hippofish/.gitlab-ci.yml

image: docker.io/rust:slim-bookworm

services:
  - name: docker.io/groonga/pgroonga:latest-alpine-12-slim
    alias: postgres
    pull_policy: if-not-present
  - name: docker.io/redis:7-alpine
    alias: redis
    pull_policy: if-not-present

workflow:
  rules:
    - if: $CI_PROJECT_PATH == 'firefish/firefish'
      when: always
    - if: $CI_MERGE_REQUEST_PROJECT_PATH == 'firefish/firefish'
      when: always
    - if: $CI_PROJECT_PATH != 'firefish/firefish'
      changes:
        paths:
          - .gitlab-ci.yml
      when: never
    - when: never

cache:
  paths:
    - node_modules
    # - /usr/local/cargo/registry/index
    # - /usr/local/cargo/registry/cache
    - target/debug/deps
    - target/debug/build

stages:
  - dependency
  - test
  - build
  - scan

variables:
  POSTGRES_DB: 'firefish_db'
  POSTGRES_USER: 'firefish'
  POSTGRES_PASSWORD: 'password'
  POSTGRES_HOST_AUTH_METHOD: 'trust'
  DEBIAN_FRONTEND: 'noninteractive'
  CARGO_PROFILE_DEV_OPT_LEVEL: '0'
  CARGO_PROFILE_DEV_LTO: 'off'
  CARGO_PROFILE_DEV_DEBUG: 'none'
  CARGO_TERM_COLOR: 'always'

default:
  before_script:
    - apt-get update && apt-get -y upgrade
    - apt-get -y --no-install-recommends install curl
    - curl -fsSL 'https://deb.nodesource.com/setup_18.x' | bash -
    - apt-get install -y --no-install-recommends build-essential clang mold python3 perl nodejs postgresql-client
    - corepack enable
    - corepack prepare pnpm@latest --activate
    - cp .config/ci.yml .config/default.yml
    - cp ci/cargo/config.toml /usr/local/cargo/config.toml
    - export PGPASSWORD="${POSTGRES_PASSWORD}"
    - psql --host postgres --user "${POSTGRES_USER}" --dbname "${POSTGRES_DB}" --command 'CREATE EXTENSION pgroonga'

test:build:
  stage: test
  rules:
    - if: $TEST == 'false'
      when: never
    - if: $CI_COMMIT_BRANCH == 'develop' || $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        paths:
          - packages/backend/*
          - packages/backend-rs/*
          - packages/macro-rs/*
          - packages/megalodon/*
          - scripts/**/*
          - package.json
          - pnpm-lock.yaml
          - Cargo.toml
          - Cargo.lock
      when: always
  needs:
    - job: cargo:clippy
      optional: true
    - job: cargo:test
      optional: true
  script:
    - pnpm install --frozen-lockfile
    - pnpm run build:debug
    - pnpm run migrate

test:build:client_only:
  stage: test
  rules:
    - if: $TEST == 'false'
      when: never
    - if: $CI_COMMIT_BRANCH == 'develop' || $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        paths:
          - packages/backend/*
          - packages/backend-rs/*
          - packages/macro-rs/*
          - packages/megalodon/*
          - scripts/**/*
          - package.json
          - pnpm-lock.yaml
          - Cargo.toml
          - Cargo.lock
      when: never
    - if: $CI_COMMIT_BRANCH == 'develop' || $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        paths:
          - packages/client/*
          - packages/firefish-js/*
          - packages/sw/*
          - locales/**/*
      when: always
  services: []
  before_script:
    - apt-get update && apt-get -y upgrade
    - apt-get -y --no-install-recommends install curl
    - curl -fsSL 'https://deb.nodesource.com/setup_18.x' | bash -
    - apt-get install -y --no-install-recommends build-essential python3 perl nodejs
    - corepack enable
    - corepack prepare pnpm@latest --activate
    - cp .config/ci.yml .config/default.yml
  script:
    - pnpm install --frozen-lockfile
    - pnpm --filter 'firefish-js' --filter 'client' --filter 'sw' run build:debug

build:container:
  stage: build
  image: docker.io/debian:bookworm-slim
  services: []
  rules:
    - if: $BUILD == 'false'
      when: never
    - if: $CI_COMMIT_BRANCH == 'develop'
      changes:
        paths:
          - packages/**/*
          - locales/**/*
          - scripts/copy-assets.mjs
          - package.json
          - pnpm-lock.yaml
          - Cargo.toml
          - Cargo.lock
          - Dockerfile
          - .dockerignore
      when: always
  needs:
    - job: test:build
      optional: true
    - job: test:build:client_only
      optional: true
  before_script:
    - apt-get update && apt-get -y upgrade
    - apt-get install -y --no-install-recommends buildah ca-certificates fuse-overlayfs
    - buildah login --username "${CI_REGISTRY_USER}" --password "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
    - export IMAGE_TAG="${CI_REGISTRY}/${CI_PROJECT_PATH}/develop:not-for-production"
    - export IMAGE_CACHE="${CI_REGISTRY}/${CI_PROJECT_PATH}/develop/cache"
  script:
    - |-
      buildah build \
        --isolation chroot \
        --device /dev/fuse:rw \
        --security-opt seccomp=unconfined \
        --security-opt apparmor=unconfined \
        --cap-add all \
        --platform linux/amd64 \
        --layers \
        --cache-to "${IMAGE_CACHE}" \
        --cache-from "${IMAGE_CACHE}" \
        --tag "${IMAGE_TAG}" \
        .
    - buildah inspect "${IMAGE_TAG}"
    - buildah push "${IMAGE_TAG}"

cargo:test:
  stage: test
  rules:
    - if: $TEST == 'false'
      when: never
    - if: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == 'main'
      when: never
    - if: $CI_COMMIT_BRANCH == 'develop' || $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        paths:
          - packages/backend-rs/**/*
          - packages/macro-rs/**/*
          - Cargo.toml
          - Cargo.lock
      when: always
  script:
    - curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C /usr/local/cargo/bin
    - pnpm install --frozen-lockfile
    - mkdir packages/backend-rs/built
    - cp packages/backend-rs/index.js packages/backend-rs/built/index.js
    - cp packages/backend-rs/index.d.ts packages/backend-rs/built/index.d.ts
    - pnpm --filter='!backend-rs' run build:debug
    - cargo test --doc
    - cargo nextest run

cargo:clippy:
  stage: test
  rules:
    - if: $TEST == 'false'
      when: never
    - if: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == 'main'
      when: never
    - if: $CI_COMMIT_BRANCH == 'develop' || $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        paths:
          - packages/backend-rs/**/*
          - packages/macro-rs/**/*
          - Cargo.toml
          - Cargo.lock
      when: always
  services: []
  before_script:
    - apt-get update && apt-get -y upgrade
    - apt-get install -y --no-install-recommends build-essential clang mold perl
    - cp ci/cargo/config.toml /usr/local/cargo/config.toml
    - rustup component add clippy
  script:
    - cargo clippy -- -D warnings

renovate:
  stage: dependency
  image:
    name: docker.io/renovate/renovate:37-slim
    entrypoint: [""]
  rules:
    - if: $RENOVATE && $CI_PIPELINE_SOURCE == 'schedule'
  services: []
  before_script: []
  script:
    - renovate --platform gitlab --token "${API_TOKEN}" --endpoint "${CI_SERVER_URL}/api/v4" "${CI_PROJECT_PATH}"

sast:
  stage: scan
  services: []
  before_script: []
  variables:
    SAST_EXCLUDED_PATHS: .git,.config,.gitlab,.vscode,ci,custom,dev,docs,locales,node_modules,target

container_scanning:
  stage: scan
  services: []
  before_script: []
  rules:
    - if: $BUILD == 'false'
      when: never
    - if: $CI_COMMIT_BRANCH == 'develop'
      changes:
        paths:
          - packages/**/*
          - locales/**/*
          - scripts/copy-assets.mjs
          - package.json
          - pnpm-lock.yaml
          - Cargo.toml
          - Cargo.lock
          - Dockerfile
          - .dockerignore
      when: always
  needs:
    - build:container
  variables:
    CS_IMAGE: "${CI_REGISTRY}/${CI_PROJECT_PATH}/develop:not-for-production"

include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Jobs/Container-Scanning.gitlab-ci.yml