.gitlab-ci.yml

## Gitlab pipeline configuration
include:
  - template: Workflows/MergeRequest-Pipelines.gitlab-ci.yml

workflow:
  auto_cancel:
    on_job_failure: all
    on_new_commit: interruptible
  # Switch between branch pipelines and merge request pipelines
  # https://docs.gitlab.com/ee/ci/yaml/README.html#switch-between-branch-pipelines-and-merge-request-pipelines
  rules:
    - if: "$CI_COMMIT_TAG"
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TITLE !~ /^Draft/
    - if: "$CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS"
      when: never
    - if: '$CI_COMMIT_BRANCH == "main"'

stages:
  - buildenv
  - generate
  - test
  - publish

variables:
  GIT_STRATEGY: fetch
  # without this the runner lacks access to the target branch
  GIT_DEPTH: "0"
  # output upload and download progress every x seconds
  TRANSFER_METER_FREQUENCY: "2s"
  # Fastzip is a performant archiver for cache/artifact archiving and extraction
  FF_USE_FASTZIP: "true"
  # Use fast compression for artifacts, resulting in larger archives
  ARTIFACT_COMPRESSION_LEVEL: "default"
  # Use no compression for caches
  CACHE_COMPRESSION_LEVEL: "fastest"
  # When enabled, each script line from the .gitlab-ci.yml file is in
  # a collapsible section in the job output, and shows the duration of each line.
  FF_SCRIPT_SECTIONS: "true"
  # enable service debugging
  # CI_DEBUG_SERVICES: "true"
  # allow some time for backup operations
  RUNNER_SCRIPT_TIMEOUT: 3h
  RUNNER_AFTER_SCRIPT_TIMEOUT: 30m
  # Set Script Log Level
  LOG_LEVEL: "INFO"

# ---------------------------------------------#
#               CACHE DEFINITIONS
# ---------------------------------------------#

# Dependencies cache: venv + pnpm-store
.cache_dependencies: &cache_dependencies
  key:
    files:
      - poetry.lock
      - Frontend/pnpm-lock.yaml
  paths:
    - .venv
    - Frontend/.pnpm-store
  unprotect: true
  when: "always"

# Build cache: docker + skaffold
.cache_build: &cache_build
  key: ${CI_JOB_GROUP_NAME}-build-cache
  paths:
    - docker-cache
    - ${SKAFFOLD_HOME}
  unprotect: true
  when: "always"

# Kubernetes cache: minikube + kubernetes
.cache_kubernetes: &cache_kubernetes
  key:
    files:
      - up.sh  # pins minikube invocation
      - devenv.lock  # pins minikube version
    prefix: ${CI_JOB_GROUP_NAME}-kubernetes-cache-${CI_RUNNER_TAGS}
  paths:
    - ${MINIKUBE_HOME}
    - kubernetes-cache
  unprotect: true
  when: "always"

# Third party cache (job-specific)
.cache_third_party: &cache_third_party
  key:
    files:
      - cicd/generate_third_party.sh
  paths:
    - third-party-cache
  unprotect: true
  when: "always"

default:
  # Allow cancellation of running tasks
  interruptible: true
  # By default run on self-hosted runners:
  tags:
    # - debug
    - self-hosted-medium
    # - saas-linux-xlarge-amd64
    # - saas-linux-large-amd64
  # Always use nix-dind image
  image: ${CI_REGISTRY_IMAGE}/nix-dind:latest
  before_script:
    - source cicd/gitlab_job_sections.sh
    #
    # START SECTION
    #
    - section_start default-before_script
    # show job instance info for debugging (only relevant for parallel jobs)
    - echo "Running job instance ${CI_NODE_INDEX} of ${CI_NODE_TOTAL}"
    # enable CI/CD mode for the devenv
    - cp "nix-dind/devenv.local.nix" "devenv.local.nix"
    # building shell
    - devenv shell -- echo "[*] devenv shell ready"
    # verify that the source tree is clean
    - devenv shell -- git-file-changed --no-update
    #
    # END SECTION
    #
    - section_end default-before_script
  after_script:
    - source cicd/gitlab_job_sections.sh
    #
    # START SECTION
    #
    - section_start default-after_script
    # collect fork logs
    - mkdir -p fork-logs && cp /var/run/fork-log.*.log fork-logs/
    #
    # END SECTION
    #
    - section_end default-after_script
  artifacts:
    # NOTE: This artifact declaration has to live here as artifacts.* does not seem to support
    # the `!reference []` GitLab annotation. This is why we have to declare all artifacts here
    # instead of where we actually generate them.
    paths:
      - fork-logs/
      # for: .default-k8s
      - dmesg.txt
      # for: all jobs which use git-file-changed
      - changed-files/
      # for: integrationtest
      - logs/
    expire_in: 1 week
    when: always
  # Dependency caching
  cache:
    - *cache_dependencies

.default-docker:
  extends: default
  variables:
    SKAFFOLD_HOME: ${CI_PROJECT_DIR}/.skaffold
  before_script:
    - !reference [default, before_script]
    #
    # START SECTION
    #
    - section_start .default-docker-before_script
    # docker login
    - echo "${CI_REGISTRY_PASSWORD}" | docker login ${CI_REGISTRY} -u "${CI_REGISTRY_USER}" --password-stdin
    - echo "${CI_DEPENDENCY_PROXY_PASSWORD}" | docker login ${CI_DEPENDENCY_PROXY_SERVER} -u "${CI_DEPENDENCY_PROXY_USER}" --password-stdin
    # restore images
    - devenv shell -- docker-image-backup-restore restore docker-cache/images/
    #
    # END SECTION
    #
    - section_end .default-docker-before_script
  after_script:
    - !reference [default, after_script]
    #
    # START SECTION
    #
    - section_start .default-docker-after_script
    # backup images
    - devenv shell -- docker-image-backup-restore backup --prune "${CI_REGISTRY_IMAGE}" '.*' docker-cache/images/
    #
    # END SECTION
    #
    - section_end .default-docker-after_script
  cache:
    - *cache_dependencies
    - *cache_build

.default-k8s:
  extends: .default-docker
  variables:
    MINIKUBE_HOME: ${CI_PROJECT_DIR}/.minikube
  before_script:
    - !reference [.default-docker, before_script]
    #
    # START SECTION
    #
    - section_start .default-k8s-before_script
    # collect dmesg
    - devenv shell -- sudo --background dmesg --follow > dmesg.txt
    # start k8s
    - devenv shell -- up --setup
    # restore images
    - devenv shell -- docker-image-backup-restore --minikube restore kubernetes-cache/images/
    #
    # END SECTION
    #
    - section_end .default-k8s-before_script
  after_script:
    - !reference [.default-docker, after_script]
    #
    # START SECTION
    #
    - section_start .default-k8s-after_script
    # start k8s
    - devenv shell -- up --setup
    # backup images
    - devenv shell -- docker-image-backup-restore --minikube backup --prune "${CI_REGISTRY_IMAGE}" '.*' kubernetes-cache/images/
    #
    # END SECTION
    #
    - section_end .default-k8s-after_script
  cache:
    - *cache_dependencies
    - *cache_build
    - *cache_kubernetes

.default-up:
  extends: .default-k8s
  before_script:
    - !reference [.default-k8s, before_script]
    #
    # START SECTION
    #
    - section_start .default-up-before_script
    # start stack
    - devenv shell -- up --expose "$(tailscale ip -4)"
    # everything should be running now: prune rest
    - devenv shell -- kubernetes-prune --all --force --volumes
    #
    # END SECTION
    #
    - section_end .default-up-before_script

.default-up-integrationtest:
  extends: .default-k8s
  before_script:
    - !reference [.default-k8s, before_script]
    #
    # START SECTION
    #
    - section_start .default-up-integrationtest-before_script
    # start stack
    - devenv shell -- up --integrationtest --expose "$(tailscale ip -4)"
    # everything should be running now: prune rest
    - devenv shell -- kubernetes-prune --all --force --volumes
    #
    # END SECTION
    #
    - section_end .default-up-integrationtest-before_script

# ---------------------------------------------#
#
#
#       BUILDENV JOBS
#
#
# ----------------------------------------------#

buildenv_nix-dind:
  extends: .default-docker
  stage: buildenv
  only:
    - main
    - tags
  script:
    - devenv shell -- nix-dind --push

# ---------------------------------------------#
#
#
#       GENERATE JOBS
#
#
# ----------------------------------------------#

generate_frontend_static:
  stage: generate
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_TAG'
      when: never
    - when: on_success
  script:
    - devenv shell -- generate-frontend-static
    - devenv shell -- git-file-changed

generate_frontend_api:
  stage: generate
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_TAG'
      when: never
    - when: on_success
  script:
    - devenv shell -- generate-frontend-api
    - devenv shell -- git-file-changed

generate_third_party:
  extends: .default-docker
  stage: generate
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_TAG'
      when: never
    - when: on_success
  script:
    - devenv shell -- generate-third-party
    - devenv shell -- git-file-changed
  cache:
    - *cache_dependencies
    - *cache_build
    - *cache_third_party

# ---------------------------------------------#
#
#
#        TEST JOBS
#
#
# ----------------------------------------------#

helm_test:
  stage: test
  script:
    - devenv shell -- build-helm
  rules:
    - if: '$CI_COMMIT_BRANCH != "main"'
    - if: $CI_COMMIT_TAG
      when: never

linting:
  stage: test
  script:
    - devenv shell -- lint

devenv_test:
  stage: test
  script:
    - devenv test

frontend_test:
  stage: test
  script:
    - devenv shell -- frontend-test
    - devenv shell -- frontend-build

backend_test:
  stage: test
  script:
    - devenv shell -- backend-test
  coverage: '/(?i)total.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: ./backend/coverage.xml

test_build_nix-dind:
  extends: .default-docker
  stage: test
  script:
    - devenv shell -- nix-dind

integrationtest:
  extends: .default-up-integrationtest
  stage: test
  retry: 2
  variables:
    # We do need to fix the RANDOM_ORDER_SEED
    # here to make pytest-split work with
    # pytest-random-order.
    #
    # see:
    #   - https://jerry-git.github.io/pytest-split/
    RANDOM_ORDER_SEED: "${CI_PIPELINE_ID}"
  parallel: 3
  script:
    - devenv shell -- run-integrationtest

integrationtest_debug:
  extends: integrationtest
  allow_failure: true
  variables:
    SLEEP_TIME: infinity
  rules:
    - when: manual

# ---------------------------------------------#
#
#
#       PUBLISH JOBS
#
#
# ----------------------------------------------#

publish_images:
  extends: .default-docker
  stage: publish
  only:
    - main
    - tags
  script:
    - devenv shell -- build --profile prod --push
    - devenv shell -- build --profile prod --push --tag latest
    - |
      if [ -n "${CI_COMMIT_TAG+x}" ]; then
        devenv shell -- build --profile prod --push --tag "${CI_COMMIT_TAG}"
      fi

publish_dev_images:
  extends: .default-docker
  stage: publish
  only:
    - main
    - tags
  script:
    - devenv shell -- build --profile dev --push

publish_helm_dev:
  stage: publish
  script:
    - devenv shell -- build-helm
      --publish
      "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/dev/charts"
      gitlab-ci-token:${CI_JOB_TOKEN}

publish_helm_test:
  stage: publish
  only:
    - main
  script:
    - devenv shell -- build-helm
      --publish
      "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/test/charts"
      gitlab-ci-token:${CI_JOB_TOKEN}

publish_helm_prod:
  stage: publish
  only:
    - tags
  script:
    - devenv shell -- build-helm
      --publish
      "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/prod/charts"
      gitlab-ci-token:${CI_JOB_TOKEN}