.gitlab-ci.yml

---
# https://docs.gitlab.com/ee/ci/yaml/index.html#switch-between-branch-pipelines-and-merge-request-pipelines
workflow:
  rules:
    - if: $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "push" && $CI_OPEN_MERGE_REQUESTS || $CI_COMMIT_TAG
      when: never
    - when: always

# https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#use-docker-in-docker
variables:
  # When you use the dind service, you must instruct Docker to talk with
  # the daemon started inside of the service. The daemon is available
  # with a network connection instead of the default
  # /var/run/docker.sock socket. Docker 19.03 does this automatically
  # by setting the DOCKER_HOST in
  # https://github.com/docker-library/docker/blob/d45051476babc297257df490d22cbd806f1b11e4/19.03/docker-entrypoint.sh#L23-L29
  #
  # The 'docker' hostname is the alias of the service container as described at
  # https://docs.gitlab.com/ee/ci/services/#accessing-the-services.
  #
  # Specify to Docker where to create the certificates. Docker
  # creates them automatically on boot, and creates
  # `/certs/client` to share between the service and job
  # container, thanks to volume mount from config.toml
  DOCKER_HOST: tcp://docker:2376
  DOCKER_VERSION: "23"
  DOCKER_TLS_CERTDIR: "/certs"
  FF_NETWORK_PER_BUILD: 1

default:
  retry: 1
  cache: &global_cache
    - key:
        files:
          - go.mod
          - go.sum
      paths:
        - /go/pkg/mod
    - key:
        files:
          - frontend/package.json
          - frontend/bun.lockb
      paths:
        - frontend/node_modules
    - key:
        files:
          - old-frontend/package.json
          - old-frontend/yarn.lock
      paths:
        - old-frontend/node_modules
    - key:
        files:
          - e2e/package.json
          - e2e/yarn.lock
      paths:
        - e2e/node_modules

include:
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml
  - template: Security/Container-Scanning.gitlab-ci.yml

stages:
  - lint
  - build-codegen
  - generate
  - unit-test
  - build
  - build-no-cache
  - test
  - release
  - container-scan

commit-lint:
  stage: lint
  image: node:lts
  before_script:
    - npm install -g commitlint@19.2.2 @commitlint/config-conventional@19.2.2
  script:
    - git fetch https://gitlab.com/isard/isardvdi.git main
    - commitlint --from=$(git merge-base HEAD FETCH_HEAD)

version:
  stage: lint
  image: node:lts
  rules:
    # semantic-release checks repository write access and we cannot use
    # GITLAB_TOKEN in unprotected branches due to security reasons.
    # https://github.com/semantic-release/semantic-release/issues/2207
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  before_script:
    - npm install -g semantic-release@23 @semantic-release/exec @semantic-release/gitlab conventional-changelog-conventionalcommits@6
  script:
    - semantic-release --dry-run --branches $CI_COMMIT_REF_NAME
  artifacts:
    paths:
      - .VERSION

check-python:
  stage: lint
  image: python:3.10-bullseye
  script:
    - pip install isort black==24.3.0
    - isort --check .
    - black --check .

check-frontend:
  stage: lint
  image: oven/bun:1.1.24-alpine
  parallel:
    matrix:
      - JOB: "format --write=false --check"
      - JOB: "lint"
        # TODO: Remove this when all lint errors are fixed
        ALLOW_FAILURE: "true"
      # - JOB: "type-check"
      #   # TODO: Remove this when all type errors are fixed
      #   ALLOW_FAILURE: "true"
  rules:
    - if: $ALLOW_FAILURE == "true"
      allow_failure: true
    - if: $ALLOW_FAILURE != "true"
      allow_failure: false
  script:
    - cd frontend
    - bun install --frozen-lockfile
    - bun run $JOB

check-old-frontend:
  stage: lint
  image: node:18.17
  script:
    - cd old-frontend
    - yarn install --frozen-lockfile
    - yarn lint --no-fix --max-warnings 0

check-protobuf:
  stage: lint
  image:
    name: bufbuild/buf:1.44.0
    entrypoint: [""]
  script:
    - buf lint
    - buf breaking --against https://gitlab.com/isard/isardvdi.git

docker-image-codegen:
  image: "docker:${DOCKER_VERSION}"
  stage: build-codegen
  services:
    - name: "docker:${DOCKER_VERSION}-dind-rootless"
  parallel:
    matrix:
      - DOCKERFILE: docker/codegen/Dockerfile
        IMAGE: codegen
  before_script:
    - until docker info; do sleep 1; done
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
  script:
    - docker build -f $DOCKERFILE --cache-from registry.gitlab.com/isard/isardvdi/$IMAGE:main --cache-to type=inline -t $CI_REGISTRY_IMAGE/$IMAGE:$CI_COMMIT_REF_SLUG .
    - docker tag $CI_REGISTRY_IMAGE/$IMAGE:$CI_COMMIT_REF_SLUG $CI_REGISTRY_IMAGE/$IMAGE:git-$CI_COMMIT_SHORT_SHA
    - docker push $CI_REGISTRY_IMAGE/$IMAGE:git-$CI_COMMIT_SHORT_SHA

docker-image-codegen-no-cache:
  image: "docker:${DOCKER_VERSION}"
  stage: build-codegen
  services:
    - name: "docker:${DOCKER_VERSION}-dind-rootless"
  parallel:
    matrix:
      - DOCKERFILE: docker/codegen/Dockerfile
        IMAGE: codegen
  before_script:
    - until docker info; do sleep 1; done
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
  script:
    - docker build -f $DOCKERFILE -t $CI_REGISTRY_IMAGE/$IMAGE:$CI_COMMIT_REF_SLUG .
    - docker tag $CI_REGISTRY_IMAGE/$IMAGE:$CI_COMMIT_REF_SLUG $CI_REGISTRY_IMAGE/$IMAGE:git-$CI_COMMIT_SHORT_SHA
    - docker push $CI_REGISTRY_IMAGE/$IMAGE:git-$CI_COMMIT_SHORT_SHA
  when: manual

gen-protobuf:
  stage: generate
  image: "docker:${DOCKER_VERSION}"
  services:
    - name: "docker:${DOCKER_VERSION}-dind-rootless"
  before_script:
    - until docker info; do sleep 1; done
  script:
    - docker run -u $(id -u) -v "$(pwd):/build" "$CI_REGISTRY_IMAGE/codegen:git-$CI_COMMIT_SHORT_SHA"
  artifacts:
    paths:
      - pkg/gen
      - frontend/src/gen
      - "**/testing_*_mock.go"

docker-compose-build:
  stage: generate
  image: "docker:${DOCKER_VERSION}"
  services:
    - name: "docker:${DOCKER_VERSION}-dind-rootless"
  before_script:
    - apk add bash git docker-compose yq
  script:
    - cp isardvdi.cfg.example isardvdi.build.cfg
    - echo "DOCKER_IMAGE_PREFIX=${CI_REGISTRY_IMAGE}/" >> isardvdi.build.cfg
    - echo "DOCKER_IMAGE_TAG=$CI_COMMIT_REF_SLUG" >> isardvdi.build.cfg
    - echo "USAGE=build" >> isardvdi.build.cfg
    - echo "BASTION_ENABLED=true" >> isardvdi.build.cfg
    - cp isardvdi.build.cfg isardvdi.infrastructure.build.cfg
    - echo "INFRASTRUCTURE_MANAGEMENT=true" >> isardvdi.infrastructure.build.cfg
    - cp isardvdi.build.cfg isardvdi.video-standalone.build.cfg
    - echo "FLAVOUR=video-standalone" >> isardvdi.video-standalone.build.cfg
    - cp isardvdi.build.cfg isardvdi.monitor.build.cfg
    - echo "FLAVOUR=monitor" >> isardvdi.monitor.build.cfg
    - cp isardvdi.build.cfg isardvdi.check.build.cfg
    - echo "FLAVOUR=check" >> isardvdi.check.build.cfg
    - cp isardvdi.build.cfg isardvdi.nextcloud.build.cfg
    - echo "FLAVOUR=nextcloud" >> isardvdi.nextcloud.build.cfg
    - BACKUP_DB_ENABLED=true CODEGEN=false ./build.sh
    - |-
      for file in docker-compose*.yml; do
        cp "$file" "no-cache-$file"
        yq -i '.services |= map_values(.build.cache_from = [ "registry.gitlab.com/isard/isardvdi/" + (.container_name | sub("isard-", "")) + ":main" ]) |= map_values(.build.cache_to = [ "type=inline" ])' $file
      done
  artifacts:
    paths:
      - docker-compose*.yml
      - no-cache-docker-compose*.yml

unit-test-go:
  stage: unit-test
  image: golang:1.23
  before_script:
    - apt-get update && apt-get install -y libvirt-dev
    - go install gotest.tools/gotestsum@latest
    - go install github.com/boumenot/gocover-cobertura@latest
  script:
    - export PATH=$PATH:~/go/bin
    - gotestsum --junitfile report.xml --format testname -- -race ./... -coverprofile coverage.out -covermode atomic
    - go tool cover -func coverage.out
    - gocover-cobertura < coverage.out > coverage.xml
  artifacts:
    when: always
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
      junit: report.xml
  coverage: /total:\s+\(statements\)\s+\d+.\d+%/

docker-image:
  image: "docker:${DOCKER_VERSION}"
  stage: build
  services:
    - name: "docker:${DOCKER_VERSION}-dind-rootless"
  parallel:
    matrix:
      - DOCKER_COMPOSE: build
        IMAGE: &containers
          - api
          - scheduler
          - authentication
          - backupninja
          - bastion
          - core_worker
          - db
          - engine
          - grafana
          - guac
          - rdpgw
          - hypervisor
          - notifier
          - portal
          - sessions
          - squid
          - static
          - stats-go
          - stats-rethinkdb
          - storage
          - webapp
          - websockify
      - DOCKER_COMPOSE: build
        IMAGE_DEPENDENCY: isard-rdpgw
        IMAGE: vpn
      - DOCKER_COMPOSE: infrastructure.build
        IMAGE: orchestrator
      - DOCKER_COMPOSE: video-standalone.build
        IMAGE: video
      - DOCKER_COMPOSE: monitor.build
        IMAGE: monitor-proxy
      - DOCKER_COMPOSE: check.build
        IMAGE:
          - check
          - check-client
      - DOCKER_COMPOSE: nextcloud.build
        IMAGE:
          - nc-proxy
          - nc-app
  before_script:
    - apk add git docker-compose
    - until docker info; do sleep 1; done
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
  script:
    - git submodule update --init --recursive --remote
    - echo $IMAGE_DEPENDENCY isard-$IMAGE | xargs -n1 docker-compose -f docker-compose.$DOCKER_COMPOSE.yml build
    - docker tag $CI_REGISTRY_IMAGE/$IMAGE:$CI_COMMIT_REF_SLUG $CI_REGISTRY_IMAGE/$IMAGE:git-$CI_COMMIT_SHORT_SHA
    - docker push $CI_REGISTRY_IMAGE/$IMAGE:git-$CI_COMMIT_SHORT_SHA

docker-image-no-cache:
  extends: docker-image
  stage: build-no-cache
  script:
    - git submodule update --init --recursive --remote
    - echo $IMAGE_DEPENDENCY isard-$IMAGE | xargs -n1 docker-compose -f no-cache-docker-compose.$DOCKER_COMPOSE.yml build
    - docker tag $CI_REGISTRY_IMAGE/$IMAGE:$CI_COMMIT_REF_SLUG $CI_REGISTRY_IMAGE/$IMAGE:git-$CI_COMMIT_SHORT_SHA
    - docker push $CI_REGISTRY_IMAGE/$IMAGE:git-$CI_COMMIT_SHORT_SHA
  when: manual

# test-e2e:
#   stage: test
#   variables:
#     DOCKER_TLS_CERTDIR: "/certs-root"
#   services:
#     - name: "docker:dind"
#       variables:
#         DOCKER_TLS_CERTDIR: "/certs-root"
#       alias: docker
#   image: "docker:latest"
#   before_script:
#     - apk add git docker-compose
#     - until docker info; do sleep 1; done
#     - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
#     - cp isardvdi.cfg.example isardvdi.e2e.cfg
#     - echo "USAGE=test" >> isardvdi.e2e.cfg
#     - echo "DOMAIN=host.docker.internal" >> isardvdi.e2e.cfg
#     - echo "DOCKER_IMAGE_PREFIX=${CI_REGISTRY_IMAGE}/" >> isardvdi.e2e.cfg
#     - echo "DOCKER_IMAGE_TAG=git-$CI_COMMIT_SHORT_SHA" >> isardvdi.e2e.cfg
#     - CODEGEN=false ./build.sh
#     - docker compose -f docker-compose.e2e.yml pull
#     - docker compose -f docker-compose.e2e.yml up -d
#   script:
#     - cd frontend
#     - docker run --rm -w "/frontend" -v "$PWD:/frontend" node:18 yarn
#     - export PORTAL="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' isard-portal | tr -d '\n')"
#     - export NETWORK="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.NetworkID}}{{end}}' isard-portal | tr -d '\n')"
#     - docker run --rm --ipc=host -w "/frontend" -v "$PWD:/frontend" -e "DOCKER=true" -e "CI=true" --add-host="host.docker.internal:$PORTAL" --network="$NETWORK" mcr.microsoft.com/playwright:v1.36.0-jammy yarn playwright test
#   artifacts:
#     when: always
#     paths:
#       - frontend/test-results
#       - frontend/playwright-report

gemnasium-dependency_scanning:
  variables:
    # Scan all the subdirectories
    DS_MAX_DEPTH: -1
    DS_INCLUDE_DEV_DEPENDENCIES: "false"

docker-tag:
  stage: release
  image:
    name: gcr.io/go-containerregistry/crane:debug
    entrypoint: [""]
  parallel:
    matrix:
      - IMAGE: *containers
      - IMAGE: &containers_extra
          - codegen
          - check
          - check-client
          - vpn
          - orchestrator
          - video
          - monitor-proxy
          - nc-proxy
          - nc-app
  script:
    - test "$CI_COMMIT_BRANCH" == "$CI_DEFAULT_BRANCH" -a ! -e ".VERSION" && exit 0
    - crane auth login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
    - crane tag $CI_REGISTRY_IMAGE/$IMAGE:git-$CI_COMMIT_SHORT_SHA $CI_COMMIT_REF_SLUG
    - test ! -e ".VERSION" && exit 0
    - crane tag $CI_REGISTRY_IMAGE/$IMAGE:git-$CI_COMMIT_SHORT_SHA v$(cat .VERSION | tr '.' '-')

release:
  stage: release
  image: node:lts
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  script:
    - test ! -e ".VERSION" && exit 0
    - 'sed -i "s/^\(\s*DOCKER_IMAGE_TAG: \)$CI_DEFAULT_BRANCH$/\1v$(cat .VERSION | tr "." "-")/" docker-compose*.yml'
    - npm install -g semantic-release@23 @semantic-release/exec @semantic-release/gitlab conventional-changelog-conventionalcommits@6
    - semantic-release --branches $CI_DEFAULT_BRANCH

container_scanning:
  stage: container-scan
  variables:
    CI_APPLICATION_REPOSITORY: $CI_REGISTRY_IMAGE/$IMAGE
    CI_APPLICATION_TAG: $CI_COMMIT_REF_SLUG
    CS_DISABLE_LANGUAGE_VULNERABILITY_SCAN: "false"
  parallel:
    matrix:
      - IMAGE: *containers
      - IMAGE: *containers_extra