# You can override the included template(s) by including variable overrides
# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
# Note that environment variables can be set in several places
# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
cache:
  key: one-key-to-rule-them-all
build:docker:
  image: docker:dind
  interruptible: true
  stage: build
  rules:
  - if: "$CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH"
    changes:
    - app/**/*
    - Dockerfile
  - if: "$CI_PIPELINE_SOURCE == 'merge_request_event'"
  tags:
  - docker
  before_script:
  - echo "COMMIT=${CI_COMMIT_SHA}" >> version.env
  script:
  - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  - docker build . --tag ${CI_REGISTRY}/${CI_PROJECT_PATH}/${CI_BUILD_REF_NAME}:${CI_BUILD_REF}
  - docker push ${CI_REGISTRY}/${CI_PROJECT_PATH}/${CI_BUILD_REF_NAME}:${CI_BUILD_REF}
build:apt:
  image: debian:bookworm-slim
  interruptible: true
  stage: build
  rules:
  - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
  - if: "$CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH"
    changes:
    - app/**/*
    - ".DEBIAN/**/*"
  - if: "$CI_PIPELINE_SOURCE == 'merge_request_event'"
  before_script:
  - echo "COMMIT=${CI_COMMIT_SHA}" >> version.env
  - source version.env
  - apt-get update -qq && apt-get install -qq -y build-essential
  - mkdir build
  - cp -r .DEBIAN build/DEBIAN
  - chmod -R 0775 build/DEBIAN
  - mkdir -p build/usr/share/fastapi-dls
  - cp -r app build/usr/share/fastapi-dls
  - cp README.md version.env build/usr/share/fastapi-dls
  - mkdir -p build/etc/fastapi-dls
  - cp .DEBIAN/env.default build/etc/fastapi-dls/env
  - mkdir -p build/etc/systemd/system
  - cp .DEBIAN/fastapi-dls.service build/etc/systemd/system/fastapi-dls.service
  - cd build/
  script:
  - sed -i -E 's/(Version\:\s)0.0/\1'"$VERSION"'/g' DEBIAN/control
  - dpkg -b . build.deb
  - dpkg -I build.deb
  artifacts:
    expire_in: 1 week
    paths:
    - build/build.deb
build:pacman:
  image: archlinux:base-devel
  interruptible: true
  stage: build
  rules:
  - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
  - if: "$CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH"
    changes:
    - app/**/*
    - ".PKGBUILD/**/*"
  - if: "$CI_PIPELINE_SOURCE == 'merge_request_event'"
  before_script:
  - echo "COMMIT=${CI_COMMIT_SHA}" >> version.env
  - pacman -Syu --noconfirm git
  - useradd --no-create-home --shell=/bin/false build && usermod -L build
  - 'echo "build ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers'
  - 'echo "root ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers'
  - chown -R build:build .
  - mv .PKGBUILD/* .
  script:
  - pwd
  - source PKGBUILD && pacman -Syu --noconfirm --needed --asdeps "${makedepends[@]}"
    "${depends[@]}"
  - sudo -u build makepkg -s
  artifacts:
    expire_in: 1 week
    paths:
    - "*.pkg.tar.zst"
test:
  image: python:3.11-slim-bullseye
  stage: test
  rules:
  - if: "$CI_COMMIT_BRANCH"
  - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  variables:
    DATABASE: sqlite:///../app/db.sqlite
  before_script:
  - pip install -r requirements.txt
  - pip install pytest httpx
  - mkdir -p app/cert
  - openssl genrsa -out app/cert/instance.private.pem 2048
  - openssl rsa -in app/cert/instance.private.pem -outform PEM -pubout -out app/cert/instance.public.pem
  - cd test
  script:
  - pytest main.py
  artifacts:
    reports:
      dotenv: version.env
".test:linux":
  stage: test
  rules:
  - if: "$CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH"
    changes:
    - app/**/*
    - ".DEBIAN/**/*"
  - if: "$CI_PIPELINE_SOURCE == 'merge_request_event'"
  needs:
  - job: build:apt
    artifacts: true
  variables:
    DEBIAN_FRONTEND: noninteractive
  before_script:
  - apt-get update -qq && apt-get install -qq -y jq curl
  script:
  - apt-get install -q -y ./build/build.deb --fix-missing
  - openssl req -x509 -newkey rsa:2048 -nodes -out /etc/fastapi-dls/webserver.crt
    -keyout /etc/fastapi-dls/webserver.key -days 7 -subj "/C=DE/O=GitLab-CI/OU=Test/CN=localhost"
  - cd /usr/share/fastapi-dls/app
  - uvicorn main:app --host 127.0.0.1 --port 443 --app-dir /usr/share/fastapi-dls/app
    --ssl-keyfile /etc/fastapi-dls/webserver.key --ssl-certfile /etc/fastapi-dls/webserver.crt
    --proxy-headers &
  - FASTAPI_DLS_PID=$!
  - echo "Started service with pid $FASTAPI_DLS_PID"
  - cat /etc/fastapi-dls/env
  - if [ "`curl --insecure -s https://127.0.0.1/-/health | jq .status`" != "up" ];
    then echo "Success"; else "Error"; fi
  - kill $FASTAPI_DLS_PID
  - apt-get purge -qq -y fastapi-dls
  - apt-get autoremove -qq -y && apt-get clean -qq
test:debian:
  extends: ".test:linux"
  image: debian:bookworm-slim
test:ubuntu:
  extends: ".test:linux"
  image: ubuntu:22.10
test:archlinux:
  image: archlinux:base
  rules:
  - if: "$CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH"
    changes:
    - app/**/*
    - ".PKGBUILD/**/*"
  - if: "$CI_PIPELINE_SOURCE == 'merge_request_event'"
  needs:
  - job: build:pacman
    artifacts: true
  script:
  - pacman -Sy
  - pacman -U --noconfirm *.pkg.tar.zst
".deploy":
  rules:
  - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
  - if: "$CI_COMMIT_TAG"
    when: never
deploy:docker:
  extends: ".deploy"
  stage: deploy
  rules:
  - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
  before_script:
  - echo "COMMIT=${CI_COMMIT_SHA}" >> version.env
  - source version.env
  - echo "Building docker image for commit ${COMMIT} with version ${VERSION}"
  script:
  - echo "GitLab-Registry"
  - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  - docker build . --tag ${CI_REGISTRY}/${CI_PROJECT_PATH}/${CI_BUILD_REF_NAME}:${VERSION}
  - docker build . --tag ${CI_REGISTRY}/${CI_PROJECT_PATH}/${CI_BUILD_REF_NAME}:latest
  - docker push ${CI_REGISTRY}/${CI_PROJECT_PATH}/${CI_BUILD_REF_NAME}:${VERSION}
  - docker push ${CI_REGISTRY}/${CI_PROJECT_PATH}/${CI_BUILD_REF_NAME}:latest
  - echo "Docker-Hub"
  - docker login -u $PUBLIC_REGISTRY_USER -p $PUBLIC_REGISTRY_TOKEN
  - docker build . --tag $PUBLIC_REGISTRY_USER/${CI_PROJECT_NAME}:${VERSION}
  - docker build . --tag $PUBLIC_REGISTRY_USER/${CI_PROJECT_NAME}:latest
  - docker push $PUBLIC_REGISTRY_USER/${CI_PROJECT_NAME}:${VERSION}
  - docker push $PUBLIC_REGISTRY_USER/${CI_PROJECT_NAME}:latest
deploy:apt:
  extends: ".deploy"
  image: debian:bookworm-slim
  stage: deploy
  rules:
  - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
  needs:
  - job: build:apt
    artifacts: true
  before_script:
  - apt-get update -qq && apt-get install -qq -y curl lsb-release
  - CODENAME=`lsb_release -cs`
  - 'if [ "`curl -s -o /dev/null -w "%{http_code}" --header "JOB-TOKEN: $CI_JOB_TOKEN"
    -s ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/debian_distributions/${CODENAME}/key.asc`"
    != "200" ]; then curl --request POST --header "JOB-TOKEN: $CI_JOB_TOKEN" "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/debian_distributions?codename=${CODENAME}";
    fi'
  script:
  - BUILD_NAME=build/build.deb
  - PACKAGE_NAME=`dpkg -I ${BUILD_NAME} | grep "Package:" | awk '{ print $2 }'`
  - PACKAGE_VERSION=`dpkg -I ${BUILD_NAME} | grep "Version:" | awk '{ print $2 }'`
  - PACKAGE_ARCH=amd64
  - EXPORT_NAME="${PACKAGE_NAME}_${PACKAGE_VERSION}_${PACKAGE_ARCH}.deb"
  - mv ${BUILD_NAME} ${EXPORT_NAME}
  - 'echo "PACKAGE_NAME:    ${PACKAGE_NAME}"'
  - 'echo "PACKAGE_VERSION: ${PACKAGE_VERSION}"'
  - 'echo "PACKAGE_ARCH:    ${PACKAGE_ARCH}"'
  - 'echo "EXPORT_NAME:     ${EXPORT_NAME}"'
  - URL="${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/debian/${EXPORT_NAME}"
  - 'echo "URL:             ${URL}"'
  - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file ${EXPORT_NAME} "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/${PACKAGE_NAME}/${PACKAGE_VERSION}/${EXPORT_NAME}"'
deploy:pacman:
  extends: ".deploy"
  image: archlinux:base-devel
  stage: deploy
  rules:
  - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
  needs:
  - job: build:pacman
    artifacts: true
  script:
  - source .PKGBUILD/PKGBUILD
  - source version.env
  - BUILD_NAME=${pkgname}-${VERSION}-${pkgrel}-any.pkg.tar.zst
  - PACKAGE_NAME=${pkgname}
  - PACKAGE_VERSION=${VERSION}
  - PACKAGE_ARCH=any
  - EXPORT_NAME=${BUILD_NAME}
  - 'echo "PACKAGE_NAME:    ${PACKAGE_NAME}"'
  - 'echo "PACKAGE_VERSION: ${PACKAGE_VERSION}"'
  - 'echo "PACKAGE_ARCH:    ${PACKAGE_ARCH}"'
  - 'echo "EXPORT_NAME:     ${EXPORT_NAME}"'
  - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file ${EXPORT_NAME} "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/${PACKAGE_NAME}/${PACKAGE_VERSION}/${EXPORT_NAME}"'
release:
  image: registry.gitlab.com/gitlab-org/release-cli:latest
  stage: ".post"
  needs:
  - job: test
    artifacts: true
  rules:
  - if: "$CI_COMMIT_TAG"
    when: never
  - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
  script:
  - echo "Running release-job for $VERSION"
  release:
    name: "$CI_PROJECT_TITLE $VERSION"
    description: Release of $CI_PROJECT_TITLE version $VERSION
    tag_name: "$VERSION"
    ref: "$CI_COMMIT_SHA"
    assets:
      links:
      - name: Package Registry
        url: https://git.collinwebdesigns.de/oscar.krause/fastapi-dls/-/packages
      - name: Container Registry
        url: https://git.collinwebdesigns.de/oscar.krause/fastapi-dls/container_registry/40
include:
- template: Auto-DevOps.gitlab-ci.yml