.gitlab-ci.yml

variables:
  # Set Gitlab's cache compression to tar+zstd for better performance.
  CACHE_COMPRESSION_FORMAT: tarzstd
  # Enable timestamps in Gitlab's job logs.
  FF_TIMESTAMPS: true
  # We use submodules
  GIT_SUBMODULE_STRATEGY: recursive
  # Force cargo colors
  CARGO_TERM_COLOR: always

# See https://docs.gitlab.com/ci/yaml/workflow/#git-flow-with-merge-request-pipelines
workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

.default-before-script:
  before_script:
    - pacman-key --init
    - pacman -Syu --needed --noconfirm just mkcert

.with-rust:
  before_script:
    - !reference [".default-before-script", "before_script"]
    # pkgconf: for the openssl crate to locate libssl files
    - pacman -Syu --needed --noconfirm rust just gcc pkgconf
  variables:
    RUST_LOG: debug
  cache:
    key: ${CI_COMMIT_REF_SLUG}-${CI_JOB_NAME}
    paths:
      - .cargo/bin
      - .cargo/registry/index
      - .cargo/registry/cache
      - target/debug/deps
      - target/debug/build
      - target/release/deps
      - target/release/build
  variables:
    CARGO_HOME: ${CI_PROJECT_DIR}/.cargo

stages:
  - check-and-build
  - push
  - deploy

licenses:
  stage: check-and-build
  extends: .default-before-script
  script:
    - pacman -Syu --needed --noconfirm reuse
    - just licenses

check-dependencies:
  stage: check-and-build
  extends: .with-rust
  script:
    - pacman -Syu --needed --noconfirm cargo-deny
    - just check-dependencies

lint:
  stage: check-and-build
  extends: .with-rust
  script:
    - just lint

er-diagram:
  stage: check-and-build
  extends: .with-rust
  variables:
    BUILDBTW_DATABASE_FILE: buildbtw_backend.sqlite
  script:
    - cargo install 'sea-orm-cli@^2.0.0-rc' --force
    - just migrate-database
    - PATH="$PATH:$CARGO_HOME/bin" just er-diagram

  artifacts:
    expose_as: "ER Diagram"
    paths:
      - target/sea-orm-cli-generated/entities.html
      - target/sea-orm-cli-generated/entities.mermaid

test:
  tags:
  stage: check-and-build
  extends: .with-rust
  script:
    - pacman -Syu --needed --noconfirm cargo-nextest
    - just test

test-e2e:
  tags:
    # the test suite needs to spawn podman containers, so we run this job in a VM
    - vm
  stage: check-and-build
  extends: .with-rust
  script:
    - pacman -Syu --needed --noconfirm cargo-nextest podman geckodriver firefox
    - just install-dev-ca
    - just gen-dev-cert
    - just test-e2e

.build-release:
  stage: check-and-build
  extends: .with-rust
  artifacts:
    paths:
      - target/release/buildbtw-backend
      - target/release/buildbtw-executor
  script:
    - just build-release

build-release:
  extends: .build-release
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'

build-release:secure:
  extends: .build-release
  tags:
    - secure
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    # Don't run this in forks - they don't have access to secure runners
    - if: $CI_PROJECT_PATH != "archlinux/buildbtw"
      when: never

.push-container-image:
  stage: push
  extends: .default-before-script
  script:
    - pacman -Syu --needed --noconfirm podman
    - just build-release-container-image
    - |
      if [[ "$CI_COMMIT_BRANCH" == "$CI_DEFAULT_BRANCH" ]]; then
        # This branch is for main branch builds.

        # REGISTRY_USERNAME/REGISTRY_PASSWORD are injected as CI/CD vars.
        # They represent a deploy token that has registry write access so we can overwrite protected tags.
        # The automatic $CI_REGISTRY_USER/$CI_REGISTRY_PASSWORD can't overwrite protected tags.
        #
        # If this is a build on main, additionally add a staging tag
        podman login -u "$REGISTRY_USERNAME" -p "$REGISTRY_PASSWORD" "$CI_REGISTRY"
        podman push buildbtw-backend "$CI_REGISTRY_IMAGE/backend:$CI_COMMIT_REF_SLUG"
        podman push buildbtw-backend "$CI_REGISTRY_IMAGE/backend:staging"

        podman artifact add "$CI_REGISTRY_IMAGE/executor:$CI_COMMIT_REF_SLUG" target/release/buildbtw-executor
        podman artifact push "$CI_REGISTRY_IMAGE/executor:$CI_COMMIT_REF_SLUG"
        podman artifact add "$CI_REGISTRY_IMAGE/executor:staging" target/release/buildbtw-executor
        podman artifact push "$CI_REGISTRY_IMAGE/executor:staging"
      elif [[ "$CI_COMMIT_TAG" == v* ]]; then
        # This branch is for tagged builds (aka releases).

        # REGISTRY_USERNAME/REGISTRY_PASSWORD are injected as CI/CD vars.
        # They represent a deploy token that has registry write access so we can overwrite protected tags.
        # The automatic $CI_REGISTRY_USER/$CI_REGISTRY_PASSWORD can't overwrite protected tags.
        #
        # If this is building a version tag, additionally add a release tag
        podman login -u "$REGISTRY_USERNAME" -p "$REGISTRY_PASSWORD" "$CI_REGISTRY"
        podman push buildbtw-backend "$CI_REGISTRY_IMAGE/backend:$CI_COMMIT_TAG"
        podman push buildbtw-backend "$CI_REGISTRY_IMAGE/backend:release"

        podman artifact add "$CI_REGISTRY_IMAGE/executor:$CI_COMMIT_TAG" target/release/buildbtw-executor
        podman artifact push "$CI_REGISTRY_IMAGE/executor:$CI_COMMIT_TAG"
        podman artifact add "$CI_REGISTRY_IMAGE/executor:release" target/release/buildbtw-executor
        podman artifact push "$CI_REGISTRY_IMAGE/executor:release"
      else
        # This branch is for merge request builds.

        podman login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
        podman push buildbtw-backend "$CI_REGISTRY_IMAGE/backend:$CI_COMMIT_REF_SLUG"
      fi

push-container-image:
  extends: .push-container-image
  needs: ["build-release"]
  tags:
    # We build containers so it's easier to do this in a VM
    - vm
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    # Don't run this in forks - there's no point to pushing container images in forks
    - if: $CI_PROJECT_PATH != "archlinux/buildbtw"
      when: never

push-container-image:secure:
  extends: .push-container-image
  needs: ["build-release:secure"]
  tags:
    # We build containers so it's easier to do this in a VM
    - vm
    - secure
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    # Don't run this in forks - they don't have access to secure runners
    - if: $CI_PROJECT_PATH != "archlinux/buildbtw"
      when: never

deploy-review-app:
  stage: deploy
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - >-
      curl
      --no-progress-meter
      --location
      --fail-with-body
      --header "Authorization: Bearer $BUILDBTW_DEV_DEPLOY_TOKEN"
      https://buildbtw.archlinux.review/hooks/deploy-branch?image-tag=$CI_COMMIT_REF_SLUG
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    auto_stop_in: 2 weeks
    url: https://$CI_COMMIT_REF_SLUG.buildbtw.archlinux.review
    on_stop: stop-review-app

stop-review-app:
  stage: deploy
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - >-
      curl
      --no-progress-meter
      --location
      --fail-with-body
      --header "Authorization: Bearer $BUILDBTW_DEV_DEPLOY_TOKEN"
      https://buildbtw.archlinux.review/hooks/undeploy-branch?image-tag=$CI_COMMIT_REF_SLUG
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    action: stop
  when: manual

deploy-staging:
  stage: deploy
  rules:
    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    # Don't run this in forks - they don't have access to secure runners
    - if: $CI_PROJECT_PATH != "archlinux/buildbtw"
      when: never
  tags:
    - secure
  script:
    - >-
      curl
      --no-progress-meter
      --location
      --fail-with-body
      --header "Authorization: Bearer $BUILDBTW_STAGING_DEPLOY_TOKEN"
      https://buildbtw.archlinux.builders/hooks/deploy-branch?image-tag=staging
  environment:
    name: staging
    url: https://buildbtw.archlinux.builders