.gitlab-ci.yml

image: eclipse-temurin:22-jdk

variables:
  ORG_GRADLE_PROJECT_ci: 'true'
  CI_DEBUG_SERVICES: "true"
  PROXY: $HTTPS_PROXY_HOST

# Verification (tests and code analysis) is unnecessary on 'develop' &
# 'main', because only verified MRs can be merged into those branches.
.verification:
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: never
    - if: $CI_COMMIT_BRANCH == "develop"
      when: never
    - when: on_success

stages:
  - build
  - check
  - docker_image
  - integration_test
  - deployment

workflow:
  rules:
    - if: $CI_MERGE_REQUEST_ID
      when: never
    - when: always


before_script:
  - GRADLE_USER_HOME="$(pwd)/.gradle"
  - export GRADLE_USER_HOME

build:
  stage: build
  rules:
    - when: on_success
  script:
    - env
    - ./gradlew -i -PciBuildNumber=$CI_PIPELINE_ID -PciJobName=$CI_PROJECT_NAME/$CI_COMMIT_REF_NAME build -x check
    - echo "PROJECT_VERSION=$(./gradlew -q properties --property version| awk '/^version:/ {print $2}')" >> variables.env
  interruptible: true
  artifacts:
    expire_in: 1 week
    reports:
      dotenv: variables.env
    paths:
      - build/libs
  cache:
    - key: gradle
      paths:
        - .gradle
    - key: $CI_PROJECT_PATH
      paths:
        - build
      policy: push

test:
  stage: check
  rules:
    - !reference [.verification, rules]
  script: ./gradlew -i test
  interruptible: true
  artifacts:
    when: always
    reports:
      junit: build/test-results/test/**/TEST-*.xml
  cache:
    - key: gradle
      paths:
        - .gradle
    - key: $CI_PROJECT_PATH
      paths:
        - build
      policy: pull

check:
  stage: check
  rules:
    - !reference [.verification, rules]
  script:
    - ./gradlew -i check -x test
  interruptible: true
  cache:
    - key: gradle
      paths:
        - .gradle
    - key: $CI_PROJECT_PATH
      paths:
        - build
      policy: pull

docker_image:
  stage: docker_image
  rules:
    - when: on_success
  needs:
   - build
  image:
    name: gcr.io/kaniko-project/executor:v1.23.2-debug
    entrypoint: [""]

  variables:
    IMAGE_NAME: eu.gcr.io/veo-projekt/veo-accounts
    # this does not work in Gitlab < 15.7, so we need the before_script workaround
    # GOOGLE_APPLICATION_CREDENTIALS: $GCR_ACCESS_TOKEN

  before_script:
    - export GOOGLE_APPLICATION_CREDENTIALS=${GCR_ACCESS_TOKEN}

  script:
    - |-
      DESTINATION_ARG="--destination $IMAGE_NAME:gitlab-git-${CI_COMMIT_SHA} --destination $IMAGE_NAME:pipeline-id-${CI_PIPELINE_ID}"
      if [ -n "$CI_COMMIT_TAG" ]; then export DESTINATION_ARG="$DESTINATION_ARG --destination $IMAGE_NAME:$CI_COMMIT_TAG";
        if [ "$CI_COMMIT_REF_NAME" = "main" ]; then export DESTINATION_ARG="$DESTINATION_ARG --destination $IMAGE_NAME:latest"; fi;
      fi;
      if [ "$CI_COMMIT_REF_NAME" = "develop" ]; then export DESTINATION_ARG="$DESTINATION_ARG --destination $IMAGE_NAME:develop"; fi;
    - /kaniko/executor
      --context "${CI_PROJECT_DIR}"
      --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
      $DESTINATION_ARG
      --build-arg VEO_ACCOUNTS_VERSION="${PROJECT_VERSION}"
      --label org.opencontainers.image.version="${PROJECT_VERSION}"
      --label org.opencontainers.image.revision=${CI_COMMIT_SHA}

  interruptible: true

http_rest_tests:
  stage: integration_test
  needs:
   - docker_image
  rules:
    - !reference [.verification, rules]
  services:
  - name: eu.gcr.io/veo-projekt/veo-accounts:pipeline-id-${CI_PIPELINE_ID}
    alias: veo-accounts
    variables:
      VEO_ACCOUNTS_KEYCLOAK_MAILING_ENABLED: 'false'
      VEO_ACCOUNTS_RABBITMQ_SUBSCRIBE: 'true'
      VEO_CORS_ORIGINS: 'https://*.verinice.example, https://frontend.somewhereelse.example'
      # FIXME: Read this from CI/CD settings
      JDK_JAVA_OPTIONS: -Dhttp.proxyHost=$PROXY -Dhttp.proxyPort=3128 -Dhttps.proxyHost=${PROXY} -Dhttps.proxyPort=3128 -Dhttps.proxySet=true -Dhttp.proxySet=true
  variables:
    VEO_RESTTEST_BASEURL: http://veo-accounts:8099
    VEO_ACCOUNTS_KEYCLOAK_PROXYHOST: $PROXY
    VEO_ACCOUNTS_KEYCLOAK_CLIENTS_SERVICE_SECRET: $KEYCLOAK_CLIENTS_SERVICE_SECRET
    VEO_ACCOUNTS_RABBITMQ_SUBSCRIBE: 'false'
    SPRING_RABBITMQ_HOST: $RABBITMQ_HOST
    SPRING_RABBITMQ_USERNAME: $RABBITMQ_USERNAME
    SPRING_RABBITMQ_PASSWORD: $RABBITMQ_PASSWORD
    VEO_ACCOUNTS_RABBITMQ_QUEUES_VEOSUBSCRIPTIONS: VEO_ACCOUNTS_REST_TEST_VEOSUBSCRIPTIONS_PIPELINE_${CI_PIPELINE_ID}
    VEO_ACCOUNTS_RABBITMQ_ROUTING_KEY_PREFIX: VEO_TEST_PIPELINE_${CI_PIPELINE_ID}.
    VEO_ACCOUNTS_RABBITMQ_QUEUE_AUTODELETE: 'true'
    VEO_ACCOUNTS_AUTH_APIKEYS_CLIENTINIT: $CLIENT_INIT_API_KEY
  script:
    - ./gradlew -i -Dhttp.nonProxyHosts="localhost|veo-accounts" -PciBuildNumber=$CI_PIPELINE_ID -PciJobName=$CI_PROJECT_NAME/$CI_COMMIT_REF_NAME restTest
  interruptible: true
  artifacts:
    when: always
    reports:
      junit: build/test-results/restTest/*.xml
  cache:
    - key: gradle
      paths:
        - .gradle
    - key: $CI_PROJECT_PATH
      paths:
        - build
      policy: pull

trigger_deployment:
  stage: deployment
  only:
    - develop
    - main
  trigger:
    project: veo/verinice-veo-deployment