.gitlab-ci.yml

---
stages:
  - codequality
  - test
  - build
  - post-build
  - pages

variables:
  APP_BUILD_VERSION: 0.0.0
  APP_BUILD_MODE: development
  POSTGRES_DB: flattrack
  POSTGRES_USER: flattrack
  POSTGRES_PASSWORD: flattrack
  EXTRA_REGISTRIES: docker.io
  IMAGE_NODE_ALPINE: docker.io/node:20-alpine3.20@sha256:09dbe0a53523c2482d85a037efc6b0e8e8bb16c6f1acf431fe36aa0ebc871c06
  IMAGE_GOLANG_ALPINE: docker.io/golang:1.23.2-alpine3.20
  IMAGE_PYTHON: docker.io/python:3.8-buster@sha256:04c3f641c2254c229fd2f704c5199ff4bea57d26c1c29008ae3a4afddde98709
  IMAGE_GOLANGCI_LINT: docker.io/golangci/golangci-lint:v1.61.0-alpine
  COSIGN_YES: "true"

.container-registry-login-dockerhub: &container-registry-login-dockerhub |
  mkdir -p $(getent passwd $(id -u) | cut -d ':' -f6)/.docker
  cat << EOF > $(getent passwd $(id -u) | cut -d ':' -f6)/.docker/config.json
  {
    "auths": {
      "https://index.docker.io/v1/": {
        "auth": "$DOCKERHUB_AUTH"
      }
    }
  }
  EOF

.image-set-build-env: &image-set-build-env |
  echo "Commit made on '${CI_COMMIT_TIMESTAMP}'"
  export APP_BUILD_HASH="$CI_COMMIT_SHORT_SHA"
  export APP_BUILD_DATE="$(git show -s --format=%cd --date=format:'%Y.%m.%d.%H%M')"
  export APP_BUILD_VERSION=0.0.0
  export APP_BUILD_MODE=staging
  export IMAGE_TAGS="latest"
  if [[ ! -z "$CI_COMMIT_TAG" ]]; then
    export APP_BUILD_VERSION="$CI_COMMIT_TAG"
    export APP_BUILD_MODE=production
    export IMAGE_TAGS="$APP_BUILD_VERSION"
  fi
  export VITE_APP_AppBuildVersion="$APP_BUILD_VERSION"
  export VITE_APP_AppBuildDate="$APP_BUILD_DATE"
  export VITE_APP_AppBuildHash="$APP_BUILD_HASH"
  export VITE_APP_AppBuildMode="$APP_BUILD_MODE"
  PROJECT_PATH=$(echo $CI_PROJECT_PATH | tr '[:upper:]' '[:lower:]')

.setup-testing-repo: &setup-testing-repo |
  echo 'https://dl-cdn.alpinelinux.org/alpine/edge/testing' | tee -a /etc/apk/repositories

.build-container: &build-container
  image:
    name: $IMAGE_GOLANG_ALPINE
    entrypoint: [""]
  retry: 2
  id_tokens:
    SIGSTORE_ID_TOKEN:
      aud: "sigstore"
  variables:
    KO_DOCKER_REPO: "$CI_REGISTRY_IMAGE"
  before_script:
    - set -x
    - *setup-testing-repo
    - apk add --no-cache curl cosign ko git crane
    - export KO_DOCKER_REPO="$(echo ${KO_DOCKER_REPO} | tr '[:upper:]' '[:lower:]')"
    - ko login "${CI_REGISTRY}" -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}"
    - *image-set-build-env
  script:
    - ./hack/publish.sh $PUBLISH_FLAGS

build-container-release:
  <<: *build-container
  stage: build
  only:
    refs:
      - main
      - tags
  variables:
    PUBLISH_FLAGS: "--sign"
  needs:
    - build-frontend-release

build-container-test:
  <<: *build-container
  stage: codequality
  variables:
    PUBLISH_FLAGS: "--tarball-test-only --debug"
  only:
    refs:
      - merge_requests
  needs:
    - build-frontend-test

copy-container-image-to-dockerhub:
  only:
    refs:
      - main
      - tags
  stage: post-build
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git cosign
    - cosign login "${CI_REGISTRY}" -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}"
    - *container-registry-login-dockerhub
    - *image-set-build-env
  script:
    - |
      [ -z "${EXTRA_REGISTRIES}" ] && exit 0
      for TAG in $(echo ${IMAGE_TAGS:-} | tr ',' ' '); do
        for REG in ${EXTRA_REGISTRIES}; do
          cosign copy --force "${CI_REGISTRY}/${PROJECT_PATH}:${TAG}" "${REG}/${PROJECT_PATH}:${TAG}"
        done
      done

.build-frontend: &build-frontend
  retry: 2
  image: $IMAGE_NODE_ALPINE
  before_script:
    - *image-set-build-env
    - cd web
    - apk add --no-cache make g++
    - npm i
  script:
    - npm run build
  artifacts:
    expire_in: 1 day
    paths:
      - kodata/web
      - flattrack*/

build-frontend-release:
  <<: *build-frontend
  stage: build
  only:
    refs:
      - main
      - tags

build-frontend-test:
  <<: *build-frontend
  stage: codequality
  only:
    refs:
      - merge_requests

test-backend-e2e:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  variables:
    POSTGRES_DB: flattrack
    POSTGRES_USER: flattrack
    POSTGRES_PASSWORD: flattrack
    POSTGRES_HOST_AUTH_METHOD: trust
    APP_DB_HOST: postgres
    APP_DB_USERNAME: flattrack
    APP_DB_PASSWORD: flattrack
    APP_DB_DATABASE: flattrack
    APP_MINIO_HOST: minio:9000
    APP_MINIO_ACCESS_KEY: minioadmin
    APP_MINIO_SECRET_KEY: minioadmin
    APP_MINIO_BUCKET: flattrack
    APP_MINIO_USE_SSL: "false"
    CGO_ENABLED: "0"
  services:
    - name: postgres:16.1-alpine3.19
      alias: postgres
    - name: minio/minio:RELEASE.2023-06-29T05-12-28Z
      alias: minio
      command:
        - server
        - /data
  before_script:
    - apk add --no-cache git gcc curl
    - go install github.com/onsi/ginkgo/ginkgo@v1.16.5
    - go build -o ./bin/flattrack main.go
    - ./bin/flattrack &
    - until curl -s http://localhost:8080; do echo "Waiting for API"; sleep 1s; done
  script:
    - ginkgo -r --randomizeAllSpecs --randomizeSuites --failOnPending --cover --trace --progress test/backend/e2e
    - pkill flattrack || true

build-backend-smoketest:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-build-smoketest.sh

spellcheck:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  allow_failure: true
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-spellcheck.sh

govet:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-govet.sh

gofmt:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-gofmt.sh

goimports:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-goimports.sh

golangci-lint:
  only:
    refs:
      - merge_requests
  stage: codequality
  image:
    name: $IMAGE_GOLANGCI_LINT
    entrypoint: [""]
  script:
    - ./hack/verify-golangci-lint.sh

govulncheck:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-govulncheck.sh

lint-frontend:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_NODE_ALPINE
  allow_failure: true
  before_script:
    - cd web
    - apk add --no-cache make g++
    - npm i
  script:
    - npm run lint

lint-backend:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  allow_failure: true
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-lint-backend.sh

verify-documented-env-vars:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-documented-env-vars.sh

check-links:
  only:
    refs:
      - merge_requests
  stage: codequality
  image:
    name: docker.io/lycheeverse/lychee:sha-a7c11c9-alpine
    entrypoint: [""]
  script:
    - ./hack/check-links.sh

pages:
  image: $IMAGE_PYTHON
  stage: pages
  script:
    ./hack/build-docs.sh
  artifacts:
    paths:
      - public
  only:
    - main

pages-smoketest:
  only:
    refs:
      - merge_requests
  image: $IMAGE_PYTHON
  stage: codequality
  script:
    ./hack/build-docs.sh

conform:
  stage: codequality
  only:
    refs:
      - merge_requests
  image:
    name: docker.io/library/alpine:3.18
    entrypoint: [""]
  before_script:
    - apk add --no-cache curl git
    - git fetch origin
    - |
      curl -sSL \
        -o /usr/local/bin/conform \
        https://github.com/siderolabs/conform/releases/download/v0.1.0-alpha.27/conform-linux-amd64
    - chmod +x /usr/local/bin/conform
  script:
    - conform enforce --commit-ref=refs/remotes/origin/main