.gitlab-ci.yml

---
###
### Pipeline(s) definition (stages and "only" keys)
###

stages:
  - build
  - check
  - unit_test
  - pebble_strict
  - pebble_breaking
  - lets_encrypt_staging

.build:
  stage: build
  only:
    - merge_requests
    - main

.check:
  stage: check
  only:
    - merge_requests
    - main

.unit_test:
  stage: unit_test
  only:
    - merge_requests
    - main

.pebble_strict:
  stage: pebble_strict
  only:
    - merge_requests
    - main

.pebble_breaking:
  stage: pebble_breaking
  only:
    - merge_requests
    - main

.lets_encrypt_staging:
  stage: lets_encrypt_staging
  only:
    - merge_requests
    - main

###
### Stage: build
###

.build-common:
  extends: .build
  image: docker:stable
  variables:
    DOCKER_DRIVER: overlay2
    DOCKER_BUILDKIT: 1

bullseye-slim:
  extends: .build-common
  script:
    - docker build
      --progress plain
      -t "acme-dns-tiny:bullseye-slim"
      -f "docker/bullseye/Dockerfile" .

bookworm-slim:
  extends: .build-common
  script:
    - docker build
      --progress plain
      -t "acme-dns-tiny:bookworm-slim"
      -f "docker/bookworm/Dockerfile" .

trixie-slim:
  extends: .build-common
  script:
    - docker build
      --progress plain
      -t "acme-dns-tiny:trixie-slim"
      -f "docker/trixie/Dockerfile" .

###
### Stage: check
###

.check-common:
  extends: .check
  image: acme-dns-tiny:bookworm-slim

compile:
  extends: .check-common
  script:
    - python3 -m py_compile acme_dns_tiny.py tools/*.py tests/*.py

lint:
  extends: .check-common
  script: |
    #!/usr/bin/env bash

    set -euxo pipefail
    IFS=$'\n\t'

    pylint acme_dns_tiny.py
    pylint tools/acme_account_deactivate.py
    pylint tools/acme_account_rollover.py
    pylint tests/config_factory.py
    pylint tests/staging_test_acme_dns_tiny.py
    pylint --disable=W0702 tests/unit_test_acme_dns_tiny.py
    pylint tests/staging_test_acme_account_deactivate.py
    pylint tests/staging_test_acme_account_rollover.py

pep8:
  extends: .check-common
  script: |
    #!/usr/bin/env bash

    set -euxo pipefail
    IFS=$'\n\t'

    pycodestyle --max-line-length=99 --ignore=E401,W503 --exclude=tests .
    pycodestyle --max-line-length=99 --ignore=E722 tests

yamllint:
  extends: .check
  image:
    name: cytopia/yamllint
    entrypoint: ["/bin/ash", "-c"]
  script:
    - yamllint -f colored .

###
### Stage: unit_test
###

.unit_test-common:
  extends: .unit_test
  variables:
    RUN_WITH_COVERAGE: "false"
  script: |
    #!/usr/bin/env bash

    set -euxo pipefail
    IFS=$'\n\t'

    if [ "${RUN_WITH_COVERAGE:-}" = "true" ] ; then
      python3-coverage run --append --source ./ -m unittest -v \
        tests.unit_test_acme_dns_tiny
    else
      python3 -m unittest -v tests.unit_test_acme_dns_tiny
    fi

bullseye-ut:
  extends: .unit_test-common
  image: acme-dns-tiny:bullseye-slim

bookworm-ut:
  extends: .unit_test-common
  image: acme-dns-tiny:bookworm-slim
  variables:
    RUN_WITH_COVERAGE: "true"
  artifacts:
    paths:
      - .coverage

trixie-ut:
  extends: .unit_test-common
  image: acme-dns-tiny:trixie-slim

###
### Stage: pebble strict
###

.pebble_strict_common:
  extends: .pebble_strict
  variables:
    GITLABCI_ACMEDIRECTORY_V2: https://pebble:14000/dir
    REQUESTS_CA_BUNDLE: "./tests/pebble.pem"
    # Never reject valid nonce, because, as script is tiny it doesn't manage it
    # (user can run it again)
    PEBBLE_WFE_NONCEREJECT: 0
    # Never reuse already validated authorizations, so tests always have to
    # validate challenges
    PEBBLE_AUTHZREUSE: 0
    RUN_WITH_COVERAGE: "false"
  services:
    - name: letsencrypt/pebble:latest
      command: ["pebble", "-strict", "false"]
      alias: pebble
  script: |
    #!/usr/bin/env bash

    set -euxo pipefail
    IFS=$'\n\t'

    if [ "${RUN_WITH_COVERAGE:-}" = "true" ] ; then
      python3-coverage run --append --source ./ -m unittest -v \
        tests.staging_test_acme_dns_tiny \
        tests.staging_test_acme_account_rollover \
        tests.staging_test_acme_account_deactivate
    else
      python3 -m unittest -v \
        tests.staging_test_acme_dns_tiny \
        tests.staging_test_acme_account_rollover \
        tests.staging_test_acme_account_deactivate
    fi

bullseye-pebble:
  extends: .pebble_strict_common
  image: acme-dns-tiny:bullseye-slim

bookworm-pebble:
  extends: .pebble_strict_common
  image: acme-dns-tiny:bookworm-slim
  variables:
    RUN_WITH_COVERAGE: "true"
  after_script: |
    #!/usr/bin/env bash

    set -euxo pipefail
    IFS=$'\n\t'

    python3-coverage report \
      --include=acme_dns_tiny.py,tools/acme_account_rollover.py,tools/acme_account_deactivate.py
    python3-coverage html
    python3-coverage xml
  coverage: '/^TOTAL.+\s+(\d+(?:\.\d+)?)%$/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
    paths:
      - htmlcov

trixie-pebble:
  extends: .pebble_strict_common
  image: acme-dns-tiny:trixie-slim

###
### Stage: pebble breaking changes allow to detect future change breaks
###

.pebble_breaking_common:
  extends:
    - .pebble_strict_common
    - .pebble_breaking
  services:
    - name: letsencrypt/pebble:latest
      command: ["pebble", "-strict", "true"]
      alias: pebble
  allow_failure: true

bookworm_pebble_breaking:
  extends: .pebble_breaking_common
  image: acme-dns-tiny:bookworm-slim

###
### Stage: Let's Encrypt staging
###

.lets_encrypt_staging_common:
  extends: .lets_encrypt_staging
  script:
    - python3-coverage run --append --source ./ -m unittest -v
      tests.staging_test_acme_dns_tiny
      tests.staging_test_acme_account_rollover
      tests.staging_test_acme_account_deactivate

bookworm-le-staging:
  extends: .lets_encrypt_staging_common
  image: acme-dns-tiny:bookworm-slim