.gitlab-ci.yml

variables:
  # Set Gitlab's cache compression to tar+zstd for better performance.
  CACHE_COMPRESSION_FORMAT: tarzstd
  # Enable timestamps in Gitlab's job logs.
  FF_TIMESTAMPS: true
  # We use submodules
  GIT_SUBMODULE_STRATEGY: recursive
  # Force cargo colors
  CARGO_TERM_COLOR: always

# See https://docs.gitlab.com/ci/yaml/workflow/#git-flow-with-merge-request-pipelines
workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

.default-before-script:
  before_script:
    - pacman-key --init
    - pacman -Syu --needed --noconfirm just mkcert

.with-rust:
  before_script:
    - !reference [".default-before-script", "before_script"]
    # pkgconf: for the openssl crate to locate libssl files
    - pacman -Syu --needed --noconfirm rust just gcc pkgconf
  cache:
    key: ${CI_COMMIT_REF_SLUG}-${CI_JOB_NAME}
    paths:
      - .cargo/bin
      - .cargo/registry/index
      - .cargo/registry/cache
      - target/debug/deps
      - target/debug/build
      - target/release/deps
      - target/release/build
  variables:
    CARGO_HOME: ${CI_PROJECT_DIR}/.cargo

stages:
  - check
  - build
  - deploy

licenses:
  stage: check
  extends: .default-before-script
  script:
    - pacman -Syu --needed --noconfirm reuse
    - just licenses

check-dependencies:
  stage: check
  extends: .with-rust
  script:
    - pacman -Syu --needed --noconfirm cargo-deny
    - just check-dependencies

format:
  stage: check
  extends: .with-rust
  script:
    - just lint

test:
  tags:
    # the test suite needs to spawn podman containers, so we run this job in a VM
    - vm
  stage: check
  extends: .with-rust
  variables:
    RUST_LOG: debug
  script:
    - pacman -Syu --needed --noconfirm cargo-nextest podman jq geckodriver firefox
    - just test

.build-release:
  stage: build
  extends: .with-rust
  artifacts:
    paths:
      - target/release/backend
  script:
    - just build-release

build-release:
  extends: .build-release
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'

build-release:secure:
  extends: .build-release
  tags:
    - secure
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    # Don't run this in forks - they don't have access to secure runners
    - if: $CI_PROJECT_PATH != "archlinux/buildbtw"
      when: never

.push-container-image:
  stage: build
  extends: .default-before-script
  script:
    - pacman -Syu --needed --noconfirm podman
    - just build-release-container-image
    - |
      if [[ "$CI_COMMIT_BRANCH" == "$CI_DEFAULT_BRANCH" ]]; then
        podman login -u "$REGISTRY_USERNAME" -p "$REGISTRY_PASSWORD" "$CI_REGISTRY"
        podman push buildbtw "$CI_REGISTRY_IMAGE/backend:$CI_COMMIT_REF_SLUG"
        # If this is a build on main, additionally add a staging tag
        podman push buildbtw "$CI_REGISTRY_IMAGE/backend:staging"
      elif [[ "$CI_COMMIT_TAG" == v* ]]; then
        podman login -u "$REGISTRY_USERNAME" -p "$REGISTRY_PASSWORD" "$CI_REGISTRY"
        podman push buildbtw "$CI_REGISTRY_IMAGE/backend:$CI_COMMIT_TAG"
        # If this is building a version tag, additionally add a release tag
        podman push buildbtw "$CI_REGISTRY_IMAGE/backend:release"
      else
        podman login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
        podman push buildbtw "$CI_REGISTRY_IMAGE/backend:$CI_COMMIT_REF_SLUG"
      fi

push-container-image:
  extends: .push-container-image
  needs: ["build-release"]
  tags:
    # We build containers so it's easier to do this in a VM
    - vm
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    # Don't run this in forks - there's no point to pushing container images in forks
    - if: $CI_PROJECT_PATH != "archlinux/buildbtw"
      when: never

push-container-image:secure:
  extends: .push-container-image
  needs: ["build-release:secure"]
  tags:
    # We build containers so it's easier to do this in a VM
    - vm
    - secure
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    # Don't run this in forks - they don't have access to secure runners
    - if: $CI_PROJECT_PATH != "archlinux/buildbtw"
      when: never

deploy_review_app:
  stage: deploy
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - >-
      curl
      --location
      --fail-with-body
      --header "Authorization: Bearer $BUILDBTW_DEV_DEPLOY_TOKEN"
      https://buildbtw.dev.archlinux.org/hooks/deploy-branch?image-tag=$CI_COMMIT_REF_SLUG
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    auto_stop_in: 2 weeks
    url: https://$CI_COMMIT_REF_SLUG.buildbtw.dev.archlinux.org
    on_stop: stop_review_app

stop_review_app:
  stage: deploy
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - >-
      curl
      --location
      --fail-with-body
      --header "Authorization: Bearer $BUILDBTW_DEV_DEPLOY_TOKEN"
      https://buildbtw.dev.archlinux.org/hooks/undeploy-branch?image-tag=$CI_COMMIT_REF_SLUG
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    action: stop
  when: manual

deploy_staging:
  stage: deploy
  rules:
    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    # Don't run this in forks - they don't have access to secure runners
    - if: $CI_PROJECT_PATH != "archlinux/buildbtw"
      when: never
  tags:
    - secure
  script:
    - >-
      curl
      --location
      --fail-with-body
      --header "Authorization: Bearer $BUILDBTW_STAGING_DEPLOY_TOKEN"
      https://buildbtw.staging.archlinux.org/hooks/deploy-branch?image-tag=staging
  environment:
    name: staging
    url: https://buildbtw.staging.archlinux.org