.gitlab-ci.yml

spec:
  inputs:
    build-linux:
      default: true
      description: 'Build Linux (ignored on master)?'
      type: boolean
    build-windows:
      default: true
      description: 'Build Windows (ignored on master)?'
      type: boolean
    build-macos-amd64:
      default: true
      description: 'Build macOS AMD64 (ignored on master)?'
      type: boolean
    build-macos-arm:
      default: true
      description: 'Build macOS ARM (ignored on master)?'
      type: boolean
    build-ci:
      default: false
      description: 'Build CI image?'
      type: boolean
    build-server-images:
      default: false
      description: 'Build MIRO Server images and push to registry.gams.com (tagged as unstable on develop and feature on feature branches) (always built on master)?'
      type: boolean
    force-build-linux-builder:
      default: false
      description: 'Build Linux build image even when Dockerfile did not change?'
      type: boolean
    force-build-windows-builder:
      default: false
      description: 'Build Windows build image even when Dockerfile did not change?'
      type: boolean
    force-release:
      default: false
      description: 'Force release even if tests fail?'
      type: boolean
    skip-tests:
      default: false
      description: 'Skip tests on branch pipelines?'
      type: boolean
    run-tests-master:
      default: false
      description: 'Run tests on master branch (default is no as tests already ran on rc branch)?'
      type: boolean
    skip-notarization:
      default: false
      description: 'Skip notarization of macOS installer?'
      type: boolean
    max-test-failures:
      default: 1
      description: 'Maximum number of tests allowed to fail before the job fails'
      type: number
---
stages:
  - prepare
  - build
  - test
  - deploy

include:
  - template: Security/Container-Scanning.gitlab-ci.yml

image:
  name: $CI_REGISTRY_IMAGE/gamsmiro-ci:latest

.assume_role_s3: &assume_role_s3
  - >
    STS=($(aws sts assume-role-with-web-identity
    --role-arn ${AWS_S3_ROLE_ARN}
    --role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}"
    --web-identity-token "$ID_TOKEN"
    --duration-seconds 3600
    --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]'
    --output text))
  - export AWS_ACCESS_KEY_ID="${STS[0]}"
  - export AWS_SECRET_ACCESS_KEY="${STS[1]}"
  - export AWS_SESSION_TOKEN="${STS[2]}"

.assume_role_s3_helm: &assume_role_s3_helm
  - >
    STS=($(aws sts assume-role-with-web-identity
    --role-arn ${AWS_S3_HELM_ROLE_ARN}
    --role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}"
    --web-identity-token "$ID_TOKEN"
    --duration-seconds 3600
    --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]'
    --output text))
  - export AWS_ACCESS_KEY_ID="${STS[0]}"
  - export AWS_SECRET_ACCESS_KEY="${STS[1]}"
  - export AWS_SESSION_TOKEN="${STS[2]}"

.assume_role_ecr: &assume_role_ecr
  - >
    STS=($(aws sts assume-role-with-web-identity
    --role-arn ${ECR_ROLE_ARN}
    --role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}"
    --web-identity-token "$ID_TOKEN"
    --duration-seconds 3600
    --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]'
    --output text))
  - export AWS_ACCESS_KEY_ID="${STS[0]}"
  - export AWS_SECRET_ACCESS_KEY="${STS[1]}"
  - export AWS_SESSION_TOKEN="${STS[2]}"

prepare_all:
  tags:
    - linux
  stage: prepare
  image: curlimages/curl
  script:
    - 'echo "Building on branch: $CI_COMMIT_BRANCH"'
    - >
      if [[ "$CI_COMMIT_BRANCH" == "master" ]]; then
        if [[ `grep -m 1 -e 'MIROVersion' src/app.R | cut -f2 -d'"' | cut -f3 -d'.'` -ge "999" ]]; then
          echo "Cannot build release with patch number greater than or equal to 999"
          exit 1
        fi
        if [[ `curl -s https://gams.com/miro/latest.ver` == `grep -m 1 -e 'MIROVersion' src/app.R | cut -f2 -d'"' | tr . ,` ]]; then
          echo "Cannot build the same release twice. Please update version number"
          exit 1
        fi
      fi
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: always
    - if: '$CI_COMMIT_BRANCH == "develop"'
      when: always
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - if: '$CI_PIPELINE_SOURCE == "web"'
    - when: manual

build_build_image_linux:
  tags:
    - linux
  image: docker:29-cli
  services:
    - docker:29-dind
  stage: prepare
  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
    - apk update && apk add jq
  script:
    - cd ci/linux
    - docker build -t $CI_REGISTRY_IMAGE/builder-linux:latest --build-arg R_BASE_VERSION=`jq -r ".rVersion" ../../build-config.json` --build-arg OPENSSL_VERSION=`jq -r ".opensslVersion" ../../build-config.json` --build-arg GAMS_VERSION_FULL=`jq -r ".gamsVersion" ../../build-config.json` .
    - docker push $CI_REGISTRY_IMAGE/builder-linux:latest
  rules:
    - if: '"$[[ inputs.force-build-linux-builder ]]" == "true"'
    - if: '$CI_PIPELINE_SOURCE != "push"'
      when: never
    - changes:
        paths:
          - ci/linux/Dockerfile
        compare_to: develop

build_build_image_windows:
  tags:
    - windows-shell
  stage: prepare
  before_script:
    - $env:CI_REGISTRY_PASSWORD | docker login $env:CI_REGISTRY -u $env:CI_REGISTRY_USER --password-stdin
  script:
    - $buildConfig=Get-Content build-config.json | ConvertFrom-Json
    - $rVersion=$buildConfig.rVersion
    - $gamsVersion=$buildConfig.gamsVersion
    - cd ci/windows
    - docker build -t $env:CI_REGISTRY_IMAGE/builder-windows:latest --build-arg R_VERSION=$rVersion --build-arg GAMS_VERSION=$gamsVersion .
    - docker push $env:CI_REGISTRY_IMAGE/builder-windows:latest
  after_script:
    - docker logout $env:CI_REGISTRY
  rules:
    - if: '"$[[ inputs.force-build-windows-builder ]]" == "true"'
    - if: '$CI_PIPELINE_SOURCE != "push"'
      when: never
    - changes:
        paths:
          - ci/windows/Dockerfile
        compare_to: develop

lint_job:
  tags:
    - linux
  stage: test
  before_script:
    - mkdir -p $R_CACHE_ROOTPATH
    - git config --global --add safe.directory "$CI_PROJECT_DIR"
    - yarn install --frozen-lockfile
  script:
    - pre-commit run --all-files
    - ./scripts/fix_copyright.sh
    - ./scripts/fix_whats_new.sh
  variables:
    PRE_COMMIT_HOME: ${CI_PROJECT_DIR}/.cache/pre-commit
    R_CACHE_ROOTPATH: ${PRE_COMMIT_HOME}/R.cache
  cache:
    - key:
        files:
          - yarn.lock
      paths:
        - node_modules/
  needs: []
  rules:
    - if: $CI_MERGE_REQUEST_ID
      when: always

build_linux_job:
  tags:
    - linux
  stage: build
  services:
    - docker:29-dind
  image: $CI_REGISTRY_IMAGE/builder-linux:latest
  variables:
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_VERIFY: 1
    DOCKER_TLS_CERTDIR: '/certs'
    DOCKER_CERT_PATH: '/certs/client'
    DOCKER_HOST: tcp://docker:2376
    GIT_SUBMODULE_STRATEGY: normal
    NODE_OPTIONS: --openssl-legacy-provider
  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
    - yarn install --frozen-lockfile
  script:
    - '[[ "$CI_COMMIT_BRANCH" != "master" ]] && [ "$[[ inputs.build-linux ]]" = false ] && [ "$[[ inputs.build-ci ]]" = false ] && [ "$[[ inputs.build-server-images ]]" = false ] && echo "Skipping Linux build" && exit 0'
    - yarn dist
    - >
      if [[ "$CI_COMMIT_BRANCH" == "master" ]]; then
        pushd server
            python3 miro_server.py build
            python3 miro_server.py push --unstable --custom-tag latest --registry "${CI_REGISTRY_IMAGE}"
        popd
      elif [[ "$CI_COMMIT_BRANCH" == "develop" ]] || [[ "$CI_COMMIT_BRANCH" == "rc" ]] || [[ "$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME" == "rc" ]]; then
        pushd server
            python3 miro_server.py build
            python3 miro_server.py push --unstable --custom-tag unstable --registry "${CI_REGISTRY_IMAGE}"
        popd
      elif $[[ inputs.build-server-images ]]; then
        pushd server
            python3 miro_server.py build
            python3 miro_server.py push --unstable --custom-tag feature --registry "${CI_REGISTRY_IMAGE}"
        popd
      elif $[[ inputs.build-ci ]]; then
        pushd server
          python3 miro_server.py build --module ui
        popd
      fi
    - >
      if $[[ inputs.build-ci ]]; then
        yarn docker-build-ci
        docker tag gamsmiro-ci $CI_REGISTRY_IMAGE/gamsmiro-ci:latest
        docker push $CI_REGISTRY_IMAGE/gamsmiro-ci:latest
        docker tag gamsmiro-server-ci $CI_REGISTRY_IMAGE/gamsmiro-server-ci:latest
        docker push $CI_REGISTRY_IMAGE/gamsmiro-server-ci:latest
      fi
  artifacts:
    paths:
      - r/
      - build/lib_devel
      - dist/*.AppImage
      - dist/*.deb
    expire_in: 1 day
  cache:
    - key: build-cache
      paths:
        - build/lib_devel/
    - key:
        files:
          - yarn.lock
      paths:
        - node_modules/
    - key:
        files:
          - src/package-lock.json
      paths:
        - src/node_modules/
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success
  needs: [prepare_all]

package_linux_job:
  tags:
    - linux
  stage: build
  needs: [build_linux_job]
  dependencies: [build_linux_job]
  script:
    - '[[ "$CI_COMMIT_BRANCH" != "master" ]] && [ "$[[ inputs.build-linux ]]" = false ] && [ "$[[ inputs.build-ci ]]" = false ] && [ "$[[ inputs.build-server-images ]]" = false ] && echo "Skipping Linux build" && exit 0'
    - mv dist/*.AppImage miro_linux_x86.AppImage
    - mv dist/*.deb miro_linux_x86.deb
  artifacts:
    paths:
      - miro_linux_x86.AppImage
      - miro_linux_x86.deb
    expose_as: 'Linux -x86_64-'
    expire_in: 1 week
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

dependency_scanning_js:
  tags:
    - linux
  stage: test
  script:
    - echo -n '{"launcher":' > npm-audit-report.json
    - npm i --package-lock-only --ignore-scripts --force
    - npm audit --omit=dev --json | tr -d '\n' >> npm-audit-report.json || true
    - echo -n ',"ui":' >> npm-audit-report.json
    - |
      pushd src
        npm audit --omit=dev --json | tr -d '\n' >> ../npm-audit-report.json || true
      popd
    - echo -n ',"server_admin":' >> npm-audit-report.json
    - |
      pushd server/admin
        npm i --package-lock-only --ignore-scripts
        npm audit --omit=dev --json | tr -d '\n' >> ../../npm-audit-report.json || true
      popd
    - echo -n '}' >> npm-audit-report.json
  artifacts:
    paths:
      - npm-audit-report.json
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

dependency_scanning_r:
  tags:
    - linux
  stage: test
  variables:
    GIT_SUBMODULE_STRATEGY: normal
  script:
    - Rscript scripts/checkVuln.R
  artifacts:
    paths:
      - r-audit-report.json
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

dependency_scanning_python:
  tags:
    - linux
  stage: test
  script:
    - pip-audit -r server/auth/requirements.txt -f json > audit-auth.json || true
    - python3 ./ci/create_pip_audit_report.py pip-audit-report.json audit-auth.json
  artifacts:
    paths:
      - pip-audit-report.json
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

container_scanning:
  tags:
    - linux
  variables:
    CS_DOCKERFILE_PATH: 'server/ui/Dockerfile'
    GIT_STRATEGY: 'fetch'
    CS_IGNORE_UNFIXED: 'true'
  before_script:
    - IMAGE_TAG="latest" && [[ "$CI_COMMIT_BRANCH" != "master" ]] && IMAGE_TAG="feature" && ([[ "$CI_COMMIT_BRANCH" == "develop" ]] || [[ "$CI_COMMIT_BRANCH" == "rc" ]] || [[ "$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME" == "rc" ]]) && IMAGE_TAG=unstable
    - export CS_IMAGE=$CI_REGISTRY_IMAGE/miro-ui:$IMAGE_TAG
  after_script:
    - cp gl-container-scanning-report.json gl-container-scanning-report-ui.json
  artifacts:
    paths:
      - gl-container-scanning-report-ui.json
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

container_scanning_admin:
  extends: container_scanning
  variables:
    CS_DOCKERFILE_PATH: 'server/admin/Dockerfile'
    GIT_STRATEGY: 'fetch'
    CS_IGNORE_UNFIXED: 'true'
  before_script:
    - IMAGE_TAG="latest" && [[ "$CI_COMMIT_BRANCH" != "master" ]] && IMAGE_TAG="feature" && ([[ "$CI_COMMIT_BRANCH" == "develop" ]] || [[ "$CI_COMMIT_BRANCH" == "rc" ]] || [[ "$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME" == "rc" ]]) && IMAGE_TAG=unstable
    - export CS_IMAGE=$CI_REGISTRY_IMAGE/miro-admin:$IMAGE_TAG
  after_script:
    - cp gl-container-scanning-report.json gl-container-scanning-report-admin.json
  artifacts:
    paths:
      - gl-container-scanning-report-admin.json
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

container_scanning_auth:
  extends: container_scanning
  variables:
    CS_DOCKERFILE_PATH: 'server/auth/Dockerfile'
    GIT_STRATEGY: 'fetch'
    CS_IGNORE_UNFIXED: 'true'
  before_script:
    - IMAGE_TAG="latest" && [[ "$CI_COMMIT_BRANCH" != "master" ]] && IMAGE_TAG="feature" && ([[ "$CI_COMMIT_BRANCH" == "develop" ]] || [[ "$CI_COMMIT_BRANCH" == "rc" ]] || [[ "$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME" == "rc" ]]) && IMAGE_TAG=unstable
    - export CS_IMAGE=$CI_REGISTRY_IMAGE/miro-auth:$IMAGE_TAG
  after_script:
    - cp gl-container-scanning-report.json gl-container-scanning-report-auth.json
  artifacts:
    paths:
      - gl-container-scanning-report-auth.json
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

container_scanning_proxy:
  extends: container_scanning
  variables:
    CS_DOCKERFILE_PATH: 'server/proxy/Dockerfile'
    GIT_STRATEGY: 'fetch'
  before_script:
    - IMAGE_TAG="latest" && [[ "$CI_COMMIT_BRANCH" != "master" ]] && IMAGE_TAG="feature" && ([[ "$CI_COMMIT_BRANCH" == "develop" ]] || [[ "$CI_COMMIT_BRANCH" == "rc" ]] || [[ "$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME" == "rc" ]]) && IMAGE_TAG=unstable
    - export CS_IMAGE=$CI_REGISTRY_IMAGE/miro-proxy:$IMAGE_TAG
  after_script:
    - cp gl-container-scanning-report.json gl-container-scanning-report-proxy.json
  artifacts:
    paths:
      - gl-container-scanning-report-proxy.json
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

container_scanning_sproxy:
  extends: container_scanning
  variables:
    CS_DOCKERFILE_PATH: 'server/docker-socket-proxy/Dockerfile'
    GIT_STRATEGY: 'fetch'
  before_script:
    - IMAGE_TAG="latest" && [[ "$CI_COMMIT_BRANCH" != "master" ]] && IMAGE_TAG="feature" && ([[ "$CI_COMMIT_BRANCH" == "develop" ]] || [[ "$CI_COMMIT_BRANCH" == "rc" ]] || [[ "$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME" == "rc" ]]) && IMAGE_TAG=unstable
    - export CS_IMAGE=$CI_REGISTRY_IMAGE/miro-sproxy:$IMAGE_TAG
  after_script:
    - cp gl-container-scanning-report.json gl-container-scanning-report-sproxy.json
  artifacts:
    paths:
      - gl-container-scanning-report-sproxy.json
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

container_scanning_db:
  extends: container_scanning
  variables:
    CS_IMAGE: 'postgres:16.1-alpine'
  after_script:
    - cp gl-container-scanning-report.json gl-container-scanning-report-db.json
  artifacts:
    paths:
      - gl-container-scanning-report-db.json
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

create_vulnerability_report:
  tags:
    - linux
  stage: test
  needs:
    - dependency_scanning_js
    - dependency_scanning_r
    - dependency_scanning_python
    - container_scanning
    - container_scanning_admin
    - container_scanning_auth
    - container_scanning_proxy
    - container_scanning_sproxy
  script:
    - python3 ci/create_vuln_report.py
  artifacts:
    paths:
      - ci-vuln-report.html
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

build_windows_job:
  tags:
    - windows
  stage: build
  image: $CI_REGISTRY_IMAGE/builder-windows:latest
  variables:
    GIT_SUBMODULE_STRATEGY: normal
  before_script:
    - yarn install --frozen-lockfile
  script:
    - 'if ("$env:CI_COMMIT_BRANCH" -ne "master" -and "$[[ inputs.build-windows ]]" -ceq "false") { "Skipping Windows build"; Exit }'
    - yarn dist
  artifacts:
    paths:
      - r/
      - build/lib_devel
      - dist/*.exe
    expire_in: 1 day
  cache:
    - key:
        files:
          - src/miro-pkg-lock.csv
      paths:
        - r
    - key: build-cache
      paths:
        - build/lib_devel/
    - key:
        files:
          - yarn.lock
      paths:
        - node_modules
    - key:
        files:
          - src/package-lock.json
      paths:
        - src/node_modules/
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success
  needs: [prepare_all]

package_windows_job:
  tags:
    - windows
  stage: build
  image: $CI_REGISTRY_IMAGE/builder-windows:latest
  needs: [build_windows_job]
  dependencies: [build_windows_job]
  script:
    - 'if ("$env:CI_COMMIT_BRANCH" -ne "master" -and "$[[ inputs.build-windows ]]" -ceq "false") { "Skipping Windows build"; Exit }'
    - |
      $src = Get-ChildItem -Path 'dist' -Filter '*.exe' -File | Select-Object -First 1
      Move-Item -LiteralPath $src.FullName -Destination 'miro_windows_x86.exe' -Force
  artifacts:
    paths:
      - miro_windows_x86.exe
    expire_in: 1 week
    expose_as: 'Windows -x86_64- Installer'
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

build_macos_job:
  tags:
    - macos
  stage: build
  variables:
    GIT_SUBMODULE_STRATEGY: normal
    SKIP_NOTARIZATION: '$[[ inputs.skip-notarization ]]'
  before_script:
    - yarn install --frozen-lockfile
  script:
    - '[[ "$CI_COMMIT_BRANCH" != "master" ]] && [ "$[[ inputs.build-macos-amd64 ]]" = false ] && echo "Skipping macOS build" && exit 0'
    - export PATH="/usr/bin:${PATH}"
    - yarn dist
  artifacts:
    paths:
      - r/
      - build/lib_devel
      - dist/*.dmg
    expire_in: 1 day
  cache:
    - key:
        files:
          - src/miro-pkg-lock.csv
      paths:
        - r
      policy: push
    - key: build-cache
      paths:
        - build/lib_devel/
    - key:
        files:
          - yarn.lock
      paths:
        - node_modules
    - key:
        files:
          - src/package-lock.json
      paths:
        - src/node_modules/
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success
  needs: [prepare_all]

package_macos_job:
  tags:
    - macos
  stage: build
  needs: [build_macos_job]
  dependencies: [build_macos_job]
  script:
    - '[[ "$CI_COMMIT_BRANCH" != "master" ]] && [ "$[[ inputs.build-macos-amd64 ]]" = false ] && echo "Skipping macOS build" && exit 0'
    - mv dist/*.dmg miro_macos_x86.dmg
  artifacts:
    paths:
      - miro_macos_x86.dmg
    expose_as: 'macOS -x86_64- DMG'
    expire_in: 1 week
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

build_macos_arm_job:
  tags:
    - macos-arm64
    - stan
  stage: build
  variables:
    GIT_SUBMODULE_STRATEGY: normal
    SKIP_NOTARIZATION: '$[[ inputs.skip-notarization ]]'
  before_script:
    - yarn install --frozen-lockfile
  script:
    - '[[ "$CI_COMMIT_BRANCH" != "master" ]] && [ "$[[ inputs.build-macos-arm ]]" = false ] && echo "Skipping macOS ARM build" && exit 0'
    - export PATH="/usr/bin:${PATH}"
    - yarn dist
    - mkdir dist/arm && mv dist/*.dmg dist/arm
  artifacts:
    paths:
      - r/
      - build/lib_devel
      - dist/arm/*.dmg
    expire_in: 1 day
  cache:
    - key:
        files:
          - src/miro-pkg-lock.csv
      paths:
        - r
      policy: push
    - key: build-cache
      paths:
        - build/lib_devel/
    - key:
        files:
          - yarn.lock
      paths:
        - node_modules
    - key:
        files:
          - src/package-lock.json
      paths:
        - src/node_modules/
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success
  needs: [prepare_all]

package_macos_arm_job:
  tags:
    - macos-arm64
    - stan
  stage: build
  needs: [build_macos_arm_job]
  dependencies: [build_macos_arm_job]
  script:
    - '[[ "$CI_COMMIT_BRANCH" != "master" ]] && [ "$[[ inputs.build-macos-arm ]]" = false ] && echo "Skipping macOS ARM build" && exit 0'
    - mv dist/arm/*.dmg miro_macos_arm.dmg
  artifacts:
    paths:
      - miro_macos_arm.dmg
    expose_as: 'macOS -arm64- DMG'
    expire_in: 1 week
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success

test_windows_job:
  tags:
    - windows
  stage: test
  image: $CI_REGISTRY_IMAGE/builder-windows:latest
  parallel: 4
  retry: 1
  variables:
    MIRO_MAX_TEST_FAILURES: '$[[ inputs.max-test-failures ]]'
  before_script:
    - yarn install --frozen-lockfile
    - $env:FORCE_RELEASE = if ("$[[ inputs.force-release ]]" -ceq "true") { "yes" } else { "no" }
  script:
    - 'if ("$[[ inputs.skip-tests ]]" -ceq "true") { "Skipping tests"; Exit }'
    - 'if ("$env:CI_COMMIT_BRANCH" -eq "master" -and "$[[ inputs.run-tests-master ]]" -ceq "false") { "Skipping tests on master"; Exit }'
    - 'if ("$env:CI_COMMIT_BRANCH" -ne "master" -and "$[[ inputs.build-windows ]]" -ceq "false") { "Skipping Windows build"; Exit }'
    - |
      if ($env:CI_NODE_INDEX -eq 1) {
        cd dist
        $installer = Get-ChildItem *.exe | Select-Object -First 1
        echo "Using installer: $installer"
        Start-Process -FilePath $installer -ArgumentList '/S' -Wait
        cd ..
        $env:MIRO_EXEC_PATH="C:\Users\ContainerAdministrator\AppData\Local\Programs\GAMS MIRO\GAMS MIRO.exe"
        yarn playwright test
      }
    - yarn test gams_sys_dir=$env:GAMS_SYS_DIR
  dependencies: [build_windows_job]
  cache:
    - key:
        files:
          - src/miro-pkg-lock.csv
      paths:
        - r
      policy: pull
    - key: build-cache
      paths:
        - build/lib_devel/
      policy: pull
    - key:
        files:
          - yarn.lock
      paths:
        - node_modules/
      policy: pull
  artifacts:
    when: always
    reports:
      junit: src/test-out.xml
    paths:
      - src/tests/testthat/_snaps
      - src/tests/logs-tests
    expire_in: 1 week
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success
  needs: [build_windows_job]

test_macos_job:
  tags:
    - macos
  stage: test
  parallel: 4
  retry: 1
  variables:
    LANG: en_US.UTF-8
    LC_ALL: en_US.UTF-8
    MIRO_MAX_TEST_FAILURES: '$[[ inputs.max-test-failures ]]'
  before_script:
    - yarn install --frozen-lockfile
    - export FORCE_RELEASE=$([ "$[[ inputs.force-release ]]" = true ] && echo "yes" || echo "no")
  script:
    - '[ "$[[ inputs.skip-tests ]]" = true ] && echo "Skipping tests" && exit 0'
    - '[[ "$CI_COMMIT_BRANCH" == "master" ]] && [ "$[[ inputs.run-tests-master ]]" = false ] && echo "Skipping tests on master" && exit 0'
    - '[[ "$CI_COMMIT_BRANCH" != "master" ]] && [ "$[[ inputs.build-macos-amd64 ]]" = false ] && echo "Skipping macOS build" && exit 0'
    - |
      if [ "$CI_NODE_INDEX" -eq 1 ]; then
        mkdir -p tmp/mnt
        hdiutil attach dist/*.dmg -mountpoint tmp/mnt -nobrowse -quiet
        export MIRO_EXEC_PATH="${PWD}/tmp/mnt/GAMS MIRO.app/Contents/MacOS/GAMS MIRO"
        yarn playwright test
      fi
    - yarn test gams_sys_dir=${GAMS_PATH_MACOS}
  after_script:
    - hdiutil detach -force tmp/mnt
    - rm -rf $HOME/.miro
  dependencies: [build_macos_job]
  cache:
    - key:
        files:
          - src/miro-pkg-lock.csv
      paths:
        - r
      policy: pull
    - key: build-cache
      paths:
        - build/lib_devel/
      policy: pull
    - key:
        files:
          - yarn.lock
      paths:
        - node_modules/
      policy: pull
  artifacts:
    when: always
    reports:
      junit: src/test-out.xml
    paths:
      - src/tests/testthat/_snaps
      - src/tests/logs-tests
    expire_in: 1 week
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success
  needs: [build_macos_job]

test_macos_arm_job:
  tags:
    - macos-arm64
  stage: test
  parallel: 4
  retry: 1
  variables:
    LANG: en_US.UTF-8
    LC_ALL: en_US.UTF-8
    MIRO_MAX_TEST_FAILURES: '$[[ inputs.max-test-failures ]]'
  before_script:
    - yarn install --frozen-lockfile
    - export FORCE_RELEASE=$([ "$[[ inputs.force-release ]]" = true ] && echo "yes" || echo "no")
  script:
    - '[ "$[[ inputs.skip-tests ]]" = true ] && echo "Skipping tests" && exit 0'
    - '[[ "$CI_COMMIT_BRANCH" == "master" ]] && [ "$[[ inputs.run-tests-master ]]" = false ] && echo "Skipping tests on master" && exit 0'
    - '[[ "$CI_COMMIT_BRANCH" != "master" ]] && [ "$[[ inputs.build-macos-arm ]]" = false ] && echo "Skipping macOS ARM build" && exit 0'
    - |
      if [ "$CI_NODE_INDEX" -eq 1 ]; then
        mkdir -p tmp/mnt
        hdiutil attach dist/arm/*.dmg -mountpoint tmp/mnt -nobrowse -quiet
        export MIRO_EXEC_PATH="${PWD}/tmp/mnt/GAMS MIRO.app/Contents/MacOS/GAMS MIRO"
        yarn playwright test
      fi
    - rm -f "/Users/gitlab/Library/Application Support/Chromium/SingletonLock"
    - yarn test gams_sys_dir=${GAMS_PATH_MACOS_ARM}
  after_script:
    - hdiutil detach -force tmp/mnt
    - rm -rf $HOME/.miro
  dependencies: [build_macos_arm_job]
  cache:
    - key:
        files:
          - src/miro-pkg-lock.csv
      policy: pull
      paths:
        - r
    - key: build-cache
      paths:
        - build/lib_devel/
      policy: pull
    - key:
        files:
          - yarn.lock
      paths:
        - node_modules/
      policy: pull
  artifacts:
    when: always
    reports:
      junit: src/test-out.xml
    paths:
      - src/tests/testthat/_snaps
      - src/tests/logs-tests
    expire_in: 1 week
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success
  needs: [build_macos_arm_job]

test_job_api:
  tags:
    - linux
  stage: test
  image: docker:29-cli
  services:
    - name: docker:29-dind
    - name: postgres:16.1-alpine
      alias: postgres
  variables:
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_CERTDIR: '/certs'
    FF_NETWORK_PER_BUILD: 'true'
    GMS_MIRO_DATABASE_HOST: postgres
    GMS_MIRO_DATABASE: miroapitests
    GMS_MIRO_DATABASE_USER: mirotests
    GMS_MIRO_DATABASE_PWD: mirotests
    POSTGRES_DB: $GMS_MIRO_DATABASE
    POSTGRES_USER: $GMS_MIRO_DATABASE_USER
    POSTGRES_PASSWORD: $GMS_MIRO_DATABASE_PWD
    POSTGRES_HOST_AUTH_METHOD: trust
    PYTEST_JUNIT: 'report.xml'
    PYTEST_COV: 'coverage.xml'
  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
  script:
    - docker pull ${CI_REGISTRY_IMAGE}/miro-auth-test:unstable && docker tag ${CI_REGISTRY_IMAGE}/miro-auth-test:unstable miro-auth-test || exit 1
    - ./test/run-api-tests.sh
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "master"'
      when: on_success
    - if: $CI_MERGE_REQUEST_TITLE =~ /^Draft:/
      when: manual
    - if: $CI_MERGE_REQUEST_ID
  needs:
    - job: test_job_miro_server
      optional: true
  artifacts:
    when: always
    expire_in: 1 week
    reports:
      junit: $PYTEST_JUNIT
      coverage_report:
        coverage_format: cobertura
        path: $PYTEST_COV

test_job:
  tags:
    - linux
  stage: test
  parallel: 4
  retry: 1
  services:
    - name: postgres:16.1-alpine
  variables:
    MIRO_DB_TYPE: postgres
    MIRO_DB_HOST: postgres
    MIRO_DB_NAME: mirotests
    MIRO_DB_USERNAME: mirotests
    MIRO_DB_PASSWORD: mirotests
    POSTGRES_DB: $MIRO_DB_NAME
    POSTGRES_USER: $MIRO_DB_USERNAME
    POSTGRES_PASSWORD: $MIRO_DB_PASSWORD
    POSTGRES_HOST_AUTH_METHOD: trust
    GAMSPY_INTERPRETER_PATH: /usr/bin/python3
    MIRO_MAX_TEST_FAILURES: '$[[ inputs.max-test-failures ]]'
    PYTHON_EXEC_PATH: /usr/bin/python3
  before_script:
    - export FORCE_RELEASE=$([ "$[[ inputs.force-release ]]" = true ] && echo "yes" || echo "no")
    - source /etc/profile.d/ci.sh
  script:
    - mchecklic
    - mtestall
    - |
      max_mem_kb=$(cat "profile.txt" | grep "Maximum resident set size" | awk '{print $6}')
      max_mem_mb=$((max_mem_kb / 1024))
      echo "Maximum memory usage: $max_mem_mb MB"
  interruptible: true
  artifacts:
    when: always
    reports:
      junit: src/test-out.xml
    paths:
      - src/tests/testthat/_snaps
      - src/tests/logs-tests
    expire_in: 1 week
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "master"'
      when: on_success
    - if: $CI_MERGE_REQUEST_TITLE =~ /^Draft:/
      when: manual
    - if: $CI_MERGE_REQUEST_ID

test_job_gamspy:
  tags:
    - linux
  stage: test
  image: python:3.13
  before_script:
    - pip install --force-reinstall git+https://github.com/GAMS-dev/gamspy.git@develop
  script:
    - ./scripts/test_gamspy_models.sh
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "master"'
      when: on_success
    - if: $CI_MERGE_REQUEST_TITLE =~ /^Draft:/
      when: manual
    - if: $CI_MERGE_REQUEST_ID

test_job_miro_server:
  tags:
    - linux
  stage: test
  image: $CI_REGISTRY_IMAGE/gamsmiro-server-ci:latest
  retry: 1
  services:
    - docker:29-dind
    - selenium/standalone-chrome
  variables:
    MIRO_PROXY_URL: http://docker:8080
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_VERIFY: 1
    DOCKER_TLS_CERTDIR: '/certs'
    DOCKER_CERT_PATH: '/certs/client'
    DOCKER_HOST: tcp://docker:2376
    FF_NETWORK_PER_BUILD: 'true'
  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
  script:
    - '[ "$[[ inputs.skip-tests ]]" = true ] && echo "Skipping tests" && exit 0'
    - '[[ "$CI_COMMIT_BRANCH" == "master" ]] && [ "$[[ inputs.run-tests-master ]]" = false ] && echo "Skipping tests on master" && exit 0'
    - ./scripts/test_miro_server.sh
  dependencies: []
  artifacts:
    when: always
    paths:
      - miro_server_all_logs.txt
      - server/miro_server/logs/**
    expire_in: 1 week
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success
  needs: [build_linux_job]

test_job_miro_server_k8s:
  tags:
    - linux
  image: $CI_REGISTRY_IMAGE/gamsmiro-server-ci:latest
  stage: test
  retry: 1
  services:
    - docker:29-dind
    - selenium/standalone-chrome
  variables:
    MIRO_PROXY_URL: http://docker:30080
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_VERIFY: 1
    DOCKER_TLS_CERTDIR: '/certs'
    DOCKER_CERT_PATH: '/certs/client'
    DOCKER_HOST: tcp://docker:2376
    FF_NETWORK_PER_BUILD: 'true'
    PYTEST_JUNIT: 'report.xml'
    PYTEST_COV: 'coverage.xml'
  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
    - mkdir kind-logs
  script:
    - '[ "$[[ inputs.skip-tests ]]" = true ] && echo "Skipping tests" && exit 0'
    - '[[ "$CI_COMMIT_BRANCH" == "master" ]] && [ "$[[ inputs.run-tests-master ]]" = false ] && echo "Skipping tests on master" && exit 0'
    - export ENGINE_NS="${ENGINE_NS_2}"
    - ./scripts/test_miro_server_k8s.sh
  dependencies: []
  artifacts:
    when: always
    expire_in: 1 week
    paths:
      - ./kind-logs
    reports:
      junit: $PYTEST_JUNIT
      coverage_report:
        coverage_format: cobertura
        path: $PYTEST_COV
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "master"'
      when: never
    - when: on_success
  needs: [test_job_miro_server]

upload_cloudfront:
  tags:
    - linux
  stage: deploy
  image: $CI_REGISTRY_IMAGE/builder-linux:latest
  id_tokens:
    ID_TOKEN:
      aud: https://git.gams.com
  script:
    - *assume_role_s3
    - echo "MIRO_SHA_HASH_WIN=`sha256sum dist/*.exe |cut -d ' ' -f1`" > .hashes.txt
    - echo "MIRO_SHA_HASH_MAC_ARM=`sha256sum dist/arm/*.dmg |cut -d ' ' -f1`" >> .hashes.txt
    - echo "MIRO_SHA_HASH_MAC_X86=`sha256sum dist/*.dmg |cut -d ' ' -f1`" >> .hashes.txt
    - echo "MIRO_SHA_HASH_LINUX=`sha256sum dist/*.AppImage |cut -d ' ' -f1`" >> .hashes.txt
    - echo "MIRO_SHA_HASH_DEB_LINUX=`sha256sum dist/*.deb |cut -d ' ' -f1`" >> .hashes.txt
    - ./ci/s3_upload_artifacts.sh
  artifacts:
    paths:
      - .hashes.txt
    expire_in: 1 week
  rules:
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: on_success

upload_dockerhub:
  tags:
    - linux
  stage: deploy
  services:
    - docker:29-dind
  image: $CI_REGISTRY_IMAGE/builder-linux:latest
  id_tokens:
    ID_TOKEN:
      aud: https://git.gams.com
  variables:
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_VERIFY: 1
    DOCKER_TLS_CERTDIR: '/certs'
    DOCKER_CERT_PATH: '/certs/client'
    DOCKER_HOST: tcp://docker:2376
  before_script:
    - echo "$DOCKERHUB_PASS" | docker login -u $DOCKERHUB_USER --password-stdin
    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
    - aws configure set default.region us-east-1
    - *assume_role_ecr
    - aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin $ECR_REGISTRY_URL_US_EAST
  script:
    - echo -e "\e[0Ksection_start:`date +%s`:download_image_section[collapsed=true]\r\e[0KDownloading images section"
    - cd server && python3 miro_server.py download ${CI_REGISTRY_IMAGE} && cd ..
    - echo -e "\e[0Ksection_end:`date +%s`:download_image_section\r\e[0K"
    - >
      pushd server
        python3 miro_server.py push
        python3 miro_server.py push --registry "${ECR_REGISTRY_URL_US_EAST}"
      popd
  rules:
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: on_success

upload_helm_chart:
  tags:
    - linux
  image: $CI_REGISTRY_IMAGE/gamsmiro-server-ci:latest
  id_tokens:
    ID_TOKEN:
      aud: https://git.gams.com
  stage: deploy
  variables:
    CHART_DIR: 'server/kubernetes/gams-miro-server'
  before_script:
    - aws configure set default.region us-east-1
    - *assume_role_s3_helm
    - echo "$HELM_GPG_PRIVATE_KEY_ARMOR" > /tmp/priv.asc
    - export GNUPGHOME="${CI_PROJECT_DIR}/.gnupg"
    - mkdir -p "$GNUPGHOME" && chmod 700 "$GNUPGHOME"
    - gpg --batch --import /tmp/priv.asc
    - echo -e "5\ny\n" | gpg --command-fd 0 --expert --batch --edit-key "$HELM_GPG_KEY_FPR" trust quit
    - gpg --export > "${GNUPGHOME}/pubring.gpg"
    - gpg --export-secret-keys --pinentry-mode loopback --passphrase "$HELM_GPG_PASSPHRASE" > "${GNUPGHOME}/secring.gpg"
    - gpg --list-secret-keys --keyid-format LONG
  script:
    - helm dependency update "$CHART_DIR" || true
    - helm lint "$CHART_DIR" || true
    - echo -n "$HELM_GPG_PASSPHRASE" > /tmp/helm-passphrase.txt
    - chmod 600 /tmp/helm-passphrase.txt
    - |
      helm package --sign "$CHART_DIR" \
        --key "${HELM_GPG_KEY_NAME}" \
        --keyring "${GNUPGHOME}/secring.gpg" \
        --passphrase-file /tmp/helm-passphrase.txt
    - |
      for f in ./*.tgz ./*.tgz.prov; do
        [ -f "$f" ] || continue;
        echo "Uploading $f";
        aws s3 cp "$f" "s3://${HELM_REPO_S3_BUCKET}/" \
          --cache-control "public, max-age=31536000, immutable" \
          --only-show-errors;
      done
    - ./ci/update-helm-index.sh
  artifacts:
    paths:
      - '*.tgz'
      - '*.tgz.prov'
      - index.yaml
    expire_in: 1 week
  dependencies: []
  rules:
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: on_success

update_saas:
  stage: deploy
  trigger:
    project: miro/miro-saas
  needs: [upload_dockerhub]
  rules:
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: on_success

update_gallery:
  stage: deploy
  trigger:
    project: miro/miro-gallery
  needs: [upload_dockerhub]
  rules:
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: on_success

update_doc_job_release:
  tags:
    - linux
  stage: deploy
  services:
    - docker:29-dind
  image: $CI_REGISTRY_IMAGE/builder-linux:latest
  variables:
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_VERIFY: 1
    DOCKER_TLS_CERTDIR: '/certs'
    DOCKER_CERT_PATH: '/certs/client'
    DOCKER_HOST: tcp://docker:2376
  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
    - git config --global user.email "puma@noreply.gams.com"
    - git config --global user.name "Gitlab Runner (puma)"
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - printf '#!/bin/sh\necho "$SSH_PRIVATE_KEY_GAMSCOM_PASSPHRASE"' > ~/.ssh/.print_ssh_password
    - chmod 700 ~/.ssh/.print_ssh_password
    - chmod +x ~/.ssh/.print_ssh_password
    - echo "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
    - chmod 644 ~/.ssh/known_hosts
    - eval $(ssh-agent -s)
    - echo "$SSH_PRIVATE_KEY_GAMSCOM" | tr -d '\r' | DISPLAY=":0.0" SSH_ASKPASS=~/.ssh/.print_ssh_password setsid ssh-add - > /dev/null
  script:
    - docker pull ${CI_REGISTRY_IMAGE}/miro-auth:latest && docker tag ${CI_REGISTRY_IMAGE}/miro-auth:latest miro-auth || exit 1
    - ./ci/push_docs.sh
    - ./ci/update_website.sh
  dependencies: [upload_cloudfront]
  needs: [upload_cloudfront, upload_dockerhub]
  rules:
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: on_success

update_doc_job:
  tags:
    - linux
  stage: deploy
  before_script:
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - printf '#!/bin/sh\necho "$SSH_PRIVATE_KEY_GAMSCOM_STAGING_PASSPHRASE"' > ~/.ssh/.print_ssh_password
    - chmod 700 ~/.ssh/.print_ssh_password
    - chmod +x ~/.ssh/.print_ssh_password
    - echo "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
    - chmod 644 ~/.ssh/known_hosts
    - eval $(ssh-agent -s)
    - echo "$SSH_PRIVATE_KEY_GAMSCOM_STAGING" | tr -d '\r' | DISPLAY=":0.0" SSH_ASKPASS=~/.ssh/.print_ssh_password setsid ssh-add - > /dev/null
  script:
    - rsync -Orlptvz doc/* staging@gams.com:/var/www/html/staging.gams.com/public_html/miro
  rules:
    - if: $CI_MERGE_REQUEST_ID
      when: always
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: always
    - if: '$CI_COMMIT_BRANCH == "develop"'
      when: always
    - when: manual
    - allow_failure: true
  needs: []