.gitlab-ci.yml

# We prefer this order semantically, but in fact we
# run test and build jobs simultaneously.
stages:
  - test
  - build
  - deploy
  - sync

workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS && $CI_PIPELINE_SOURCE == "push"
      # To prevent duplicate pipelines, when a branch has a merge request, we only
      # run a merge request pipeline when the branch is pushed.
      when: never
    - if: $CI_COMMIT_BRANCH
    - if: $CI_COMMIT_TAG

variables:
  GIT_SUBMODULE_STRATEGY: recursive
  # We want full history so that "git describe" always works correctly.
  GIT_DEPTH: 0
  FF_ENABLE_BASH_EXIT_CODE_CHECK: "true"
  # We always want to run with the Go version installed in a Docker image.
  GOTOOLCHAIN: local
  DOCKER_PIPELINE_IMAGE_NAME: "$CI_REGISTRY_IMAGE/pipeline:$CI_PIPELINE_ID"
  DOCKER_ELASTIC_PIPELINE_IMAGE_NAME: "$CI_REGISTRY_IMAGE/elastic/pipeline:$CI_PIPELINE_ID"
  ELASTIC_VERSION: "7.17.9"
  DOCKER_DRIVER: overlayfs
  FF_NETWORK_PER_BUILD: 1
  DOCKER_HOST: tcp://docker:2375
  # Disable umask 0000. See: https://gitlab.com/gitlab-org/gitlab-runner/-/issues/1736
  FF_DISABLE_UMASK_FOR_DOCKER_EXECUTOR: 1
  PACKAGE_REGISTRY_URL: "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic"
  FF_SCRIPT_SECTIONS: 1
  FF_TIMESTAMPS: 1

test_go:
  stage: test

  image: golang:1.25-alpine3.22

  services:
    - name: elasticsearch:7.16.3
      alias: elasticsearch
      variables:
        network.bind_host: 0.0.0.0
        network.publish_host: elasticsearch
        ES_JAVA_OPTS: "-Xmx1000m"
        discovery.type: single-node
        xpack.security.enabled: false
        ingest.geoip.downloader.enabled: false
        cluster.routing.allocation.disk.watermark.flood_stage: "100%"
    - name: registry.gitlab.com/tozd/docker/postgresql:18
      alias: postgres
      variables:
        LOG_TO_STDOUT: 1
        PGSQL_ROLE_1_USERNAME: test
        PGSQL_ROLE_1_PASSWORD: test
        PGSQL_DB_1_NAME: test
        PGSQL_DB_1_OWNER: test
  variables:
    ELASTIC: http://elasticsearch:9200
    POSTGRES: postgres://test:test@postgres:5432/test

  before_script:
    - apk --update add make bash gcc musl-dev mailcap git
    - (cd /go; go install gotest.tools/gotestsum@v1.13.0)
    - (cd /go; go install github.com/boumenot/gocover-cobertura@v1.4.0)
    - go version

  script:
    - make test-ci

  artifacts:
    when: always
    reports:
      junit: tests.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
    paths:
      - tests.xml
      - coverage.html
      - coverage.xml
    expire_in: never

  coverage: '/coverage: \d+\.\d+% of statements/'

test_node:
  stage: test

  image: node:24.10-alpine3.22

  before_script:
    - apk --update add git

  script:
    - npm ci --audit=false
    - npm run test-ci

  artifacts:
    when: always
    reports:
      junit: tests.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura-coverage.xml
    paths:
      - coverage/
    exclude:
      - coverage/tmp/
    expire_in: never

  coverage: '/^All files\s+\|\s+\S+\s+\|\s+\S+\s+\|\s+\S+\s+\|\s+\S+\s+\|/'

lint_go:
  stage: test

  image: golang:1.25-alpine3.22

  before_script:
    - apk --update add make bash gcc musl-dev git
    - wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.5.0

  script:
    - make lint-ci

  artifacts:
    when: always
    reports:
      codequality: codeclimate.json
    expire_in: never

lint_node:
  stage: test

  image: node:24.10-alpine3.22

  before_script:
    - apk --update add git

  script:
    - npm ci --audit=false
    - npm run lint-ci
    - git diff --exit-code --color=always

  artifacts:
    when: always
    reports:
      codequality: codeclimate.json
    expire_in: never

lint_vue:
  stage: test

  image: node:24.10-alpine3.22

  before_script:
    - apk --update add git

  script:
    - npm ci --audit=false
    - npm run lint-vue

lint_style:
  stage: test

  image: node:24.10-alpine3.22

  before_script:
    - apk --update add git

  script:
    - npm ci --audit=false
    - npm run lint-style-ci
    - git diff --exit-code --color=always

  artifacts:
    when: always
    reports:
      codequality: codeclimate.json
    expire_in: never

fmt_go:
  stage: test

  image: golang:1.25-alpine3.22

  before_script:
    - apk --update add make bash git gcc musl-dev grep
    - go install mvdan.cc/gofumpt@v0.9.1
    - go install golang.org/x/tools/cmd/goimports@v0.37.0

  script:
    - make fmt-ci

fmt_node:
  stage: test

  image: node:24.10-alpine3.22

  before_script:
    - apk --update add git

  script:
    - npm ci --audit=false
    - npm run fmt
    - git diff --exit-code --color=always

lint_docs:
  stage: test

  image: node:24.10-alpine3.22

  before_script:
    - apk --update add make bash git

  script:
    - make lint-docs-ci

audit_go:
  stage: test

  image: golang:1.25-alpine3.22

  before_script:
    - apk --update add make bash git gcc musl-dev
    - go install github.com/sonatype-nexus-community/nancy@v1.0.52

  script:
    - make audit

audit_node:
  stage: test

  image: node:24.10-alpine3.22

  before_script:
    - apk --update add git

  # Signatures audit is done during install in Dockerfile.
  script:
    - npm ci --audit=false
    - npm run check-audit

commits:
  stage: test

  image: golang:1.25-alpine3.22

  variables:
    GIT_DEPTH: "0"

  before_script:
    - apk --update add git

  script:
    - '! git log --oneline "-G^(<<<<<<<|=======|>>>>>>>)" | grep "^"'

reuse:
  stage: test

  image:
    name: fsfe/reuse:latest
    entrypoint: [""]

  script:
    - reuse lint

docker:
  stage: build

  image: docker:28-cli

  services:
    - name: docker:28-dind
      command:
        - "--feature"
        - "containerd-snapshotter=true"

  before_script:
    - docker info
    - echo "$CI_REGISTRY_PASSWORD" | docker login --username "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"

  script:
    - export BUILD_TIMESTAMP="$(date -u +%FT%TZ)"
    - echo BUILD_TIMESTAMP "$BUILD_TIMESTAMP"
    - export VERSION="$(git describe --tags --always --dirty=+)"
    - echo VERSION "$VERSION"
    - docker build
      --platform linux/amd64,linux/arm64
      --target production
      --tag "$DOCKER_PIPELINE_IMAGE_NAME"
      --tag "$CI_REGISTRY_IMAGE/commit:$CI_COMMIT_SHA"
      --build-arg BUILD_TIMESTAMP
      --label "org.opencontainers.image.version=$VERSION"
      --label "org.opencontainers.image.created=$BUILD_TIMESTAMP"
      --label "org.opencontainers.image.revision=$CI_COMMIT_SHA"
      --label "org.opencontainers.image.url=$CI_PROJECT_URL" .
    - docker build
      --platform linux/amd64,linux/arm64
      --target debug
      --tag "$DOCKER_PIPELINE_IMAGE_NAME-debug"
      --tag "$CI_REGISTRY_IMAGE/commit:$CI_COMMIT_SHA-debug"
      --build-arg BUILD_TIMESTAMP
      --label "org.opencontainers.image.version=$VERSION"
      --label "org.opencontainers.image.created=$BUILD_TIMESTAMP"
      --label "org.opencontainers.image.revision=$CI_COMMIT_SHA"
      --label "org.opencontainers.image.url=$CI_PROJECT_URL" .
    - docker push "$DOCKER_PIPELINE_IMAGE_NAME"
    - docker push "$CI_REGISTRY_IMAGE/commit:$CI_COMMIT_SHA"
    - docker push "$DOCKER_PIPELINE_IMAGE_NAME-debug"
    - docker push "$CI_REGISTRY_IMAGE/commit:$CI_COMMIT_SHA-debug"
    - export IMAGE_ID=$(docker create --platform linux/amd64 "$DOCKER_PIPELINE_IMAGE_NAME")
    - docker cp "$IMAGE_ID:/peerdb" peerdb-linux-amd64
    - docker rm "$IMAGE_ID"
    - export IMAGE_ID=$(docker create --platform linux/arm64 "$DOCKER_PIPELINE_IMAGE_NAME")
    - docker cp "$IMAGE_ID:/peerdb" peerdb-linux-arm64
    - docker rm "$IMAGE_ID"

  artifacts:
    expose_as: binaries
    name: binaries
    paths:
      - peerdb-linux-amd64
      - peerdb-linux-arm64
    expire_in: never

  # We want to run it as soon as possible and do not wait for test stage to finish.
  needs: []

docker_elastic:
  stage: build

  image: docker:28-cli

  services:
    - name: docker:28-dind
      command:
        - "--feature"
        - "containerd-snapshotter=true"

  before_script:
    - docker info
    - echo "$CI_REGISTRY_PASSWORD" | docker login --username "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"

  script:
    - docker build
      --platform linux/amd64,linux/arm64
      --file elastic.dockerfile
      --tag "$DOCKER_ELASTIC_PIPELINE_IMAGE_NAME"
      --tag "$CI_REGISTRY_IMAGE/elastic/commit:$CI_COMMIT_SHA"
      --build-arg ELASTIC_VERSION .
    - docker push "$DOCKER_ELASTIC_PIPELINE_IMAGE_NAME"
    - docker push "$CI_REGISTRY_IMAGE/elastic/commit:$CI_COMMIT_SHA"

  # We want to run it as soon as possible and do not wait for test stage to finish.
  needs: []

push_branch:
  stage: deploy

  image:
    name: gcr.io/go-containerregistry/crane/debug:v0.20.3
    entrypoint: [""]

  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | crane auth login --username "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"

  script:
    - crane cp "$DOCKER_PIPELINE_IMAGE_NAME" "$CI_REGISTRY_IMAGE/branch/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA"
    - crane tag "$CI_REGISTRY_IMAGE/branch/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA" latest
    - crane cp "$DOCKER_PIPELINE_IMAGE_NAME-debug" "$CI_REGISTRY_IMAGE/branch/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA-debug"
    - crane tag "$CI_REGISTRY_IMAGE/branch/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA-debug" latest-debug

  rules:
    - if: $CI_COMMIT_BRANCH

  # We do not need build artifacts in this job.
  dependencies: []

push_tag:
  stage: deploy

  image:
    name: gcr.io/go-containerregistry/crane/debug:v0.20.3
    entrypoint: [""]

  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | crane auth login --username "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"

  script:
    - crane cp "$DOCKER_PIPELINE_IMAGE_NAME" "$CI_REGISTRY_IMAGE/tag/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA"
    - crane tag "$CI_REGISTRY_IMAGE/tag/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA" latest
    - crane cp "$DOCKER_PIPELINE_IMAGE_NAME-debug" "$CI_REGISTRY_IMAGE/tag/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA-debug"
    - crane tag "$CI_REGISTRY_IMAGE/tag/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA-debug" latest-debug

  rules:
    # Only on protected tags. Protected tags start with "v".
    - if: "$CI_COMMIT_TAG && $CI_COMMIT_REF_NAME =~ /^v/"

  # We do not need build artifacts in this job.
  dependencies: []

push_elastic:
  stage: deploy

  image:
    name: gcr.io/go-containerregistry/crane/debug:v0.20.3
    entrypoint: [""]

  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | crane auth login --username "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"

  script:
    - crane cp "$DOCKER_ELASTIC_PIPELINE_IMAGE_NAME" "$CI_REGISTRY_IMAGE/elastic/$ELASTIC_VERSION:$CI_COMMIT_SHA"
    - crane tag "$CI_REGISTRY_IMAGE/elastic/$ELASTIC_VERSION:$CI_COMMIT_SHA" latest

  rules:
    - if: $CI_COMMIT_BRANCH == "main"

  # We do not need build artifacts in this job.
  dependencies: []

upload_binaries:
  stage: deploy

  image: curlimages/curl:8.1.2

  script:
    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file peerdb-linux-amd64 "$PACKAGE_REGISTRY_URL/linux-amd64/${CI_COMMIT_REF_NAME#v}/peerdb"'
    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file peerdb-linux-arm64 "$PACKAGE_REGISTRY_URL/linux-arm64/${CI_COMMIT_REF_NAME#v}/peerdb"'

  rules:
    # Only on protected tags. Protected tags start with "v".
    - if: "$CI_COMMIT_TAG && $CI_COMMIT_REF_NAME =~ /^v/"

  dependencies:
    - docker

publish:
  stage: deploy

  image: golang:1.25-alpine3.22

  script:
    - GOPROXY=proxy.golang.org go list -m "gitlab.com/peerdb/peerdb@$CI_COMMIT_REF_NAME"

  rules:
    # Only on protected tags on main repository. Protected tags start with "v".
    - if: '$CI_COMMIT_TAG && $CI_COMMIT_REF_NAME =~ /^v/ && $CI_PROJECT_PATH == "peerdb/peerdb"'

  # We do not need build artifacts in this job.
  dependencies: []

sync_releases:
  stage: sync

  image:
    name: registry.gitlab.com/tozd/gitlab/release/tag/v0-6-0:latest-debug
    entrypoint: [""]

  script:
    # On branch jobs, just update or remove releases, thus releases are created only on tag jobs.
    - /gitlab-release ${CI_COMMIT_BRANCH:+--no-create}

  rules:
    # Protected tags start with "v".
    - if: '$GITLAB_API_TOKEN && ($CI_COMMIT_BRANCH == "main" || ($CI_COMMIT_TAG && $CI_COMMIT_REF_NAME =~ /^v/))'

  # We do not need build artifacts in this job.
  dependencies: []

sync_config:
  stage: sync

  image:
    name: registry.gitlab.com/tozd/gitlab/config/tag/v0-5-0:latest-debug
    entrypoint: [""]

  script:
    - /gitlab-config set

  rules:
    - if: '$GITLAB_API_TOKEN && $SOPS_AGE_KEY_FILE && $CI_COMMIT_BRANCH == "main"'
      changes:
        - .gitlab-conf.yml

  # We do not need build artifacts in this job.
  dependencies: []