.gitlab-ci.yml

# SPDX-FileCopyrightText: OpenTalk GmbH <mail@opentalk.eu>
#
# SPDX-License-Identifier: EUPL-1.2

---
default:
  image: node:20-alpine

stages:
  - analyze
  - lint
  - test
  - prepare-artifact
  - build
  - deploy
  - cleanup
  - e2e

.setup-pnpm: &setup-pnpm
  - corepack enable
  - corepack prepare pnpm@latest-9 --activate
  - pnpm config set store-dir .pnpm-store

analyze:code_review:
  stage: analyze
  when: manual
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  before_script:
    - apk add --no-cache git
    - GIT_URL=https://gitlab-ci-token:${CI_JOB_TOKEN}@git.opentalk.dev/opentalk/tools/coreebo.git
    - git clone --depth 1 --branch $COREEBO_VERSION $GIT_URL
    - cd coreebo
    - npm ci
  script:
    - npm run review -- -id $CI_MERGE_REQUEST_IID

lint:prettier+eslint:
  stage: lint
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  before_script:
    - *setup-pnpm
  script:
    - pnpm install
    - pnpm lint --max-warnings 0
    - pnpm fmt:ci

lint:yaml:
  stage: lint
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  before_script:
    - apk add --no-cache yamllint
  script: yamllint .

lint:compliance:
  stage: lint
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  before_script:
    - apk add --no-cache git
    - *setup-pnpm
    - pnpm install
  script:
    - pnpm dlx licensee --production --errors-only

lint:licensing:
  stage: lint
  image:
    name: fsfe/reuse:2.1.0
    entrypoint: ['']
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  script:
    - reuse lint

lint:audit:
  stage: lint
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  before_script:
    - *setup-pnpm
  script:
    - pnpm audit --prod
  allow_failure: true

lint:commit:
  stage: lint
  allow_failure: true
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  before_script:
    - apk add --no-cache git
    - npm install -g @commitlint/cli @commitlint/config-conventional
  script:
    - npx commitlint --from $CI_MERGE_REQUEST_DIFF_BASE_SHA --to HEAD --verbose

test:unit-tests:
  stage: test
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_COMMIT_TAG && $CI_PROJECT_ROOT_NAMESPACE == 'opentalk'
  before_script:
    - apk add --no-cache git
    - *setup-pnpm
    - pnpm install
  script:
    - pnpm test:unit:ci
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura-coverage.xml
      junit:
        - junit.xml
  coverage: /All files[^\|]*\|[^\|]*\s+([\d\.]+)/

prepare-artifact:build:
  stage: prepare-artifact
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_COMMIT_TAG && $CI_PROJECT_ROOT_NAMESPACE == 'opentalk'
  before_script:
    - apk add git jq
    - *setup-pnpm
    - pnpm install
  script:
    - pnpm build
    - echo v$(jq -r '.version' ./app/package.json) > ./dist/FRONTEND_VERSION
  artifacts:
    paths:
      - dist/*
    expire_in: 1 days

prepare-artifact:build-profiler:
  stage: prepare-artifact
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_COMMIT_TAG && $CI_PROJECT_ROOT_NAMESPACE == 'opentalk'
  before_script:
    - apk add git jq
    - *setup-pnpm
    - pnpm install
  script:
    - pnpm build:profiler
    - jq -r '.version' ./app/package.json > ./dist-profiler/FRONTEND_VERSION
  artifacts:
    paths:
      - dist-profiler/*
    expire_in: 1 days

# Upload Source Maps to our glitchtip instance when a tag is created and pushed to main
prepare-artifact:upload-sourcemaps:
  stage: prepare-artifact
  dependencies:
    - prepare-artifact:build
  needs:
    - prepare-artifact:build
  rules:
    - if: $CI_COMMIT_TAG && $CI_PROJECT_ROOT_NAMESPACE == 'opentalk'
  before_script:
    - *setup-pnpm
    - pnpm add -w @sentry/cli
    - echo "[ defaults ]" >> .sentryclirc
    - echo "url=${GLITCHTIP_URL}" >> .sentryclirc
    - echo "org=${GLITCHTIP_ORG}" >> .sentryclirc
    - echo "project=${GLITCHTIP_PROJECT}" >> .sentryclirc
  script:
    - RELEASE_TAG=${CI_COMMIT_TAG:-999.0.0-unreleased}
    - node_modules/.bin/sentry-cli sourcemaps inject dist/
    - node_modules/.bin/sentry-cli login --auth-token $GLITCHTIP_AUTH_TOKEN
    - node_modules/.bin/sentry-cli sourcemaps upload --release $RELEASE_TAG dist/
  artifacts:
    paths:
      - dist/*
    expire_in: 1 days


build:container:
  stage: build
  dependencies:
    - prepare-artifact:upload-sourcemaps
    - prepare-artifact:build
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: ['']
  rules:
    # set variable for push to main
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      variables:
        IMAGE_DESTINATION_ARGS: --destination $CI_REGISTRY_IMAGE:latest
    # set variable for release tags
    - if: $CI_COMMIT_TAG && $CI_PROJECT_ROOT_NAMESPACE == 'opentalk'
      variables:
        IMAGE_DESTINATION_ARGS: >
          --destination $CI_REGISTRY_IMAGE:latest
          --destination $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
    # set variable for MR event
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      variables:
        IMAGE_DESTINATION_ARGS: >
          --destination ${CI_REGISTRY_IMAGE}:${CI_MERGE_REQUEST_IID}_${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}
    # set variable for forked pipeline (commented out to get rid of pipelines in forked repos)
    # - if: $CI_PROJECT_ROOT_NAMESPACE != 'opentalk' &&
    #      $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH &&
    #      $CI_COMMIT_BRANCH != null
    #  variables:
    #    IMAGE_DESTINATION_ARGS: --no-push
  script:
    - mkdir -p /kaniko/.docker
    - >
      echo
      "{\"auths\":{\"$CI_REGISTRY\":{\"auth\":\"$(echo -n ${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD} | base64)\"}}}" >
      /kaniko/.docker/config.json
    - >
      /kaniko/executor
      --registry-mirror=mirror.gcr.io
      --context $CI_PROJECT_DIR
      --dockerfile $CI_PROJECT_DIR/ci/DockerfileCI
      $IMAGE_DESTINATION_ARGS
      --force

build:container-profiling:
  stage: build
  dependencies:
    - prepare-artifact:build-profiler
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: ['']
  # todo - check when profiling should be build
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_TAG && $CI_PROJECT_ROOT_NAMESPACE == 'opentalk'
  script:
    - mkdir -p /kaniko/.docker
    - >
      echo
      "{\"auths\":{\"$CI_REGISTRY\":{\"auth\":\"$(echo -n ${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD} | base64)\"}}}" >
      /kaniko/.docker/config.json
    - >
      /kaniko/executor
      --registry-mirror=mirror.gcr.io
      --context $CI_PROJECT_DIR
      --dockerfile $CI_PROJECT_DIR/ci/DockerfileCI
      --destination $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG:+$CI_COMMIT_TAG-}profiling
      --destination $CI_REGISTRY_IMAGE:profiling
      --build-arg DIST_FOLDER=dist-profiler
      --force


deploy:review-app:
  stage: deploy
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  image: alpine/helm:3.10.2
  tags:
    - kubernetes
  before_script:
    - helm repo add --username gitlab-ci-token --password ${CI_JOB_TOKEN}
      opentalk https://git.opentalk.dev/api/v4/projects/218/packages/helm/stable
  script:
    - helm uninstall frontend-$CI_MERGE_REQUEST_IID -n review-latest || true
    - helm upgrade --version 0.1.0 --install --force frontend-$CI_MERGE_REQUEST_IID opentalk/ot-web-frontend-helm
      --set image.repository=$CI_REGISTRY_IMAGE
      --set image.tag=${CI_MERGE_REQUEST_IID}_${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}
      --set ingress.tls[0].secretName=frontend-$CI_MERGE_REQUEST_IID-tls
      --set ot_frontend_url=www.$CI_MERGE_REQUEST_IID.review-latest.kube.opentalk.run
      --set ot_keycloak_domain=accounts.review-latest.kube.opentalk.run
      --set ot_backend_url=controller.review-latest.kube.opentalk.run
      --set ot_feature_shared_folder="true"
      --set ot_sentry_dsn=$SENTRY_DSN_TESTING
      --set-string 'ingress.annotations.cert-manager\.io/cluster-issuer=letsencrypt-prod'
      --set-string 'ingress.annotations.kubernetes\.io/ingress\.class=traefik'
      --set-string
      'ingress.annotations.traefik\.ingress\.kubernetes\.io/router\.middlewares=review-latest-auth@kubernetescrd'
      -n review-latest --create-namespace --wait
    - echo "https://${BASIC_AUTH_USER}:${BASIC_AUTH_PASS}@www.${CI_MERGE_REQUEST_IID}.review-latest.kube.opentalk.run"

e2e:test:
  image: mcr.microsoft.com/playwright:v1.44.1-jammy
  stage: e2e
  variables:
    INSTANCE_URL: https://${BASIC_AUTH_USER}:${BASIC_AUTH_PASS}@www.${CI_MERGE_REQUEST_IID}.review-latest.kube.opentalk.run
    USERNAME: ${BASIC_AUTH_USER}
    USER_EMAIL: ${BASIC_USER_EMAIL}
    PASSWORD: ${BASIC_AUTH_PASS}
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_COMMIT_TAG && $CI_PROJECT_ROOT_NAMESPACE == 'opentalk'
  allow_failure: true
  parallel:
    matrix:
      - PROJECT:
          - chromium
          - webkit
          - firefox
  before_script:
    - *setup-pnpm
    - pnpm install
  script:
    - npx playwright install --with-deps
    - npx playwright test --project=$PROJECT --shard=$SHARD

e2e:smoke:
  image: mcr.microsoft.com/playwright:v1.44.1-jammy
  stage: e2e
  variables:
    INSTANCE_URL: https://${BASIC_AUTH_USER}:${BASIC_AUTH_PASS}@www.${CI_MERGE_REQUEST_IID}.review-latest.kube.opentalk.run
    USERNAME: ${BASIC_AUTH_USER}
    USER_EMAIL: ${BASIC_USER_EMAIL}
    PASSWORD: ${BASIC_AUTH_PASS}
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_COMMIT_TAG && $CI_PROJECT_ROOT_NAMESPACE == 'opentalk'
  allow_failure: true
  parallel:
    matrix:
      - PROJECT:
          - chromium
          - webkit
          - firefox
  before_script:
    - *setup-pnpm
    - pnpm install
  script:
    - npx playwright install --with-deps
    - npx playwright test --project=smoke-$PROJECT --shard=$SHARD

cleanup:review-app:
  stage: cleanup
  rules:
    - if: $CI_MERGE_REQUEST_EVENT_TYPE == "close"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
          $CI_PROJECT_ROOT_NAMESPACE == 'opentalk' &&
          $CI_PIPELINE_SOURCE == 'push'
  allow_failure: true
  image:
    name: alpine/helm:3.10.2
    entrypoint: ['']
  tags:
    - kubernetes
  before_script:
    - apk add --no-cache --update curl
    - apk add --no-cache jq
  script:
    - API_MR_URL="${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/merge_requests"
    - |
      MERGE_REQUEST_IID=`curl --header "PRIVATE-TOKEN: ${READ_API_TOKEN}" "${API_MR_URL}?scope=all&state=merged" | \
            jq --arg COMMIT_SHA $CI_COMMIT_SHA '.[] | select(.merge_commit_sha == $COMMIT_SHA).iid'`
    - echo $MERGE_REQUEST_IID
    - helm uninstall frontend-$MERGE_REQUEST_IID -n review-latest