.gitlab-ci.yml

include:
  - project: 'gitlab-org/quality/pipeline-common'
    file:
      - '/ci/danger-review.yml'

stages:
  - lint
  - build
  - test
  - acceptance-test
  - release
  - publish

variables:
  # TODO(@timofurrer): verify if there is an option to read this version from either .go-version or go.mod
  GO_VERSION: '1.19'
  # NOTE(@timofurrer): used for caching, see `cache.paths` settings
  GOPATH: ${CI_PROJECT_DIR}/.go
  IMAGE_TAG: latest


workflow:
  rules:
    - if: $CI_MERGE_REQUEST_IID
      changes:
      - .gitlab/ci/Dockerfile
      - .go-version
      variables:
        IMAGE_TAG: ${CI_COMMIT_REF_SLUG}
    # Apparently including the merged workflow rules in addition to the custom rule above doesn't work.
    # This comes from https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Workflows/MergeRequest-Pipelines.gitlab-ci.yml
    - if: $CI_MERGE_REQUEST_IID
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

default:
  image: golang:${GO_VERSION}
  tags:
    - saas-linux-medium-amd64

cache:
  key:
    files:
      - go.sum
      - GNUMakefile
  paths:
    - .go/pkg/mod

.run-for-supported-versions:
  parallel:
    matrix:
      - GITLAB_VERSION: ["15.6.6-${GITLAB_EDITION}.0", "15.7.5-${GITLAB_EDITION}.0", "15.8.0-${GITLAB_EDITION}.0"]

# Disabling code navigatino with LSIF, until the upload issue is solved.
# see https://gitlab.com/gitlab-org/gitlab/-/issues/365885#note_1219840952
# code_navigation:
#   needs: []
#   stage: build
#   image: sourcegraph/lsif-go:v1
#   allow_failure: true # recommended
#   script:
#     - lsif-go
#     - ls -lh dump.lsif
#   artifacts:
#     reports:
#       lsif: dump.lsif
#   rules:
#     - if: $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
#     - if: $CI_COMMIT_TAG

danger-review:
  needs: []
  stage: lint
  allow_failure: true
  variables:
    GITLAB_DANGERFILES_VERSION: "3.6.4"

make:lint:
  needs: []
  stage: lint
  script:
    - make ${TARGET}
  parallel:
    matrix:
      - TARGET: [lint-golangci, lint-examples-tf, lint-examples-sh, lint-generated, lint-custom]

go:build:
  rules:
    - if: $CI_MERGE_REQUEST_IID
      changes:
        - "**/*.go"
        - go.mod
        - go.sum
        - .gitlab-ci.yml
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_TAG
  needs: []
  stage: build
  script:
    - make build

acctest:image:
  needs: []
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:v1.9.0-debug
    entrypoint: [""]
  variables:
    TERRAFORM_VERSION: '1.3.4'
  rules:
    # Tag with the commit SHA if we're in an MR
    - if: $CI_MERGE_REQUEST_IID
      changes:
        - .gitlab/ci/Dockerfile
        - .go-version
      variables:
        DOCKER_TAG: $CI_COMMIT_REF_SLUG
    # If we're on our main branch, tag with "latest"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      changes:
        - .gitlab/ci/Dockerfile
        - .go-version
      variables:
        DOCKER_TAG: latest
  before_script:
    # Authenticate to the docker registry and dependency proxy
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"auth\":\"$(printf "%s:%s" "${CI_REGISTRY_USER}" "${CI_REGISTRY_PASSWORD}" | base64 | tr -d '\n')\"},\"$CI_DEPENDENCY_PROXY_SERVER\":{\"auth\":\"$(printf "%s:%s" ${CI_DEPENDENCY_PROXY_USER} "${CI_DEPENDENCY_PROXY_PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
  script:
    # Read in the value from the .go-version file
    - export GO_VERSION=$(cat .go-version)
    # Build the docker image
    - /kaniko/executor
      --context "${CI_PROJECT_DIR}/.gitlab/ci"
      --cache=true
      --dockerfile "${CI_PROJECT_DIR}/.gitlab/ci/Dockerfile"
      --destination "${CI_REGISTRY_IMAGE}:${DOCKER_TAG}"
      --build-arg GO_VERSION=$GO_VERSION
      --build-arg TERRAFORM_VERSION=$TERRAFORM_VERSION
      # TODO(PatrickRice): Ensure that the dependency proxy is enabled properly on the project
      #--build-arg DOCKER_REGISTRY_IMAGE_PREFIX="${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/"

go:test:
  rules:
    - if: $CI_MERGE_REQUEST_IID
      changes:
        - "**/*.go"
        - go.mod
        - go.sum
        - .gitlab-ci.yml
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_TAG
  stage: test
  script:
    - make test

.testacc:
  stage: acceptance-test
  services:
    - docker:20.10.16-dind
  variables:
    DOCKER_HOST: tcp://docker:2376/
    DOCKER_TLS_VERIFY: 1
    DOCKER_TLS_CERTDIR: "/certs"
    DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"
    GITLAB_BASE_URL: http://docker:8080/api/v4
    # Debug logging of the test suite
    TF_LOG_PATH: "$CI_PROJECT_DIR/$GITLAB_EDITION-$GITLAB_VERSION-acctest.jsonl"
    # NOTE: the test command will complain about that `JSON` value with:
    #       `[WARN] Invalid log level: "JSON". Defaulting to level: TRACE. Valid levels are: [TRACE DEBUG INFO WARN ERROR]`
    #       But it actually works ¯\_(ツ)_/¯
    TF_LOG: JSON
  # Use the CI container we build
  image: registry.gitlab.com/gitlab-org/terraform-provider-gitlab:${IMAGE_TAG}
  before_script:
    - export GITLAB_$(echo "${GITLAB_EDITION}" | tr '[:lower:]' '[:upper:]')_VERSION=${GITLAB_VERSION}
    - docker-compose pull 2>"${GITLAB_EDITION}-${GITLAB_VERSION}-docker-compose-pull-logs.txt"
    - test -f "${GITLAB_LICENSE}" && cp "${GITLAB_LICENSE}" "${CI_PROJECT_DIR}/Gitlab-license.txt"
    - make testacc-up SERVICE=gitlab-${GITLAB_EDITION} GITLAB_$(echo "${GITLAB_EDITION}" | tr '[:lower:]' '[:upper:]')_VERSION=${GITLAB_VERSION}
  script:
    - make testacc
  artifacts:
    paths:
      - $GITLAB_EDITION-$GITLAB_VERSION-docker-compose-pull-logs.txt
      - $CI_PROJECT_DIR/$GITLAB_EDITION-$GITLAB_VERSION-acctest.jsonl
    expire_in: 2 days
    when: always

testacc:ce:
  extends: 
    - .testacc
    - .run-for-supported-versions
  rules:
    - if: $CI_MERGE_REQUEST_IID
      changes:
        - "**/*.go"
        - go.mod
        - go.sum
        - .gitlab-ci.yml
        - docker-compose.yml
        - GNUmakefile
        - scripts/await-healthy.sh
        - scripts/healthcheck-and-setup.sh
        - scripts/gitlab.rb
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_TAG
  variables:
    GITLAB_EDITION: ce

testacc:ee:
  extends: 
    - .testacc
    - .run-for-supported-versions
  variables:
    GITLAB_EDITION: ee
  rules:
  # If we're on a merge request, only run the tests if go files have changed.
  # Otherwise, run them on the default branch as long as EE is enabled.
    - if: $CI_MERGE_REQUEST_IID && $ENABLE_EE_ACCEPTANCE_TESTS == "true"
      changes:
        - "**/*.go"
        - go.mod
        - go.sum
        - .gitlab-ci.yml
        - docker-compose.yml
        - GNUmakefile
        - scripts/await-healthy.sh
        - scripts/healthcheck-and-setup.sh
        - scripts/gitlab.rb
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $ENABLE_EE_ACCEPTANCE_TESTS == "true" 
    - if: $CI_COMMIT_TAG && $ENABLE_EE_ACCEPTANCE_TESTS == "true" 

testacc:ce:nightly:
  extends: .testacc
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule"
  variables:
    GITLAB_EDITION: ce
    GITLAB_VERSION: nightly

testacc:ee:nightly:
  extends: .testacc
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $ENABLE_EE_ACCEPTANCE_TESTS == "true" && $CI_PIPELINE_SOURCE == "schedule"
  variables:
    GITLAB_EDITION: ee
    GITLAB_VERSION: nightly
  
testacc:nightly:failure:
  image: alpine:latest
  stage: acceptance-test
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule"
      when: on_failure
  needs:
    # needs to be set to optional for pipelines in forks that may not have 
    # EE tests enabled.
    - job: testacc:ee:nightly
      optional: true
    - job: testacc:ee
      optional: true
    # CE jobs will always be present in the pipeline
    - job: testacc:ce:nightly
    - job: testacc:ce
  before_script:
    - apk add --update curl jq
  script:
    - sed -i "s@REPLACE_ME@$CI_PIPELINE_URL@g" .gitlab/ci-issue-template.md
    - template=$(cat .gitlab/ci-issue-template.md)
    - |
      request=$(cat <<EOF
      {
          "title": "Nightly Pipeline Build Issue for Pipeline $CI_PIPELINE_ID",
          "description": $(echo "$template" | jq -R -s ".")
      }
      EOF
      )
    - 'curl --silent --show-error --fail --request POST --header "PRIVATE-TOKEN: $GITLAB_TOKEN_ACCEPTANCE_TESTS_NIGHTLY" --header "Content-Type: application/json" $CI_API_V4_URL/projects/$CI_PROJECT_ID/issues --data "$request" | jq'

goreleaser:
  stage: release
  dependencies: []
  only:
    - tags
  image:
    name: goreleaser/goreleaser:v1.12.1
    entrypoint: ['']
  variables:
    # Disable shallow cloning so that goreleaser can diff between tags to
    # generate a changelog.
    GIT_DEPTH: 0
    GITLAB_TOKEN: $CI_JOB_TOKEN
  before_script:
    - apk add gpg-agent
    - gpg --batch --no-tty --import $GPG_PRIVATE_KEY
    - "export GPG_FINGERPRINT=$(gpg --with-colons --list-keys | awk -F: '/^pub/ { print $5 }')"
  script:
    - goreleaser release
    # NOTE(@timofurrer): goreleaser doesn't write `release.extra_files` to the `dist/` folder
    #                    before upload, therefore, we are going to create it for now.
    #                    Note that it also strips the first character (the leading `v`) from the tag
    - cp terraform-registry-manifest.json dist/${CI_PROJECT_NAME}_${CI_COMMIT_TAG:1}_manifest.json
  artifacts:
    paths:
      - dist/$CI_PROJECT_NAME_*.zip
      - dist/$CI_PROJECT_NAME_*_SHA256SUMS*
      - dist/$CI_PROJECT_NAME_*_manifest.json
      - docs/
      - CHANGELOG.md

github-for-terraform-registry:
  stage: publish
  only:
    - tags
  image: alpine:3.16
  variables:
    GIT_STRATEGY: none
    GITHUB_ORG: gitlabhq
    GITHUB_REPO: $CI_PROJECT_NAME
  before_script:
    - apk add --update curl jq file git
    - ls dist/
  script:
    # NOTE(@timofurrer): publish docs to GitHub, so that they end up in the GitHub release Source code assets,
    #                    ready for the Terraform Registry to discover.
    - |
      git clone --depth 1 https://gitlab-terraform-provider-bot:$GITHUB_TOKEN_FOR_SYNC@github.com/$GITHUB_ORG/$GITHUB_REPO.git /tmp/github-repo
      cp -rf docs CHANGELOG.md /tmp/github-repo
      cd /tmp/github-repo
      git config user.email "Terraform-Provider-Bot@gitlab.com"
      git config user.name "gitlab-terraform-provider-bot"
      git add docs CHANGELOG.md
      git commit --message "Update docs for $CI_COMMIT_TAG release" --allow-empty
      git push
      cd -
      rm -rf /tmp/github-repo
    # create a pre-release Release on GitHub
    # see https://docs.github.com/en/rest/releases/releases#create-a-release
    - |
      gh_release=$(curl --silent --show-error --fail-with-body -X POST -H "Accept: application/vnd.github.v3+json" -H "Authorization: token $GITHUB_TOKEN_FOR_SYNC" \
        https://api.github.com/repos/$GITHUB_ORG/$GITHUB_REPO/releases \
        -d '{
          "tag_name":"'$CI_COMMIT_TAG'",
          "target_commitish":"main",
          "name":"'$CI_COMMIT_TAG'",
          "body":"This release hosted on GitHub only exists because it is the only way to publish to the Terraform Provider Registry.\n\nSee the official release page on GitLab here: **'$CI_PROJECT_URL'/-/releases/'$CI_COMMIT_TAG'**",
          "draft":false,
          "prerelease":true,
          "generate_release_notes":false
        }'
      )
    - gh_release_id=$(echo $gh_release | jq -r '.id')
    # NOTE(@timofurrer): cannot use `.upload_url` from `$gh_release`, because it contains the query parameters in some weird unusable way ...
    - gh_release_upload_url="https://uploads.github.com/repos/$GITHUB_ORG/$GITHUB_REPO/releases/$gh_release_id/assets"
    - 'echo "GitHub Release URL: $gh_release_upload_url"'
    # uploading release assets for GitHub release created in previous step
    # see https://docs.github.com/en/rest/releases/assets#upload-a-release-asset
    - |
      echo "Uploading assets from dist/ produced by goreleaser"
      for asset in dist/*; do
        echo -n "Uploading $asset ..."
        content_type=$(file -b --mime-type "$asset")
        filename=$(basename "$asset")
        curl --silent --output /dev/null --show-error --fail-with-body -X POST -H "Accept: application/vnd.github.v3+json" -H "Authorization: token $GITHUB_TOKEN_FOR_SYNC" \
          "$gh_release_upload_url?name=$filename" \
          -H "Content-Type: $content_type" \
          --data-binary "@$asset"
        echo " done."
      done
    # now that all assets are uploaded we can "release" the "pre-release" created earlier.
    - |
      curl --silent --show-error --fail-with-body \
        -X PATCH \
        -H "Accept: application/vnd.github+json" \
        -H "Authorization: token $GITHUB_TOKEN_FOR_SYNC" \
        https://api.github.com/repos/$GITHUB_ORG/$GITHUB_REPO/releases/$gh_release_id \
        -d '{"prerelease":false}'