.gitlab-ci.yml

variables:
  # The default timeout is 60 minutes. Set RUNNER_SCRIPT_TIMEOUT to 55m to
  # leave room for the after_script timeout that defaults to 5m.
  RUNNER_SCRIPT_TIMEOUT: 55m
  # Not normally needed, but may be if some script uses `apt-get install`.
  DEBIAN_FRONTEND: noninteractive
  # Locale settings do not affect the build, but might affect tests.
  LC_ALL: C

  # enable junk filling via jemalloc option
  MALLOC_CONF: "junk:true"

  # automated commits will inherit identification from pipeline trigger
  GIT_AUTHOR_NAME: "$GITLAB_USER_NAME (GitLab job $CI_JOB_ID)"
  GIT_AUTHOR_EMAIL: "$GITLAB_USER_EMAIL"
  GIT_COMMITTER_NAME: "$GIT_AUTHOR_NAME"
  GIT_COMMITTER_EMAIL: "$GIT_AUTHOR_EMAIL"

  CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9

  GIT_DEPTH: 1
  GIT_CLEAN_FLAGS: -ffdxq

  # The following values may be overwritten in GitLab's CI/CD Variables Settings.
  BUILD_PARALLEL_JOBS: 6
  TEST_PARALLEL_JOBS: 4

  CLANG_VERSION: 22
  CLANG: "clang-${CLANG_VERSION}"
  SCAN_BUILD: "scan-build-${CLANG_VERSION}"
  LLVM_SYMBOLIZER: "/usr/lib/llvm-${CLANG_VERSION}/bin/llvm-symbolizer"
  CLANG_FORMAT: "clang-format-${CLANG_VERSION}"

  CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls

  TSAN_CONFIGURE_FLAGS_COMMON: "-Db_sanitize=thread -Doptimization=2 -Ddebug=true -Didn=enabled -Dlocktype=system -Djemalloc=disabled -Dnamed-lto=disabled --pkg-config-path /opt/tsan/lib/pkgconfig"
  TSAN_SYMBOLIZER_PATH_DEBIAN: "${LLVM_SYMBOLIZER}"
  TSAN_SYMBOLIZER_PATH_FEDORA: "/usr/bin/llvm-symbolizer"

  WITHOUT_LIBEDIT: "-Dline=disabled"
  WITH_LIBEDIT: "-Dline=enabled"

  STRESS_CONFIGURE_FLAGS: "-Doptimization=g -Dcmocka=disabled"

  INSTALL_PATH: "${CI_PROJECT_DIR}/.local"

  # In multithreaded unit tests, abort on the first failure
  CMOCKA_TEST_ABORT: 1

  # Disable pytest's "cacheprovider" plugin to prevent it from creating
  # cross-testrun files as there is no need to use that feature in CI.
  PYTEST_ADDOPTS: "-p no:cacheprovider"

  HYPOTHESIS_PROFILE: "ci"

  # Some jobs may clean up the build artifacts unless this is set to 0.
  CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 1

  # DNS Shotgun performance testing defaults
  SHOTGUN_ROUNDS: 1
  SHOTGUN_DURATION: 120
  # allow unlimited improvements against baseline
  SHOTGUN_EVAL_THRESHOLD_CPU_MIN: '-inf'
  SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN: '-inf'
  SHOTGUN_EVAL_THRESHOLD_RCODE_MAX: '+inf'
  SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN: '-inf'
  SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN: '-inf'

  # Even though there's only one job per runtime environment, the GitLab
  # "instance" executor insists on cloning the Git repository to a path that
  # contains a variable number from zero to the "maximum concurrent instances
  # count" allowed on the GitLab Runner. See the "0" directory in this example
  # path: /home/ec2-user/builds/t1_4FZzvz/0/isc-projects/bind9/.git/.
  #
  # This is not a problem for isolated jobs like "stress" tests that depend on
  # no other jobs. However, it is a problem for jobs that need other jobs'
  # artifacts. For example, a system test job that has its Git repo cloned to
  # the "/1/" sub-path will fail if it downloads build job artifacts that have
  # ./configure output files with "/0/" in its sub-path recorded.
  GIT_CLONE_PATH_INSTANCE_EXECUTOR: "/home/ec2-user/builds/${CI_PROJECT_PATH}/"

default:
  # Allow all running CI jobs to be automatically canceled when a new
  # version of a branch is pushed.
  #
  # See: https://docs.gitlab.com/ee/ci/pipelines/settings.html#auto-cancel-redundant-pipelines
  interruptible: true

  # AWS can interrupt the spot instance anytime, so let's retry the job when
  # the interruption event happens to avoid a pipeline failure.
  retry:
    max: 2
    when:
      - runner_system_failure

workflow:
  # Prevent jobs marked with "interruptible: false" that have not yet been
  # started from getting canceled when a newer pipeline is created for the same
  # branch.  This setting was added to enable "iterative autorebases" to work
  # correctly with `resource_group`.  Without this setting, pending rebase jobs
  # waiting for a resource group would get canceled by the "git push" operation
  # at the end of a prior rebase job belonging to the same resource group.
  auto_cancel:
    on_new_commit: interruptible

include:
  - project: 'isc-projects/bind9-qa'
    file: '/.gitlab-ci-common.yml'

stages:
  - quick-checks
  - other-checks
  - build
  - unit
  - system
  - performance
  - docs
  - postmerge
  - release

### Runner Tag Templates

# AlmaLinux autoscaling GitLab Runners on AWS EC2 (amd64)

.almalinux-8fips-amd64-image: &almalinux_8fips_amd64_image
  tags:
    - almalinux-8
    - amd64
    - autoscaler
    - aws
    - fips
    - shell

.almalinux-9fips-amd64-image: &almalinux_9fips_amd64_image
  tags:
    - almalinux-9
    - amd64
    - autoscaler
    - aws
    - fips
    - shell

.almalinux-10fips-amd64-image: &almalinux_10fips_amd64_image
  tags:
    - almalinux-10
    - amd64
    - autoscaler
    - aws
    - fips
    - shell

# Autoscaling GitLab Runner on AWS EC2 (amd64)

.linux-amd64: &linux_amd64
  tags:
    - linux
    - aws
    - runner-manager
    - amd64

# Autoscaling GitLab Runner on AWS EC2 (arm64)

.linux-arm64: &linux_arm64
  tags:
    - linux
    - aws
    - runner-manager
    - aarch64

.freebsd-autoscaler-13-amd64-tags: &freebsd_autoscaler_13_amd64_tags
  tags:
    - amd64
    - autoscaler
    - aws
    - bsd-stress-test-1
    - shell
    - stress-test

.freebsd-autoscaler-14-amd64-tags: &freebsd_autoscaler_14_amd64_tags
  tags:
    - amd64
    - autoscaler
    - aws
    - bsd-stress-test-2
    - shell
    - stress-test

.freebsd-autoscaler-15-amd64-tags: &freebsd_autoscaler_15_amd64_tags
  tags:
    - amd64
    - autoscaler
    - aws
    - bsd-stress-test-3
    - shell
    - stress-test

### Docker Image Templates

# Alpine Linux

.alpine-3.24-amd64: &alpine_3_24_amd64_image
  image: "$CI_REGISTRY_IMAGE:alpine-3.24-amd64"
  <<: *linux_amd64

# AlmaLinux

.almalinux-8-amd64: &almalinux_8_amd64_image
  image: "$CI_REGISTRY_IMAGE:almalinux-8-amd64"
  <<: *linux_amd64

.almalinux-9-amd64: &almalinux_9_amd64_image
  image: "$CI_REGISTRY_IMAGE:almalinux-9-amd64"
  <<: *linux_amd64

.almalinux-10-amd64: &almalinux_10_amd64_image
  image: "$CI_REGISTRY_IMAGE:almalinux-10-amd64"
  <<: *linux_amd64

# Debian

.debian-bookworm-amd64: &debian_bookworm_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-bookworm-amd64"
  <<: *linux_amd64

.debian-trixie-amd64: &debian_trixie_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-trixie-amd64"
  <<: *linux_amd64

.tsan-debian-trixie-amd64: &tsan_debian_trixie_amd64_image
  image: "$CI_REGISTRY_IMAGE:tsan-debian-trixie-amd64"
  <<: *linux_amd64

.debian-trixie-amd64cross32: &debian_trixie_amd64cross32_image
  image: "$CI_REGISTRY_IMAGE:debian-trixie-amd64cross32"
  <<: *linux_amd64

.debian-trixie-386: &debian_trixie_386_image
  image: "$CI_REGISTRY_IMAGE:debian-trixie-386"
  <<: *linux_amd64

.debian-sid-amd64: &debian_sid_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
  <<: *linux_amd64

# openSUSE Tumbleweed

.tumbleweed-latest-amd64: &tumbleweed_latest_amd64_image
  image: "$CI_REGISTRY_IMAGE:tumbleweed-latest-amd64"
  <<: *linux_amd64

# Fedora

.tsan-fedora-44-amd64: &tsan_fedora_44_amd64_image
  image: "$CI_REGISTRY_IMAGE:tsan-fedora-44-amd64"
  <<: *linux_amd64

.fedora-44-amd64: &fedora_44_amd64_image
  image: "$CI_REGISTRY_IMAGE:fedora-44-amd64"
  <<: *linux_amd64

.fedora-44-arm64: &fedora_44_arm64_image
  image: "$CI_REGISTRY_IMAGE:fedora-44-arm64"
  <<: *linux_arm64

# Ubuntu

.ubuntu-jammy-amd64: &ubuntu_jammy_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-jammy-amd64"
  <<: *linux_amd64

.ubuntu-noble-amd64: &ubuntu_noble_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-noble-amd64"
  <<: *linux_amd64

.ubuntu-resolute-amd64: &ubuntu_resolute_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-resolute-amd64"
  <<: *linux_amd64

# Base image
# This is a meta image that is used as a base for non-specific jobs

.base: &base_image
  <<: *debian_trixie_amd64_image

### Job Templates

.rule_mr_code: &rule_mr_code
  - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
    changes:
      - '**/*.c'
      - '**/*.h'
      - '**/meson.build'

.rule_mr_shell: &rule_mr_shell
  - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
    changes:
      - '**/*.sh'
      - '**/*.sh.in'
      - 'bin/tests/system/org.isc.bind.system'

.rule_mr_python: &rule_mr_python
  - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
    changes:
      - '**/*.py'

.rule_mr_system_tests: &rule_mr_system_tests
  - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
    changes:
      - 'bin/tests/system/**/*'

.rule_mr_manual: &rule_mr_manual
  - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
    when: manual  # only run on MR if requested
    allow_failure: true  # don't block the pipeline or the pipeline result

.rule_tag: &rule_tag
  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null'

.rule_tag_open_source: &rule_tag_open_source
  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/'

.rule_tag_open_source_stable: &rule_tag_open_source_stable
  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $CI_COMMIT_TAG =~ $STABLE_VERSION_REGEX'

.rule_tag_open_source_maintenance: &rule_tag_open_source_maintenance
  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/ && $RELEASE_TYPE != "security"'

.rule_tag_open_source_security: &rule_tag_open_source_security
  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/ && $RELEASE_TYPE == "security"'

.rule_tag_security: &rule_tag_security
  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $RELEASE_TYPE == "security"'

.rule_tag_security_or_subscription: &rule_tag_security_or_subscription
  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && ($RELEASE_TYPE == "security" || $CI_COMMIT_TAG =~ /-S/)'

.rule_source_other_than_mr: &rule_source_other_than_mr
  - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/ && $REBASE_ONLY != "1"'

.rule_source_all: &rule_source_all
  - if: '$CI_PIPELINE_SOURCE =~ /^(api|merge_request_event|pipeline|schedule|trigger|web)$/ && $REBASE_ONLY != "1"'

.rule_branch_after_autorebase: &rule_branch_after_autorebase
  - if: '$CI_PIPELINE_SOURCE == "push" && $AUTOREBASED == "1"'

.api-pipelines-schedules-tags-triggers-web-triggering-rules: &api_pipelines_schedules_tags_triggers_web_triggering_rules
  rules:
    - *rule_tag
    - *rule_source_other_than_mr

.default-triggering-rules_list: &default_triggering_rules_list
  - *rule_tag
  - *rule_source_all
  - *rule_branch_after_autorebase

.default-triggering-rules: &default_triggering_rules
  rules:
    - *default_triggering_rules_list

.code-triggering-rules: &code_triggering_rules
  rules:
    - *rule_mr_code
    - *rule_mr_manual
    - *rule_tag
    - *rule_source_other_than_mr
    - *rule_branch_after_autorebase

.shell-triggering-rules: &shell_triggering_rules
  rules:
    - *rule_mr_shell
    - *rule_mr_manual
    - *rule_tag
    - *rule_source_other_than_mr
    - *rule_branch_after_autorebase

.python-triggering-rules: &python_triggering_rules
  rules:
    - *rule_mr_python
    - *rule_mr_manual
    - *rule_tag
    - *rule_source_other_than_mr
    - *rule_branch_after_autorebase

.extra-system-tests-triggering-rules: &extra_system_tests_triggering_rules
  rules:
    - *rule_tag
    - *rule_source_other_than_mr
    - *rule_mr_system_tests

.quick-check: &quick_checks_job
  <<: *default_triggering_rules
  <<: *base_image
  stage: quick-checks
  needs: []
  tags:
    - smalljob

.other-check: &other_checks_job
  <<: *default_triggering_rules
  <<: *base_image
  stage: other-checks
  needs: []

.configure: &configure
    - meson setup
      --libdir=lib
      -Dcmocka=enabled
      -Ddeveloper=enabled
      -Dleak-detection=enabled
      -Doptimization=1
      -Dnamed-lto=thin
      $EXTRA_CONFIGURE
      build

.git-clone-bind9-qa: &git_clone_bind9-qa
  - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git "$CI_PROJECT_DIR"/bind9-qa

# change directory to the workspace before including this
.find_python: &find_python
  - PYTHON="$(cat build/bin/tests/system/isctest/vars/.build_vars/PYTHON)"
  - test -x "$PYTHON"

.find_pytest: &find_pytest
  - PYTEST="$(cat build/bin/tests/system/isctest/vars/.build_vars/PYTEST)"
  - test -x "$PYTEST"

.parse_tsan: &parse_tsan
    - *find_python
    - find -name 'tsan.*' -exec "$PYTHON" "$CI_PROJECT_DIR"/bind9-qa/ci/parse_tsan.py {} \;

.check_readline_setup: &check_readline_setup
    # WITH_LIBEDIT/WITHOUT_LIBEDIT are always-set global variables, so inspect
    # the actual per-job configure flags to decide what to assert.
    - case " ${EXTRA_CONFIGURE} " in
        *" -Dline=disabled "*)
          ! grep -e "^#define HAVE_LIBEDIT" build/config.h;;
        *" -Dline=enabled "*)
          grep -e "^#define HAVE_LIBEDIT" build/config.h;;
      esac

.list_installed_package_versions: &list_installed_package_versions
  - echo -e "\e[0Ksection_start:`date +%s`:installed_packages_section[collapsed=true]\r\e[0KHeader of the installed packages collapsible section"
  - ( pip3 list || pip list || echo "no pip" ) 2>/dev/null
  - for cmd in "apk info --verbose" "dpkg-query --show --showformat='\${Package}-\${Version}\n'" "pkg info --quiet" "rpm -qa | sort"; do
      eval "$cmd" 2>/dev/null && break;
    done || true
  - echo -e "\e[0Ksection_end:`date +%s`:installed_packages_section\r\e[0K"

# Unpack release tarball and continue work in the extracted directory.
.unpack_release_tarball: &unpack_release_tarball
  - tar --extract --file build/meson-dist/bind-*.tar.xz
  - rm -f build/meson-dist/bind-*.tar.xz
  - cd bind-*

.fips-feature-test: &fips_feature_test
    - if build/feature-test --have-fips-mode; then
        if [ "$(cat /proc/sys/crypto/fips_enabled)" = "1" ]; then
          echo "FIPS is enabled";
        else
          echo "FIPS is disabled";
          exit 1;
        fi
      fi

.build: &build_job
  <<: *default_triggering_rules
  stage: build
  before_script:
    - *list_installed_package_versions
  script:
    - *configure
    - *check_readline_setup
    - meson compile -C build
    - meson compile -C build system-test-dependencies
    - test -z "${RUN_MESON_INSTALL}" || meson install -C build --destdir=$INSTALL_PATH
    - test -z "${RUN_MESON_INSTALL}" || DESTDIR="${INSTALL_PATH}" sh build/util/check-make-install.sh
    #- test -z "${CROSS_COMPILATION}" || grep -F -A 1 "checking whether we are cross compiling" config.log | grep -q "result.*yes"
    - test -z "${CROSS_COMPILATION}" || file build/lib/dns/gen | grep -F -q "ELF 64-bit LSB"
    #- test -z "${CROSS_COMPILATION}" || ( ! git ls-files -z --others --exclude lib/dns/gen | xargs -0 file | grep "ELF 64-bit LSB" )
    - *find_python
    # Check that embedded sanitizer flags are in sync with the `meson.build` file.
    - $PYTHON ${CI_PROJECT_DIR}/ci/sanitizer_default_check.py build
    - build/named -V
    - *fips_feature_test
  needs: []
  artifacts:
    untracked: true
    when: always

.setup_interfaces: &setup_interfaces
    - if [ "$(id -u)" -eq "0" ]; then
        sh -x build/bin/tests/system/ifconfig.sh up;
      else
        sudo sh -x build/bin/tests/system/ifconfig.sh up;
      fi

.display_pytest_failures: &display_pytest_failures
    - awk '/^=+ FAILURES =+/{flag=1;next}/^=+.*=+$/{flag=0}flag' bin/tests/system/pytest.out.txt || true
    - awk '/^=+ ERRORS =+/{flag=1;next}/^=+.*=+$/{flag=0}flag' bin/tests/system/pytest.out.txt || true

.shotgun: &shotgun_job
  <<: *base_image
  stage: performance
  rules:
    - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
      variables:
        BASELINE: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
        SHOTGUN_ROUNDS: 5
      when: manual  # don't run on each MR unless requested
      allow_failure: true
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      variables:
        SHOTGUN_ROUNDS: 5
        WEEKDAY: "1"  # run only on Monday mornings
    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|trigger|web)$/ && $REBASE_ONLY != "1"'
      variables:
        SHOTGUN_ROUNDS: 5
      when: manual
      allow_failure: true
  timeout: 2h
  variables:
    RUNNER_SCRIPT_TIMEOUT: 1h55m
  script:
    - if [ -n "$WEEKDAY" ] && [ "$(date +%w)" != "$WEEKDAY" ]; then exit 0; fi  # if WEEKDAY is set, only run on those days
    - if [ -z "$BASELINE" ]; then export BASELINE=$BIND_BASELINE_VERSION; fi  # this dotenv variable can't be set in the rules section, because rules are evaluated before any jobs run
    - PIPELINE_ID=$(curl -s -X POST --fail
        -F "token=$CI_JOB_TOKEN"
        -F ref=main
        -F "variables[SHOTGUN_TEST_VERSION]=['$CI_COMMIT_REF_NAME', '$BASELINE']"
        -F "variables[SHOTGUN_DURATION]=300"
        -F "variables[SHOTGUN_ROUNDS]=$SHOTGUN_ROUNDS"
        -F "variables[SHOTGUN_TRAFFIC_MULTIPLIER]=$SHOTGUN_TRAFFIC_MULTIPLIER"
        -F "variables[SHOTGUN_SCENARIO]=$SHOTGUN_SCENARIO"
        -F "variables[SHOTGUN_EVAL_THRESHOLD_CPU_MIN]=$SHOTGUN_EVAL_THRESHOLD_CPU_MIN"
        -F "variables[SHOTGUN_EVAL_THRESHOLD_CPU_MAX]=$SHOTGUN_EVAL_THRESHOLD_CPU_MAX"
        -F "variables[SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN]=$SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN"
        -F "variables[SHOTGUN_EVAL_THRESHOLD_MEMORY_MAX]=$SHOTGUN_EVAL_THRESHOLD_MEMORY_MAX"
        -F "variables[SHOTGUN_EVAL_THRESHOLD_RCODE_MIN]=$SHOTGUN_EVAL_THRESHOLD_RCODE_MIN"
        -F "variables[SHOTGUN_EVAL_THRESHOLD_RCODE_MAX]=$SHOTGUN_EVAL_THRESHOLD_RCODE_MAX"
        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN"
        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX"
        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN"
        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MAX]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MAX"
        https://gitlab.isc.org/api/v4/projects/188/trigger/pipeline | jq .id)
    - *git_clone_bind9-qa
    - >
      "$CI_PROJECT_DIR"/bind9-qa/ci/wait_shotgun.py ${WEEKDAY:+--notify} $PIPELINE_ID
  needs:
    - job: ci-variables
      artifacts: true

.system_test_common: &system_test_job
  <<: *default_triggering_rules
  stage: system
  before_script:
    - *setup_interfaces
  # This script needs to: 1) fail if the system tests fail, 2) fail if
  # the junit.xml file is broken, 3) produce the junit.xml file even if
  # the system tests fail.  Therefore, $RET is used to "cache" the
  # result of running pytest as interrupting the script immediately when
  # system tests fail would make checking the contents of the junit.xml
  # file impossible (GitLab Runner uses "set -o pipefail").
  script:
    - *fips_feature_test
    - *find_pytest
    - *find_python
    - *git_clone_bind9-qa
    - ( if [ "${CI_DISPOSABLE_ENVIRONMENT}" = "true" ]; then sleep 3000; "$PYTHON" "${CI_PROJECT_DIR}/bind9-qa/ci/get_running_system_tests.py"; fi ) &
    - cd bin/tests/system
    - RET=0
    - >
      ("$PYTEST" --junit-xml="$CI_PROJECT_DIR"/junit_pytest.xml -n "$TEST_PARALLEL_JOBS" | tee pytest.out.txt) || RET=1
    - >
      "$PYTHON" "$CI_PROJECT_DIR"/bind9-qa/ci/postprocess_junit_files.py "$CI_PROJECT_DIR"/junit_pytest.xml --output "$CI_PROJECT_DIR"/junit.xml
    - (exit $RET)
    - '( ! grep -F "grep: warning:" pytest.out.txt )'
    - test "$CLEAN_BUILD_ARTIFACTS_ON_SUCCESS" -eq 0 || ( cd ../../.. && ninja -C build clean >/dev/null 2>&1 )
  after_script:
    - *display_pytest_failures
  artifacts:
    untracked: true
    exclude:
      - "**/__pycache__/**/*"
    when: always
    reports:
      junit: junit.xml

.system_test_tsan: &system_test_tsan_job
  <<: *system_test_job
  after_script:
    - *display_pytest_failures
    - *parse_tsan

.unit_test_common: &unit_test_job
  <<: *default_triggering_rules
  stage: unit
  # This script needs to: 1) fail if the unit tests fail, 2) fail if the
  # junit.xml file is broken, 3) produce the JUnit reports even if the
  # unit tests fail.  Therefore, $RET is used to "cache" the result of
  # running "meson test" as interrupting the script immediately when
  # unit tests fail would make checking the contents of the junit.xml
  # file impossible (GitLab Runner uses "set -o pipefail").

  # Additionally, both flaky and CMocka test need special handling:
  # - flaky tests are retried a number of times (default 2) before being
  #   considered failed
  # - for CMocka tests, we use the CMocka's XML report to get more detailed
  #   information (subtest results and timings). Meson also produces
  #   a JUnit report, so we need to not pass it to GitLab to avoid duplication.
  script:
    - *fips_feature_test
    - *find_python
    - *git_clone_bind9-qa
    # Set CMocka JUnit XML output.
    - export CMOCKA_MESSAGE_OUTPUT="xml"
    - export CMOCKA_XML_FILE="$(pwd)/build/meson-logs/include-cmocka-%g.junit.xml"
    - RET=0
    - MESON_WRAPPER="$CI_PROJECT_DIR/bind9-qa/ci/meson_retry_if_flaky.sh 2"
    # When Git checks out the sources, their modification times are newer than
    # the build tree from the artifact, so meson would rebuild all of BIND 9.
    # Age the tracked sources (not "build", to keep ninja's recorded mtimes) so
    # only the unit tests get built.  "-r" skips the tarball job, which runs
    # from an untracked dir.  Use BIND 9's git-birthday as the timestamp.
    - git ls-files -z | xargs -0 -r touch -t 199808172205
    # Build the test binaries here (rather than in the build job) and run them.
    # CMocka tests: Mark Meson-generated XMLs to exclude them later with --logbase, CMocka generates better ones.
    - meson test -C build --suite cmocka --wrapper "$MESON_WRAPPER" --logbase "exclude-" || RET=1
    # Non-CMocka test: Use Meson-generated XMLs.
    - meson test -C build --no-suite cmocka --wrapper "$MESON_WRAPPER" --logbase "include-" || RET=1
    - >
      "$PYTHON" "$CI_PROJECT_DIR"/bind9-qa/ci/postprocess_junit_files.py build/meson-logs/include-*.junit.xml --output "$CI_PROJECT_DIR/junit.xml"
    - (exit $RET)
    - test "$CLEAN_BUILD_ARTIFACTS_ON_SUCCESS" -eq 0 || ninja -C build clean >/dev/null 2>&1
  artifacts:
    untracked: true
    when: always
    reports:
      junit:
        - junit.xml

.unit_test_tsan: &unit_test_tsan_job
  <<: *unit_test_job
  after_script:
    - *parse_tsan

.docs: &docs_job
  stage: docs
  script:
    - *configure
    - test -z "${DOC_CHECK_MISC_CHANGE}" || ninja -C build doc-misc
    - test -z "${DOC_CHECK_MISC_CHANGE}" || cp build/doc/misc/options build/doc/misc/rndc.grammar build/doc/misc/*.zoneopt doc/misc/
    - test -z "${DOC_CHECK_MISC_CHANGE}" || git diff > doc-misc.patch
    - test -z "${DOC_CHECK_MISC_CHANGE}" || if test "$(git status --porcelain --untracked-files=no | wc -l)" -gt "0"; then git status --short; exit 1; fi
    - meson compile -C build arm arm-epub man
    - find build/man/ -maxdepth 2 -name "*.[0-9]" -exec mandoc -T lint "{}" \; | ( ! grep -v -e "skipping paragraph macro. sp after" -e "unknown font, skipping request. ft C" -e "input text line longer than 80 bytes" )

.respdiff: &respdiff_job
  <<: *code_triggering_rules
  stage: system
  before_script:
    - *configure
    - meson compile -C build
    - *setup_interfaces
    - *git_clone_bind9-qa
    - cd "$CI_PROJECT_DIR"/bind9-qa/respdiff
  after_script:
    - *parse_tsan
    - cd "$CI_PROJECT_DIR"/bind9-qa/respdiff
    - if [ ! -e rspworkdir/report.json ]; then respdiff/msgdiff.py --config rspworkdir/respdiff.cfg rspworkdir; fi
    - if [ ! -e rspworkdir/report.txt ]; then respdiff/diffsum.py --config rspworkdir/respdiff.cfg --limit 0 rspworkdir | tee rspworkdir/report.txt; fi
  needs: []
  artifacts:
    paths:
      - bind9-qa/respdiff
    exclude:
      - bind9-qa/respdiff/rspworkdir/data.mdb # Exclude a 10 GB file.
    untracked: true
    when: always

### Job Definitions

# Jobs in the quick-checks stage

misc:
  <<: *quick_checks_job
  script:
    - sh util/checklibs.sh > checklibs.out
    - sh util/check-categories.sh
    - sh util/check-gitignore.sh
    - sh util/check-trailing-whitespace.sh
    - bash util/unused-headers.sh
    # Check that every rdata source file is registered for header generation
    - meson setup build
    - bash util/check-rdata-registration.sh build
    # Check dangling symlinks in the repository
    - if find . -xtype l | grep .; then exit 1; fi
    - muon-meson analyze -Werror
  artifacts:
    paths:
      - checklibs.out
    when: on_failure

black:
  <<: *quick_checks_job
  <<: *python_triggering_rules
  script:
    - black $(git ls-files '*.py')
    - git diff > black.patch
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
  artifacts:
    paths:
      - black.patch
    expire_in: "1 week"
    when: on_failure

vulture:
  <<: *quick_checks_job
  <<: *python_triggering_rules
  script:
    - vulture

ci-variables:
  <<: *quick_checks_job
  script:
    # When testing a .0 release, compare it against the previous development
    # release (e.g., 9.19.0 and 9.18.0 should both be compared against 9.17.22).
    - export BIND_BASELINE_TAG=$(meson introspect meson.build --projectinfo | ./util/select-baseline-version.jq)
    - BIND_BASELINE_VERSION="$(curl -s -G -d "version=^${BIND_BASELINE_TAG}" -d "order_by=version" "https://gitlab.isc.org/api/v4/projects/1/repository/tags" | jq -r '.[0].name')"
    - echo "BIND_BASELINE_VERSION=$BIND_BASELINE_VERSION" >> ci_vars.env
  artifacts:
    reports:
      dotenv: ci_vars.env

ci-orphaned-anchors:
  <<: *quick_checks_job
  script:
    - *git_clone_bind9-qa
    - >
      "$CI_PROJECT_DIR"/bind9-qa/ci-orphaned-anchors/check_orphaned_anchors_ci.py .gitlab-ci.yml
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      changes:
        - .gitlab-ci.yml

clang-format:
  <<: *quick_checks_job
  rules:
    - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
      changes:
        - '**/*.c'
        - '**/*.h'
        - '**/.clang-format'
        - '**/.clang-format.headers'
    - *rule_mr_manual
    - *rule_tag
    - *rule_source_other_than_mr
    - *rule_branch_after_autorebase
  script:
    - if [ -r .clang-format ]; then "${CLANG_FORMAT}" -i -style=file $(git ls-files '*.c' '*.h'); fi
    - git diff > clang-format.patch
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
  artifacts:
    paths:
      - clang-format.patch
    expire_in: "1 week"
    when: on_failure

meson-format:
  <<: *quick_checks_job
  rules:
    - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
      changes:
        - '**/meson.build'
    - *rule_mr_manual
    - *rule_tag
    - *rule_source_other_than_mr
    - *rule_branch_after_autorebase
  script:
    - git ls-files "*meson.build" | xargs muon-meson fmt -i
    - git diff > meson-format.patch
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
  artifacts:
    paths:
      - meson-format.patch
    expire_in: "1 week"
    when: on_failure

doctest:
  <<: *quick_checks_job
  # This script needs to: 1) fail if the doctest fails, 2) fail if
  # the junit.xml file is broken, 3) produce the junit.xml file even if
  # the doctest fails.  Therefore, $RET is used to "cache" the
  # result of running pytest as interrupting the script immediately when
  # a doctest fails would make checking the contents of the junit.xml
  # file impossible (GitLab Runner uses "set -o pipefail").
  script:
    - *configure
    - meson compile -C build system-test-init
    - *find_python
    - *find_pytest
    - cd bin/tests/system/isctest
    - RET=0
    - >
      "$PYTEST" --noconftest --doctest-modules --junit-xml="$CI_PROJECT_DIR/junit_doctest.xml" || RET=1
    - *git_clone_bind9-qa
    - >
      "$PYTHON" "$CI_PROJECT_DIR"/bind9-qa/ci/postprocess_junit_files.py "$CI_PROJECT_DIR/junit_doctest.xml" --output "$CI_PROJECT_DIR/junit.xml"
    - (exit $RET)
  artifacts:
    reports:
      junit:
        - junit.xml

pylint:
  <<: *quick_checks_job
  <<: *python_triggering_rules
  script:
    - pylint $(git ls-files '*.py')

ruff:
  <<: *quick_checks_job
  <<: *python_triggering_rules
  script:
    - ruff check

reuse:
  <<: *quick_checks_job
  image:
    name: docker.io/fsfe/reuse:latest
    entrypoint: [""]
  script:
    - reuse lint

shfmt:
  <<: *quick_checks_job
  <<: *shell_triggering_rules
  script:
    - shfmt -w -i 2 -ci -bn . $(find . -name "*.sh.in")
    - git diff > shfmt.patch
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
  artifacts:
    paths:
      - shfmt.patch
    expire_in: "1 week"
    when: on_failure

danger:
  <<: *quick_checks_job
  script:
    - pip install git+https://gitlab.isc.org/isc-projects/hazard.git
    - hazard
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

mypy:
  <<: *quick_checks_job
  <<: *python_triggering_rules
  script:
    - mypy "bin/tests/system/isctest/"

linkcheck:
  <<: *quick_checks_job
  script:
    # Some domains tested by linkchecker may think that we connect to them too
    # often and will refuse connection or reply with and error code, which
    # makes this job fail. Let's check links only on Wednesdays.
    - if [ "$(date +%w)" != "3" ]; then exit 0; fi
    - pushd doc/arm/ > /dev/null && sphinx-build -b linkcheck . linkcheck_output/
  artifacts:
    paths:
      - doc/arm/linkcheck_output/
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'

generate-stress-test-configs:
  <<: *quick_checks_job
  script:
    - *git_clone_bind9-qa
    - >
      "$CI_PROJECT_DIR"/bind9-qa/stress/generate_stress_test_configs.py > stress-test-configs.yml
  artifacts:
    paths:
      - stress-test-configs.yml

generate-tsan-stress-test-configs:
  <<: *quick_checks_job
  script:
    - *git_clone_bind9-qa
    - >
      "$CI_PROJECT_DIR"/bind9-qa/stress/generate_tsan_stress_jobs.py > tsan-stress-test-configs.yml
  artifacts:
    paths:
      - tsan-stress-test-configs.yml
  when: manual

# Jobs in the other-checks stage

checkbashisms:
  <<: *other_checks_job
  <<: *shell_triggering_rules
  script:
    - checkbashisms $(find . -path './.git' -prune -o -type f -exec sh -c 'head -n 1 "{}" | grep -qsF "#!/bin/sh"' \; -print)

coccinelle:
  <<: *other_checks_job
  rules:
    - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
      changes:
        - '**/*.c'
        - '**/*.h'
        - 'cocci/**'
        - 'util/check-cocci.sh'
    - *rule_mr_manual
    - *rule_tag
    - *rule_source_other_than_mr
    - *rule_branch_after_autorebase
  script:
    - util/check-cocci.sh
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi

# Jobs for scan-build builds on Debian 13 "trixie" (amd64)

.scan_build: &scan_build
  - ${SCAN_BUILD} --html-title="BIND 9 ($CI_COMMIT_SHORT_SHA)"
                  --keep-cc
                  --status-bugs
                  --keep-going
                  -o scan-build.reports ninja -C build

scan-build:
  <<: *other_checks_job
  variables:
    CC: "${CLANG}"
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Didn=enabled --native-file ci/clang-trixie.ini"
  before_script:
    - *list_installed_package_versions
  script:
    - *configure
    - *scan_build
  artifacts:
    paths:
      - scan-build.reports/
    when: on_failure

# Coverity Scan analysis upload

.coverity_prep: &coverity_prep
  - curl --output /tmp/cov-analysis-linux64.md5 https://scan.coverity.com/download/linux64
         --form project=$COVERITY_SCAN_PROJECT_NAME
         --form token=$COVERITY_SCAN_TOKEN
         --form md5=1
  - curl --output /tmp/cov-analysis-linux64.tgz https://scan.coverity.com/download/linux64
         --form project=$COVERITY_SCAN_PROJECT_NAME
         --form token=$COVERITY_SCAN_TOKEN
  - test "$(md5sum /tmp/cov-analysis-linux64.tgz | awk '{ print $1 }')" = "$(cat /tmp/cov-analysis-linux64.md5)"
  - tar --extract --gzip --file=/tmp/cov-analysis-linux64.tgz --directory=/tmp
  - test -d /tmp/cov-analysis-linux64-*

.coverity_build: &coverity_build
  - /tmp/cov-analysis-linux64-*/bin/cov-build --dir /tmp/cov-int sh -c 'ninja -C ./build -v'
  - tar --create --gzip --file=/tmp/cov-int.tar.gz --directory /tmp cov-int
  - curl -v https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME
        --form token=$COVERITY_SCAN_TOKEN
        --form email=bind-changes@isc.org
        --form file=@/tmp/cov-int.tar.gz
        --form version="$(git rev-parse --short HEAD)"
        --form description="$(git rev-parse --short HEAD) / $CI_COMMIT_TITLE / $CI_COMMIT_REF_NAME:$CI_PIPELINE_ID" 2>&1
        | tee curl-response.txt
  - grep -q 'Build successfully submitted' curl-response.txt

coverity:
  <<: *other_checks_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Doptimization=g -Ddoc=disabled -Didn=enabled"
  script:
    - *coverity_prep
    - *configure
    - *coverity_build
  after_script:
    - mv -v /tmp/cov-int.tar.gz ${CI_PROJECT_DIR}/
  artifacts:
    paths:
      - curl-response.txt
      - cov-int.tar.gz
    expire_in: "1 week"
    when: on_failure
  rules:
    - if: '$COVERITY_SCAN_PROJECT_NAME != null && $COVERITY_SCAN_TOKEN != null'

# Simple reproductibilty test, needs an image with meson >=1.6.0
reproducible-build:
  <<: *other_checks_job
  <<: *alpine_3_24_amd64_image
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
  before_script:
    - *list_installed_package_versions
  script:
    # dnstap produces an intermediate .a file, and meson considers all .a
    # files to be final results independently of whether they are installed
    # or not. But the content of the .a file is unstable under LTO because
    # -ffat-lto-objects embeds non-deterministic GIMPLE bytecode. Hence we
    # disable dnstap for reproducibility tests.
    - meson reprotest -- -Ddnstap=disabled
  artifacts:
    untracked: true
    when: on_failure

# git fsck operates over the whole repository and is sufficient to schedule it
# only in one branch, preferably "main". GitLab's clone strategy prevents us
# from using the "bind9" repo clone; we need to clone it ourselves.
fsck:
  <<: *other_checks_job
  variables:
    GIT_STRATEGY: none
  script:
    - git clone https://gitlab.isc.org/isc-projects/bind9.git bind9-full-clone
    - cd bind9-full-clone/
    - git fsck
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'

tarball-create:
  <<: *build_job
  <<: *base_image
  script:
    - *configure
    - meson dist -C build --no-tests
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; git diff > diff.patch; exit 1; fi
  artifacts:
    paths:
      - diff.patch
      - build/meson-dist/*.tar.xz
  needs: []

# Jobs for doc builds on Debian 13 "trixie" (amd64)

changelog:
  <<: *base_image
  <<: *docs_job
  rules:
    - if: '$CI_MERGE_REQUEST_TITLE =~ /\s(dev|usr|pkg):/'
  before_script:
    - echo -e "$CI_MERGE_REQUEST_TITLE\n" > commitmsg
    - sed -i 's/^Draft:\s*//' commitmsg
    - echo -e "$CI_MERGE_REQUEST_DESCRIPTION" >> commitmsg
    - git commit --allow-empty -F commitmsg
    - export CHANGELOG=$(ls doc/changelog/changelog-9.* | sort --version-sort | tail -n 1)
    - printf "\n" >> $CHANGELOG
    - ./contrib/gitchangelog/gitchangelog.py HEAD^..HEAD >> $CHANGELOG
  after_script:
    - git diff
  needs: []
  artifacts:
    untracked: true

docs:
  <<: *default_triggering_rules
  <<: *base_image
  <<: *docs_job
  before_script:
    - *list_installed_package_versions
  variables:
    DOC_CHECK_MISC_CHANGE: 1
  needs: []
  artifacts:
    untracked: true
    when: always

docs:tarball:
  <<: *default_triggering_rules
  <<: *base_image
  <<: *docs_job
  before_script:
    - *unpack_release_tarball
  needs:
    - job: tarball-create
      artifacts: true

# Job detecting named.conf breakage introduced since the previous point release

cross-version-config-tests:
  stage: system
  <<: *base_image
  <<: *default_triggering_rules
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
  script:
    - *configure
    - *setup_interfaces
    - meson compile -C build system-test-init system-test-dependencies
    - meson compile -C build
    - *find_python
    - *find_pytest
    - git clone --branch "${BIND_BASELINE_VERSION}" --depth 1 https://gitlab.isc.org/isc-projects/bind9.git "bind-${BIND_BASELINE_VERSION}"
    - cd "bind-${BIND_BASELINE_VERSION}"
    # The cross-version-config-tests job would fail when a system test is
    # removed from the upcoming release. To avoid this, remove the system test
    # also from the $BIND_BASELINE_VERSION.
    - find bin/tests/system/ -mindepth 1 -maxdepth 1 -type d -exec sh -c 'test -e ../"$0" || rm -rfv -- "$0"' {} \;
    # @DYLIB@ is missing
    - cp ../bin/tests/system/isctest/vars/basic.py ./bin/tests/system/isctest/vars/basic.py
    - cp ../bin/tests/system/isctest/vars/.build_vars/TOP_BUILDDIR ./bin/tests/system/isctest/vars/.build_vars/TOP_BUILDDIR
    - echo "${CI_PROJECT_DIR}/bind-${BIND_BASELINE_VERSION}" > ../build/bin/tests/system/isctest/vars/.build_vars/TOP_SRCDIR
    - cd ./bin/tests/system
    # System tests that employ binary drivers will fail on ABI change and
    # should not be run.
    - rm -r dlzexternal
    - rm -r dyndb
    # This script needs to: 1) fail if the tests fail, 2) fail if
    # the junit.xml file is broken, 3) produce the junit.xml file even if
    # the  tests fail.  Therefore, $RET is used to "cache" the
    # result of running pytest as interrupting the script immediately when
    # system tests fail would make checking the contents of the junit.xml
    # file impossible (GitLab Runner uses "set -o pipefail").
    - RET=0
    - >
      "$PYTEST" --setup-only --junit-xml="$CI_PROJECT_DIR"/junit_pytest.xml -n "${TEST_PARALLEL_JOBS:-1}" || RET=1
    - *git_clone_bind9-qa
    - >
      "$PYTHON" "$CI_PROJECT_DIR"/bind9-qa/ci/postprocess_junit_files.py "$CI_PROJECT_DIR"/junit_pytest.xml --output "$CI_PROJECT_DIR"/junit.xml
    - (exit $RET)
  needs:
    - job: ci-variables
      artifacts: true
  artifacts:
    reports:
      junit: junit.xml
    paths:
      - bind-*
      - junit.xml
    untracked: true
    expire_in: "1 day"
    when: always
  allow_failure: true # !12163, commit 9771df0a

# Jobs for regular GCC builds on Alpine Linux 3.24 (amd64)

gcc:alpine3.24:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "${WITHOUT_LIBEDIT}"
  <<: *alpine_3_24_amd64_image
  <<: *build_job

system:gcc:alpine3.24:amd64:
  <<: *alpine_3_24_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:alpine3.24:amd64
      artifacts: true

unit:gcc:alpine3.24:amd64:
  <<: *alpine_3_24_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:alpine3.24:amd64
      artifacts: true

# Jobs for regular GCC builds on Alma Linux 8 (amd64)

gcc:almalinux8:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Didn=enabled"
  <<: *almalinux_8_amd64_image
  <<: *build_job

system:gcc:almalinux8:amd64:
  <<: *almalinux_8_amd64_image
  <<: *system_test_job
  <<: *extra_system_tests_triggering_rules
  needs:
    - job: gcc:almalinux8:amd64
      artifacts: true

unit:gcc:almalinux8:amd64:
  <<: *almalinux_8_amd64_image
  <<: *unit_test_job
  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
  needs:
    - job: gcc:almalinux8:amd64
      artifacts: true

# Jobs for regular GCC builds on Alma Linux 9 (amd64)

gcc:almalinux9:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Didn=enabled -Ddeveloper=disabled"
  <<: *almalinux_9_amd64_image
  <<: *build_job

system:gcc:almalinux9:amd64:
  <<: *almalinux_9_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:almalinux9:amd64
      artifacts: true

unit:gcc:almalinux9:amd64:
  <<: *almalinux_9_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:almalinux9:amd64
      artifacts: true

# Jobs for regular GCC builds on Alma Linux 10 (amd64)

gcc:almalinux10:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Didn=enabled"
  <<: *almalinux_10_amd64_image
  <<: *build_job

system:gcc:almalinux10:amd64:
  <<: *almalinux_10_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:almalinux10:amd64
      artifacts: true

unit:gcc:almalinux10:amd64:
  <<: *almalinux_10_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:almalinux10:amd64
      artifacts: true

# Jobs for scheduled GCC builds on AlmaLinux 8 & 9 FIPS-aware images with FIPS
# mode in BIND 9 enabled

gcc:8fips:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Didn=enabled -Dfips=enabled -Dtracing=disabled"
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  <<: *almalinux_8fips_amd64_image
  <<: *build_job

system:gcc:8fips:amd64:
  <<: *almalinux_8fips_amd64_image
  <<: *system_test_job
  <<: *extra_system_tests_triggering_rules
  variables:
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  needs:
    - job: gcc:8fips:amd64
      artifacts: true

unit:gcc:8fips:amd64:
  <<: *almalinux_8fips_amd64_image
  <<: *unit_test_job
  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
  variables:
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  needs:
    - job: gcc:8fips:amd64
      artifacts: true

gcc:9fips:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Didn=enabled -Dfips=enabled -Dleak-detection=disabled"
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  <<: *almalinux_9fips_amd64_image
  <<: *build_job

system:gcc:9fips:amd64:
  <<: *almalinux_9fips_amd64_image
  <<: *system_test_job
  <<: *extra_system_tests_triggering_rules
  variables:
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  needs:
    - job: gcc:9fips:amd64
      artifacts: true

unit:gcc:9fips:amd64:
  <<: *almalinux_9fips_amd64_image
  <<: *unit_test_job
  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
  variables:
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  needs:
    - job: gcc:9fips:amd64
      artifacts: true

gcc:10fips:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Didn=enabled -Dfips=enabled -Dleak-detection=disabled"
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  <<: *almalinux_10fips_amd64_image
  <<: *build_job

system:gcc:10fips:amd64:
  <<: *almalinux_10fips_amd64_image
  <<: *system_test_job
  variables:
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  needs:
    - job: gcc:10fips:amd64
      artifacts: true

unit:gcc:10fips:amd64:
  <<: *almalinux_10fips_amd64_image
  <<: *unit_test_job
  variables:
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  needs:
    - job: gcc:10fips:amd64
      artifacts: true

gcc:tarball:nosphinx:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Didn=enabled -Ddeveloper=disabled"
    RUN_MESON_INSTALL: 1
  <<: *almalinux_9_amd64_image
  <<: *build_job
  before_script:
    - *list_installed_package_versions
    - (! command -v sphinx-build >/dev/null)
    - *unpack_release_tarball
  needs:
    - job: tarball-create
      artifacts: true

# Jobs for regular GCC builds on Debian 12 "bookworm" (amd64)

gcc:bookworm:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Didn=enabled"
  <<: *debian_bookworm_amd64_image
  <<: *build_job

system:gcc:bookworm:amd64:
  <<: *debian_bookworm_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:bookworm:amd64
      artifacts: true

unit:gcc:bookworm:amd64:
  <<: *debian_bookworm_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:bookworm:amd64
      artifacts: true

# Jobs for regular GCC builds on Debian 13 "trixie" (amd64)

gcc:trixie:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    # Tracing needs to be disabled otherwise gcovr fails
    EXTRA_CONFIGURE: "-Doptimization=0 -Db_coverage=true -Dtracing=disabled -Didn=enabled ${WITH_LIBEDIT}"
    RUN_MESON_INSTALL: 1
  <<: *debian_trixie_amd64_image
  <<: *build_job

system:gcc:trixie:amd64:
  <<: *debian_trixie_amd64_image
  <<: *system_test_job
  variables:
    CI_ENABLE_LONG_TESTS: 1
    CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 0
    TZ: Australia/Sydney
  # using artifacts from unit test job is required for gcov
  needs:
    - job: unit:gcc:trixie:amd64
      artifacts: true
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      variables:
        CI_ENABLE_LIVE_INTERNET_TESTS: 1
    - *default_triggering_rules_list

unit:gcc:trixie:amd64:
  <<: *debian_trixie_amd64_image
  <<: *unit_test_job
  variables:
    CI_ENABLE_LONG_TESTS: 1
    CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 0
  needs:
    - job: gcc:trixie:amd64
      artifacts: true

# Minimal jobs for regular GCC builds on Debian 13 "trixie" (amd64)

minimal:gcc:trixie:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Dauto_features=disabled -Dcmocka=enabled -Ddeveloper=disabled -Doptimization=s"
  <<: *debian_trixie_amd64_image
  <<: *build_job

system:minimal:gcc:trixie:amd64:
  <<: *debian_trixie_amd64_image
  <<: *system_test_job
  needs:
    - job: minimal:gcc:trixie:amd64
      artifacts: true

unit:minimal:gcc:trixie:amd64:
  <<: *debian_trixie_amd64_image
  <<: *unit_test_job
  needs:
    - job: minimal:gcc:trixie:amd64
      artifacts: true

# Build job for cross-compiled GCC builds on 64-bit Debian 13 "trixie"
# (amd64) with 32-bit BIND 9.

gcc:trixie:amd64cross32:
  variables:
    CFLAGS: "${CFLAGS_COMMON}"
    CROSS_COMPILATION: 1
    EXTRA_CONFIGURE: "--cross-file ci/amd64cross32.ini -Didn=enabled -Dgssapi=disabled -Dtracing=disabled ${WITH_LIBEDIT}"
  <<: *debian_trixie_amd64cross32_image
  <<: *build_job

# Jobs for regular GCC builds on Debian 13 "trixie" (386)

gcc:trixie:386:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Didn=enabled"
  <<: *debian_trixie_386_image
  <<: *build_job

system:gcc:trixie:386:
  <<: *debian_trixie_386_image
  <<: *system_test_job
  needs:
    - job: gcc:trixie:386
      artifacts: true

unit:gcc:trixie:386:
  <<: *debian_trixie_386_image
  <<: *unit_test_job
  needs:
    - job: gcc:trixie:386
      artifacts: true

# Run with pkcs11-provider tests
gcc:ossl3:trixie:amd64:
  <<: *debian_trixie_amd64_image
  <<: *build_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
    EXTRA_CONFIGURE: "-Doptimization=3 -Djemalloc=disabled -Dleak-detection=disabled"
    RUN_MESON_INSTALL: 1

system:gcc:ossl3:trixie:amd64:
  # Set up environment variables to run pkcs11-provider based system tests
  variables:
    OPENSSL_CONF: "/var/tmp/etc/openssl-provider.cnf"
    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
  <<: *debian_trixie_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:ossl3:trixie:amd64
      artifacts: true

unit:gcc:ossl3:amd64:
  # Set up environment variables to run unit tests with PKCS#11-aware OpenSSL
  variables:
    OPENSSL_CONF: "/var/tmp/etc/openssl-provider.cnf"
    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
  <<: *debian_trixie_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:ossl3:trixie:amd64
      artifacts: true

# Jobs for regular GCC builds on Debian "sid" (amd64)

gcc:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *build_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Doptimization=3 -Didn=enabled"

system:gcc:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  <<: *extra_system_tests_triggering_rules
  needs:
    - job: gcc:sid:amd64
      artifacts: true

unit:gcc:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
  needs:
    - job: gcc:sid:amd64
      artifacts: true

# Jobs for tarball GCC builds on Debian 13 "trixie" (amd64)

gcc:tarball:
  variables:
    CC: gcc
    EXTRA_CONFIGURE: "-Didn=enabled"
    RUN_MESON_INSTALL: 1
  <<: *base_image
  <<: *build_job
  before_script:
    - *list_installed_package_versions
    - *unpack_release_tarball
  needs:
    - job: tarball-create
      artifacts: true

system:gcc:tarball:
  <<: *base_image
  <<: *system_test_job
  before_script:
    - cd bind-*
    - *setup_interfaces
  after_script:
    - cd bind-*
    - *display_pytest_failures
  needs:
    - job: gcc:tarball
      artifacts: true

unit:gcc:tarball:
  <<: *base_image
  <<: *unit_test_job
  before_script:
    - cd bind-*
  needs:
    - job: gcc:tarball
      artifacts: true

# Jobs for debug GCC builds on openSUSE Tumbleweed (amd64)

gcc:tumbleweed:amd64:
  <<: *tumbleweed_latest_amd64_image
  <<: *build_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -DDEBUG"
    EXTRA_CONFIGURE: "-Didn=enabled -Dgssapi=disabled ${WITH_LIBEDIT}"

system:gcc:tumbleweed:amd64:
  <<: *tumbleweed_latest_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:tumbleweed:amd64
      artifacts: true

unit:gcc:tumbleweed:amd64:
  <<: *tumbleweed_latest_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:tumbleweed:amd64
      artifacts: true

# Jobs for regular GCC builds on Ubuntu 22.04 Jammy Jellyfish (amd64)

gcc:jammy:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Dgeoip=disabled -Didn=enabled -Ddoh=disabled -Dcmocka=disabled -Ddnstap=disabled -Dgssapi=disabled"
  <<: *ubuntu_jammy_amd64_image
  <<: *build_job

system:gcc:jammy:amd64:
  <<: *ubuntu_jammy_amd64_image
  <<: *system_test_job
  <<: *extra_system_tests_triggering_rules
  needs:
    - job: gcc:jammy:amd64
      artifacts: true

unit:gcc:jammy:amd64:
  <<: *ubuntu_jammy_amd64_image
  <<: *unit_test_job
  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
  needs:
    - job: gcc:jammy:amd64
      artifacts: true

# Jobs for regular GCC builds on Ubuntu 24.04 Noble Numbat (amd64)

gcc:noble:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Didn=enabled"
  <<: *ubuntu_noble_amd64_image
  <<: *build_job

system:gcc:noble:amd64:
  <<: *ubuntu_noble_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:noble:amd64
      artifacts: true

unit:gcc:noble:amd64:
  <<: *ubuntu_noble_amd64_image
  <<: *unit_test_job
  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
  needs:
    - job: gcc:noble:amd64
      artifacts: true

# Jobs for regular GCC builds on Ubuntu 26.04 Resolute Raccoon (amd64)

gcc:resolute:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Didn=enabled"
  <<: *ubuntu_resolute_amd64_image
  <<: *build_job

system:gcc:resolute:amd64:
  <<: *ubuntu_resolute_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:resolute:amd64
      artifacts: true

unit:gcc:resolute:amd64:
  <<: *ubuntu_resolute_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:resolute:amd64
      artifacts: true

# Jobs for ASAN builds on Fedora 44 (amd64)

gcc:asan:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Db_sanitize=address,undefined -Didn=enabled -Djemalloc=disabled -Dtracing=disabled"
  <<: *fedora_44_amd64_image
  <<: *build_job

system:gcc:asan:
  <<: *fedora_44_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:asan
      artifacts: true

unit:gcc:asan:
  <<: *fedora_44_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:asan
      artifacts: true

clang:asan:
  variables:
    CC: ${CLANG}
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Db_sanitize=address,undefined -Db_lundef=false -Didn=enabled -Djemalloc=disabled -Dtracing=disabled --native-file ci/clang-trixie.ini"
  <<: *base_image
  <<: *build_job

system:clang:asan:
  <<: *base_image
  <<: *system_test_job
  <<: *extra_system_tests_triggering_rules
  needs:
    - job: clang:asan
      artifacts: true

unit:clang:asan:
  <<: *base_image
  <<: *unit_test_job
  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
  needs:
    - job: clang:asan
      artifacts: true

# Jobs for TSAN builds on Fedora 44 (amd64)

gcc:tsan:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Wno-stringop-overread"
    LDFLAGS: "-Wl,--disable-new-dtags"
    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON}"
  <<: *tsan_fedora_44_amd64_image
  <<: *build_job

system:gcc:tsan:
  variables:
    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_FEDORA}"
  <<: *tsan_fedora_44_amd64_image
  <<: *system_test_tsan_job
  <<: *extra_system_tests_triggering_rules
  needs:
    - job: gcc:tsan
      artifacts: true

unit:gcc:tsan:
  variables:
    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_FEDORA}"
  <<: *tsan_fedora_44_amd64_image
  <<: *unit_test_tsan_job
  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
  needs:
    - job: gcc:tsan
      artifacts: true

clang:tsan:
  <<: *tsan_debian_trixie_amd64_image
  <<: *build_job
  variables:
    CC: "${CLANG}"
    CFLAGS: "${CFLAGS_COMMON}"
    LDFLAGS: "-Wl,--disable-new-dtags"
    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false --native-file ci/clang-trixie.ini"

system:clang:tsan:
  variables:
    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
  <<: *tsan_debian_trixie_amd64_image
  <<: *system_test_tsan_job
  needs:
    - job: clang:tsan
      artifacts: true

unit:clang:tsan:
  variables:
    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
  <<: *tsan_debian_trixie_amd64_image
  <<: *unit_test_tsan_job
  needs:
    - job: clang:tsan
      artifacts: true

tsan:stress:
  <<: *default_triggering_rules
  stage: system
  # In a downstream pipeline, yaml variables inherited from the parent outrank
  # the child's job-level `variables:` block. Inherit only what the child
  # actually needs (image lookup), so the parent's RUNNER_SCRIPT_TIMEOUT does
  # not override the per-job values set in the generated child config.
  inherit:
    variables:
      - CI_REGISTRY_IMAGE
  variables:
    PARENT_PIPELINE_ID: $CI_PIPELINE_ID
  trigger:
    include:
      - artifact: tsan-stress-test-configs.yml
        job: generate-tsan-stress-test-configs
  needs:
    - job: generate-tsan-stress-test-configs
      artifacts: true
    - job: gcc:tsan
      artifacts: true
    - job: clang:tsan
      artifacts: true

# Jobs for Clang builds on Debian 13 "trixie" (amd64)

clang:trixie:amd64:
  variables:
    CC: ${CLANG}
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "--native-file ci/clang-trixie.ini"
    RUN_MESON_INSTALL: 1
  <<: *debian_trixie_amd64_image
  <<: *build_job

system:clang:trixie:amd64:
  <<: *debian_trixie_amd64_image
  <<: *system_test_job
  <<: *extra_system_tests_triggering_rules
  needs:
    - job: clang:trixie:amd64
      artifacts: true

unit:clang:trixie:amd64:
  <<: *debian_trixie_amd64_image
  <<: *unit_test_job
  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
  needs:
    - job: clang:trixie:amd64
      artifacts: true

# Jobs for Clang builds on FreeBSD 13 (amd64)

clang:freebsd13:amd64:
  variables:
    CC: clang
    CFLAGS: "${CFLAGS_COMMON}"
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
    # incompatibility; see https://bugs.freebsd.org/275241.
    EXTRA_CONFIGURE: "${WITH_LIBEDIT} -Doptimization=g --native-file ci/freebsd.ini"
  <<: *build_job
  <<: *freebsd_autoscaler_13_amd64_tags

system:clang:freebsd13:amd64:
  variables:
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  needs:
    - job: clang:freebsd13:amd64
      artifacts: true
  <<: *system_test_job
  <<: *freebsd_autoscaler_13_amd64_tags
  <<: *extra_system_tests_triggering_rules

unit:clang:freebsd13:amd64:
  variables:
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  needs:
    - job: clang:freebsd13:amd64
      artifacts: true
  <<: *unit_test_job
  <<: *freebsd_autoscaler_13_amd64_tags
  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules

# Jobs for Clang builds on FreeBSD 14 (amd64)

clang:freebsd14:amd64:
  variables:
    CC: clang
    CFLAGS: "${CFLAGS_COMMON}"
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
    # incompatibility; see https://bugs.freebsd.org/275241.
    EXTRA_CONFIGURE: "${WITH_LIBEDIT} -Doptimization=g --native-file ci/freebsd.ini"
  <<: *build_job
  <<: *freebsd_autoscaler_14_amd64_tags

system:clang:freebsd14:amd64:
  variables:
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  needs:
    - job: clang:freebsd14:amd64
      artifacts: true
  <<: *system_test_job
  <<: *freebsd_autoscaler_14_amd64_tags

unit:clang:freebsd14:amd64:
  variables:
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  needs:
    - job: clang:freebsd14:amd64
      artifacts: true
  retry: 1  # GL #4924
  <<: *unit_test_job
  <<: *freebsd_autoscaler_14_amd64_tags

# Jobs for Clang builds on FreeBSD 15 (amd64)

clang:freebsd15:amd64:
  variables:
    CC: clang
    CFLAGS: "${CFLAGS_COMMON}"
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
    # incompatibility; see https://bugs.freebsd.org/275241.
    EXTRA_CONFIGURE: "${WITH_LIBEDIT} -Doptimization=g --native-file ci/freebsd.ini"
  <<: *build_job
  <<: *freebsd_autoscaler_15_amd64_tags

system:clang:freebsd15:amd64:
  variables:
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  needs:
    - job: clang:freebsd15:amd64
      artifacts: true
  <<: *system_test_job
  <<: *freebsd_autoscaler_15_amd64_tags

unit:clang:freebsd15:amd64:
  variables:
    GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
  needs:
    - job: clang:freebsd15:amd64
      artifacts: true
  <<: *unit_test_job
  <<: *freebsd_autoscaler_15_amd64_tags

# Build and run tests against the latest git version of libuv

gcc:tumbleweed:libuv-git:amd64:
  <<: *tumbleweed_latest_amd64_image
  <<: *build_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -DDEBUG"
    EXTRA_CONFIGURE: "-Didn=enabled ${WITH_LIBEDIT}"
  before_script:
    - *list_installed_package_versions
    - zypper --non-interactive rm --clean-deps libuv-devel
    - git clone --depth 1 https://github.com/libuv/libuv.git /tmp/libuv
    - cd /tmp/libuv
    - sh autogen.sh
    - ./configure --prefix="$CI_PROJECT_DIR/libuv"
    - make -j"$BUILD_PARALLEL_JOBS" CFLAGS=""
    - make install
    - cd "$CI_PROJECT_DIR"
    - export PKG_CONFIG_PATH="$CI_PROJECT_DIR/libuv/lib/pkgconfig:${PKG_CONFIG_PATH:-}"
  rules:
    - *rule_source_other_than_mr

system:gcc:tumbleweed:libuv-git:amd64:
  <<: *tumbleweed_latest_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:tumbleweed:libuv-git:amd64
      artifacts: true
  rules:
    - *rule_source_other_than_mr

unit:gcc:tumbleweed:libuv-git:amd64:
  <<: *tumbleweed_latest_amd64_image
  <<: *unit_test_job
  before_script:
    - build/named -V > named.version
    - "grep -E '^compiled with libuv version: [0-9]+\\.[0-9]+\\.[0-9]+$' named.version"
    - "grep -E '^linked to libuv version: [0-9]+\\.[0-9]+\\.[0-9]+-dev$' named.version"
  needs:
    - job: gcc:tumbleweed:libuv-git:amd64
      artifacts: true
  rules:
    - *rule_source_other_than_mr

# Job producing a release directory

release:
  <<: *base_image
  stage: release
  script:
    - export RELEASE_DIRECTORY="bind-${CI_COMMIT_TAG}-release"
    - export BIND_VERSION="bind-${CI_COMMIT_TAG#v}"
    # Prepare release tarball contents (tarballs + documentation)
    - mkdir -p "${RELEASE_DIRECTORY}/doc/arm"
    - pushd "${RELEASE_DIRECTORY}"
    - mv "../build/meson-dist/${BIND_VERSION}.tar.xz" .
    - tar --extract --file="${BIND_VERSION}.tar.xz" --strip-components=1 "${BIND_VERSION}"/{COPYRIGHT,LICENSE,README.md,srcid}
    - mv ../build/arm/ doc/arm/html/
    - mv ../build/arm-epub/Bv9ARM.epub doc/arm/
    - echo '<!DOCTYPE HTML><html lang="en"><meta http-equiv="refresh" content="0; url=doc/arm/html/notes.html"><title>Redirect</title></html>' > "RELEASE-NOTES-${BIND_VERSION}.html"
    - echo '<!DOCTYPE HTML><html lang="en"><meta http-equiv="refresh" content="0; url=doc/arm/html/changelog.html"><title>Redirect</title></html>' > "CHANGELOG-${BIND_VERSION}.html"
    - popd
  needs:
    - job: tarball-create
      artifacts: true
    - job: docs
      artifacts: true
  tags:
    - smalljob
  rules:
    - *rule_tag
  artifacts:
    paths:
      - bind-${CI_COMMIT_TAG}-release
    expire_in: "1 month"

.manual_release_job: &manual_release_job
  stage: release
  when: manual

.signer-ssh-job: &signer_ssh_job
  <<: *manual_release_job
  allow_failure: false
  tags:
    - signer
  script:
    - ( rm -f "/tmp/${CI_JOB_NAME}.log" "/tmp/${CI_JOB_NAME}-done" && umask 111 && touch "/tmp/${CI_JOB_NAME}.log" "/tmp/${CI_JOB_NAME}-done" )
    - |
      cat > "/tmp/${CI_JOB_NAME}.sh" <<EOF
      #!/bin/sh
      set -e -x
      {
        ${SSH_SCRIPT_CLIENT}
        echo "${CI_COMMIT_TAG}" > "/tmp/${CI_JOB_NAME}-done"
      } 2>&1 | tee "/tmp/${CI_JOB_NAME}.log"
      EOF
    - chmod +x "/tmp/${CI_JOB_NAME}.sh"
    - /bin/sh -c "set -e -x; ${SSH_SCRIPT_RUNNER_PRE}"
    - echo -e "\e[31m*** Sleeping until /tmp/${CI_JOB_NAME}.sh is executed over SSH... ⌛\e[0m"
    - while [ "$(cat "/tmp/${CI_JOB_NAME}-done")" != "${CI_COMMIT_TAG}" ]; do sleep 10; done
    - /bin/sh -c "set -e -x; ${SSH_SCRIPT_RUNNER_POST}"
    - cp "/tmp/${CI_JOB_NAME}.log" "${CI_PROJECT_DIR}/${CI_JOB_NAME}-${CI_COMMIT_TAG}.log"
    - rm -f "/tmp/${CI_JOB_NAME}.log" "/tmp/${CI_JOB_NAME}-done" "/tmp/${CI_JOB_NAME}.sh"

# Job signing the source tarballs in the release directory

sign:
  <<: *signer_ssh_job
  before_script:
    - export SOURCE_TARBALL="bind-${CI_COMMIT_TAG#v}.tar.xz"
  variables:
    RELEASE_DIRECTORY: bind-${CI_COMMIT_TAG}-release
    SSH_SCRIPT_RUNNER_PRE: |-
      ( umask 111 && cat "${RELEASE_DIRECTORY}/$${SOURCE_TARBALL}" > "/tmp/${CI_COMMIT_TAG}.bin" )
    SSH_SCRIPT_CLIENT: |-
      gpg2 --local-user "$${SIGNING_KEY_FINGERPRINT}" --armor --digest-algo SHA512 --detach-sign --output "/tmp/${CI_COMMIT_TAG}.asc" "/tmp/${CI_COMMIT_TAG}.bin"
    SSH_SCRIPT_RUNNER_POST: |-
      cat "/tmp/${CI_COMMIT_TAG}.asc" > "${RELEASE_DIRECTORY}/$${SOURCE_TARBALL}.asc"
      tar --create --file="${RELEASE_DIRECTORY}".tar.gz --gzip "${RELEASE_DIRECTORY}"
      rm -f "/tmp/${CI_COMMIT_TAG}.bin" "/tmp/${CI_COMMIT_TAG}.asc"
  artifacts:
    paths:
      - bind-${CI_COMMIT_TAG}-release.tar.gz
      - sign-${CI_COMMIT_TAG}.log
    expire_in: never
  needs:
    - job: release
      artifacts: true
  rules:
    - *rule_tag

# Job staging the signed tarballs

staging:
  <<: *signer_ssh_job
  variables:
    RELEASE_TARBALL: bind-${CI_COMMIT_TAG}-release.tar.gz
    SSH_SCRIPT_RUNNER_PRE: |-
      mv "${RELEASE_TARBALL}" "/tmp/${RELEASE_TARBALL}"
    SSH_SCRIPT_CLIENT: |-
      scp "/tmp/${RELEASE_TARBALL}" "${STAGING_USER_UPLOAD}@${STAGING_HOST}:${STAGING_DIR}"
      ssh "${STAGING_USER_ACTIONS}@${STAGING_HOST}" "unpack ${CI_COMMIT_TAG}"
    SSH_SCRIPT_RUNNER_POST: |-
      rm -f "/tmp/${RELEASE_TARBALL}"
  artifacts:
    paths:
      - staging-${CI_COMMIT_TAG}.log
    expire_in: "1 month"
  needs:
    - job: sign
      artifacts: true
  rules:
    - *rule_tag

# Job copying a staged release to a secret location

publish-private:
  <<: *signer_ssh_job
  variables:
    SSH_SCRIPT_CLIENT: |-
      ssh "${STAGING_USER_ACTIONS}@${STAGING_HOST}" "publish-private ${CI_COMMIT_TAG}"
    SSH_SCRIPT_RUNNER_POST: |-
      awk '/^Public Use URL:/ {print $$NF}' "/tmp/${CI_JOB_NAME}.log" > "url-${CI_COMMIT_TAG}.txt"
  artifacts:
    paths:
      - publish-private-${CI_COMMIT_TAG}.log
      - url-${CI_COMMIT_TAG}.txt
    expire_in: "1 month"
  needs:
    - job: staging
      artifacts: false
  rules:
    - *rule_tag_security_or_subscription

# Job copying a staged release to a well-known location

publish:
  <<: *signer_ssh_job
  before_script:
    - TODAY="$(date +%Y-%m-%d)"
    - SCHEDULED_PUBLICATION="$(curl -m 5 -s "https://gitlab.isc.org/isc-projects/bind9-qa/-/raw/main/releng/metadata.json" | jq -r ".schedule.public")"
    - if [ -z "${FORCE_PUBLICATION}" ] && [ "${TODAY}" != "${SCHEDULED_PUBLICATION}" ]; then echo "Unscheduled publication denied; publication is scheduled for ${SCHEDULED_PUBLICATION}"; exit 1; fi
  variables:
    SSH_SCRIPT_CLIENT: |-
      ssh "${STAGING_USER_ACTIONS}@${STAGING_HOST}" "publish ${CI_COMMIT_TAG}"
  artifacts:
    paths:
      - publish-${CI_COMMIT_TAG}.log
    expire_in: "1 month"
  needs:
    - job: staging
      artifacts: false
  rules:
    - *rule_tag_open_source

publish-cleanup:
  <<: *base_image
  stage: release
  script:
    - *git_clone_bind9-qa
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/manage_distros_token.py delete
  needs:
    - job: publish
      artifacts: false
  tags:
    - smalljob
  rules:
    - *rule_tag_open_source_security

.manual_release_job_qa: &manual_release_job_qa
  <<: *manual_release_job
  <<: *base_image
  before_script:
    - *git_clone_bind9-qa
  needs:
    - job: staging
      artifacts: false
  tags:
    - smalljob

# Job assigning issues and merge requests to version milestones

assign-milestones:
  <<: *manual_release_job_qa
  needs:
    - job: sign
      artifacts: false
  variables:
    GIT_DEPTH: 1000
  script:
    - |
      "${CI_PROJECT_DIR}"/bind9-qa/releng/assign_mrs_to_versioned_milestones.py --version "${CI_COMMIT_TAG}" --metadata "${CI_PROJECT_DIR}"/bind9-qa/releng/metadata.json
  rules:
    - *rule_tag

# Jobs to update RPMs

.rpm-build-job-common: &rpm_build_job_common
  <<: *manual_release_job_qa
  # prevent Git push races between pipelines started for different tags
  resource_group: "rpm-build-${SERVICE}"
  after_script:
    - git -C bind/ remote get-url origin | sed "s|\.git$|/-/commit/$(cat commit.txt)|"
    - git -C bind/ show --color "$(cat commit.txt)" | sed "s|^$| |"

.rpm-build-job: &rpm_build_job
  <<: *rpm_build_job_common
  needs:
    - job: publish
      artifacts: false
  script:
    - >
      "${CI_PROJECT_DIR}"/bind9-qa/releng/update_rpms.py build --service "${SERVICE}" --version "${CI_COMMIT_TAG}"

.rpm-build-job-private: &rpm_build_job_private
  <<: *rpm_build_job_common
  needs:
    - job: publish-private
      artifacts: true
  script:
    - >
      "${CI_PROJECT_DIR}"/bind9-qa/releng/update_rpms.py build --service "${SERVICE}" --version "${CI_COMMIT_TAG}" --base-url "$(cat "url-${CI_COMMIT_TAG}.txt")"

.rpm-publish-job: &rpm_publish_job
  <<: *manual_release_job_qa
  script:
    - >
      "${CI_PROJECT_DIR}"/bind9-qa/releng/update_rpms.py publish --service "${SERVICE}" --commit "$(cat "commit.txt")"

# Update Cloudsmith packages

rpms-cloudsmith-build:
  <<: *rpm_build_job
  variables:
    SERVICE: cloudsmith
  rules:
    - *rule_tag_open_source_maintenance
  artifacts:
    paths:
      - commit.txt
    expire_in: "1 month"

rpms-cloudsmith-build-private:
  <<: *rpm_build_job_private
  variables:
    SERVICE: cloudsmith
  rules:
    - *rule_tag_security_or_subscription
  artifacts:
    paths:
      - commit.txt
    expire_in: "1 month"

# Publish Cloudsmith packages

rpms-cloudsmith-publish:
  <<: *rpm_publish_job
  variables:
    SERVICE: cloudsmith
  needs:
    - job: rpms-cloudsmith-build
      artifacts: true
  rules:
    - *rule_tag_open_source_maintenance

rpms-cloudsmith-publish-private:
  <<: *rpm_publish_job
  variables:
    SERVICE: cloudsmith
  needs:
    - job: rpms-cloudsmith-build-private
      artifacts: true
  rules:
    - *rule_tag_security_or_subscription

# Update Copr packages

rpms-copr:
  <<: *rpm_build_job
  variables:
    SERVICE: copr
  rules:
    - *rule_tag_open_source

# Setting the FORCE_CVE_IDS environment variable to a comma-separated
# list of CVE IDs enables overriding the autodetected ones.
#
# Setting the FORCE_SECURITY_RELEASES environment variable to a
# comma-separated list of BIND 9 versions enables overriding the
# autodetected ones.
.printing_press_job: &printing_press_job
  <<: *manual_release_job_qa
  script:
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/printing_press_mr.py --document "${DOCUMENT}" --metadata "$CI_PROJECT_DIR"/bind9-qa/releng/metadata.json ${FORCE_CVE_IDS:+--force-cve-ids ${FORCE_CVE_IDS}} ${FORCE_SECURITY_RELEASES:+--force-security-releases ${FORCE_SECURITY_RELEASES}}
  artifacts:
    paths:
      - printing-press/
    when: on_failure

# Job updating the Docker image for a specific release

update-docker-image:
  <<: *base_image
  <<: *manual_release_job
  variables:
    RELEASE_DIRECTORY: "bind-${CI_COMMIT_TAG}-release"
  script:
    - VERSION="${CI_COMMIT_TAG#v}"
    - CHECKSUM="$(sha256sum "${RELEASE_DIRECTORY}/bind-${VERSION}.tar.xz" | awk '{print $1}')"
    - BRANCH="${CI_COMMIT_TAG%.*}"
    - DOCKER_PROJECT="https://gitlab.isc.org/isc-projects/bind9-docker"
    - CLONE_URL="https://oauth2:${BIND_TEAM_WRITE_TOKEN}@${DOCKER_PROJECT#https://}"
    - git clone --depth 1 --branch "${BRANCH}" "${CLONE_URL}" docker-project
    - cd docker-project
    - sed -E -i Dockerfile -e "s/^(ARG BIND9_VERSION=).*/\1${VERSION}/"
    - sed -E -i Dockerfile -e "s/^(ARG BIND9_CHECKSUM=).*/\1${CHECKSUM}/"
    - git commit -m "Version bump to ${VERSION}" Dockerfile
    - git push
    - COMMIT_SHA="$(git log -n1 --format=%H)"
    - *git_clone_bind9-qa
    - echo "Docker image for BIND ${BRANCH} updated to version ${CI_COMMIT_TAG}, commit [${COMMIT_SHA}](${DOCKER_PROJECT}/-/commit/${COMMIT_SHA})" > message.txt
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/message_zulip.py --message message.txt --channel bind9 --topic Packaging
  needs:
    - job: release
      artifacts: true
    - job: publish
      artifacts: false
  rules:
    - *rule_tag_open_source
  tags:
    - smalljob

# Job creating the release announcement MR in Printing Press

prepare-release-announcement:
  <<: *printing_press_job
  variables:
    DOCUMENT: release-announcement
  rules:
    - *rule_tag_open_source
  after_script:
    - if [ "${CI_JOB_STATUS}" = "success" ]; then "$CI_PROJECT_DIR"/bind9-qa/releng/send_release_links.py --metadata "$CI_PROJECT_DIR"/bind9-qa/releng/metadata.json --message-zulip; fi

# Job preparing an EVN MR in Printing Press

prepare-evn:
  <<: *printing_press_job
  variables:
    DOCUMENT: evn
  rules:
    - *rule_tag_security

# Job preparing a security pre-announcement MR in Printing Press

prepare-preannouncement:
  <<: *printing_press_job
  variables:
    DOCUMENT: security-preannouncement
  rules:
    - *rule_tag_security

# Job preparing a packager notification MR in Printing Press

prepare-packager-notification:
  <<: *printing_press_job
  before_script:
    - *git_clone_bind9-qa
    # produce distros_git_url.txt to be immediately read by printing_press_mr.py
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/manage_distros_token.py create
  variables:
    DOCUMENT: packager-notification
  rules:
    - *rule_tag_security

# Job preparing a post-disclosure notification MR in Printing Press

prepare-post-disclosure-notification:
  <<: *printing_press_job
  variables:
    DOCUMENT: post-disclosure-notification
  rules:
    - *rule_tag_security

# Job merging the tag back into its base branch

merge-tag:
  <<: *manual_release_job_qa
  variables:
    GIT_DEPTH: 100
  needs:
    # TODO: if necessary, update job name after pushing tags from within CI is implemented
    - job: publish
      artifacts: false
  script:
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/merge_tag.py --tag "$CI_COMMIT_TAG"
  rules:
    - *rule_tag_open_source
  artifacts:
    paths:
      - bind9/
    when: on_failure

update-stable-tag:
  <<: *manual_release_job_qa
  needs:
    # TODO: if necessary, update job name after pushing tags from within CI is implemented
    - job: publish
      artifacts: false
  script:
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/update_stable_tag.py --tag "$CI_COMMIT_TAG"
    # Work around https://github.com/readthedocs/readthedocs.org/issues/10838
    - sleep 300
    - rm -rf ./bind9  # remove already cloned project
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/update_stable_tag.py --tag "$CI_COMMIT_TAG"
  rules:
    - *rule_tag_open_source_stable
  artifacts:
    paths:
      - bind9/
    when: on_failure

.customer-git: &customer_git
  <<: *base_image
  stage: release
  when: manual
  variables:  # ensure clean git environment and sufficient history
    GIT_STRATEGY: clone
    GIT_DEPTH: 1000

# To trigger this job and push a branch to a customer, you must set the
# CUSTOMER job variable by clicking on the manual job (not the play button) and
# set it to the name of the target customer.
customer-git:branch:
  <<: *customer_git
  needs: []
  rules:
    - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_PIPELINE_SOURCE == "merge_request_event"'
      variables:
        BRANCH: '$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME'
    - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_PIPELINE_SOURCE =~ /^(api|pipeline|trigger|web)$/ && $REBASE_ONLY != "1"'
      variables:
        BRANCH: '$CI_COMMIT_BRANCH'
  before_script:
    - test -n "$CUSTOMER"
    - *git_clone_bind9-qa
  script:
    - git checkout -b "$BRANCH"  # ensure refs/heads/$BRANCH exists; GitLab clones with detached HEAD
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/push_to_customer_repository.py --branch "$BRANCH" --customer "$CUSTOMER" --force

customer-git:tag:
  <<: *customer_git
  needs:
    - job: release
      artifacts: false
  rules:
    - *rule_tag
  before_script:
    - *git_clone_bind9-qa
    - git clone --depth 1 "https://token:${ISC_CUSTOMERS_WRITE_TOKEN}@gitlab.isc.org/isc-customers/isc-customer-settings.git"
  script:
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/push_to_customer_repository.py --tag "$CI_COMMIT_TAG" --entitlements isc-customer-settings/entitlements.yaml --force

# Respdiff tests

respdiff:
  <<: *respdiff_job
  <<: *base_image
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -DISC_TRACK_PTHREADS_OBJECTS"
    EXTRA_CONFIGURE: "-Doptimization=g"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.3"
  script:
    - bash respdiff.sh -m /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" -r "${PWD}/respdiff" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
    - cd ../.. && ninja -C build clean >/dev/null 2>&1

respdiff:asan:
  <<: *respdiff_job
  <<: *base_image
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Doptimization=g -Db_sanitize=address,undefined -Djemalloc=disabled"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.3"
  script:
    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" -r "${PWD}/respdiff" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
    - cd ../.. && ninja -C build clean >/dev/null 2>&1

respdiff:tsan:
  <<: *respdiff_job
  <<: *tsan_debian_trixie_amd64_image
  variables:
    CC: "${CLANG}"
    CFLAGS: "${CFLAGS_COMMON}"
    LDFLAGS: "-Wl,--disable-new-dtags"
    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.3"
    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
  script:
    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" -r "${PWD}/respdiff" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
    - cd ../.. && ninja -C build clean >/dev/null 2>&1

respdiff-third-party:
  <<: *respdiff_job
  <<: *base_image
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "-Doptimization=g"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
  script:
    - bash respdiff.sh -s third_party -q "${PWD}/100k_mixed.txt" -c 1 -w "${PWD}/rspworkdir" -r "${PWD}/respdiff" "${CI_PROJECT_DIR}"
    - cd ../.. && ninja -C build clean >/dev/null 2>&1

.respdiff-recent-named: &respdiff_recent_named
  <<: *respdiff_job
  <<: *base_image
  needs:
    - job: ci-variables
      artifacts: true
  script:
    - cd ${CI_PROJECT_DIR}
    - BASELINE=${CI_MERGE_REQUEST_TARGET_BRANCH_NAME:-$BIND_BASELINE_VERSION}
    - git fetch --unshallow origin ${BASELINE}
    - git worktree add baseline-build FETCH_HEAD
    - cd baseline-build
    - *configure
    - meson compile -C build
    - cd "$CI_PROJECT_DIR"/bind9-qa/respdiff
    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" -r "${PWD}/respdiff" "${CI_PROJECT_DIR}" "${CI_PROJECT_DIR}/baseline-build/build/named"

respdiff:recent-named:
  <<: *respdiff_recent_named
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -DISC_TRACK_PTHREADS_OBJECTS"
    EXTRA_CONFIGURE: "-Doptimization=g"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.15"

# Performance tests

shotgun:udp:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: udp
    SHOTGUN_TRAFFIC_MULTIPLIER: 15

shotgun:tcp:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: tcp
    SHOTGUN_TRAFFIC_MULTIPLIER: 12

shotgun:dot:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: dot
    SHOTGUN_TRAFFIC_MULTIPLIER: 5

shotgun:doh-get:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: doh-get
    SHOTGUN_TRAFFIC_MULTIPLIER: 2
    SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX: 0.4  # bump from the default due to increased tail-end jitter

stress-test-child-pipeline:
  <<: *default_triggering_rules
  stage: performance
  # In a downstream pipeline, yaml variables inherited from the parent outrank
  # the child's job-level `variables:` block. Inherit only what the child
  # actually needs (image lookup), so the parent's RUNNER_SCRIPT_TIMEOUT does
  # not override the per-job values set in the generated child config.
  inherit:
    variables:
      - CI_REGISTRY_IMAGE
  rules:
    - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
      changes:
        - '**/*.c'
        - '**/*.h'
    - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
      when: manual  # don't run on each MR unless requested
      allow_failure: true
    - *rule_tag
    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/ && $REBASE_ONLY != "1"'
    - *rule_branch_after_autorebase
  trigger:
    include:
      - artifact: stress-test-configs.yml
        job: generate-stress-test-configs
  needs:
    - job: generate-stress-test-configs
      artifacts: true

gcov:
  <<: *default_triggering_rules
  <<: *base_image
  stage: system
  needs:
    - job: system:gcc:trixie:amd64
      artifacts: true
  script:
    # Ensure gcov files for unit tests are found via tests/ rather than
    # lib/*/tests/ to prevent confusing gcovr.
    # - find lib/ -name tests -type l -delete
    - ninja -C build coverage
    - tail -n 3 build/meson-logs/coverage.txt
  coverage: /^TOTAL.*\s+(\d+\%)$/
  artifacts:
    paths:
      - build/meson-logs/
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/meson-logs/coverage.xml

# Pairwise testing of build options

pairwise:
  <<: *base_image
  stage: build
  needs: []
  script:
      - util/pairwise-testing.sh
  artifacts:
    paths:
      - pairwise-commands.txt
      - pairwise-model.txt
      - pairwise-output.*.txt
    when: on_failure
  rules:
    - if: '$PAIRWISE_TESTING != null'

.post_merge_template: &post_merge
  <<: *base_image
  stage: postmerge
  needs: []
  tags:
    - smalljob
  # post-merge processes should run even if another MR was merged while the job was running (or queued)
  interruptible: false
  variables:
    # avoid leftover branches from previous jobs
    GIT_STRATEGY: clone
    # assumed max depth of a MR for backport or a rebased force-push
    GIT_DEPTH: 1000
  before_script:
    # force-pushes should not trigger process automation (happens only in -sub branches)
    - >
      echo "previous branch tip: $CI_COMMIT_BEFORE_SHA"
    - set +o pipefail; git log --format='%H' | grep --silent "$CI_COMMIT_BEFORE_SHA" && PREVIOUS_TIP_REACHABLE=1
    - test "$PREVIOUS_TIP_REACHABLE" != "1" && echo "force-push detected, stop" && exit 0
    # non-fast-forward merges are disabled so we have to have merge commit on top
    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e "s|^See merge request ${CI_PROJECT_PATH}\!||p")"
    - >
      : stop if this is not a merge request in the current project\'s namespace
    - test -n "$MERGE_REQUEST_ID" || exit 0
    - *git_clone_bind9-qa

backports:
  <<: *post_merge
  rules:
    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^security-(main|bind-9\.[0-9]+)$/ || $CI_COMMIT_REF_NAME =~ /^bind-9\.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
  script:
    # CI job token is not sufficient for push operations
    - git remote get-url origin | sed -e "s/gitlab-ci-token:$CI_JOB_TOKEN/oauth2:$BIND_TEAM_WRITE_TOKEN/" | xargs git remote set-url --push origin
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/backport_mr.py $CI_PROJECT_ID "$MERGE_REQUEST_ID"

merged-metadata:
  <<: *post_merge
  rules:
    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^security-(main|bind-9\.[0-9]+)$/ || $CI_COMMIT_REF_NAME =~ /^bind-9\.[0-9]+(-sub)?$/ || $CI_COMMIT_REF_NAME =~ /^v9\.[0-9]+\.[0-9]+-release$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
  script:
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/after_merge.py "$CI_PROJECT_ID" "$MERGE_REQUEST_ID"

.autorebase-common: &autorebase_common
  stage: postmerge
  needs: []
  interruptible: false

.autorebase: &autorebase
  <<: *autorebase_common
  <<: *base_image
  # ensure autorebases for each distinct private branch are serialized when the
  # upstream branch is pushed to multiple times in quick succession
  resource_group: "${CI_JOB_NAME}-${CI_COMMIT_REF_NAME}"
  tags:
    - smalljob
  variables:
    # avoid leftover branches from previous jobs
    GIT_STRATEGY: clone
    GIT_DEPTH: 1000
  script:
    # CI job token is not sufficient for push operations
    - git remote get-url origin | sed -e "s/gitlab-ci-token:${CI_JOB_TOKEN}/oauth2:${BIND_TEAM_WRITE_TOKEN}/" | xargs git remote set-url --push origin
    - git remote add base-project "${CI_SERVER_URL}/${BASE_PROJECT}.git"
    - git fetch --depth="${GIT_DEPTH}" base-project "${BASE_COMMIT}"
    # If this branch has no changes compared to its base branch yet, there is nothing to rebase;
    # push the new revision anyway to trigger any potential downstream autorebases.
    - if [ -z "$(git log --max-count=1 "${BASE_COMMIT}..")" ]; then git push origin "${BASE_COMMIT}:${CI_COMMIT_REF_NAME}"; exit 0; fi
    - *git_clone_bind9-qa
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/rebase.py ${REWRITE_CHERRY_PICKS_FROM:+--rewrite-cherry-picks-from ${REWRITE_CHERRY_PICKS_FROM}} --base-project "${BASE_PROJECT}" "${BASE_COMMIT}"
    - *configure
    - meson compile -C build
    - git range-diff --color=always "${BASE_COMMIT}" "${CI_COMMIT_SHA}" HEAD
    - if ! git push --force-with-lease -o ci.variable="AUTOREBASED=1" origin "HEAD:${CI_COMMIT_REF_NAME}"; then touch .git-push-failed; exit 1; fi
  after_script:
    - if [ "${CI_JOB_STATUS}" = "success" ]; then exit 0; fi
    - |
      REASON_DETAILS=""
      if git rebase --abort; then
          # Rebase failed; try applying recent commits from the base branch on top of the branch being rebased to determine which one introduces conflicts
          git rebase --rebase-merges "${CI_COMMIT_SHA}" "${BASE_COMMIT}" || true
          CONFLICT_COMMIT="$(git rev-parse REBASE_HEAD)"
          CONFLICT_COMMIT_AUTHOR_LOGIN="$(git log --max-count=1 --pretty="%al" "${CONFLICT_COMMIT}")"
          CONFLICT_COMMIT_AUTHOR_USERNAME="$(curl -m 5 -s "https://gitlab.isc.org/isc-projects/bind9-qa/-/raw/main/releng/users.json" | jq -r ".${CONFLICT_COMMIT_AUTHOR_LOGIN}" || :)"
          if [ -n "${CONFLICT_COMMIT_AUTHOR_USERNAME}" ] && [ "${CONFLICT_COMMIT_AUTHOR_USERNAME}" != "null" ]; then
            CONFLICT_COMMIT_AUTHOR="@**${CONFLICT_COMMIT_AUTHOR_USERNAME}**"
          else
            CONFLICT_COMMIT_AUTHOR="\`${CONFLICT_COMMIT_AUTHOR_LOGIN}\`"
          fi
          CONFLICT_COMMIT_MERGE="$(git log --reverse --merges --pretty="%H" "${CONFLICT_COMMIT}..${BASE_COMMIT}" | head -1)"
          read -r CONFLICT_COMMIT_MERGE_REQUEST_PROJECT CONFLICT_COMMIT_MERGE_REQUEST_ID < <(git log --max-count=1 "${CONFLICT_COMMIT_MERGE}" | sed -n -E 's|^\s*See merge request ([a-z-]+/bind9)!([0-9]+).*|\1 \2|p' | head -1)
          REASON="merge conflict introduced by a change in the base branch"
          REASON_DETAILS="${REASON_DETAILS}\n**First bad commit**: [${CONFLICT_COMMIT}](https://gitlab.isc.org/${CONFLICT_COMMIT_MERGE_REQUEST_PROJECT}/-/commit/${CONFLICT_COMMIT}) (authored by ${CONFLICT_COMMIT_AUTHOR})"
          REASON_DETAILS="${REASON_DETAILS}\n**First bad merge request**: https://gitlab.isc.org/${CONFLICT_COMMIT_MERGE_REQUEST_PROJECT}/-/merge_requests/${CONFLICT_COMMIT_MERGE_REQUEST_ID}"
      else
          # Rebase did not fail; most likely, this is a build failure, or the job was canceled
          if [ "${CI_JOB_STATUS}" = "failed" ]; then
              if [ -f ".git-push-failed" ]; then
                  REASON="branch was updated during rebase"
              else
                  REASON="build failure after a successful rebase"
              fi
          else
              REASON="job was canceled"
          fi
      fi
      MSG="#### :rotating_light: Autorebase error for branch \`${CI_COMMIT_REF_NAME}\` :rotating_light:"
      MSG="${MSG}\n**Job**: ${CI_JOB_URL}"
      MSG="${MSG}\n**Reason**: ${REASON}"
      MSG="${MSG}${REASON_DETAILS}"
      echo -e "$MSG" > message.txt
    - >
      "$CI_PROJECT_DIR"/bind9-qa/releng/message_zulip.py --message message.txt --channel bind9-team --topic 'Autorebase errors'

autorebase-trigger-security:
  <<: *autorebase_common
  rules:
    - if: '$CI_PROJECT_NAMESPACE == "isc-projects" && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_REF_NAME =~ /^(main|bind-9\.[0-9]+)$/'
  inherit:
      variables: false
  variables:
    REBASE_ONLY: 1
    BASE_PROJECT: isc-projects/bind9
    BASE_COMMIT: "${CI_COMMIT_SHA}"
  trigger:
      project: isc-private/bind9
      branch: "security-${CI_COMMIT_BRANCH}"

autorebase-security:
  <<: *autorebase
  rules:
    - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_PIPELINE_SOURCE == "pipeline" && $CI_COMMIT_REF_NAME =~ /^security-(main|bind-9\.[0-9]+)$/ && $REBASE_ONLY == "1" && $CI_COMMIT_REF_NAME =~ $AUTOREBASED_BRANCHES'