.gitlab-ci.yml

stages:
  - lint
  - quality
  - build
  - test
  - release
  - post-release
  - notify
  - docs

workflow:
  rules:
    - if: $CI_COMMIT_BRANCH
    - if: $CI_COMMIT_TAG

#### Templates ####
.TEMPLATE:PHP:CLI:
  image: php:8.0-cli
  stage: lint
  script:
    - find . -name \*.php -exec php -l "{}" \;
  dependencies: [ ]

.TEMPLATE:PHP:phpstan:
  image:
    name: phpstan/phpstan
    entrypoint: [ "" ]
  stage: lint
  script:
    - phpstan analyse src/ | tee phpstan.txt
  dependencies: [ ]

.TEMPLATE:MD:markdownlint:
  stage: lint
  image: node:latest
  before_script:
    - npm install -g markdownlint-cli
  script:
    - markdownlint .
  dependencies: [ ]

.TEMPLATE:BASH:shellcheck:
  image: koalaman/shellcheck-alpine
  stage: lint
  script:
    - shellcheck -x cam/webcam .docker/* cron/backup
  dependencies: [ ]

.TEMPLATE:PHP:noverify:
  image: golang:alpine
  stage: lint
  artifacts:
    when: on_failure
    paths:
      - noverify.txt
    expire_in: 2 weeks
  before_script:
    - apk add --no-cache git
    - go get -u github.com/VKCOM/noverify
  script:
    - noverify check -exclude-checks undefined,caseBreak src/ | tee noverify.txt
  dependencies: [ ]

.TEMPLATE:DOCKER:lint:
  image: node:latest
  stage: lint
  before_script:
    - npm install -g dockerfilelint
  script:
    - dockerfilelint Dockerfile
  dependencies: [ ]

.TEMPLATE:DOCS:mkdocs:
  stage: docs
  image: python:3.8-alpine
  before_script:
    - apk add --no-cache --virtual .build gcc musl-dev
    - pip install mkdocs-material
    - pip install mkdocs-minify-plugin
  dependencies: [ ]

### Docker Image Templates ###

## Bullseye ###
.TEMPLATE:DOCKER:build:
  image: docker:latest
  stage: build
  services:
    - name: docker:dind
  before_script:
    - mkdir -p $HOME/.docker/cli-plugins/
    - wget -O $HOME/.docker/cli-plugins/docker-buildx https://github.com/docker/buildx/releases/download/v$BUILDX_VERSION/buildx-v$BUILDX_VERSION.linux-amd64
    - chmod a+x $HOME/.docker/cli-plugins/docker-buildx
    - docker run --privileged --rm tonistiigi/binfmt --install $BUILDX_PLATFORM
    - docker buildx create --use --driver docker-container --name binfmt --platform=$BUILDX_PLATFORM
    - docker login -u $CI_REGISTRY_USER -p ${CI_REGISTRY_PASSWORD} $CI_REGISTRY
  script:
    - >
      if [ "$LATEST_RELEASE" = "true" ]; then
        apk add --no-cache jq && export ACUPARSE_VERSION=$(cat .version | jq -r '.VERSION') \
        && docker login -u $GITHUB_USER -p $GITHUB_REGISTRY_TOKEN $GITHUB_REGISTRY \
        && docker login -u $DOCKERHUB_USER -p $DOCKERHUB_REGISTRY_TOKEN \
        && docker buildx build \
        --build-arg BUILD_DATE=$DATE \
        --build-arg VCS_REF=$CI_COMMIT_SHA \
        --build-arg BUILD_VERSION=$ACUPARSE_VERSION \
        --build-arg BUILD_BRANCH=stable \
        --tag $CI_REGISTRY_IMAGE:$ACUPARSE_VERSION \
        --tag $CI_REGISTRY_IMAGE:latest \
        --tag $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA \
        --tag $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$ACUPARSE_VERSION \
        --tag $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:latest \
        --tag $DOCKER_REGISTRY_TAG:$ACUPARSE_VERSION \
        --tag $DOCKER_REGISTRY_TAG:latest \
        --tag $GITHUB_REGISTRY/$DOCKER_REGISTRY_TAG:$ACUPARSE_VERSION \
        --tag $GITHUB_REGISTRY/$DOCKER_REGISTRY_TAG:latest \
        --platform $BUILDX_PLATFORM \
        --push \
        .
      else
        docker buildx build \
        --build-arg BUILD_DATE=$DATE \
        --build-arg VCS_REF=$CI_COMMIT_SHA \
        --build-arg BUILD_VERSION=$CI_COMMIT_SHA \
        --build-arg BUILD_BRANCH=$CI_COMMIT_REF_SLUG \
        --tag $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA \
        --tag $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:latest \
        --platform $BUILDX_PLATFORM_DEV \
        --push \
        .
      fi
  dependencies: [ ]
  retry: 2

## Buster ##
.TEMPLATE:DOCKER:build:LEGACY:
  variables:
    OS_VERSION: buster
  extends: .TEMPLATE:DOCKER:build
  script:
    - >
      if [ "$LATEST_RELEASE" = "true" ]; then
        apk add --no-cache jq && export ACUPARSE_VERSION=$(cat .version | jq -r '.VERSION') \
        && docker login -u $GITHUB_USER -p $GITHUB_REGISTRY_TOKEN $GITHUB_REGISTRY \
        && docker login -u $DOCKERHUB_USER -p $DOCKERHUB_REGISTRY_TOKEN \
        && docker buildx build \
        --build-arg OS_VERSION=$OS_VERSION \
        --build-arg BUILD_DATE=$DATE \
        --build-arg VCS_REF=$CI_COMMIT_SHA \
        --build-arg BUILD_VERSION=$ACUPARSE_VERSION \
        --build-arg BUILD_BRANCH=stable \
        --tag $CI_REGISTRY_IMAGE:$ACUPARSE_VERSION-$OS_VERSION \
        --tag $CI_REGISTRY_IMAGE:$OS_VERSION \
        --tag $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA-$OS_VERSION \
        --tag $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$ACUPARSE_VERSION-$OS_VERSION \
        --tag $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$OS_VERSION \
        --tag $DOCKER_REGISTRY_TAG:$ACUPARSE_VERSION-$OS_VERSION \
        --tag $DOCKER_REGISTRY_TAG:$OS_VERSION \
        --tag $GITHUB_REGISTRY/$DOCKER_REGISTRY_TAG:$ACUPARSE_VERSION-$OS_VERSION \
        --tag $GITHUB_REGISTRY/$DOCKER_REGISTRY_TAG:$OS_VERSION \
        --platform $BUILDX_PLATFORM \
        --push \
        .
      else
        docker buildx build \
        --build-arg OS_VERSION=$OS_VERSION \
        --build-arg BUILD_DATE=$DATE \
        --build-arg VCS_REF=$CI_COMMIT_SHA \
        --build-arg BUILD_VERSION=$CI_COMMIT_SHA \
        --build-arg BUILD_BRANCH=$CI_COMMIT_REF_SLUG \
        --tag $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA-$OS_VERSION \
        --tag $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$OS_VERSION \
        --platform $BUILDX_PLATFORM_DEV \
        --push \
        .
      fi
### END: Docker Image Templates ###

#### END: Templates ####

##### JOBS #####

#### PHP ####

#### PHP CLI ####
PHP:CLI:
  extends: .TEMPLATE:PHP:CLI
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_COMMIT_BRANCH == "stable"'

DEV:PHP:CLI:
  extends: .TEMPLATE:PHP:CLI
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_COMMIT_BRANCH != "stable"'
  allow_failure: true

#### phpstan ####

DEV:PHP:phpstan:
  extends: .TEMPLATE:PHP:phpstan
  script:
    - phpstan analyse --level max src/ | tee phpstan.txt
  artifacts:
    when: on_failure
    paths:
      - phpstan.txt
    expire_in: 2 weeks
  allow_failure: true
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_COMMIT_BRANCH != "stable"'

#### noverify ####

DEV:PHP:noverify:
  extends: .TEMPLATE:PHP:noverify
  allow_failure: true
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_COMMIT_BRANCH != "stable"'

#### END: PHP ####

#### Markdown ####
MD:markdownlint:
  extends: .TEMPLATE:MD:markdownlint
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_COMMIT_BRANCH == "stable"'

DEV:MD:markdownlint:
  extends: .TEMPLATE:MD:markdownlint
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_COMMIT_BRANCH != "stable"'
  allow_failure: true

#### END: Markdown ####

#### Bash ####
BASH:shellcheck:
  extends: .TEMPLATE:BASH:shellcheck
  before_script:
    - export SHELLCHECK_OPTS="-e SC2034 -e SC2059 -e SC2086"
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_COMMIT_BRANCH == "stable"'

DEV:BASH:shellcheck:
  extends: .TEMPLATE:BASH:shellcheck
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_COMMIT_BRANCH != "stable"'
  allow_failure: true

#### END: Bash ####

#### Docker File ####
DOCKER:lint:
  extends: .TEMPLATE:DOCKER:lint
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_COMMIT_BRANCH == "stable"'

DEV:DOCKER:lint:
  extends: .TEMPLATE:DOCKER:lint
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_COMMIT_BRANCH != "stable"'
  allow_failure: true

#### END: Docker File ####

#### Build and Release a Docker Container ####
DOCKER:build:
  extends: .TEMPLATE:DOCKER:build
  variables:
    LATEST_RELEASE: 'true'
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_COMMIT_BRANCH == "stable"'
  needs: [ "DOCKER:lint" ]

DEV:DOCKER:build:
  extends: .TEMPLATE:DOCKER:build
  allow_failure: false
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_COMMIT_BRANCH != "stable"'
  needs: [ "DEV:DOCKER:lint" ]

DOCKER:build:LEGACY:
  extends: .TEMPLATE:DOCKER:build:LEGACY
  variables:
    LATEST_RELEASE: 'true'
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_COMMIT_BRANCH == "stable"'
  needs: [ "DOCKER:lint" ]

DEV:DOCKER:build:LEGACY:
  extends: .TEMPLATE:DOCKER:build:LEGACY
  allow_failure: false
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_COMMIT_BRANCH != "stable"'
  needs: [ "DEV:DOCKER:lint" ]
#### END: Docker Image ####

#### Test Installer and Container ####
INSTALLER:
  stage: test
  trigger:
    project: acuparse/installer
    branch: master
    strategy: depend
  variables:
    UPSTREAM_BRANCH: $CI_COMMIT_REF_NAME
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_COMMIT_BRANCH == "stable"'
  needs: [ "DOCKER:build" ]

DEV:INSTALLER:
  stage: test
  trigger:
    project: acuparse/installer
    branch: dev
    strategy: depend
  variables:
    UPSTREAM_BRANCH: $CI_COMMIT_REF_NAME
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_COMMIT_BRANCH != "stable"'
  needs: [ "DEV:DOCKER:build" ]

#### END: Test Installer ####

#### Publish Project Documentation ####
pages:
  extends: .TEMPLATE:DOCS:mkdocs
  script:
    - mkdocs build
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_COMMIT_BRANCH == "stable"'
  artifacts:
    paths:
      - public
  needs: [ "MD:markdownlint" ]

DEV:DOCS:mkdocs:
  extends: .TEMPLATE:DOCS:mkdocs
  script:
    - mkdocs build --site-dir public_html
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_COMMIT_BRANCH != "stable"'
  allow_failure: true
  artifacts:
    paths:
      - public_html
  needs: [ "DEV:MD:markdownlint" ]

#### END: Project Documentation ####

#### Tag Release ####
RELEASE:GITLAB:tag:
  stage: release
  image: registry.gitlab.com/gitlab-org/release-cli
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_COMMIT_BRANCH == "stable"'
  before_script:
    - apk add curl jq sed --no-cache
    - export VERSION=$(cat .version | jq -r '.VERSION')
    - export RELEASE_NOTES=$(sed '1,/'$VERSION'/d;/## \[\[/Q' CHANGELOG.md)
  script:
    - release-cli create --name "Version $VERSION" --description "$RELEASE_NOTES" --tag-name "v$VERSION" --ref "$CI_COMMIT_SHA"
  dependencies: [ ]
  needs: [ "INSTALLER" ]

RELEASE:GITHUB:tag:
  stage: post-release
  image: alpine
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: $CI_COMMIT_TAG =~ /^v[0-9](?:\.[0-9]){2,3}.*/
  before_script:
    - apk add curl jq sed --no-cache
    - export VERSION=$(cat .version | jq -r '.VERSION')
    - export RELEASE_NOTES=$(sed '1,/'$VERSION'/d;/## \[\[/Q' CHANGELOG.md)
    - export GHE_NOTES=$(echo "$RELEASE_NOTES" | sed '1{/^[[:space:]]*$/d}' | sed -E ':a;N;$!ba;s/\r{0,1}\n/\\n/g')
  script:
    - >
      curl -X POST -u $GITHUB_USER:$GITHUB_RELEASE_TOKEN -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/acuparse/acuparse/releases -d '{"tag_name":"v'"$VERSION"'","name":"Version '"$VERSION"'","body":"'"$GHE_NOTES"'","target_commitish":"'"$CI_COMMIT_SHA"'"}'
  dependencies: [ ]

#### Update RMS ####
RELEASE:RMS:
  stage: post-release
  image: alpine
  before_script:
    - apk add curl jq --no-cache
    - export VERSION=$(cat .version | jq -r '.VERSION')
  script:
    - >
      curl -H "Authorization: Bearer $RMS_TOKEN" -X POST -d "version=$VERSION" "$RMS_HOST/releases" | jq
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: $CI_COMMIT_TAG =~ /^v[0-9](?:\.[0-9]){2,3}.*/
  dependencies: [ ]

#### Announce Release ####
RELEASE:Announce:
  stage: notify
  image: alpine
  before_script:
    - apk add curl jq --no-cache
    - export VERSION=$(cat .version | jq -r '.VERSION')
    - export RELEASE_VERSION="${VERSION//./-}"
  script:
    - >
      curl -X POST --data-urlencode 'payload={"blocks":[{"type":"section","text":{"type":"mrkdwn","text":"Acuparse Version `'"$VERSION"'` is now available!\nSee the <https://www.acuparse.com/releases/v'"$RELEASE_VERSION"'|Release Notes> for more details!\n\nFor update instructions, see the <https://docs.acuparse.com/UPDATING|Update Guide>."},"accessory":{"type":"image","image_url":"https://www.acuparse.com/assets/img/release.jpg","alt_text":"Ship Image"}}]}' "$SLACK_RELEASE_HOOK_URL"
    - curl -s --user "api:$MAILGUN_API_KEY" "https://api.mailgun.net/v3/$MAILGUN_DOMAIN/messages" -F from='Acuparse Release Management Service <no_reply@'$MAILGUN_DOMAIN'>' -F to='Acuparse Users Mailing List <users@lists.'$MAILGUN_DOMAIN'>' -F subject='Acuparse '$VERSION' is now available' --form-string html='<h2>Acuparse Version '$VERSION' is now available!</h2><p>See the <a href="https://www.acuparse.com/releases/v'$RELEASE_VERSION'">Release Notes</a> for more details!<br>For update instructions, see the <a href="https://docs.acuparse.com/UPDATING">Update Guide</a>.</p>'
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: $CI_COMMIT_TAG =~ /^v[0-9](?:\.[0-9]){2,3}.*/
  dependencies: [ ]
  needs: [ "RELEASE:RMS" ]

#### End Release ####

include:
  - template: Jobs/Code-Quality.gitlab-ci.yml
  - template: Security/Container-Scanning.gitlab-ci.yml
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/License-Scanning.gitlab-ci.yml
  - template: Security/SAST.gitlab-ci.yml

code_quality:
  rules:
    - if: '$CODE_QUALITY_DISABLED'
      when: never
    - if: '$CI_COMMIT_BRANCH == "stable"'
    - if: '$CI_COMMIT_BRANCH == "dev"'

##### END: JOBS #####