.gitlab-ci.yml

# yaml-language-server: $schema=https://gitlab.com/gitlab-org/gitlab/-/raw/master/app/assets/javascripts/editor/schema/ci.json
variables:
  CACHE_COMPRESSION_FORMAT: tarzstd
  CARGO_HOME: $CI_PROJECT_DIR/.cargo-home
  # enable timestamps in logs: https://docs.gitlab.com/ci/jobs/job_logs/#job-log-timestamps
  FF_TIMESTAMPS: true
  RUST_BACKTRACE: full
  COVERAGE_REPORT: true

stages:
  - check
  - test
  - signstaros
  - publish
  - report
  - pages

# Prepares system, installs `just` and runs on default branch and in MRs.
.default:
  image: registry.archlinux.org/archlinux/archlinux-docker:base-master
  before_script:
    - pacman-key --init
    - pacman -Sy --needed --noconfirm archlinux-keyring just
  interruptible: true
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

# Installs Rust tools as 'root'.
.default-with-rust:
  extends: .default
  before_script:
    - pacman-key --init
    - pacman -Sy --needed --noconfirm archlinux-keyring just
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'rust-dev'"
    - just install-alpm-package-set rust-dev
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "install-rust-dev-tools" "Install Rust development tools"
    - just install-rust-dev-tools
    - just --justfile .gitlab/justfile section-end "install-rust-dev-tools"

# Installs Rust tools as 'testuser'.
.default-with-rust-and-testuser:
  extends: .default
  before_script:
    - pacman-key --init
    - pacman -Sy --needed --noconfirm archlinux-keyring just
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'rust-dev'"
    - just install-alpm-package-set rust-dev
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "create-testuser" "Create 'testuser'"
    - useradd -m testuser
    - chown -R testuser:testuser .
    - just --justfile .gitlab/justfile section-end "create-testuser"
    - just --justfile .gitlab/justfile section-start "install-rust-dev-tools" "Install Rust development tools as 'testuser'"
    - WORKDIR="$(pwd)" runuser -w WORKDIR -l testuser -c 'env && cd "$WORKDIR" && just install-rust-dev-tools'
    - just --justfile .gitlab/justfile section-end "install-rust-dev-tools"

commits:
  extends: .default
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'commits'"
    - just install-alpm-package-set commits
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    # fetch the default branch as we need it for comparison
    - git fetch origin $CI_DEFAULT_BRANCH
    # setup a dummy user as `cog verify` needs that
    - git config --local user.name "Foobar McFooface"
    - git config --local user.email "foobar@mcfooface.com"
    - just --justfile .gitlab/justfile section-start "check-commits" "Check commits"
    - just check-commits
    - just --justfile .gitlab/justfile section-end "check-commits"
  stage: check

spelling:
  extends: .default
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'spelling'"
    - just install-alpm-package-set spelling
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "check-spelling" "Check spelling in all files"
    - just check-spelling
    - just --justfile .gitlab/justfile section-end "check-spelling"
  stage: check

formatting:
  extends: .default-with-rust
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'formatting'"
    - just install-alpm-package-set formatting
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "check-formatting" "Check source file formatting"
    - just check-formatting
    - just --justfile .gitlab/justfile section-end "check-formatting"
  stage: check

shell-code:
  extends: .default
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'shell'"
    - just install-alpm-package-set shell
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "check-shell-code" "Check shell code"
    - just check-shell-code
    - just --justfile .gitlab/justfile section-end "check-shell-code"
  stage: check

rust-code:
  extends: .default-with-rust
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'rust'"
    - just install-alpm-package-set rust
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "check-rust-code" "Check Rust code"
    - just check-rust-code-all
    - just --justfile .gitlab/justfile section-end "check-rust-code"
  stage: check
  cache:
    key:
      files:
        - Cargo.lock
    paths:
      - .cargo-home
    policy: pull-push

unused-deps:
  extends: .default-with-rust
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'unused'"
    - just install-alpm-package-set unused
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "check-unused-deps" "Check for unused Rust dependencies"
    - just check-unused-deps
    - just --justfile .gitlab/justfile section-end "check-unused-deps"
  stage: check

dependencies:
  extends: .default-with-rust
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'dependencies'"
    - just install-alpm-package-set dependencies
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "check-dependencies" "Check Rust dependencies"
    - just check-dependencies
    - just --justfile .gitlab/justfile section-end "check-dependencies"
  stage: check

licenses:
  extends: .default
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'licenses'"
    - just install-alpm-package-set licenses
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "check-licenses" "Check licenses"
    - just check-licenses
    - just --justfile .gitlab/justfile section-end "check-licenses"
  stage: check

links:
  extends: .default
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'links'"
    - just install-alpm-package-set links
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "check-links" "Check links in all files"
    - just check-links
    - just --justfile .gitlab/justfile section-end "check-links"
  stage: check
  retry:
    max: 1
    when: script_failure
    exit_codes: 2
  cache:
    paths:
      - .lycheecache
    policy: pull-push

test:
  artifacts:
    reports:
      # Unit test reports
      # See: https://gitlab.archlinux.org/help/ci/testing/unit_test_reports#how-to-set-it-up
      junit: target/nextest/default/junit.xml
      coverage_report:
        coverage_format: cobertura
        path: target/llvm-cov/cobertura-coverage.xml
      # Expose the code coverage as a GitLab metric.
      # This allows us to easily spot changes in the overall coverage.
      metrics: target/llvm-cov/coverage-metrics.txt
  cache:
    key:
      files:
        - Cargo.lock
    paths:
      - .cargo-home
    policy: pull-push
  coverage: "/Test-coverage: ([0-9.]*)%/"
  extends: .default-with-rust
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'coverage'"
    - just install-alpm-package-set coverage
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "test" "Run unit tests"
    - just test-all
    - just --justfile .gitlab/justfile section-end "test"
    - just --justfile .gitlab/justfile section-start "test-docs" "Run doc tests"
    - just test-docs-all
    - just --justfile .gitlab/justfile section-end "test-docs"
    - just --justfile .gitlab/justfile section-start "create-coverage-report" "Create coverage report"
    - just create-coverage-report cobertura with-docs unit-test-coverage
    - just --justfile .gitlab/justfile section-end "create-coverage-report"
  stage: test

docs:
  extends: .default-with-rust
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'docs'"
    - just install-alpm-package-set docs
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "docs" "Build Rust API documentation"
    - just docs
    - just --justfile .gitlab/justfile section-end "docs"
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'book'"
    - just install-alpm-package-set book
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "build-book" "Build project documentation"
    - just build-book
    - just --justfile .gitlab/justfile section-end "build-book"
  stage: test

integration-test:
  artifacts:
    reports:
      # Unit test reports
      # See: https://gitlab.archlinux.org/help/ci/testing/unit_test_reports#how-to-set-it-up
      junit: target/nextest/default/junit.xml
      coverage_report:
        coverage_format: cobertura
        path: target/llvm-cov/cobertura-coverage.xml
      # Expose the code coverage as a GitLab metric.
      # This allows us to easily spot changes in the overall coverage.
      metrics: target/llvm-cov/coverage-metrics.txt
  coverage: "/Test-coverage: ([0-9.]*)%/"
  extends: .default-with-rust-and-testuser
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'containerized'"
    - just install-alpm-package-set containerized
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "integration-test-nethsm" "Run integration tests against a NetHSM container as 'testuser'"
    - WORKDIR="$(pwd)" runuser -w CI,COVERAGE_REPORT,WORKDIR -l testuser -c 'env && cd "$WORKDIR" && just nethsm-integration-tests'
    - just --justfile .gitlab/justfile section-end "integration-test-nethsm"
    - just --justfile .gitlab/justfile section-start "integration-test-containerized" "Run containerized integration tests as 'testuser'"
    - WORKDIR="$(pwd)" runuser -w CI,COVERAGE_REPORT,WORKDIR -l testuser -c 'env && cd "$WORKDIR" && just containerized-integration-tests-all'
    - just --justfile .gitlab/justfile section-end "integration-test-containerized"
    - just --justfile .gitlab/justfile section-start "create-coverage-report" "Create coverage report as 'testuser'"
    - WORKDIR="$(pwd)" runuser -w CI,COVERAGE_REPORT,WORKDIR -l testuser -c 'env && cd "$WORKDIR" && just create-coverage-report cobertura with-docs integration-test-coverage'
    - just --justfile .gitlab/justfile section-end "create-coverage-report"
  stage: test
  tags:
    - vm
  timeout: 20m

test-readmes:
  extends: .default-with-rust-and-testuser
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'readmes'"
    - just install-alpm-package-set readmes
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "test-readmes" "Run README tests as 'testuser'"
    - WORKDIR="$(pwd)" runuser -w CI,WORKDIR -l testuser -c 'env && cd "$WORKDIR" && just test-readmes'
    - just --justfile .gitlab/justfile section-end "test-readmes"
  stage: test
  tags:
    - vm

build-image:
  # NOTE: This fails until a new version of `signstar-configure-build` with support for `signstar_config::BackendConnection` is released and used.
  allow_failure: true
  dependencies: []
  extends: .default
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'signstar-os'"
    - just install-alpm-package-set signstar-os
    # show the mkosi version
    - mkosi --version
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "create-testuser" "Create 'testuser'"
    - useradd -m testuser
    - chown -R testuser:testuser .
    - just --justfile .gitlab/justfile section-end "create-testuser"
    - just --justfile .gitlab/justfile section-start "create-openpgp-key" "Create ephemeral OpenPGP signing key"
    - export KEY="$(mktemp)"
    - rsop generate-key --signing-only test > "$KEY"
    - chown testuser:testuser "$KEY"
    - just --justfile .gitlab/justfile section-end "create-openpgp-key"
    - just --justfile .gitlab/justfile section-start "build-image" "Build Signstar OS image as 'testuser'"
    - WORKDIR="$(pwd)" runuser -w WORKDIR,KEY -l testuser -c 'env && cd "$WORKDIR" && just build-image "$KEY"'
    - just --justfile .gitlab/justfile section-end "build-image"
  stage: signstaros
  tags:
    - vm

build-test-image:
  # NOTE: This fails because of pacman issue which is already merged, see: https://gitlab.archlinux.org/pacman/pacman/-/merge_requests/328
  allow_failure: true
  extends: .default-with-rust-and-testuser
  dependencies: []
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'signstar-os'"
    - just install-alpm-package-set signstar-os
    # show the mkosi version
    - mkosi --version
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "create-openpgp-key" "Create ephemeral OpenPGP signing key"
    - export KEY="$(mktemp)"
    - rsop generate-key --signing-only test > "$KEY"
    - chown testuser:testuser "$KEY"
    - just --justfile .gitlab/justfile section-end "create-openpgp-key"
    - just --justfile .gitlab/justfile section-start "build-image" "Build Signstar OS test image as 'testuser'"
    - WORKDIR="$(pwd)" runuser -w WORKDIR,KEY -l testuser -c 'env && cd "$WORKDIR" && just build-test-image "$KEY"'
    - just --justfile .gitlab/justfile section-end "build-image"
  stage: signstaros
  tags:
    - vm

crates_publish:
  dependencies: []
  extends: .default-with-rust
  rules:
    - if: '$CARGO_REGISTRY_TOKEN && $CI_COMMIT_TAG && $CI_PROJECT_PATH == "archlinux/signstar"'
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'publish'"
    - just install-alpm-package-set publish
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "ci-publish" "Publish a crate on crates.io"
    - just ci-publish
    - just --justfile .gitlab/justfile section-end "ci-publish"
  stage: publish
  tags:
    - secure

issue-bot:
  dependencies: []
  image: registry.gitlab.com/gitlab-org/distribution/issue-bot:latest
  rules:
    - if: $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH
      when: on_failure
  script: /issue-bot
  stage: report

pages:
  artifacts:
    paths:
      - output/docs
  dependencies: []
  extends: .default-with-rust
  publish: output/docs
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  script:
    - just --justfile .gitlab/justfile section-start "install-alpm-packages" "Install ALPM package set 'book'"
    - just install-alpm-package-set book
    - just --justfile .gitlab/justfile section-end "install-alpm-packages"
    - just --justfile .gitlab/justfile section-start "build-book" "Build project documentation"
    - just build-book
    - just --justfile .gitlab/justfile section-end "build-book"
  stage: pages