.gitlab-ci.yml

include:
  - project: computing/gitlab-ci-templates
    file: debian.yml
  - project: computing/gitlab-ci-templates
    file: python.yml
  - project: computing/gitlab-ci-templates
    file: workflow/sccb.yml
  - template: Security/Dependency-Scanning.gitlab-ci.yml

variables:
  # Allow Celery to run as root, because everything runs as root under Docker.
  C_FORCE_ROOT: 'true'

stages:
  - build
  - test
  - deploy

# Build source distribution
build:
  stage: build
  extends: .python:build

# Install redis
.install-redis: &install-redis
  apt-get install -y -qq redis-server

.test-common:
  stage: test
  extends:
    - .debian:base
    - .python:pytest
  variables:
    PYTEST_OPTIONS: "--cov-report=html"
  artifacts:
    paths:
      - htmlcov/

# Run test suite using poetry environment and locked dependencies
.test-poetry:
  extends: .test-common
  before_script:
    - !reference [".debian:base", before_script]
    - !reference [".python:pytest", before_script]
    - *install-redis
    - curl -sSL https://install.python-poetry.org | python3 -
    - export PATH="/root/.local/bin:$PATH"
    - poetry config virtualenvs.create false
    - poetry install -E test
  needs: []
test/poetry/python3.8:
  extends: .test-poetry
  image: python:3.8
test/poetry/python3.9:
  extends: .test-poetry
  image: python:3.9
test/poetry/python3.10:
  extends: .test-poetry
  image: python:3.10

# Run test suite using wheel and bleeding-edge dependencies
.test-wheel:
  extends: .test-common
  variables:
    PYTEST_OPTIONS: "--pyargs $CI_PROJECT_NAME"
  before_script:
    - INSTALL_TARGET=$(echo *.whl)[test]
    - !reference [".debian:base", before_script]
    - !reference [".python:pytest", before_script]
    - *install-redis
  needs:
    - build
test/wheel/python3.8:
  extends: .test-wheel
  image: python:3.8
test/wheel/python3.9:
  extends: .test-wheel
  image: python:3.9
test/wheel/python3.10:
  extends: .test-wheel
  image: python:3.10

lint:
  stage: test
  extends: .python:flake8
  needs: []

associate commits in Sentry:
  stage: test
  needs:
    - build
  only:
    - main@emfollow/gwcelery
    - tags@emfollow/gwcelery
  image:
    name: getsentry/sentry-cli
    entrypoint: [""]
  script:
    - SENTRY_VERSION=$(echo *.tar.* | sed 's/\.tar\..*//')
    - sentry-cli releases new ${SENTRY_VERSION}
    - sentry-cli releases set-commits --auto ${SENTRY_VERSION}

# Generate documentation
doc:
  stage: test
  extends:
    - .debian:base
    - .python:sphinx
  # FIXME: temporarily set image to Python 3.9 because default `python` image
  # is now Python 3.10 which lacks wheels for many packages right now.
  image: python:3.9
  variables:
    SOURCEDIR: doc
    REQUIREMENTS: .[doc]
  before_script:
    - !reference [".debian:base", before_script]
    - !reference [".python:sphinx", before_script]
    - apt-get install -y -qq graphviz
  needs: []

# SCCB request
sccb:
  stage: deploy
  before_script:
    # poetry-dynamic-versioning needs to be installed to properly
    # update the version information in pyproject.toml
    - >
      python -m pip install --upgrade pip;
      curl -sSL https://install.python-poetry.org | python3 -;
      python -m pip install --upgrade poetry-dynamic-versioning
  needs: []

# Publish coverage
pages:
  stage: deploy
  script:
    - mv htmlcov public/
  artifacts:
    paths:
      - public
    expire_in: 30 days
  only:
    - main
  needs:
    - test/poetry/python3.8

# Upload package to PyPI.
# Place your PyPI API token in the repository's GitLab CI secrets.
pypi:
  stage: deploy
  image: python:slim
  script:
    - pip install twine
    - twine upload --username __token__ --password $PYPI_API_TOKEN *.tar.* *.whl
  needs:
    - build
  only:
    - tags@emfollow/gwcelery

# Create a release in GitLab
release:
  stage: deploy
  image: python
  variables:
    GIT_STRATEGY: fetch
  script:
    - python -m pip install --upgrade pip poetry poetry-dynamic-versioning
    - PACKAGE_NAME="$(basename $PWD)"
    - PACKAGE_VERSION="$(poetry version --short)"
    - CHANGES_FILENAME="$(echo CHANGES.*)"
    - |
      tee json <<EOF
      {
        "name": "${PACKAGE_VERSION}",
        "tag_name": "${CI_COMMIT_TAG}",
        "description": "Version ${PACKAGE_VERSION}",
        "assets": {
          "links": [
            {
              "name": "PyPI",
              "url": "https://pypi.org/project/${PACKAGE_NAME}/${PACKAGE_VERSION}/"
            },
            {
              "name": "Change log",
              "url": "${CI_PROJECT_URL}/blob/v${VERSION}/${CHANGES_FILENAME}"
            },
            {
              "name": "Documentation",
              "url": "https://${PACKAGE_NAME}.readthedocs.io/en/v${PACKAGE_VERSION}/"
            }
          ]
        }
      }
      EOF
    - |
      if [ -n "$CI_COMMIT_TAG" ]
      then
        curl --silent --show-error --fail \
        --request POST --header "Private-Token: $GITLAB_ACCESS_TOKEN" \
        --header "Content-Type: application/json" \
        --data "@json" \
        "$CI_API_V4_URL/projects/$CI_PROJECT_ID/releases"
      fi

.deploy-common: &deploy-common
  image: containers.ligo.org/emfollow/ssh-kerberos
  stage: deploy
  only:
    - branches@emfollow/gwcelery
    - tags@emfollow/gwcelery
  needs: []

# Continuous deployment.
# Note that all deployments except playground/CIT are manual.

.deploy-start: &deploy-start
  <<: *deploy-common
  script:
    # Update the repository.
    - |
      ssh -T $REMOTE_HOST bash <<EOF
      set -e
      if [ ! -d .git ]; then git init; fi
      git fetch --tags ${CI_REPOSITORY_URL} $CI_COMMIT_SHA
      git checkout -f $CI_COMMIT_SHA
      EOF
    # Reinstall and start (new session to reload bashrc).
    - |
      ssh -T $REMOTE_HOST bash <<EOF
      . .bashrc
      set -e
      python -m pip install --upgrade pip
      curl -sSL https://install.python-poetry.org | python3 -
      # FIXME: It would be simpler to use `poetry install`, but it tries to
      # uninstall system site-packages even if they are not writable.
      pip install --no-deps -r <(poetry export --with dev)
      pip install --no-deps .

      # FIXME: remove pip uninstall temporary directories left behind due to
      # bug with pip on NFS. See https://github.com/pypa/pip/issues/6327
      chmod -R ug+rwx .local/lib/python*/site-packages/~* || true
      rm -rf .local/lib/python*/site-packages/~* || true
      gwcelery condor resubmit
      EOF

.deploy-stop: &deploy-stop
  <<: *deploy-common
  script: |
    ssh -T $REMOTE_HOST bash <<EOF
    . .bashrc
    set -e
    gwcelery condor rm
    EOF

deploy to production at CIT:
  <<: *deploy-start
  when: manual
  environment:
    name: production/CIT
    on_stop: stop deployment on production at CIT
    url: https://emfollow.ligo.caltech.edu/flower
  variables:
    REMOTE_HOST: emfollow@emfollow.ligo.caltech.edu

deploy to production at LHO:
  <<: *deploy-start
  when: manual
  environment:
    name: production/LHO
    on_stop: stop deployment on production at LHO
    url: https://emfollow.ligo-wa.caltech.edu/flower
  variables:
    REMOTE_HOST: emfollow@emfollow.ligo-wa.caltech.edu

deploy to playground at CIT:
  <<: *deploy-start
  environment:
    name: playground/CIT
    on_stop: stop deployment on playground at CIT
    url: https://emfollow-playground.ligo.caltech.edu/flower
  variables:
    REMOTE_HOST: emfollow-playground@emfollow-playground.ligo.caltech.edu

deploy to playground at LHO:
  <<: *deploy-start
  when: manual
  environment:
    name: playground/LHO
    on_stop: stop deployment on playground at LHO
    url: https://emfollow-playground.ligo-wa.caltech.edu/flower
  variables:
    REMOTE_HOST: emfollow-playground@emfollow-playground.ligo-wa.caltech.edu

deploy to test at CIT:
  <<: *deploy-start
  when: manual
  environment:
    name: test/CIT
    on_stop: stop deployment on test at CIT
    url: https://emfollow-test.ligo.caltech.edu/flower
  variables:
    REMOTE_HOST: emfollow-test@emfollow-test.ligo.caltech.edu

deploy to test at LHO:
  <<: *deploy-start
  when: manual
  environment:
    name: test/LHO
    on_stop: stop deployment on test at LHO
    url: https://emfollow-test.ligo-wa.caltech.edu/flower
  variables:
    REMOTE_HOST: emfollow-test@emfollow-test.ligo-wa.caltech.edu

stop deployment on production at CIT:
  <<: *deploy-stop
  when: manual
  environment:
    name: production/CIT
    action: stop

stop deployment on production at LHO:
  <<: *deploy-stop
  when: manual
  environment:
    name: production/LHO
    action: stop

stop deployment on playground at CIT:
  <<: *deploy-stop
  when: manual
  environment:
    name: playground/CIT
    action: stop

stop deployment on playground at LHO:
  <<: *deploy-stop
  when: manual
  environment:
    name: playground/LHO
    action: stop

stop deployment on test at CIT:
  <<: *deploy-stop
  when: manual
  environment:
    name: test/CIT
    action: stop

stop deployment on test at LHO:
  <<: *deploy-stop
  when: manual
  environment:
    name: test/LHO
    action: stop