE: ${CI_REGISTRY_IMAGE}/keycloak:${CI_COMMIT_SHA}
    RELEASE_IMAGE: ${RELEASE_REGISTRY_IMAGE}-keycloak


# Docs
#######

.docs:rules:deploy-master-docs:
  rules:
    - <<: *if-schedule
      when: never
    - <<: *if-tag-semver
      when: never
    - <<: *if-default-branch-refs

.docs:rules:build-docs:
  rules:
    - <<: *if-merge-request
    - !reference [".docs:rules:deploy-master-docs", rules]

Export GQL Schema:
  stage: docs
  extends:
    - .docs:rules:build-docs
    - .variables:mo
  needs:
    - Build OS2mo
  image: $IMAGE_SHA
  variables:
    OUT: $CI_PROJECT_DIR/docs/src/tech-docs/graphql/voyager.html
    QUERY_EXPORT_DIR: "/tmp"
  script:
    - python docs/schema_to_voyager.py
  artifacts:
    paths:
      - $OUT


Export Changelog:
  extends:
    - .docs:rules:build-docs
    - .docs:export-changelog
  variables:
    OUT: $CI_PROJECT_DIR/docs/.dynamic_changelog.md
    CHANGELOG_EXTRA_FLAGS: --start-rev=12.11.1


.build-docs:
  stage: docs
  extends:
    - .docs:rules:build-docs
  needs:
    - Export GQL Schema
    - Export Changelog
  image: python:3.10
  variables:
    POETRY_VERSION: 1.3.2
    POETRY_VIRTUALENVS_CREATE: "false"
  before_script:
    - pip3 install poetry==${POETRY_VERSION}
    - cd docs && poetry install --no-interaction
  script:
    - cat .dynamic_changelog.md .static_changelog.md >> src/changelog.md
    - mkdocs build --strict --site-dir=$CI_PROJECT_DIR/site
  artifacts:
    paths:
      - $CI_PROJECT_DIR/site
    expire_in: 1 week

Build and deploy branch docs:
  extends:
    - .build-docs
  environment:
    name: docs/$CI_COMMIT_REF_SLUG
    url: $CI_JOB_URL/artifacts/file/site/index.html
    auto_stop_in: 1 week
  rules:
    - <<: *if-merge-request

Build master docs:
  extends:
    - .build-docs
    - .docs:rules:deploy-master-docs

# To release to GitLab Pages, the job must be called 'pages'
pages:
  stage: docs
  extends:
    - .docs:rules:deploy-master-docs
  needs:
    - Build master docs
  image: alpine:latest
  script:
    - cp -r $CI_PROJECT_DIR/site public
  artifacts:
    paths:
      - public/