.gitlab-ci.yml

stages:
  - docker
  - test
  - static scans
  - pkg-test
  - oe-checkout
  - oe-test
  - deploy
  - trigger

variables:
  UBUNTU_BIONIC_MASTER_IMAGE: ${CI_REGISTRY_IMAGE}:ci-master-UBUNTU_BIONIC
  UBUNTU_XENIAL_MASTER_IMAGE: ${CI_REGISTRY_IMAGE}:ci-master-UBUNTU_XENIAL
  UBUNTU_FOCAL_MASTER_IMAGE: ${CI_REGISTRY_IMAGE}:ci-master-UBUNTU_FOCAL
  UBUNTU_BIONIC_MASTER_INSTALLIMAGE: ${CI_REGISTRY_IMAGE}:ci-install-master-UBUNTU_BIONIC
  UBUNTU_XENIAL_MASTER_INSTALLIMAGE: ${CI_REGISTRY_IMAGE}:ci-install-master-UBUNTU_XENIAL
  UBUNTU_BIONIC_PR_IMAGE: ${CI_REGISTRY_IMAGE}:ci-${CI_COMMIT_REF_SLUG}-UBUNTU_BIONIC
  UBUNTU_XENIAL_PR_IMAGE: ${CI_REGISTRY_IMAGE}:ci-${CI_COMMIT_REF_SLUG}-UBUNTU_XENIAL
  UBUNTU_FOCAL_PR_IMAGE: ${CI_REGISTRY_IMAGE}:ci-${CI_COMMIT_REF_SLUG}-UBUNTU_FOCAL
  UBUNTU_BIONIC_PR_INSTALLIMAGE: ${CI_REGISTRY_IMAGE}:ci-install-${CI_COMMIT_REF_SLUG}-UBUNTU_BIONIC
  UBUNTU_XENIAL_PR_INSTALLIMAGE: ${CI_REGISTRY_IMAGE}:ci-install-${CI_COMMIT_REF_SLUG}-UBUNTU_XENIAL

  CCACHE_DIR: $CI_PROJECT_DIR/ccache

  GIT_SUBMODULE_STRATEGY: none

  # bitbake variables
  BITBAKE_IMAGE: ${METAUPDATER_REGISTRY_IMAGE}:ci-master-bitbake
  BITBAKE_CHECKOUT_IMAGE: ${METAUPDATER_REGISTRY_IMAGE}:ci-master-checkout

include:
  - template: SAST.gitlab-ci.yml
  - template: Secret-Detection.gitlab-ci.yml
  - template: Dependency-Scanning.gitlab-ci.yml
  - template: License-Scanning.gitlab-ci.yml
  - project: 'olp/edge/ota/connect/client/meta-updater'
    ref: 'master'
    file: 'scripts/ci/gitlab/docker.yml'
  - project: 'olp/edge/ota/connect/client/meta-updater'
    ref: 'master'
    file: 'scripts/ci/gitlab/checkout.yml'
  - project: 'olp/edge/ota/connect/client/meta-updater'
    ref: 'master'
    file: 'scripts/ci/gitlab/tests.yml'

Docker Setup:
  image: docker:18
  stage: docker
  except:
    - /^20\d\d\.\d\d?-docs$/
    - /^docs\//
  services:
    - docker:18-dind
  before_script:
    - docker login -u "$DOCKERHUB_USERNAME" -p "$DOCKERHUB_PASSWORD"
    - docker login -u gitlab-ci-token -p "$CI_JOB_TOKEN" "$CI_REGISTRY"
  script:
    # main images
    - docker pull "$UBUNTU_BIONIC_PR_IMAGE" || docker pull "$UBUNTU_BIONIC_MASTER_IMAGE" || true
    - docker build --pull --cache-from "$UBUNTU_BIONIC_MASTER_IMAGE" --cache-from "$UBUNTU_BIONIC_PR_IMAGE" -f "$CI_PROJECT_DIR/docker/Dockerfile.ubuntu.bionic" -t "$UBUNTU_BIONIC_PR_IMAGE" .
    - docker push "$UBUNTU_BIONIC_PR_IMAGE"

    - docker pull "$UBUNTU_XENIAL_PR_IMAGE" || docker pull "$UBUNTU_XENIAL_MASTER_IMAGE" || true
    - docker build --pull --cache-from "$UBUNTU_XENIAL_MASTER_IMAGE" --cache-from "$UBUNTU_XENIAL_PR_IMAGE" -f "$CI_PROJECT_DIR/docker/Dockerfile.ubuntu.xenial" -t "$UBUNTU_XENIAL_PR_IMAGE" .
    - docker push "$UBUNTU_XENIAL_PR_IMAGE"

    - docker pull "$UBUNTU_FOCAL_PR_IMAGE" || docker pull "$UBUNTU_FOCAL_MASTER_IMAGE" || true
    - docker build --pull --cache-from "$UBUNTU_FOCAL_MASTER_IMAGE" --cache-from "$UBUNTU_FOCAL_PR_IMAGE" -f "$CI_PROJECT_DIR/docker/Dockerfile.ubuntu.focal" -t "$UBUNTU_FOCAL_PR_IMAGE" .
    - docker push "$UBUNTU_FOCAL_PR_IMAGE"

    # used for install tests
    - docker pull "$UBUNTU_BIONIC_PR_INSTALLIMAGE" || docker pull "$UBUNTU_BIONIC_MASTER_INSTALLIMAGE" || true
    - docker build --pull --cache-from "$UBUNTU_BIONIC_MASTER_INSTALLIMAGE" --cache-from "$UBUNTU_BIONIC_PR_INSTALLIMAGE" -f "$CI_PROJECT_DIR/docker/Dockerfile-test-install.ubuntu.bionic" -t "$UBUNTU_BIONIC_PR_INSTALLIMAGE" .
    - docker push "$UBUNTU_BIONIC_PR_INSTALLIMAGE"

    - docker pull "$UBUNTU_XENIAL_PR_INSTALLIMAGE" || docker pull "$UBUNTU_XENIAL_MASTER_INSTALLIMAGE" || true
    - docker build --pull --cache-from "$UBUNTU_XENIAL_MASTER_INSTALLIMAGE" --cache-from "$UBUNTU_XENIAL_PR_INSTALLIMAGE" -f "$CI_PROJECT_DIR/docker/Dockerfile-test-install.ubuntu.xenial" -t "$UBUNTU_XENIAL_PR_INSTALLIMAGE" .
    - docker push "$UBUNTU_XENIAL_PR_INSTALLIMAGE"

# static scans:

license_scanning:
  stage: static scans

bandit-sast:
  stage: static scans
  needs: []

flawfinder-sast:
  stage: static scans
  needs: []

secret_detection:
  stage: static scans
  needs: []

coverage:
  variables:
    GIT_CLONE_PATH: $CI_BUILDS_DIR/aktualizr-coverage-$CI_JOB_ID
    GIT_SUBMODULE_STRATEGY: 'recursive'

    TEST_BUILD_DIR: 'build-coverage'
    TEST_CMAKE_BUILD_TYPE: 'Valgrind'
    TEST_WITH_COVERAGE: '1'
    TEST_WITH_P11: '1'
    TEST_WITH_FAULT_INJECTION: '1'
    TEST_SOTA_PACKED_CREDENTIALS: "$CI_PROJECT_DIR/credentials.zip"
  image: "$UBUNTU_BIONIC_PR_IMAGE"
  stage: test
  needs: ["Docker Setup"]
  except:
    - /^20\d\d\.\d\d?-docs$/
    - /^docs\//
  cache:
    key: "$CI_JOB_NAME"
    paths:
      - ccache/
  artifacts:
    paths:
      - build-coverage/coverage/
    reports:
      junit: build-coverage/report.xml
  script:
    - aws s3 cp s3://ota-gitlab-ci/hereotaconnect_prod.zip $CI_PROJECT_DIR/credentials.zip
    - ./scripts/test.sh
    - xsltproc -o build-coverage/report.xml ./third_party/junit/ctest2junit.xsl build-coverage/Testing/**/Test.xml > /dev/null

nop11:
  variables:
    GIT_CLONE_PATH: $CI_BUILDS_DIR/aktualizr-nop11-$CI_JOB_ID
    GIT_SUBMODULE_STRATEGY: 'recursive'

    TEST_BUILD_DIR: 'build-nop11'
    TEST_CMAKE_BUILD_TYPE: 'Debug'
    TEST_WITH_TESTSUITE: '0'
  image: "$UBUNTU_BIONIC_PR_IMAGE"
  stage: test
  needs: ["Docker Setup"]
  except:
    - /^20\d\d\.\d\d?-docs$/
    - /^docs\//
  cache:
    key: "$CI_JOB_NAME"
    paths:
      - ccache/
  script:
    - ./scripts/test.sh

focal-build-static:
  variables:
    GIT_CLONE_PATH: $CI_BUILDS_DIR/aktualizr-focal-build-static-$CI_JOB_ID
    GIT_SUBMODULE_STRATEGY: 'recursive'

    TEST_BUILD_DIR: 'build-ubuntu-focal'
    TEST_CC: 'clang'
    # should run with valgrind but some leaks are still unfixed
    # TEST_CMAKE_BUILD_TYPE = 'Valgrind'
    TEST_CMAKE_BUILD_TYPE: 'Debug'
    TEST_TESTSUITE_ONLY: 'crypto'
    TEST_WITH_STATICTESTS: '1'
    TEST_WITH_DOCS: '1'
  image: "$UBUNTU_FOCAL_PR_IMAGE"
  stage: test
  needs: ["Docker Setup"]
  except:
    - /^20\d\d\.\d\d?-docs$/
    - /^docs\//
  cache:
    key: "$CI_JOB_NAME"
    paths:
      - ccache/
  artifacts:
    paths:
      - build-ubuntu-focal/docs/doxygen/
    reports:
      junit: build-ubuntu-focal/report.xml
  script:
    - ./scripts/test.sh
    - xsltproc -o build-ubuntu-focal/report.xml ./third_party/junit/ctest2junit.xsl build-ubuntu-focal/Testing/**/Test.xml > /dev/null


.u-pkg:
  needs: ["Docker Setup"]
  stage: test
  except:
    - /^20\d\d\.\d\d?-docs$/
    - /^docs\//
  cache:
    key: "$CI_JOB_NAME"
    paths:
      - ccache/
  script:
    - mkdir -p $TEST_INSTALL_DESTDIR
    - ./scripts/build_ubuntu.sh

bionic-pkg:
  extends: .u-pkg
  variables:
    GIT_CLONE_PATH: $CI_BUILDS_DIR/aktualizr-bionic-pkg-$CI_JOB_ID
    GIT_SUBMODULE_STRATEGY: 'recursive'

    TEST_BUILD_DIR: 'build-bionic'
    TEST_INSTALL_RELEASE_NAME: '-ubuntu_18.04'
    TEST_INSTALL_DESTDIR: "$CI_PROJECT_DIR/build-bionic/pkg"
  image: "$UBUNTU_BIONIC_PR_IMAGE"
  artifacts:
    paths:
      - build-bionic/pkg

xenial-pkg:
  extends: .u-pkg
  variables:
    GIT_CLONE_PATH: $CI_BUILDS_DIR/aktualizr-xenial-pkg-$CI_JOB_ID
    GIT_SUBMODULE_STRATEGY: 'recursive'

    TEST_BUILD_DIR: 'build-xenial'
    TEST_INSTALL_RELEASE_NAME: '-ubuntu_16.04'
    TEST_INSTALL_DESTDIR: "$CI_PROJECT_DIR/build-xenial/pkg"
  image: "$UBUNTU_XENIAL_PR_IMAGE"
  artifacts:
    paths:
      - build-xenial/pkg


.pkg-test:
  stage: pkg-test
  except:
    - /^20\d\d\.\d\d?-docs$/
    - /^docs\//
  script:
    - ./scripts/test_install_garage_deploy.sh
    - ./scripts/test_install_aktualizr.sh

bionic-pkg-test:
  extends: .pkg-test
  variables:
    TEST_INSTALL_DESTDIR: "$CI_PROJECT_DIR/build-bionic/pkg"
  needs: ["bionic-pkg"]
  image: "$UBUNTU_BIONIC_PR_INSTALLIMAGE"

xenial-pkg-test:
  extends: .pkg-test
  variables:
    TEST_INSTALL_DESTDIR: "$CI_PROJECT_DIR/build-xenial/pkg"
  needs: ["xenial-pkg"]
  image: "$UBUNTU_XENIAL_PR_INSTALLIMAGE"


# -- yocto tests

OE Docker setup:
  extends: .bb_docker_remote
  stage: docker
  variables:
      GIT_CHECKOUT: 'false'
  only:
    variables:
      - $OE_PTEST
      - $CI_COMMIT_REF_NAME == "master"
      - $CI_COMMIT_REF_NAME =~ /^\d\d\d\d\.\d+(-\w+)?$/
  except:
    - /^20\d\d\.\d\d?-docs$/
    - /^docs\//


OE Checkout:
  extends: .bb_checkout
  stage: oe-checkout
  needs: []
  variables:
      GIT_CHECKOUT: 'false'
  only:
    variables:
      - $OE_PTEST
      - $CI_COMMIT_REF_NAME == "master"
      - $CI_COMMIT_REF_NAME =~ /^\d\d\d\d\.\d+(-\w+)?$/
  except:
    - /^20\d\d\.\d\d?-docs$/
    - /^docs\//
  variables:
    MANIFEST: dunfell

Ptest qemux86_64:
  extends: .oe-selftest
  stage: oe-test
  variables:
      GIT_CHECKOUT: false
  dependencies:
    - OE Checkout
  allow_failure: true
  only:
    variables:
      - $OE_PTEST
      - $CI_COMMIT_REF_NAME == "master"
      - $CI_COMMIT_REF_NAME =~ /^\d\d\d\d\.\d+(-\w+)?$/
  except:
    - /^20\d\d\.\d\d?-docs$/
    - /^docs\//
  variables:
    TEST_BUILD_DIR: 'build-ptest'
    OE_SELFTESTS: 'updater_qemux86_64_ptest'
    TEST_AKTUALIZR_REMOTE: '1'
    # note: tag will take precedence if not empty
    TEST_AKTUALIZR_TAG: $CI_COMMIT_TAG
    TEST_AKTUALIZR_BRANCH: $CI_COMMIT_REF_NAME
    TEST_AKTUALIZR_REV: $CI_COMMIT_SHA

# -- create GitHub releases

github-release:
  image: "$UBUNTU_BIONIC_PR_IMAGE"
  stage: deploy
  # focal-build-static is needed for doxygen
  needs: ["bionic-pkg", "xenial-pkg", "focal-build-static"]
  script:
    # github release
    - ./scripts/make_src_archive.sh ./aktualizr_src-$CI_COMMIT_TAG.tar.gz
    - >-
      ./scripts/publish_github_rls.py $CI_COMMIT_TAG
      build-xenial/pkg/garage_deploy-ubuntu_16.04.deb
      build-xenial/pkg/aktualizr-ubuntu_16.04.deb
      build-bionic/pkg/garage_deploy-ubuntu_18.04.deb
      build-bionic/pkg/aktualizr-ubuntu_18.04.deb
      aktualizr_src-$CI_COMMIT_TAG.tar.gz
    # github doxygen
    - ./scripts/publish_github_docs.sh
  only:
    variables:
      - $CI_COMMIT_TAG =~ /^\d\d\d\d\.\d+(-\w+)?$/
  except:
    - /^20\d\d\.\d\d?-docs$/
  variables:
    DOX_DOCS: 'build-ubuntu-focal/docs/doxygen/html'
    TEST_BUILD_DIR: 'build-gh-rls'

# -- publish coverage results on gitlab pages

pages:
  stage: deploy
  needs: ["coverage"]
  script:
    - mv build-coverage/coverage/ public/
  artifacts:
    paths:
      - public
    expire_in: 7 days
  # would be nice to have on a per-PR basis: # https://gitlab.com/gitlab-org/gitlab-ce/issues/35141
  only:
    - master


# -- e2e

app-docker-image:
  image: docker:18
  services:
    - docker:18-dind
  stage: deploy
  only:
    - master
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  needs: []
  allow_failure: true
  before_script:
    - docker login -u "$DOCKERHUB_USERNAME" -p "$DOCKERHUB_PASSWORD"
    - docker login -u gitlab-ci-token -p "$CI_JOB_TOKEN" "$CI_REGISTRY"
  script:
    - cp ./docker/Dockerfile.aktualizr ./ci/gitlab/Dockerfile
    - docker build --build-arg AKTUALIZR_BASE=$UBUNTU_BIONIC_MASTER_IMAGE -t $CI_REGISTRY_IMAGE/app:ci-$CI_COMMIT_REF_SLUG -f ./ci/gitlab/Dockerfile .
    - docker push $CI_REGISTRY_IMAGE/app:ci-$CI_COMMIT_REF_SLUG

trigger-device-farm-pipeline:
  stage: trigger
  only:
    - master
  trigger: olp/edge/ota/testing/device-farm

# -- otf

trigger-otf-pipeline:
  image: "$UBUNTU_BIONIC_PR_IMAGE"
  stage: trigger
  when: on_success
  needs: ["github-release"]
  script:
    - curl -X POST -F "token=$CI_JOB_TOKEN" -F "ref=master" -F "variables[TEST_JOB_ONLY]=true" https://main.gitlab.in.here.com/api/v4/projects/163/trigger/pipeline
  only:
    variables:
      - $CI_COMMIT_REF_NAME =~ /^\d\d\d\d\.\d+(-\w+)?$/
  except:
    - /^20\d\d\.\d\d?-docs$/
    - /^docs\//
  allow_failure: true

trigger-docsite-build:
  stage: trigger
  only:
    - /^20\d\d\.\d\d?-docs$/
  trigger:
    project: olp/edge/ota/documentation/ota-connect-docs
    branch: master

trigger-osx-build:
  stage: trigger
  trigger:
    project: olp/edge/ota/connect/client/homebrew-otaconnect
    branch: master
  rules:
    - if: $OSX_BUILD
      when: always

build-osx-release:
  stage: trigger
  needs: ["github-release"]
  variables:
    VERSION: "$CI_COMMIT_TAG"
    REVISION: "$CI_COMMIT_SHA"
    RELEASE_BASE_URL: "https://github.com/advancedtelematic/aktualizr/releases/download"
    GITHUB_REPOSITORY: "uptane/aktualizr"
    GITHUB_TOKEN: "$GITHUB_API_TOKEN"
    HOMEBREW_GITHUB_API_TOKEN: "$GITHUB_API_TOKEN"
    FORMULA_DIR: "/usr/local/Homebrew/Library/Taps/advancedtelematic/homebrew-otaconnect"
    FORMULA_FILE: "${FORMULA_DIR}/aktualizr.rb"
  before_script:
    - brew uninstall -f aktualizr
    - brew untap advancedtelematic/otaconnect
    - rm -rf $(brew --cache)/aktualizr--git
    - brew install ghr
  script:
    # clone a repo that contains the aktualizr formula
    - brew tap advancedtelematic/otaconnect
    # update Version and Revision in the formula
    - sed -i '' -E "s/  version = \"20[1-2][0-9].[0-9]+\"/  version = \"${VERSION}\"/" ${FORMULA_FILE}
    - sed -i '' -E "s/  revision = \".*\"/  revision = \"${REVISION}\"/" ${FORMULA_FILE}
    # build aktualizr
    - brew install -v --build-bottle aktualizr
    - aktualizr --version
    # create aktualizr bottle - an archive/tar.gz file along with a json file containing its metadata
    - brew bottle --json --no-rebuild --force-core-tap --root-url=${RELEASE_BASE_URL}/${VERSION} aktualizr
    # undo changes in the formula (version and revision)
    - git -C ${FORMULA_DIR} stash
    # update the formula with sha256 hash of the new bottle (the archive file)
    - brew bottle --merge --write --no-commit ./aktualizr--${VERSION}.mojave.bottle.json
    # update Version and Revision in the formula and create a pull request with the updated formula
    # that contains the new version, revision and sha256 of the bottle/archive file
    - brew bump-formula-pr -v -d -f --tag=${VERSION} --revision=${REVISION} --no-browse aktualizr
    # add the bottle file to the github release artifacts
    - mv aktualizr--${VERSION}.mojave.bottle.tar.gz aktualizr-${VERSION}.mojave.bottle.tar.gz
    - ghr -u "${GITHUB_REPOSITORY%/*}" -r "${GITHUB_REPOSITORY#*/}" ${VERSION} aktualizr-${VERSION}.mojave.bottle.tar.gz
  rules:
    - if: $CI_COMMIT_TAG =~ /^20\d\d\.\d\d?-docs$/
      when: never
    - if: $OSX_RELEASE && $CI_COMMIT_TAG =~ /^\d\d\d\d\.\d+(-\w+)?$/
      when: on_success
  tags:
  - osx