.gitlab-ci.yml

image: eclipse-temurin:25-jdk@sha256:e787e08ef76f4c16866108cd7f9fcd96a68eef3ac6cc76866897d4d02d5a2262

variables:
  ORG_GRADLE_PROJECT_ci: 'true'
  CI_DEBUG_SERVICES: "true"

include:
  - project: "veo/verinice-veo"
    file: "/.gitlab/ci_templates/common_jobs.yaml"
    ref: develop

# Verification (tests and code analysis) is unnecessary on 'develop' &
# 'master', because only verified MRs can be merged into those branches.
.verification:
  rules:
    - if: $CI_COMMIT_BRANCH == "master"
      when: never
    - if: $CI_COMMIT_BRANCH == "develop"
      when: never
    - when: on_success

stages:
  - build
  - check
  - docker_image
  - copy
  - deployment

workflow:
  rules:
    - if: $CI_MERGE_REQUEST_ID
      when: never
    - when: always

before_script:
  - GRADLE_USER_HOME="$(pwd)/.gradle"
  - export GRADLE_USER_HOME

build:
  stage: build
  rules:
    - when: on_success
  script:
    - env
    - ./gradlew -i -PciBuildNumber=$CI_PIPELINE_ID -PciJobName=$CI_PROJECT_NAME/$CI_COMMIT_REF_NAME build -x check
    - echo "PROJECT_VERSION=$(./gradlew -q properties --property version| awk '/^version:/ {print $2}')" >> variables.env
  interruptible: true
  artifacts:
    expire_in: 1 week
    reports:
      dotenv: variables.env
    paths:
      - build/libs
  cache:
    - key: gradle
      paths:
        - .gradle
    - key: $CI_PROJECT_PATH
      paths:
        - build
      policy: push

determine-destinations:
  before_script: []
  image:
    name: alpine/git@sha256:4f9488b7295baec153a9953479690f835ad4699b1d9f11e3897a4485c224fc3e
    entrypoint: [ "" ]
  stage: build
  script:
    - |-
      IMAGE_NAME="eu.gcr.io/veo-projekt/veo-forms"
      DESTINATION_ARG="--destination $IMAGE_NAME:gitlab-git-${CI_COMMIT_SHA} --destination $IMAGE_NAME:pipeline-id-${CI_PIPELINE_ID}"
      if echo "$CI_COMMIT_TAG" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
        DESTINATION_ARG="$DESTINATION_ARG --destination $IMAGE_NAME:$CI_COMMIT_TAG"
        git fetch --tags
        LATEST_TAG=$(git tag --list | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n1)
        if [ "$CI_COMMIT_TAG" = "$LATEST_TAG" ]; then
          DESTINATION_ARG="$DESTINATION_ARG --destination $IMAGE_NAME:latest"
        fi
      fi
      if [ "$CI_COMMIT_REF_NAME" = "develop" ]; then
        DESTINATION_ARG="$DESTINATION_ARG --destination $IMAGE_NAME:develop"
      fi

      echo "DESTINATION_ARG=$DESTINATION_ARG" > destinations.env
  artifacts:
    reports:
      dotenv: destinations.env
    expire_in: 1 hour


test:
  stage: check
  rules:
    - !reference [.verification, rules]
  script:
  - ./gradlew -i test jacotura
  - awk -F"," '{ instructions += $4 + $5; covered += $5 } END { print covered, "/", instructions, " instructions covered"; print 100*covered/instructions, "% covered" }' build/reports/jacoco/test/jacocoTestReport.csv
  services:
  - name: postgres:16.14-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
    alias: db
    variables:
      POSTGRES_USER: test
      POSTGRES_PASSWORD: test
  variables:
    SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/postgres
    SPRING_DATASOURCE_DRIVERCLASSNAME: org.postgresql.Driver
  artifacts:
    when: always
    reports:
      junit: build/test-results/test/**/TEST-*.xml
      coverage_report:
        coverage_format: cobertura
        path: build/reports/cobertura.xml
  coverage: '/([0-9]{1,3}.[0-9]*).%.covered/'
  cache:
    - key: gradle
      paths:
        - .gradle
    - key: $CI_PROJECT_PATH
      paths:
        - build
      policy: pull

check:
  stage: check
  rules:
    - !reference [.verification, rules]
  script:
    - ./gradlew -i check -x test
  interruptible: true
  cache:
    - key: gradle
      paths:
        - .gradle
    - key: $CI_PROJECT_PATH
      paths:
        - build
      policy: pull

docker_image:
  stage: docker_image
  rules:
    - when: on_success
  needs:
   - build
   - determine-destinations
  image:
    name: gcr.io/kaniko-project/executor:v1.24.0-debug@sha256:2562c4fe551399514277ffff7dcca9a3b1628c4ea38cb017d7286dc6ea52f4cd
    entrypoint: [""]

  variables:
    # this does not work in Gitlab < 15.7, so we need the before_script workaround
    # GOOGLE_APPLICATION_CREDENTIALS: $GCR_ACCESS_TOKEN

  before_script:
    - export GOOGLE_APPLICATION_CREDENTIALS=${GCR_ACCESS_TOKEN}

  script:
    - /kaniko/executor
      --context "${CI_PROJECT_DIR}"
      --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
      $DESTINATION_ARG
      --build-arg VEO_FORMS_VERSION="${PROJECT_VERSION}"
      --label org.opencontainers.image.version="${PROJECT_VERSION}"
      --label org.opencontainers.image.revision=${CI_COMMIT_SHA}
  interruptible: true

copy-image:
  extends: .registry-copy-image
  variables:
    IMAGE_REPO: 'veo-forms'
    IMAGE_TAG: '$CI_COMMIT_TAG'

update-values:
  stage: deployment
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop"'
      variables:
        VALUES_FILE: 'dev-values.yaml'
        IMAGE_TAG: 'gitlab-git-${CI_COMMIT_SHA}'
    - if: '$CI_COMMIT_TAG'
      variables:
        VALUES_FILE: 'stage-values.yaml'
        IMAGE_TAG: '${CI_COMMIT_TAG}'
    - when: never
  trigger:
    project: veo/verinice-veo-argocd
    branch: main
    strategy: mirror
    inputs:
      valuesFile: $VALUES_FILE
      imageTag: $IMAGE_TAG
      serviceName: 'forms'