.gitlab-ci.yml

variables:
  GIT_SUBMODULE_STRATEGY: recursive
  # We want full history so that "git describe" always works correctly.
  GIT_DEPTH: 0
  FF_ENABLE_BASH_EXIT_CODE_CHECK: "true"
  # We always want to run with the Go version installed in a Docker image.
  GOTOOLCHAIN: local
  DOCKER_DRIVER: overlay2
  DOCKER_BUILDKIT: "1"
  FF_NETWORK_PER_BUILD: 1

test:
  stage: test

  image: golang:$IMAGE_TAG

  services:
    - name: ghcr.io/letsencrypt/pebble-challtestsrv:2.6.0
      alias: pebble-challtestsrv
      command: ["-defaultIPv6", "", "-defaultIPv4", ""]
    - name: ghcr.io/letsencrypt/pebble:2.6.0
      alias: pebble
      command: ["-config", "/test/config/pebble-config.json", "-dnsserver", "pebble-challtestsrv:8053"]
      variables:
        PEBBLE_VA_NOSLEEP: 1
        PEBBLE_WFE_NONCEREJECT: 0
        PEBBLE_AUTHZREUSE: 100

  variables:
    DOCKER_HOST: tcp://pebble:2375
    PEBBLE_HOST: pebble

  before_script:
    - apk --update add make bash gcc musl-dev mailcap
    - (cd /go; go install gotest.tools/gotestsum@v1.12.0)
    - (cd /go; go install github.com/boumenot/gocover-cobertura@v1.2.0)
    - go version
    - BUILD_IP="$(getent ahostsv4 build | awk '{print $1}' | head -1)"
    - echo "$BUILD_IP"
    - ip -o route get to 8.8.8.8 | sed -n 's/.*src \([0-9.]\+\).*/\1/p'
    - wget -O - --post-data '{"host":"site.test", "addresses":["'"$BUILD_IP"'"]}' http://pebble-challtestsrv:8055/add-a
    - nslookup -port=8053 site.test pebble-challtestsrv

  script:
    - make test-ci

  after_script:
    - wget -O - --post-data '{"host":"site.test"}' http://pebble-challtestsrv:8055/dns-request-history

  artifacts:
    when: always
    reports:
      junit: tests.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
    paths:
      - tests.xml
      - coverage.html
      - coverage.xml
    expire_in: never

  # "\s" at the beginning is important so that we match only output from
  # "go tool covdata percent" and not one from "go test" itself.
  coverage: '/\scoverage: \d+\.\d+% of statements/'

  parallel:
    matrix:
      - IMAGE_TAG: ['1.23-alpine3.19']

lint:
  stage: test

  image: golang:1.23-alpine3.19

  before_script:
    - apk --update add make bash gcc musl-dev jq
    - wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.60.3

  script:
    - make lint-ci

  artifacts:
    when: always
    reports:
      codequality: codeclimate.json
    expire_in: never

fmt:
  stage: test

  image: golang:1.23-alpine3.19

  before_script:
    - apk --update add make bash git gcc musl-dev grep
    - go install mvdan.cc/gofumpt@v0.7.0
    - go install golang.org/x/tools/cmd/goimports@v0.24.0

  script:
    - make fmt-ci

lint_docs:
  stage: test

  image: node:20.17-alpine3.19

  before_script:
    - apk --update add make bash git

  script:
    - make lint-docs-ci

audit:
  stage: test

  image: golang:1.23-alpine3.19

  before_script:
    - apk --update add make bash git gcc musl-dev
    - go install github.com/sonatype-nexus-community/nancy@v1.0.46

  script:
    - make audit

commits:
  stage: test

  image: golang:1.23-alpine3.19

  variables:
    GIT_DEPTH: "0"

  before_script:
    - apk --update add git

  script:
    - '! git log --oneline "-G^(<<<<<<<|=======|>>>>>>>)" | grep "^"'

publish:
  stage: deploy

  image: golang:1.23-alpine3.19

  script:
    - GOPROXY=proxy.golang.org go list -m "gitlab.com/tozd/waf@$CI_COMMIT_REF_NAME"

  rules:
    # Only on protected tags on main repository. Protected tags start with "v".
    - if: '$CI_COMMIT_TAG && $CI_COMMIT_REF_NAME =~ /^v/ && $CI_PROJECT_PATH == "tozd/waf"'

  # We do not need build artifacts in this job.
  dependencies: []

sync_releases:
  stage: deploy

  image:
    name: registry.gitlab.com/tozd/gitlab/release/tag/v0-6-0:latest-debug
    entrypoint: [""]

  script:
    # On branch jobs, just update or remove releases, thus releases are created only on tag jobs.
    - /gitlab-release ${CI_COMMIT_BRANCH:+--no-create}

  rules:
    # Protected tags start with "v".
    - if: '$GITLAB_API_TOKEN && ($CI_COMMIT_BRANCH == "main" || ($CI_COMMIT_TAG && $CI_COMMIT_REF_NAME =~ /^v/))'

  # We do not need build artifacts in this job.
  dependencies: []

sync_config:
  stage: deploy

  image:
    name: registry.gitlab.com/tozd/gitlab/config/tag/v0-5-0:latest-debug
    entrypoint: [""]

  script:
    - /gitlab-config set

  rules:
    - if: '$GITLAB_API_TOKEN && $SOPS_AGE_KEY_FILE && $CI_COMMIT_BRANCH == "main"'
      changes:
        - .gitlab-conf.yml

  # We do not need build artifacts in this job.
  dependencies: []