.gitlab-ci.yml.jinja

default:
  image: docker:27
  services:
    - docker:27-dind
  before_script:
    - apk add --no-cache make bash python3 ncurses openssh-client-common
    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin

stages:
  - ctb
  - bump
  - release
#  - deploy

variables:
  # Use TLS https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#tls-enabled
  # DOCKER_HOST: tcp://docker:2376
  DOCKER_TLS_CERTDIR: "/certs"
  CONTAINER_BACKEND_RELEASE_IMAGE: $CI_REGISTRY_IMAGE/backend
  {%- if is_volto %}
  CONTAINER_FRONTEND_RELEASE_IMAGE: $CI_REGISTRY_IMAGE/frontend
  {%- endif %}
  CONTAINER_VARNISH_RELEASE_IMAGE: $CI_REGISTRY_IMAGE/varnish
  VERSION_NUMBER: 1
  UV_VERSION: "0.5"
  PYTHON_VERSION: "3.12"
  BASE_LAYER: alpine
  # GitLab CI creates a separate mountpoint for the build directory,
  # so we need to copy instead of using hard links.
  UV_LINK_MODE: copy

check-configuration:
  stage: ctb
  rules:
  - changes:
      - deploy/conf/**

  image: alpine:latest

  before_script:
    - apk add --no-cache bash curl docker-cli gettext
  script:
    - cd deploy

    # test caddy
    - cat ./conf/Caddyfile | docker run --rm -i caddy:latest caddy validate --adapter caddyfile --config -

    # test nginx
    - >
      docker run --rm
      -e SERVER_DOMAIN={{ domain }}
      -v $(pwd)/conf/nginx-config-extra.conf:/etc/nginx/nginx-config-extra.conf:ro
      -v $(pwd)/conf/default.conf.template:/etc/nginx/templates/default.conf.template
      nginx nginx -t -c /etc/nginx/nginx.conf

check-backend:
  stage: ctb
  image: ghcr.io/astral-sh/uv:$UV_VERSION-python$PYTHON_VERSION-$BASE_LAYER

  before_script:
    - apk add --no-cache make bash python3 ncurses openssh-client-common git
  script:
    - cd backend
    - make lint
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        - backend/**/*

{%- if is_volto %}
check-frontend:
  image: node:lts-alpine
  stage: ctb
  before_script:
    - apk add --no-cache make bash python3 ncurses openssh-client-common git
    - npm i -g corepack@latest && corepack enable
  script:
    - cd frontend
    - make install
    - make lint
    - make ci-i18n
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        - frontend/**/*
{%- endif %}

test-backend:
  stage: ctb
  needs:
    - check-backend
  image: ghcr.io/astral-sh/uv:$UV_VERSION-python$PYTHON_VERSION-$BASE_LAYER
  before_script:
    - apk add --no-cache build-base make bash python3 ncurses openssh-client openssh-client-common git linux-headers
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - touch ~/.ssh/config
    - 'echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'
    # We need this in case we are using private repos to host packages
    # added in the mx.ini, otherwise CI/CD can't access those packages
    - eval `ssh-agent -s`
    - echo "${DEPLOY_SSH_PRIVATE_KEY}" | tr -d '\r' | ssh-add - > /dev/null # add ssh k
  script:
    - cd backend
    - make test
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        - backend/**/*

{%- if is_volto %}
test-frontend:
  image: node:lts-alpine
  stage: ctb
  needs:
    - check-frontend
  before_script:
    - apk add --no-cache make bash python3 ncurses openssh-client-common git
    - npm i -g corepack@latest && corepack enable

  script:
    - cd frontend
    - make install
    - make ci-test
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        - frontend/**/*
{%- endif %}

build-backend:
  stage: ctb
  needs:
    - test-backend
  before_script:
    - apk add --no-cache build-base make bash python3 curl ncurses openssh-client openssh-client-common
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - touch ~/.ssh/config
    - 'echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'
    # We need this in case we are using private repos to host packages
    # added in the mx.ini, otherwise CI/CD can't access those packages
    - eval `ssh-agent -s`
    - echo "${DEPLOY_SSH_PRIVATE_KEY}" | tr -d '\r' | ssh-add - > /dev/null # add ssh k
    # We need to manually install `uv` because the base docker image doesn't have it
    - curl -LsSf https://astral.sh/uv/install.sh | sh
    - source $HOME/.local/bin/env

  script:
    - set -e # Stop if the execution of any command fails
    - cd backend
    - make build-image
    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
    - docker push $CONTAINER_BACKEND_RELEASE_IMAGE:latest
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        - backend/**/*

{%- if is_volto %}
build-frontend:
  stage: ctb
  needs:
    - test-frontend
  before_script:
    - apk add --no-cache make bash python3 ncurses openssh-client-common

  script:
    - set -e # Stop if the execution of any command fails
    - cd frontend
    - make build-image
    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
    - docker push $CONTAINER_FRONTEND_RELEASE_IMAGE:latest
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        - frontend/**/*
{%- endif %}


bump-version:
  image: node:lts-alpine
  rules:
    - if: $CI_COMMIT_REF_NAME == "main"
  stage: bump
  before_script:
    # install basic packages
    - apk add --no-cache make bash python3 ncurses openssh-client openssh-client-common git
    # Git dance
    - eval `ssh-agent -s`
    - echo "${DEPLOY_SSH_PRIVATE_KEY}" | tr -d '\r' | ssh-add - > /dev/null # add ssh key
    # create ssh configuration to disable host checking when pushing
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - touch ~/.ssh/config
    - 'echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'
    # Configure git
    - git config --global user.name "${CI_GITLAB_USERNAME}"
    - git config --global user.email "${CI_GITLAB_USER_EMAIL}"
    # Get git repo URL using ssh syntax
    - export CI_PUSH_REPO=$(echo "$CI_REPOSITORY_URL" | sed -e "s|.*@\(.*\)|git@\1|" -e "s|/|:/|" )
    - git remote set-url --push origin "ssh://${CI_PUSH_REPO}"
    - git checkout -B $CI_COMMIT_REF_NAME
    - git pull origin $CI_COMMIT_REF_NAME
    - git push origin -u $CI_COMMIT_REF_NAME -o ci.skip
  script:
    # Install npm required packages
    - npm i -D @release-it/conventional-changelog@10.0.0 @release-it/bumper@7.0.0
    - npx release-it -y --ci
    # - git push origin $CI_COMMIT_REF_NAME -u -o ci.skip

build-and-release:
  rules:
    - if: $CI_COMMIT_REF_NAME == "main"
  stage: release
  before_script:
    # install basic packages
    - apk add --no-cache make bash python3 ncurses openssh-client openssh-client-common git
    # Git dance
    - eval `ssh-agent -s`
    - echo "${DEPLOY_SSH_PRIVATE_KEY}" | tr -d '\r' | ssh-add - > /dev/null # add ssh key
    # create ssh configuration to disable host checking when pushing
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - touch ~/.ssh/config
    - 'echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'
    # Configure git
    - git config --global user.name "${CI_GITLAB_USERNAME}"
    - git config --global user.email "${CI_GITLAB_USER_EMAIL}"
    # Get git repo URL using ssh syntax
    - export CI_PUSH_REPO=$(echo "$CI_REPOSITORY_URL" | sed -e "s|.*@\(.*\)|git@\1|" -e "s|/|:/|" )
    - git remote set-url --push origin "ssh://${CI_PUSH_REPO}"
    - git checkout -B $CI_COMMIT_REF_NAME
    - git pull origin $CI_COMMIT_REF_NAME
    - git push origin -u $CI_COMMIT_REF_NAME -o ci.skip
    - export VERSION_NUMBER=$(cat version.txt)
  script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
    # tag and release backend
    - docker pull $CONTAINER_BACKEND_RELEASE_IMAGE:latest
    - docker tag $CONTAINER_BACKEND_RELEASE_IMAGE:latest $CONTAINER_BACKEND_RELEASE_IMAGE:$VERSION_NUMBER
    - docker push $CONTAINER_BACKEND_RELEASE_IMAGE:$VERSION_NUMBER
    {%- if is_volto %}
    # tag and release frontend
    - docker pull $CONTAINER_FRONTEND_RELEASE_IMAGE:latest
    - docker tag $CONTAINER_FRONTEND_RELEASE_IMAGE:latest $CONTAINER_FRONTEND_RELEASE_IMAGE:$VERSION_NUMBER
    - docker push $CONTAINER_FRONTEND_RELEASE_IMAGE:$VERSION_NUMBER
    {%- endif %}


# deploy:
#   stage: deploy
#   rules:
#     - if: $CI_COMMIT_TAG
#   script:
#     - mkdir -p ~/.ssh/
#     - touch ~/.ssh/known_hosts
#     - echo "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
#     - chmod 644 ~/.ssh/known_hosts
#     - cd devops
#     - eval `ssh-agent -s`
#     - echo "${DEPLOY_SSH_PRIVATE_KEY}" | tr -d '\r' | ssh-add - > /dev/null # add ssh key
#     - export TERM=dumb
#     - export VERSION_NUMBER=$(cat version.txt)
#     - touch .env
#     - 'echo "DEPLOY_ENV=${DEPLOY_ENV}" >> .env'
#     - 'echo "DEPLOY_HOST=${DEPLOY_HOST}" >> .env'
#     - 'echo "DEPLOY_PORT=${DEPLOY_PORT}" >> .env'
#     - 'echo "DEPLOY_USER=${DEPLOY_USER}" >> .env'
#     - 'echo "DOCKER_CONFIG=${DOCKER_CONFIG}" >> .env'
#     - 'echo "STACK_NAME=${STACK_NAME}" >> .env'
#     - 'echo "STACK_PARAM=${VERSION_NUMBER}" >> .env'
#     # Force using the environment variables, because .env file contents are not taken by docker stack deploy
#     - export $(cat .env)
#     - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
#     - make docker-setup
#     - make stack-deploy
#   environment: production
# deploy-with-auxiliary-docker-image:
#   stage: deploy
#   variables:
#     REGISTRY: ${CI_REGISTRY}
#     USERNAME: ${CI_REGISTRY_USER}
#     PASSWORD: ${CI_REGISTRY_PASSWORD}
#     REMOTE_HOST: ${DEPLOY_HOST}
#     REMOTE_PORT: ${DEPLOY_PORT}
#     REMOTE_USER: ${DEPLOY_USER}
#     REMOTE_PRIVATE_KEY: "${DEPLOY_SSH_PRIVATE_KEY}"
#     STACK_FILE: devops/stacks/${DEPLOY_HOST}.yml
#     STACK_NAME: ${STACK_NAME}
#     DEPLOY_IMAGE: ghcr.io/kitconcept/docker-stack-deploy:latest
#   script:
#     - docker pull ${DEPLOY_IMAGE}
#     - docker run --rm
#       -v "$(pwd)":/github/workspace
#       -v /var/run/docker.sock:/var/run/docker.sock
#       -e REGISTRY=${REGISTRY}
#       -e USERNAME=${USERNAME}
#       -e PASSWORD=${PASSWORD}
#       -e REMOTE_HOST=${REMOTE_HOST}
#       -e REMOTE_PORT=${REMOTE_PORT}
#       -e REMOTE_USER=${REMOTE_USER}
#       -e REMOTE_PRIVATE_KEY="${REMOTE_PRIVATE_KEY}"
#       -e STACK_FILE=${STACK_FILE}
#       -e STACK_NAME=${STACK_NAME}
#       ${DEPLOY_IMAGE}
#   only:
#     - main
#   environment: production