.gitlab-ci.yml

image: python:3.10

variables:
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
  runStages: prepare lint test dependency-check sonarqube-check

cache:
  paths:
    - .cache/pip
  key: pip

before_script:
  - python -V
  - pip install virtualenv
  - virtualenv venv
  - source venv/bin/activate
  - test -n "$SKIP_PIP_INSTALL" || find .wheels -name '*.whl' -print0 | xargs -0 --no-run-if-empty pip --require-virtualenv install
  - test -n "$SKIP_PIP_INSTALL" || pip --require-virtualenv install -r requirements_dev.txt

stages:
  - prepare
  - lint
  - test
  - docs
  - dependency-check
  - sonarqube-check

build-ldap:
  stage: prepare
  variables:
    SKIP_PIP_INSTALL: "yes"
  script:
  - apt update && apt install -y libldap-dev python3-dev libsasl2-dev
  - pip install python-ldap
  - mkdir .wheels
  - find .cache/pip -name 'python_ldap*.whl' -print0 | xargs -0 -i cp -v "{}" .wheels/
  artifacts:
    expire_in: 2 days
    paths:
    - .wheels
  rules:
    - if: $runStages =~ /(prepare|test|lint|sonarqube-check)/
      when: always

test:
  script:
    - printf "[run]\nconcurrency = multiprocessing" > .coveragerc
    - coverage run ./manage.py test --parallel
    - coverage combine
    - coverage xml
  artifacts:
    expire_in: 2 days
    paths:
      - coverage.xml
  rules:
    - if: $runStages =~ /(test|sonarqube-check)/
      when: always

migrations-check:
  stage: test
  script:
    - ./manage.py makemigrations --no-input --check -v0 ||
      ( RET=$?; echo "makemigrations failed with code $?, dry-run follows:" 1>&2;
        ./manage.py makemigrations --no-input --dry-run; exit $RET )
  rules:
    - if: $runStages =~ /test/
      when: always

black:
  stage: lint
  script:
    - black . --check
  rules:
    - if: $runStages =~ /lint/
      when: always

flake8:
  stage: lint
  script:
    - flake8
  rules:
    - if: $runStages =~ /lint/
      when: always

isort:
  stage: lint
  script:
    - isort . --check
  rules:
    - if: $runStages =~ /lint/
      when: always

mypy:
  stage: lint
  script:
    - mypy .
  rules:
    - if: $runStages =~ /lint/
      when: always

sonarqube-check:
  stage: sonarqube-check
  image:
    name: sonarsource/sonar-scanner-cli:latest
    entrypoint: [""]
  variables:
    SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"
    GIT_DEPTH: "0"
  cache:
    key: "${CI_JOB_NAME}"
    paths:
      - .sonar/cache
  before_script:
    - ''
  script:
    - >
      sonar-scanner
      -Dsonar.qualitygate.wait=true
      -Dsonar.host.url=${CI_SONAR_HOST}
      -Dsonar.token=${CI_SONAR_TOKEN}
      -Dsonar.dependencyCheck.jsonReportPath=dependency-check-report.json
      -Dsonar.dependencyCheck.htmlReportPath=dependency-check-report.html
      -Dsonar.dependencyCheck.severity.high=7.0
      -Dsonar.dependencyCheck.severity.medium=4.0
      -Dsonar.dependencyCheck.severity.low=0.0
  allow_failure: true
  needs:
    - job: test
      artifacts: true
    - job: dependency-check
      artifacts: true
  rules:
    - if: $runStages =~ /sonarqube-check/
      when: always

dependency-check:
  stage: dependency-check
  image:
    name: owasp/dependency-check-action:latest
    entrypoint: [""]
  before_script:
    - apt update && apt install -y python3
  script:
    - >
      /usr/share/dependency-check/bin/dependency-check.sh
      --project Kamu --scan . --enableExperimental
      --format HTML --format JSON
  allow_failure: true
  artifacts:
    when: always
    expire_in: 1 week
    paths:
      - dependency-check-report.html
      - dependency-check-report.json
  needs: []
  rules:
    - if: $runStages =~ /(dependency-check|sonarqube-check)/
      when: always

pages:
  stage: docs
  script:
    - make -C docs html
    - mv docs/_build/html public
  artifacts:
    expire_in: 1 week
    paths:
    - public
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

pages-test:
  stage: docs
  script:
    - make -C docs html
    - mv docs/_build/html test
  artifacts:
    expire_in: 1 week
    paths:
      - test
  rules:
    - if: $CI_COMMIT_BRANCH != "main"