.gitlab-ci.yml

---
stages:
  - codequality
  - test
  - build
  - post-build
  - pages

include:
  template: Dependency-Scanning.gitlab-ci.yml

variables:
  APP_BUILD_VERSION: 0.0.0
  APP_BUILD_MODE: development
  POSTGRES_DB: flattrack
  POSTGRES_USER: flattrack
  POSTGRES_PASSWORD: flattrack
  EXTRA_REGISTRIES: docker.io
  IMAGE_DENO_ALPINE: docker.io/denoland/deno:alpine-2.5.4@sha256:9b5cfe963dc3ee97dde39c7b29989709de34b11fc72565ee8fe223a43d08c4a6
  IMAGE_GOLANG_ALPINE: docker.io/golang:1.25.5-alpine3.22@sha256:3587db7cc96576822c606d119729370dbf581931c5f43ac6d3fa03ab4ed85a10
  IMAGE_GOLANGCI_LINT: docker.io/golangci/golangci-lint:v2.6.2-alpine@sha256:a3abd55b17a74e36703f3d27e8183958b8bee15a1b1ffb25529192e114e0edbe
  IMAGE_PYTHON: docker.io/python:3.13.2-alpine3.21@sha256:323a717dc4a010fee21e3f1aac738ee10bb485de4e7593ce242b36ee48d6b352
  IMAGE_LYCHEE: docker.io/lycheeverse/lychee:sha-469ccd0-alpine@sha256:41e05e0a9effda7b1fabbf94d26d888327517dc21d320f577fcce10eec7b3eca
  IMAGE_POSTGRES: docker.io/postgres:18.0-alpine3.22@sha256:48c8ad3a7284b82be4482a52076d47d879fd6fb084a1cbfccbd551f9331b0e40
  IMAGE_MINIO: quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z
  IMAGE_CONFORM: registry.gitlab.com/bobymcbobs/container-images/conform:v1753521600-daa77a05@sha256:3142518fe8224247f53665b9082220fb557c14b617f9a4530384c3e121958acf
  IMAGE_ORAS: ghcr.io/oras-project/oras:v1.3.0@sha256:6ce045ce069a89934d6666b8b49f9c4c0145201bd6de6dbe2aee267814c55468
  IMAGE_RELEASE_CLI: registry.gitlab.com/gitlab-org/cli:v1.80.4@sha256:212c2ea8bb59382b7b6e6527a3ae4873ce5792d415f34dac97b2efa6adcaf6f9
  COSIGN_YES: "true"

.container-registry-login-dockerhub: &container-registry-login-dockerhub |
  mkdir -p $(getent passwd $(id -u) | cut -d ':' -f6)/.docker
  cat << EOF > $(getent passwd $(id -u) | cut -d ':' -f6)/.docker/config.json
  {
    "auths": {
      "https://index.docker.io/v1/": {
        "auth": "$DOCKERHUB_AUTH"
      }
    }
  }
  EOF

.image-set-build-env: &image-set-build-env |
  echo "Commit made on '${CI_COMMIT_TIMESTAMP}'"
  export APP_BUILD_HASH="$CI_COMMIT_SHORT_SHA"
  export APP_BUILD_DATE="$(git show -s --format=%cd --date=format:'%Y.%m.%d.%H%M')"
  export APP_BUILD_VERSION=0.0.0
  export APP_BUILD_MODE=staging
  export IMAGE_TAGS="latest"
  if [[ ! -z "$CI_COMMIT_TAG" ]]; then
    export APP_BUILD_VERSION="$CI_COMMIT_TAG"
    export APP_BUILD_MODE=production
    export IMAGE_TAGS="$APP_BUILD_VERSION"
  fi
  export VITE_APP_AppBuildVersion="$APP_BUILD_VERSION"
  export VITE_APP_AppBuildDate="$APP_BUILD_DATE"
  export VITE_APP_AppBuildHash="$APP_BUILD_HASH"
  export VITE_APP_AppBuildMode="$APP_BUILD_MODE"
  PROJECT_PATH=$(echo $CI_PROJECT_PATH | tr '[:upper:]' '[:lower:]')

.setup-testing-repo: &setup-testing-repo |
  echo 'https://dl-cdn.alpinelinux.org/alpine/edge/testing' | tee -a /etc/apk/repositories

.setup-community-repo: &setup-community-repo |
  echo 'https://dl-cdn.alpinelinux.org/alpine/edge/community' | tee -a /etc/apk/repositories

.build-container: &build-container
  image:
    name: $IMAGE_GOLANG_ALPINE
    entrypoint: [""]
  retry: 2
  id_tokens:
    SIGSTORE_ID_TOKEN:
      aud: "sigstore"
  variables:
    KO_DOCKER_REPO: "$CI_REGISTRY_IMAGE"
  before_script:
    - set -x
    - *setup-testing-repo
    - apk add --no-cache curl cosign ko git crane jq syft bash file tar gzip
    - export KO_DOCKER_REPO="$(echo ${KO_DOCKER_REPO} | tr '[:upper:]' '[:lower:]')"
    - ko login "${CI_REGISTRY}" -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}"
    - *image-set-build-env
  script:
    - ./hack/publish.sh $PUBLISH_FLAGS

build-container-release:
  <<: *build-container
  stage: build
  only:
    refs:
      - main
      - tags
  variables:
    PUBLISH_FLAGS: "--sign"
  needs:
    - build-frontend-release

build-container-test:
  <<: *build-container
  stage: codequality
  variables:
    PUBLISH_FLAGS: "--tarball-test-only --debug"
  only:
    refs:
      - merge_requests
  needs:
    - build-frontend-test

copy-container-image-to-dockerhub:
  only:
    refs:
      - main
      - tags
  stage: post-build
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git cosign
    - cosign login "${CI_REGISTRY}" -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}"
    - *container-registry-login-dockerhub
    - *image-set-build-env
  script:
    - |
      [ -z "${EXTRA_REGISTRIES}" ] && exit 0
      for TAG in $(echo ${IMAGE_TAGS:-} | tr ',' ' '); do
        for REG in ${EXTRA_REGISTRIES}; do
          cosign copy --force "${CI_REGISTRY}/${PROJECT_PATH}:${TAG}" "${REG}/${PROJECT_PATH}:${TAG}"
        done
      done

.build-frontend: &build-frontend
  retry: 2
  image: $IMAGE_DENO_ALPINE
  before_script:
    - *image-set-build-env
    - cd web
  script:
    - deno task build
  artifacts:
    expire_in: 1 day
    paths:
      - kodata/web
      - flattrack*/

build-frontend-release:
  <<: *build-frontend
  stage: build
  only:
    refs:
      - main
      - tags

build-frontend-test:
  <<: *build-frontend
  stage: codequality
  only:
    refs:
      - merge_requests

test-backend-e2e:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  variables:
    POSTGRES_DB: flattrack
    POSTGRES_USER: flattrack
    POSTGRES_PASSWORD: flattrack
    POSTGRES_HOST_AUTH_METHOD: trust
    APP_DB_HOST: postgres
    APP_DB_USERNAME: flattrack
    APP_DB_PASSWORD: flattrack
    APP_DB_DATABASE: flattrack
    APP_MINIO_HOST: minio:9000
    APP_MINIO_ACCESS_KEY: minioadmin
    APP_MINIO_SECRET_KEY: minioadmin
    APP_MINIO_BUCKET: flattrack
    APP_MINIO_USE_SSL: "false"
    CGO_ENABLED: "0"
  services:
    - name: $IMAGE_POSTGRES
      alias: postgres
    - name: $IMAGE_MINIO
      alias: minio
      command:
        - server
        - /data
  before_script:
    - apk add --no-cache git gcc curl
    - go install github.com/onsi/ginkgo/ginkgo@v1.16.5
    - go build -o ./bin/flattrack main.go
    - ./bin/flattrack &
    - until curl -s http://localhost:8080; do echo "Waiting for API"; sleep 1s; done
  script:
    - ginkgo -r --randomizeAllSpecs --randomizeSuites --failOnPending --cover --trace --progress test/backend/e2e
    - pkill flattrack || true

build-backend-smoketest:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-build-smoketest.sh

spellcheck:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  allow_failure: true
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-spellcheck.sh

govet:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-govet.sh

gofmt:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-gofmt.sh

goimports:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-goimports.sh

golangci-lint:
  stage: codequality
  only:
    - merge_requests
  image:
    name: $IMAGE_GOLANGCI_LINT
    entrypoint: [""]
  script:
    - ./hack/verify-golangci-lint.sh

govulncheck:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-govulncheck.sh

lint-frontend:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_DENO_ALPINE
  allow_failure: true
  before_script:
    - cd web
  script:
    - deno task lint

lint-backend:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  allow_failure: true
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-lint-backend.sh

verify-documented-env-vars:
  only:
    refs:
      - merge_requests
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
  script:
    - ./hack/verify-documented-env-vars.sh

check-links:
  only:
    refs:
      - merge_requests
  stage: codequality
  image:
    name: $IMAGE_LYCHEE
    entrypoint: [""]
  script:
    - ./hack/check-links.sh

pages:
  image: $IMAGE_PYTHON
  stage: pages
  script: ./hack/build-docs.sh
  artifacts:
    paths:
      - public
  only:
    - main

pages-smoketest:
  only:
    refs:
      - merge_requests
  image: $IMAGE_PYTHON
  stage: codequality
  script: ./hack/build-docs.sh

conform:
  only:
    refs:
      - merge_requests
  stage: codequality
  image:
    name: $IMAGE_CONFORM
    entrypoint: [""]
  before_script:
    - git fetch origin
  script:
    - /conform enforce --commit-ref=refs/remotes/origin/main

push-artifacthub-yml:
  only:
    refs:
      - main
  stage: build
  image:
    name: $IMAGE_ORAS
    entrypoint: [""]
  before_script:
    - oras login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
  script:
    - |
      oras push \
        registry.gitlab.com/flattrack/flattrack:artifacthub.io \
        --config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
        artifacthub-repo.yml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml

make-release:
  stage: build
  rules:
    - if: $CI_COMMIT_TAG
  image: $IMAGE_RELEASE_CLI
  before_script:
    - *setup-testing-repo
    - *setup-community-repo
    - apk add --no-cache git git-cliff bash kustomize
  script:
    - echo "Release $CI_COMMIT_TAG"
    - git cliff --latest > ./changelog.md
  release:
    tag_name: "$CI_COMMIT_TAG"
    description: "./changelog.md"
    ref: "$CI_COMMIT_SHA"