.gitlab-ci.yml

stages:
  - lint
  - build
  - test
  - build deb
  - build docker
  - publish
  - docs
  - downstreams
  - release

variables:
  DOCKER_TLS_CERTDIR: "/certs"

.testserver: &testserver
#  services:
#    - postgres
  variables:
    POSTGRES_PASSWORD: test
#    SIGNALD_POSTGRES_TEST_DATABASE: postgresql://postgres:test@postgres/

clang-format:
  image: debian:buster-backports
  stage: lint
  before_script:
    - apt-get update && apt-get install -y clang-format-11 git python3 wget make
  script:
    - tools/format.sh
  needs: []
  rules:
    - when: on_success


.build:
  image: openjdk:${JAVA_VERSION}-jdk
  stage: build
  needs: []
  script:
    - 'export "VERSION=$(./version.sh)"'
    - 'echo "Version: ${VERSION}"'
    - ./gradlew installDist
  artifacts:
    paths:
      - build/
    expire_in: 30 days
  rules:
    - when: on_success

build:
  extends: .build
  parallel:
    matrix:
      - JAVA_VERSION: [11, 12, 13, 14, 15, 16, 17]

build java11 x86_64-unknown-linux-gnu:
  extends: .build
  variables:
    JAVA_VERSION: 11

build java11 aarch64-unknown-linux-gnu:
  extends: .build
  variables:
    JAVA_VERSION: 11
    SIGNALD_TARGET: aarch64-unknown-linux-gnu


build deb x86_64-unknown-linux-gnu:
  image: registry.gitlab.com/signald/infrastructure/signald-builder-x86:d5e68709
  stage: build deb
  needs: []
  before_script:
    - export VERSION="$(./version.sh)"
    - echo "Building signald version $VERSION"
    - "sed -i 's/^Architecture:.*/Architecture: amd64/g' debian/control"
  script:
    - gbp dch --ignore-branch --debian-tag="%(version)s" --git-author --new-version="${VERSION}"
    - dpkg-buildpackage -b
    - mv ../signald_* .
  artifacts:
    paths:
      - "signald_*"
    expire_in: 30 days
  rules:
    - if: '$CI_PROJECT_PATH == "signald/signald" && $CI_COMMIT_REF_PROTECTED == "true"'
      when: on_success
    - when: manual
      allow_failure: true

build deb aarch64-unknown-linux-gnu:
  image: registry.gitlab.com/signald/infrastructure/signald-builder-arm64-v8:010941fc
  stage: build deb
  needs: []
  tags: [arm-builder]
  before_script:
    - export VERSION="$(./version.sh)"
    - echo "Building signald version $VERSION"
    - "sed -i 's/^Architecture:.*/Architecture: arm64/g' debian/control"
  script:
    - gbp dch --ignore-branch --debian-tag="%(version)s" --git-author --new-version="${VERSION}"
    - dpkg-buildpackage -b
    - mv ../signald_* .
  artifacts:
    paths:
      - "signald_*"
    expire_in: 30 days
  rules:
    - if: '$CI_PROJECT_PATH == "signald/signald" && $CI_COMMIT_REF_PROTECTED == "true"'
      when: on_success
    - when: manual
      allow_failure: true

.docker-buildx:
  stage: build docker
  tags: [docker-builder]
  needs: []
  before_script:
    - podman login --username "${CI_DEPENDENCY_PROXY_USER}" --password "${CI_DEPENDENCY_PROXY_PASSWORD}" "${CI_DEPENDENCY_PROXY_SERVER}"
    - podman login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}
    - export VERSION="$(./version.sh | sed 's#+#-#g' | sed 's#/#-#g')"
    - DOCKER_PLATFORM=$(echo "${PLATFORM:6}" | sed 's#/#-#g')
  script:
    - podman build --platform "${PLATFORM}" --build-arg "CI_BUILD_REF_NAME=${CI_BUILD_REF_NAME}" --build-arg "CI_COMMIT_SHA=${CI_COMMIT_SHA}" -t "${CI_REGISTRY_IMAGE}:${VERSION}-${DOCKER_PLATFORM}-non-root" -f "${CONTAINERFILE:-Containerfile}" .
    - sed -i "s#FROM .*#FROM ${CI_REGISTRY_IMAGE}:${VERSION}-${DOCKER_PLATFORM}-non-root#g" uid-transition.Containerfile
    - podman build --platform "${PLATFORM}" --build-arg "CI_BUILD_REF_NAME=${CI_BUILD_REF_NAME}" --build-arg "CI_COMMIT_SHA=${CI_COMMIT_SHA}" -t "${CI_REGISTRY_IMAGE}:${VERSION}-${DOCKER_PLATFORM}" -f "uid-transition.Containerfile" .
    - podman push "${CI_REGISTRY_IMAGE}:${VERSION}-${DOCKER_PLATFORM}-non-root"
    - podman push "${CI_REGISTRY_IMAGE}:${VERSION}-${DOCKER_PLATFORM}"
  rules:
    - if: '$CI_PROJECT_NAMESPACE == "signald" && $CI_COMMIT_REF_PROTECTED == "true"'
      when: on_success
    - when: manual
      allow_failure: true

container amd64:
  extends: .docker-buildx
  variables:
    PLATFORM: linux/amd64

container arm64:
  extends: .docker-buildx
  variables:
    PLATFORM: linux/arm64/v8

container manifest:
  stage: publish
  needs: ["container amd64", "container arm64"]
  tags: [docker-builder]
  before_script:
    - sudo apt-get update && sudo apt-get install -y podman
    - podman login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}
    - if [[ "${CI_COMMIT_REF_PROTECTED}" == "true" ]]; then podman login -u ${DOCKER_HUB_USERNAME} -p ${DOCKER_HUB_PASSWORD} docker.io; fi
    - export VERSION="$(./version.sh | sed 's#+#-#g' | sed 's#/#-#g')"
  script:
    - |
      for platform in amd64 arm64-v8; do
        set -x
        podman pull --quiet "${CI_REGISTRY_IMAGE}:${VERSION}-${platform}"
        podman pull --quiet "${CI_REGISTRY_IMAGE}:${VERSION}-${platform}-non-root"
        set +x
      done
    - tools/podman-multiarch-manifest.sh "${CI_REGISTRY_IMAGE}:${VERSION}" "${CI_REGISTRY_IMAGE}:${VERSION}"-{amd64,arm64-v8}
    - tools/podman-multiarch-manifest.sh "${CI_REGISTRY_IMAGE}:${VERSION}-non-root" "${CI_REGISTRY_IMAGE}:${VERSION}"-{amd64,arm64-v8}-non-root
    - |
      if [ "${CI_COMMIT_REF_PROTECTED}" == "true" ]; then
        set -x
      
        for platform in amd64 arm64-v8; do
          podman tag "${CI_REGISTRY_IMAGE}:${VERSION}-${platform}" "docker.io/signald/signald:${VERSION}-${platform}"
          podman push --quiet "docker.io/signald/signald:${VERSION}-${platform}"

          podman tag "${CI_REGISTRY_IMAGE}:${VERSION}-${platform}-non-root" "docker.io/signald/signald:${VERSION}-${platform}-non-root"
          podman push --quiet "docker.io/signald/signald:${VERSION}-${platform}-non-root"
        done

        tools/podman-multiarch-manifest.sh "${CI_REGISTRY_IMAGE}:unstable" "${CI_REGISTRY_IMAGE}:${VERSION}"-{amd64,arm64-v8}
        tools/podman-multiarch-manifest.sh "docker.io/signald/signald:unstable" "docker.io/signald/signald:${VERSION}"-{amd64,arm64-v8}

        # count commits since last tag
        commits="$(git rev-list $(git describe --always --abbrev=0 HEAD)..HEAD --count)"
        if [ "${commits}" = "0" ]; then # an actual release
          tools/podman-multiarch-manifest.sh "docker.io/signald/signald:${VERSION}" "docker.io/signald/signald:${VERSION}"-{amd64,arm64-v8}
          tools/podman-multiarch-manifest.sh "docker.io/signald/signald:${VERSION}-non-root" "docker.io/signald/signald:${VERSION}"-{amd64,arm64-v8}-non-root
          tools/podman-multiarch-manifest.sh "docker.io/signald/signald:stable" "docker.io/signald/signald:${VERSION}"-{amd64,arm64-v8}
          tools/podman-multiarch-manifest.sh "docker.io/signald/signald:latest" "docker.io/signald/signald:${VERSION}"-{amd64,arm64-v8}
          tools/podman-multiarch-manifest.sh "${CI_REGISTRY_IMAGE}:stable" "${CI_REGISTRY_IMAGE}:${VERSION}"-{amd64,arm64-v8}
          tools/podman-multiarch-manifest.sh "${CI_REGISTRY_IMAGE}:latest" "${CI_REGISTRY_IMAGE}:${VERSION}"-{amd64,arm64-v8}
          tools/podman-multiarch-manifest.sh "docker.io/finn/signald:${VERSION}"  "docker.io/signald/signald:${VERSION}"-{amd64,arm64-v8}
          tools/podman-multiarch-manifest.sh "docker.io/finn/signald:latest" "docker.io/signald/signald:${VERSION}"-{amd64,arm64-v8}
        fi

        set +x # to avoid printing tokens
        echo "Authenticating to dockerhub to delete temporary tags"
        token=$(curl -sfd "{\"username\": \"${DOCKER_HUB_USERNAME}\", \"password\": \"${DOCKER_HUB_PASSWORD}\"}" -H "Content-Type: application/json" https://hub.docker.com/v2/users/login/ | jq -r '.token')
        for platform in amd64 arm64-v8; do
          echo "deleting tag ${VERSION}-${platform}"
          curl --fail -s -X DELETE -H "Authorization: JWT ${token}" https://hub.docker.com/v2/repositories/signald/signald/tags/${VERSION}-${platform}/

          echo "deleting tag ${VERSION}-${platform}-non-root"
          curl --fail -s -X DELETE -H "Authorization: JWT ${token}" https://hub.docker.com/v2/repositories/signald/signald/tags/${VERSION}-${platform}-non-root/
        done

        echo "image pushed to docker.io/signald/signald:${VERSION} and ${CI_REGISTRY_IMAGE}:${VERSION}"
      fi
  rules:
    - if: '$CI_PROJECT_PATH == "signald/signald" && $CI_COMMIT_BRANCH'
      when: on_success
    - when: manual
      allow_failure: true


unit tests x86:
  <<: *testserver
  image: openjdk:11-jdk
  stage: test
  needs: []
  before_script:
    - cp tools/log4j2.xml src/main/resources/log4j2.xml
  script:
    - ./gradlew test
  rules:
    - when: on_success
  artifacts:
    when: always
    reports:
      junit: build/test-results/test/**/TEST-*.xml
    paths:
      - build/reports/tests/test

unit tests aarch64-unknown-linux-gnu:
  <<: *testserver
  image: debian
  stage: test
  tags: [arm-builder]
  needs: []
  before_script:
    - apt update && apt install -y make openjdk-11-jdk-headless
  script:
    - ./gradlew test
  rules:
    - if: '$CI_PROJECT_PATH == "signald/signald" && $CI_COMMIT_REF_PROTECTED == "true"'
      when: on_success
    - when: manual
      allow_failure: true

unit tests x86_64-apple-darwin:
  image: debian
  stage: test
  tags: [darwin-builder]
  needs: []
  before_script:
    - apt update && apt install -y make openjdk-11-jdk-headless
  script:
    - export PATH=/usr/local/opt/openjdk/bin:$PATH # work around issue with brew installed java
    - ./gradlew cleanTest test
  after_script:
    - rm -rf ~/.config/signald
  rules:
    - if: '$CI_PROJECT_PATH == "signald/signald" && $CI_COMMIT_REF_PROTECTED == "true"'
      when: on_success
    - when: manual
      allow_failure: true

publish debian packages:
  image: registry.gitlab.com/signald/infrastructure/signald-builder-x86:d5e68709
  stage: publish
  tags: [deb-signer]
  needs: ["build deb x86_64-unknown-linux-gnu", "build deb aarch64-unknown-linux-gnu"]
  script:
    - tools/aptly-publish.sh
  variables:
    DISTRIBUTION: unstable
  rules:
    - if: '$CI_PROJECT_PATH == "signald/signald" && $CI_COMMIT_REF_PROTECTED == "true" && $CI_COMMIT_BRANCH'
      when: on_success

publish stable debian packages:
  image: registry.gitlab.com/signald/infrastructure/signald-builder-x86:d5e68709
  stage: publish
  tags: [deb-signer]
  needs: ["build deb x86_64-unknown-linux-gnu", "build deb aarch64-unknown-linux-gnu"]
  script:
    - tools/aptly-publish.sh
  variables:
    DISTRIBUTION: stable
  allow_failure: true
  rules:
    - if: '$CI_PROJECT_PATH == "signald/signald" && $CI_COMMIT_REF_PROTECTED == "true" && $CI_COMMIT_TAG'
      when: on_success

validate protocol:
  image: golang:latest
  stage: docs
  before_script:
    - apt-get update && apt-get install -y openjdk-11-jdk-headless
  script:
    - build/install/signald/bin/signald --dump-protocol > protocol.json
    - go run ./tools/protocol-validator < protocol.json
  needs: ["build java11 x86_64-unknown-linux-gnu"]
  artifacts:
    paths:
      - protocol.json
    expire_in: 1 year
    reports:
      metrics: metrics.txt
  rules:
    - when: on_success
  allow_failure: true

signald.org-branch:
  image: debian
  stage: docs
  before_script:
    - echo 'deb http://deb.debian.org/debian buster-backports main' > /etc/apt/sources.list.d/backports.list
    - apt-get update && apt-get install -t buster-backports -y hugo golang-go
    - apt-get install -y jq locales python3 python3-requests python3-pip openjdk-11-jdk-headless curl git
    - apt install -y --allow-downgrades libcurl3-gnutls/stable  # wtf is this shit? https://superuser.com/questions/1642858/git-on-debian-10-backports-throws-fatal-unable-to-access-https-github-com-us
    - pip3 install anybadge
    - sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen
    - git clone https://gitlab.com/signald/signald.org
  script:
    - mkdir -p signald.org/content/signaldctl/reference
    - SIGNALDCTL_PUBLIC_DOC_MODE=on ./signaldctl doc -o md ./signald.org/content/signaldctl/reference
    - build/install/signald/bin/signald --dump-protocol | jq . > ./signald.org/content/protocol.json
    - cd signald.org
    - go run generate.go < content/protocol.json
    - mkdir -p themes/hugo-geekdoc/
    - curl -L https://github.com/thegeeklab/hugo-geekdoc/releases/latest/download/hugo-geekdoc.tar.gz | tar -xz -C themes/hugo-geekdoc/ --strip-components=1
    - python3 ./generate-badges.py
    - sed -i "s#https://signald.org#https://signald.gitlab.io/-/signald/-/jobs/${CI_JOB_ID}/artifacts/public/#" config.toml
    - hugo
    - mv public ../public
  artifacts:
    paths:
      - public
    expose_as: signald dot org preview
    expire_in: 1 month
  rules:
    - if: '$CI_COMMIT_REF_PROTECTED == "false" && $CI_PROJECT_PATH == "signald/signald"'
  needs:
    - "build java11 x86_64-unknown-linux-gnu"
    - project: signald/signald-go
      job: build:x86
      ref: main
      artifacts: true

signald.org:
  stage: downstreams
  needs: ["validate protocol"]
  trigger: signald/signald.org
  only:
    - main

release:
  stage: release
  image: debian:latest
  only:
    - tags
  before_script:
    - apt update
    - apt install -y python3-requests
  script:
    - python3 ./tools/release/ci-create.py