.gitlab-ci.yml

# Copyright (C) 2023 Univention GmbH
#
# SPDX-License-Identifier: AGPL-3.0-only

include:
  - project: univention/dist/docker-services
    file:
      - kaniko.yml
      - pre-commit.yml
  - project: 'univention/documentation/sphinx-docker'
    file: 'pipeline/sphinx.yml'

variables:
  APPCENTER_CONTROL_IMAGE: "docker-registry.knut.univention.de/knut/univention-appcenter-control"
  POETRY_VERSION: "1.5.1"
  UCS_VERSION: "505"
  UCS_RELEASE: "5.0"
  DEB_IMAGE: docker-registry.knut.univention.de/phahn/ucs-debbase:$UCS_VERSION
  UCSLINT_IMAGE: gitregistry.knut.univention.de/univention/ucs
  SCOPE: "guardian"
  DOCS_DIR: "docs/guardian-manual"
  DOC_TARGET_VERSION: "2.0"
  DOC_TARGET_NAME: "guardian-manual"
  DOC_TARGET_PATH: "$DOC_TARGET_NAME/$DOC_TARGET_VERSION"

workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_OPEN_MERGE_REQUESTS
    - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_REF_PROTECTED == "true"
    - if: $CI_PIPELINE_SOURCE == "web"
    - if: $CI_PIPELINE_SOURCE == "webide"

stages:
  - test
  - build_python
  - build_docker
  - package
  - publish
  - build
  - merge
  - production
  - lint

.pre_commit:
  stage: lint
  needs: []
  extends: .pre-commit
  variables:
    PRE_COMMIT_IMAGE: "docker-registry.knut.univention.de/knut/pre-commit-opa"

run_precommit_general:
  extends: .pre_commit
  script:
    - export SKIP=$(python3 .gitlab-ci/pre_commit_hook_parser.py .pre-commit-config.yaml general)
    - pre-commit run -a

run_precommit_backend:
  extends: .pre_commit
  script:
    - export SKIP=$(python3 .gitlab-ci/pre_commit_hook_parser.py .pre-commit-config.yaml backend)
    - pre-commit run -a

run_precommit_frontend:
  extends: .pre_commit
  script:
    - export SKIP=$(python3 .gitlab-ci/pre_commit_hook_parser.py .pre-commit-config.yaml frontend)
    - cd /tmp  &&curl https://nodejs.org/download/release/v18.19.0/node-v18.19.0-linux-x64.tar.gz --output node.tar.gz
    - cd /usr/local && tar -xzf /tmp/node.tar.gz --strip-components 1
    - npm install -g yarn
    - cd $CI_PROJECT_DIR
    - yarn --cwd management-ui install
    - pre-commit run -a

# No jobs for OPA code were created, since the form and structure of the OPA code is not final yet. TODO

.test:
  stage: test
  image: docker-registry.knut.univention.de/python:3.11-slim
  variables:
    GUARDIAN__MANAGEMENT__BASE_URL: "http://localhost:8001"
    GUARDIAN_COMPONENT: ""
    GUARDIAN_TEST_ARGS: ""
  script:
    - cd "$GUARDIAN_COMPONENT"
    - pip install poetry=="$POETRY_VERSION"
    - poetry config --local virtualenvs.create false
    - poetry install
    - pytest -vv "$GUARDIAN_TEST_ARGS" .
  rules:
    - if: "$CI_COMMIT_MESSAGE =~ /skip-build/ || $pipeline =~ /skip-build/"
      when: never
    - if: "$CI_COMMIT_MESSAGE =~ /force-build/ || $pipeline =~ /force-build/"
    - changes:
        - $GUARDIAN_COMPONENT/**/*

.coverage:
  extends: .test
  variables:
    GUARDIAN__MANAGEMENT__BASE_URL: "http://localhost:8001"
    GUARDIAN_COMPONENT: ""
    GUARDIAN_TEST_ARGS: ""
    GUARDIAN_COVERAGE_COMPONENT: ""
    GUARDIAN_COVERAGE_LIMIT: ""
  script:
    - cd "$GUARDIAN_COMPONENT"
    - pip install poetry=="$POETRY_VERSION"
    - poetry config --local virtualenvs.create false
    - poetry install
    - pytest -vv "$GUARDIAN_TEST_ARGS" --cov="$GUARDIAN_COVERAGE_COMPONENT" --cov-report=term --cov-report=xml:coverage.xml .
    - coverage report --fail-under="$GUARDIAN_COVERAGE_LIMIT"  # Variable set in Gitlab UI
  coverage: '/(?i)total.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: $GUARDIAN_COMPONENT/coverage.xml

test_management:
  extends: .test
  variables:
    GUARDIAN_COMPONENT: "management-api"
    GUARDIAN_TEST_ARGS: "-k not e2e_udm"

coverage_management:
  extends: .coverage
  variables:
    GUARDIAN_COMPONENT: "management-api"
    GUARDIAN_TEST_ARGS: "-k not e2e_udm"
    GUARDIAN_COVERAGE_COMPONENT: "guardian_management_api"
    GUARDIAN_COVERAGE_LIMIT: $MANAGEMENT_COVERAGE_LIMIT

test_authz:
  extends: .test
  variables:
    GUARDIAN_COMPONENT: "authorization-api"

coverage_authz:
  extends: .coverage
  variables:
    GUARDIAN_COMPONENT: "authorization-api"
    GUARDIAN_COVERAGE_COMPONENT: "guardian_authorization_api"
    GUARDIAN_COVERAGE_LIMIT: $AUTHZ_COVERAGE_LIMIT

test_guardian_lib:
  extends: .test
  variables:
    GUARDIAN_COMPONENT: "guardian-lib"

coverage_guardian_lib:
  extends: .coverage
  variables:
    GUARDIAN_COMPONENT: "guardian-lib"
    GUARDIAN_COVERAGE_COMPONENT: "guardian_lib"
    GUARDIAN_COVERAGE_LIMIT: $GUARDIAN_LIB_COVERAGE_LIMIT

build_guardian_lib:
  stage: build_python
  needs:
    - test_guardian_lib
    - coverage_guardian_lib
  rules:
    - changes:
        - guardian-lib/**/*
  artifacts:
    paths:
      - guardian-lib/dist/
    expire_in: 1 week
  image: docker-registry.knut.univention.de/python:3.11-slim
  script:
    - cd guardian-lib
    - pip install poetry=="$POETRY_VERSION"
    - |-
      if [ "$CI_COMMIT_BRANCH" != "$CI_DEFAULT_BRANCH" ]; then
        poetry version "0.0.0.dev0+${CI_COMMIT_REF_SLUG//-/.}.$CI_COMMIT_SHORT_SHA"
      else
        true
      fi
    - poetry config --local virtualenvs.create false
    - poetry build

build_docker_image_opa:
  stage: build_docker
  rules:
    - changes:
        - opa/**/*
  extends: .kaniko
  variables:
    KANIKO_BUILD_CONTEXT: "$CI_PROJECT_DIR/opa"
    CI_REGISTRY_IMAGE: $CI_REGISTRY_IMAGE/guardian-opa
    KANIKO_ARGS: --build-arg commit="$CI_COMMIT_SHA" --build-arg date="$CI_JOB_STARTED_AT" --cache=true --cache-repo=$CI_REGISTRY_IMAGE/cache

build_docker_image_management_ui:
  stage: build_docker
  rules:
    - changes:
        - management-ui/**/*
  extends: .kaniko
  variables:
    DOCKERFILE_PATH: "$CI_PROJECT_DIR/management-ui/docker/Dockerfile"
    CI_REGISTRY_IMAGE: $CI_REGISTRY_IMAGE/guardian-management-ui
    KANIKO_ARGS: --build-arg commit="$CI_COMMIT_SHA" --build-arg date="$CI_JOB_STARTED_AT" --cache=true --cache-repo=$CI_REGISTRY_IMAGE/cache

build_docker_image_authz:
  stage: build_docker
  needs:
    - test_authz
    - coverage_authz
  rules:
    - changes:
        - authorization-api/**/*
  extends: .kaniko
  variables:
    KANIKO_BUILD_CONTEXT: "$CI_PROJECT_DIR/authorization-api"
    CI_REGISTRY_IMAGE: $CI_REGISTRY_IMAGE/guardian-authorization-api
    KANIKO_ARGS: --build-arg commit="$CI_COMMIT_SHA" --build-arg date="$CI_JOB_STARTED_AT" --skip-unused-stages --cache=true --cache-repo=$CI_REGISTRY_IMAGE/cache

build_docker_image_management:
  stage: build_docker
  needs:
    - test_management
    - coverage_management
  rules:
    - changes:
        - management-api/**/*
  extends: .kaniko
  variables:
    KANIKO_BUILD_CONTEXT: "$CI_PROJECT_DIR/management-api"
    CI_REGISTRY_IMAGE: $CI_REGISTRY_IMAGE/guardian-management-api
    KANIKO_ARGS: --build-arg commit="$CI_COMMIT_SHA" --build-arg date="$CI_JOB_STARTED_AT" --skip-unused-stages --cache=true --cache-repo=$CI_REGISTRY_IMAGE/cache

publish_guardian-lib:
  stage: publish
  when: manual
  rules:
    - changes:
        - guardian-lib/**/*
  dependencies:
    - build_guardian_lib
  needs:
    - build_guardian_lib
  image: docker-registry.knut.univention.de/python:3.11-slim
  script:
    - cd guardian-lib
    - pip install poetry=="$POETRY_VERSION"
    - |-
      if [ "$CI_COMMIT_BRANCH" != "$CI_DEFAULT_BRANCH" ]; then
        poetry version "0.0.0.dev0+${CI_COMMIT_REF_SLUG//-/.}.$CI_COMMIT_SHORT_SHA"
      else
        true
      fi
    - poetry config --local virtualenvs.create false
    - poetry config --local repositories.project_local ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/pypi
    - poetry publish -r project_local --username gitlab-ci-token --password ${CI_JOB_TOKEN}

.app_to_test_appcenter:
  stage: publish
  image: $APPCENTER_CONTROL_IMAGE
  needs: []
  variables:
    APP_ID: "guardian-authorization-api"
    APP_DIR: "appcenter-authz"
    APP_NAME: "5.0/$APP_ID"
  script:
    - cd "$APP_DIR"
    - APP_VERSION="$(sed -n 's/^Version\s*=\s*//p' ini)"
    - echo "updating $APP_NAME=$APP_VERSION"
    - ./scripts/generate-preinst
    - univention-appcenter-control upload "$APP_NAME=$APP_VERSION" configure compose configure_host inst ini preinst README_UPDATE_DE README_UPDATE_EN settings uinst test test_preinstall
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      changes:
        - $APP_DIR/**/*
    - when: manual
      allow_failure: true

authz_app_to_test_appcenter:
  extends: .app_to_test_appcenter
  variables:
    APP_ID: "guardian-authorization-api"
    APP_DIR: "appcenter-authz"
    APP_NAME: "5.0/$APP_ID"

management_app_to_test_appcenter:
  extends: .app_to_test_appcenter
  variables:
    APP_ID: "guardian-management-api"
    APP_DIR: "appcenter-management"
    APP_NAME: "5.0/$APP_ID"

management_ui_app_to_test_appcenter:
  extends: .app_to_test_appcenter
  variables:
    APP_ID: "guardian-management-ui"
    APP_DIR: "appcenter-management-ui"
    APP_NAME: "5.0/$APP_ID"

docs-linkcheck:
  extends: .sphinx-linkcheck-template
  rules:
    - changes:
      - $DOCS_DIR/**/*

docs-spelling:
  extends: .sphinx-spelling-template
  rules:
    - changes:
      - $DOCS_DIR/**/*

docs-html:
  extends: .sphinx-html-template
  rules:
    - changes:
      - $DOCS_DIR/**/*

docs-pdf:
  extends: .sphinx-pdf-template
  rules:
    - changes:
      - $DOCS_DIR/**/*

docs-merge-to-one-artifact:
  extends: .sphinx-merge-template
  needs:
    - job: docs-html
    - job: docs-pdf
    - job: docs-spelling
      artifacts: false
    - job: docs-linkcheck
      artifacts: false
  rules:
    - if: $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
      changes:
      - $DOCS_DIR/**/*
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      changes:
      - $DOCS_DIR/**/*
      when: manual

docs-review:
  extends: .sphinx-review-template
  needs:
    - job: docs-merge-to-one-artifact
  rules:
    - changes:
      - $DOCS_DIR/**/*

# The template has inherit:variables:false to prevent the passing of pipeline
# variables to downstream, and therefore $DOCS_DIR is not available here.
docs-create-production-merge-request:
  extends: .sphinx-docs-merge-request-template
  needs:
    - job: docs-merge-to-one-artifact
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      changes:
      - docs/guardian-manual/**/*