.gitlab-ci.yml

default:
  image: gradle:8.9-jdk17

# Explicit version of the Mergerequests-Pipelines workflow, with the main branch
# added.
workflow:
  rules:
    - if: $CI_MERGE_REQUEST_IID
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_BRANCH == "main"

stages:
  - build
  - test
  - qa
  - package
  - review
  - deploy
  - publish

include:
  # Use gitlab security scanning iff it is available
  - template: Dependency-Scanning.gitlab-ci.yml
  # Mend (dependency scanning)
  - project: 'swe/gitlab-ci'
    file: '/templates/mend-scanning.yml'
  - project: 'swe/gitlab-ci'
    file: '/templates/mend-generate-badge.yml'
  # Review Apps
  - project: 'rpki/helm-charts'
    file: '/gitlab/review.yml'


variables:
  BUILD_NUMBER: ${CI_COMMIT_REF_SLUG}-${CI_PIPELINE_ID}
  GRADLE_USER_HOME: "${CI_PROJECT_DIR}/.gradle/"
  GRADLE_OPTS: "-Dorg.gradle.caching=true -Dorg.gradle.parallel=true -Dorg.gradle.daemon=false"
  HSM_IMPL: thales


######## Build stage ########
build:
  stage: build
  # slow builds in augusts 2023
  timeout: 60m
  services:
    - postgres:15
  variables:
      POSTGRES_DB: certdb_test
      POSTGRES_USER: certdb
      POSTGRES_PASSWORD: ""
      POSTGRES_HOST: postgres
      POSTGRES_HOST_AUTH_METHOD: trust
      SPRING_DATASOURCE_URL: jdbc:postgresql://postgres/certdb_test
      SPRING_DATASOURCE_USERNAME: certdb
      SPRING_DATASOURCE_PASSWORD: ""
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - .gradle/caches
      - .gradle/wrapper
  before_script:
    - mkdir -m 755 -p /export/bad/certification/repository/{ta,online}/published
    - mkdir -m 755 -p /export/bad/certification/ta/{data,requests,responses}
  script:
    - ./gradlew -i build integrationTest
    - cat build/reports/jacoco/test/html/index.html
  artifacts:
    when: always
    paths:
      - build
      - scripts/*
    reports:
      junit:
        - build/test-results/**/*.xml

build-image:
  stage: package
  needs: ["build"]
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - .gradle/caches
      - .gradle/wrapper
  before_script:
    - apt-get update
    - apt-get install --yes --no-install-recommends docker.io
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - mkdir -p ~/.config/google-cloud-tools-java/jib/
    - cp jib.config.json ~/.config/google-cloud-tools-java/jib/config.json
  script:
    - ./gradlew jib --image $CI_REGISTRY_IMAGE/ci:ci-step-$BUILD_NUMBER
  rules:
    - if: $CI_MERGE_REQUEST_EVENT_TYPE == "merge_train"
      when: never
    - when: on_success

image-tag-latest:
  stage: deploy
  dependencies:
    - build-image
  image: docker-registry.ripe.net/swe/gitlab-ci/debian-deployenv
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker pull $CI_REGISTRY_IMAGE/ci:ci-step-$BUILD_NUMBER
    - docker tag $CI_REGISTRY_IMAGE/ci:ci-step-$BUILD_NUMBER ${CI_REGISTRY_IMAGE}:latest
    - docker push ${CI_REGISTRY_IMAGE}:latest
  rules:
    - if: $CI_MERGE_REQUEST_EVENT_TYPE == "merge_train"
      when: never
    - if: $CI_COMMIT_BRANCH == "main"
    - when: manual


######### Test stage #########
sonarqube:
  stage: qa
  needs: ["build"]
  dependencies: ["build"]
  variables:
    GIT_DEPTH: 0
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - .gradle/caches
      - .gradle/wrapper
  script:
    - ./gradlew -i -Dsonar.projectKey=rpki-ripe-ncc sonarqube
  allow_failure: true
  rules:
    - if: $CI_MERGE_REQUEST_EVENT_TYPE == "merge_train"
      when: never
    - if: '$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME =~ /^renovate/'
      when: never
    - if: $CI_MERGE_REQUEST_IID
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_BRANCH == "next"

control/run-on-staging:
  image: node:22-alpine
  stage: qa
  script:
    - ./scripts/gitlab-deploy-check
  allow_failure: true
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: always
    - when: never

######## Deploy stage ########
.delivr-deploy: &delivr-deploy
  stage: deploy
  needs: ["build"]
  image: $CI_REGISTRY/swe/delivr:latest
  script:
    - echo "Checking environment name $CI_ENVIRONMENT_NAME"
    - echo "Check build number $BUILD_NUMBER"
    - delivr --application rpki-core --environment $CI_ENVIRONMENT_NAME \
             --artifact-file build/distributions/rpki-ripe-ncc-${BUILD_NUMBER}.tgz

production:
  <<: *delivr-deploy
  environment:
    name: production
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual
    - when: never

prepdev:
  <<: *delivr-deploy
  environment:
    name: prepdev
  rules:
    - if: $CI_MERGE_REQUEST_EVENT_TYPE == "merge_train"
      when: never
    - when: manual

pilot:
  <<: *delivr-deploy
  environment:
    name: pilot
  rules:
    - if: $CI_MERGE_REQUEST_EVENT_TYPE == "merge_train"
      when: never
    - when: manual

publish-to-github:
  stage: publish
  image: alpine:latest
  needs:
    - production
  before_script:
    - apk add --virtual runtime-deps bash git openssh-client
  script: |
    [ -n "$GITHUB_DEPLOY_KEY" ] || ( echo "GITHUB_DEPLOY_KEY is not set"; exit 1 )
    [ -n "$GITHUB_KNOWN_HOSTS" ] || ( echo "GITHUB_KNOWN_HOSTS is not set"; exit 1 )
    mkdir -m 700 -p ~/.ssh
    cat >> ~/.ssh/known_hosts <(echo "$GITHUB_KNOWN_HOSTS")
    eval $(ssh-agent -s)
    ssh-add <(echo "$GITHUB_DEPLOY_KEY")
    ./scripts/publish-source-code --push --verify --allow-older 10 --committer-name 'RPKI Team at RIPE NCC' --committer-email 'rpki@ripe.net' -- $CI_COMMIT_BEFORE_SHA $CI_COMMIT_SHA
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: on_success
    - when: never

review:
  variables:
    GIT_STRATEGY: none
    RPKI_CORE_IMAGE: $CI_REGISTRY_IMAGE/ci:ci-step-$BUILD_NUMBER
  needs:
    - build-image