.gitlab-ci.yml

variables:
  ALLOW_QUALITY_GATE_FAILURE: 'false'

default:
  id_tokens:
    ID_TOKEN:
      aud: "https://$VAULT_DOMAIN"

workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
      when: never
    - if: $CI_COMMIT_BRANCH
    - if: $CI_COMMIT_TAG

stages:
  - build
  - test
  - report
  - analyze
  - deploy
  - rollout

image:
  name: maven:3-eclipse-temurin-17

.job-template:
  secrets:
    ARTIFACTORY_DOMAIN:
      vault: Artifactory/domain@Build-Environment
      file: false
    ARTIFACTORY_USERNAME:
      vault: Artifactory/user-write-username@Build-Environment
      file: false
    ARTIFACTORY_PASSWORD:
      vault: Artifactory/user-write-password@Build-Environment
      file: false
    DEPENDENCY_CHECK_NIST_NVD_API_KEY:
      vault: nist-nvd/api-key@Build-Environment
      file: false
    SONAR_DOMAIN:
      vault: Sonar/domain@Build-Environment
      file: false
    SONAR_TOKEN:
      vault: Sonar/token@Build-Environment
      file: false
    SONATYPE_OSSRH_SIGN_KEY_NAME:
      vault: sonatype-ossrh-signing/name@Build-Environment
      file: false
    SONATYPE_OSSRH_SIGN_KEY_PASSPHRASE:
      vault: sonatype-ossrh-signing/passphrase@Build-Environment
      file: false
    SONATYPE_OSSRH_SIGN_SECRING:
      vault: sonatype-ossrh-signing/secring@Build-Environment
      file: false
    SONATYPE_OSSRH_SIGN_PUBRING:
      vault: sonatype-ossrh-signing/pubring@Build-Environment
      file: false
    SONATYPE_OSSRH_REPO_USERNAME:
      vault: sonatype-ossrh-repository/username@Build-Environment
      file: false
    SONATYPE_OSSRH_REPO_TOKEN:
      vault: sonatype-ossrh-repository/token@Build-Environment
      file: false
  cache:
    key: maven-repository
    paths:
      - .m2/repository
  before_script:
    - ./configure_maven.sh

build:
  extends: .job-template
  stage: build
  script:
    - mvn clean package -DskipTests
  artifacts:
    paths:
      - target

unit test:
  extends: .job-template
  stage: test
  needs:
    - job: build
  script:
    - mvn test
    - mvn jacoco:report
    - ./print_coverage.sh target/site/jacoco/jacoco.csv
  coverage: '/Instructions covered: \d+.\d+%/'
  artifacts:
    when: always
    paths:
      - target/surefire-reports
      - target/site/jacoco
    reports:
      junit: target/surefire-reports/TEST-*.xml

dependencies check:
  extends: .job-template
  stage: report
  needs:
    - job: build
  script:
    - mvn dependency-check:check
  cache:
    - !reference [.job-template, cache]
    - key: dependency-check-data
      paths:
        - target/dependency-check-data
  artifacts:
    paths:
      - target/dependency-check-reports

sonar:
  extends: .job-template
  stage: analyze
  needs:
    - job: build
    - job: unit test
    - job: dependencies check
  script:
    - mvn -Dsonar.scm.revision=$CI_COMMIT_SHA -Dsonar.branch.name=$CI_COMMIT_REF_NAME sonar:sonar
  rules:
    - if: $ALLOW_QUALITY_GATE_FAILURE == 'true' || ($CI_COMMIT_TAG == null && $CI_COMMIT_REF_NAME != 'main')
      when: on_success
      allow_failure: true
    - allow_failure: false

deploy development:
  extends: .job-template
  stage: deploy
  needs:
    - job: build
    - job: sonar
      artifacts: false
  except:
    - tags
  script:
    - mvn -Pdevelopment deploy -DskipTests

deploy release:
  extends: .job-template
  stage: deploy
  needs:
    - job: build
    - job: sonar
      artifacts: false
  only:
    - tags
  script:
    - mvn -Prelease deploy -DskipTests

rollout:
  extends: .job-template
  stage: rollout
  needs:
    - job: build
    - job: sonar
      artifacts: false
  only:
    - tags
  when: manual
  script:
    - ./configure_gnupg.sh
    - mvn -Prollout deploy -DskipTests -Dgpg.keyname=$SONATYPE_OSSRH_SIGN_KEY_NAME -Dgpg.passphrase=$SONATYPE_OSSRH_SIGN_KEY_PASSPHRASE