.gitlab-ci.yml

stages:
  - lint
  - test
  - build
  - deploy-stage
  - deploy-prod

include:
  - project: 'product-security/dev/component-registry-ops'
    ref: "$CORGI_OPS_BRANCH"
    file: '/templates/gitlab/ansible-run.yml'

.common_ci_setup: &common_ci_setup
  - export LANG=en_US.UTF-8
  - cd /etc/pki/ca-trust/source/anchors/ && curl -O "${ROOT_CA_URL}"; cd -
  - update-ca-trust
  - export REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt

.common_test_setup: &common_test_setup
  # Define below in CI settings, then export here so subprocesses can use also
  # Keep in sync with OpenShift
  # Internal hostnames or URLs that appear in build metadata; used in tests
  - export CORGI_TEST_CACHITO_URL
  - export CORGI_TEST_CODE_URL
  - export CORGI_TEST_DOWNLOAD_URL
  - export CORGI_TEST_OSBS_HOST1
  - export CORGI_TEST_OSBS_HOST2
  - export CORGI_TEST_OSBS_HOST3
  - export CORGI_TEST_REGISTRY_URL
  # Not used in tests directly, but needed for tests to pass
  - export CORGI_LOOKASIDE_CACHE_URL
  - export CORGI_APP_STREAMS_LIFE_CYCLE_URL
  - export CORGI_BREW_URL
  - export CORGI_BREW_DOWNLOAD_ROOT_URL
  - export CORGI_ERRATA_TOOL_URL
  - export CORGI_MANIFEST_HINTS_URL
  - export CORGI_PRODSEC_DASHBOARD_URL
  - export PIP_INDEX_URL
  - export ROOT_CA_URL

build-image:
  stage: build
  extends:
    - .ansible-build
# No "except: refs: schedules" here, daily image rebuilds
# (as part of detect-secrets daily CI job) give us any new security updates

deploy-stage:
  stage: deploy-stage
  extends:
    - .ansible-deploy-stage
  except:
    refs:
      - schedules

deploy-prod:
  stage: deploy-prod
  extends:
    - .ansible-deploy-prod
  except:
    refs:
      - schedules

test:
  stage: test
  # Keep in sync with Dockerfile
  image: registry.redhat.io/ubi8/ubi:8.6
  services:
    # Keep in sync with OpenShift
    - name: registry.redhat.io/rhel8/postgresql-13:1
      alias: postgres
  variables:
    # Env vars for postgres image initialization
    POSTGRESQL_ADMIN_PASSWORD: test
    # Application-specific env vars
    CORGI_DB_USER: postgres  # default admin user
    CORGI_DB_HOST: postgres  # same as service alias
    CORGI_DB_PASSWORD: test  # same as POSTGRESQL_ADMIN_PASSWORD
  before_script:
    - *common_ci_setup
    - *common_test_setup
  script:
    - dnf --disableplugin=subscription-manager --nodocs -y install python39 python39-devel gcc krb5-devel postgresql-devel
    - python3.9 -m pip install tox
    - tox -e corgi -- --record-mode=none --cov-report term --junitxml=junit.xml  # Do not create any VCR cassettes in CI
  except:
    refs:
      - schedules
  # report coverage lines like 'TOTAL    2962    882    70%'
  coverage: '/TOTAL(?:\s+\d+\s+\d+\s+)(\d+)%/'
  artifacts:
      when: always
      reports:
        coverage_report:
          coverage_format: cobertura
          path: coverage.xml
        junit:
          - junit.xml
      expire_in: 1 week

test-migrations:
  stage: test
  # Keep in sync with Dockerfile
  image: registry.redhat.io/ubi8/ubi:8.6
  services:
    # Keep in sync with OpenShift
    - name: registry.redhat.io/rhel8/postgresql-13:1
      alias: postgres
  variables:
    # Env vars for postgres image initialization
    POSTGRESQL_ADMIN_PASSWORD: test
    # Application-specific env vars
    CORGI_DB_USER: postgres  # default admin user
    CORGI_DB_HOST: postgres  # same as service alias
    CORGI_DB_PASSWORD: test  # same as POSTGRESQL_ADMIN_PASSWORD
  before_script:
    - *common_ci_setup
    - *common_test_setup
  script:
    - dnf --disableplugin=subscription-manager --nodocs -y install python39 python39-devel gcc krb5-devel postgresql-devel
    - python3.9 -m pip install tox
    - tox -e corgi-migrations
  except:
    refs:
      - schedules

mypy:
  stage: test
  image: $PYTHON_TOX_IMAGE_LATEST
  before_script:
    - *common_ci_setup
  script:
    - tox -e mypy
  except:
    refs:
      - schedules

schema:
  stage: test
  image: $PYTHON_TOX_IMAGE_LATEST
  before_script:
    - *common_ci_setup
  script:
    - tox -e schema
  except:
    refs:
      - schedules

flake8:
  stage: lint
  image: $PYTHON_TOX_IMAGE_LATEST
  before_script:
    - *common_ci_setup
  script:
    - tox -e flake8
  except:
    refs:
      - schedules

black:
  stage: lint
  image: $PYTHON_TOX_IMAGE_LATEST
  before_script:
    - *common_ci_setup
  script:
    - tox -e black
  except:
    refs:
      - schedules

isort:
  stage: lint
  image: $PYTHON_TOX_IMAGE_LATEST
  before_script:
    - *common_ci_setup
  script:
    - tox -e isort
  except:
    refs:
      - schedules

bandit:
  stage: lint
  image: $PYTHON_TOX_IMAGE_LATEST
  before_script:
    - *common_ci_setup
  script:
    - tox -e bandit
  except:
    refs:
      - schedules

radon:
  stage: lint
  image: $PYTHON_TOX_IMAGE_LATEST
  before_script:
    - *common_ci_setup
  script:
    - tox -e radon
  except:
    refs:
      - schedules

secrets:
  stage: lint
  image: $PYTHON_TOX_IMAGE_LATEST
  before_script:
    - *common_ci_setup
  script:
    - tox -e secrets
  only:
    refs:
      - schedules