.gitlab-ci.yml

# SPDX-License-Identifier: AGPL-3.0-only
# SPDX-FileCopyrightText: 2024 Univention GmbH

---

include:
  - project: "univention/customers/dataport/upx/common-ci"
    ref: "v1.33.0"
    file:
      - "defaults/stages.yaml"
      - "defaults/nubus-workflow.yaml"
      - "jobs/lint-pre-commit.yaml"
      - "jobs/lint-commit-messages.yaml"
      - "jobs/semantic-release-env.yaml"
      - "jobs/container-build-external.yaml"
      - "jobs/package-and-publish-helm-charts-external.yaml"
      - "jobs/check-debian-updates.yaml"

  - project: "univention/dist/docker-services"
    ref: "master"
    file:
      - "dind.yml"

variables:
  POETRY_VERSION: "1.6.1"

lint-pre-commit:
  before_script:
    - helm repo add bitnami https://charts.bitnami.com/bitnami
    - helm repo add nats https://nats-io.github.io/k8s/helm/charts/

.build-matrix: &build-matrix
  - IMAGE_NAME: "provisioning-events-and-consumer-api"
    KANIKO_ARGS: "--target final"
    DOCKERFILE_PATH: "docker/events-and-consumer-api/Dockerfile"
  - IMAGE_NAME: "provisioning-events-and-consumer-api-test"
    KANIKO_ARGS: "--target test"
    DOCKERFILE_PATH: "docker/events-and-consumer-api/Dockerfile"
  - IMAGE_NAME: "provisioning-dispatcher"
    KANIKO_ARGS: "--target final"
    DOCKERFILE_PATH: "docker/dispatcher/Dockerfile"
  - IMAGE_NAME: "provisioning-udm-transformer"
    KANIKO_ARGS: "--target final"
    DOCKERFILE_PATH: "docker/udm-transformer/Dockerfile"
  - IMAGE_NAME: "test"
    DOCKERFILE_PATH: "docker/test/Dockerfile"
  - IMAGE_NAME: "provisioning-example-client"
    DOCKERFILE_PATH: "docker/example-client/Dockerfile"
  - IMAGE_NAME: "provisioning-prefill"
    KANIKO_ARGS: "--target final"
    DOCKERFILE_PATH: "docker/prefill/Dockerfile"
  - IMAGE_NAME: "provisioning-udm-listener"
    KANIKO_ARGS: "--target final"
    DOCKERFILE_PATH: "docker/udm-listener/Dockerfile"

.publish-matrix: &publish-matrix
  - IMAGE_NAME:
    - "provisioning-events-and-consumer-api"
  - IMAGE_NAME:
    - "provisioning-dispatcher"
  - IMAGE_NAME:
    - "provisioning-udm-listener"
  - IMAGE_NAME:
    - "provisioning-udm-transformer"
  - IMAGE_NAME:
    - "provisioning-example-client"
  - IMAGE_NAME:
    - "provisioning-prefill"

container-build:
  parallel:
    matrix: *build-matrix
  variables:
    KANIKO_BUILD_CONTEXT: "${CI_PROJECT_DIR}"

container-malware-scan:
  parallel:
    matrix: *publish-matrix

test-integration:
  stage: "test"
  extends: .dind
  image: "${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/docker:24.0.7"
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: "never"
    - when: "on_success"
  before_script:
    # Allow that the Docker API version is negotiated between client and server
    - unset DOCKER_API_VERSION
    - export IMAGE_TAG=${RELEASE_VERSION}
    - echo -e "\e[0Ksection_start:`date +%s`:docker_debug[collapsed=true]\r\e[0KDocker version details"
    - echo $IMAGE_TAG
    - docker version
    - echo -e "\e[0Ksection_end:`date +%s`:docker_debug\r\e[0K"
    - echo -e "\e[0Ksection_start:`date +%s`:docker_compose_config[collapsed=true]\r\e[0KDocker Compose configuration"
    - docker compose config test
    - echo -e "\e[0Ksection_end:`date +%s`:docker_compose_config\r\e[0K"
    - docker compose up --no-build --quiet-pull --wait --wait-timeout 60 nats1 nats2 nats3
  script:
    - docker compose run --quiet-pull --rm test /app/.venv/bin/python3 -m pytest -lvv tests/integration
  after_script:
    - docker compose down --volumes

test-end-to-end:
  # allow_failure: true
  stage: "test"
  extends: .dind
  image: "${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/docker:24.0.7"
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: "never"
    - when: "on_success"
  before_script:
    # Allow that the Docker API version is negotiated between client and server
    - unset DOCKER_API_VERSION
    - export IMAGE_TAG=${RELEASE_VERSION}
    - echo -e "\e[0Ksection_start:`date +%s`:docker_debug[collapsed=true]\r\e[0KDocker version details"
    - echo $IMAGE_TAG
    - docker version
    - echo -e "\e[0Ksection_end:`date +%s`:docker_debug\r\e[0K"
    - echo -e "\e[0Ksection_start:`date +%s`:docker_compose_config[collapsed=true]\r\e[0KDocker Compose configuration"
    - docker compose config test
    - echo -e "\e[0Ksection_end:`date +%s`:docker_compose_config\r\e[0K"
    - docker compose up --no-build --quiet-pull --wait --wait-timeout 60 events-and-consumer-api nats1 nats2 nats3 dispatcher prefill udm-transformer udm-listener ldap-notifier udm-rest-api ldap-server ldif-producer
  script:
    # Wait for UDM Listener to get ready. (It's not worth it to fix this properly atm)
    - sleep 10
    - cp tests/e2e/e2e_settings.json.example tests/e2e/e2e_settings.json
    - docker compose run --quiet-pull --rm test /app/.venv/bin/python3 -m pytest tests/e2e/ -lvv --environment pipeline
  after_script:
    - docker logs events-and-consumer-api-dev >& provisioning-api.log
    - docker logs provisioning-dispatcher >& dispatcher.log
    - docker logs provisioning-prefill >& prefill.log
    - docker logs provisioning-udm-transformer >& udm-transformer.log
    - docker logs udm-listener>& udm-listener.log
    - docker logs ldap-server >& ldap-server.log
    - docker logs udm-rest-api >& udm-rest-api.log
    - docker compose down --volumes
  artifacts:
    paths:
      - provisioning-api.log
      - dispatcher.log
      - prefill.log
      - udm-transformer.log
      - udm-listener.log
      - ldap-server.log
      - udm-rest-api.log
    expire_in: "1 day"
    when: "always"
    expose_as: "docker compose server logs"


# TODO: docker compose run nats ... somehow
test-events-and-consumer-api:
  stage: "test"
  image: "${CI_REGISTRY_IMAGE}/provisioning-events-and-consumer-api-test:${RELEASE_VERSION}"
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: "never"
    - when: "on_success"
  script:
    - poetry config virtualenvs.in-project true
    - poetry install --with dev
    - poetry run pytest -lvv --ignore=tests/integration/ --ignore=tests/e2e --cov --cov-report=term --cov-report=xml:coverage.xml --cov-branch
  coverage: '/(?i)total.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml

push-image-external:
  parallel:
    matrix: *publish-matrix

container-sign-external:
  parallel:
    matrix: *publish-matrix

check-debian-updates:
  parallel:
    matrix: *publish-matrix
  variables:
    TARGET_IMAGE: "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:latest"

test_provisioning_lib:
  stage: test
  image: docker-registry.knut.univention.de/python:3.11-slim
  script:
    - pip install poetry=="$POETRY_VERSION"
    - poetry config --local virtualenvs.create false
    - poetry install --with dev
    - python3 -m pytest -lvv -m provisioning_lib --cov=src/univention/provisioning/consumer --cov-report=term --cov-report=xml:coverage.xml
  coverage: '/(?i)total.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml

build_provisioning_lib:
  stage: package
  dependencies:
    - pre-semantic-release
  needs:
    - test_provisioning_lib
    - pre-semantic-release
  artifacts:
    paths:
      - src/dist/
    expire_in: 1 week
  image: docker-registry.knut.univention.de/python:3.11-slim
  before_script:
    - |
      # Split the version string by hyphen (-) into two parts
      IFS='-' read -ra parts <<< "$RELEASE_VERSION"

      # Extract the version number and the suffix
      version_number="${parts[0]}"
      suffix="${parts[*]:1}"

      # Check if the suffix exists
      if [ "$CI_COMMIT_BRANCH" != "$CI_DEFAULT_BRANCH" ]; then
          modified_suffix="dev0+${suffix// /-}"
          export package_version="$version_number.$modified_suffix.${CI_COMMIT_SHORT_SHA}"
      else
          export package_version="$version_number"
      fi
  script:
    - cd src
    - pip install poetry=="$POETRY_VERSION"
    - poetry version "$package_version"
    - poetry config --local virtualenvs.create false
    - poetry build

publish_provisioning_lib:
  stage: publish
  extends: build_provisioning_lib
  dependencies:
    - build_provisioning_lib
    - pre-semantic-release
  needs:
    - build_provisioning_lib
    - test_provisioning_lib
    - pre-semantic-release
  script:
    - cd src
    - pip install poetry=="$POETRY_VERSION"
    - poetry version "$package_version"
    - poetry config --local virtualenvs.create false
    - poetry config --local repositories.project_local ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/pypi
    - poetry publish -r project_local --username gitlab-ci-token --password ${CI_JOB_TOKEN}

...