.gitlab-ci.yml

default:
  image: ${PROTON_CI_REGISTRY}/android-shared/docker-android/oci:v2.1.6
  interruptible: true
  tags:
    - shared-small

before_script:
  - if [[ -f /load-env.sh ]]; then source /load-env.sh; fi
  - bundle config set path ${BUNDLE_GEM_PATH}
  - bundle config set without 'production'
  - bundle install

variables:
  # Clean up cache when extraction fails
  FF_CLEAN_UP_FAILED_CACHE_EXTRACT: "true"
  # Output upload and download progress every 5 seconds
  TRANSFER_METER_FREQUENCY: "5s"
  # Use no compression for artifacts
  ARTIFACT_COMPRESSION_LEVEL: "fastest"
  # Use low compression for caches
  CACHE_COMPRESSION_LEVEL: "fast"
  # Gem path
  BUNDLE_GEM_PATH: 'vendor/ruby'

# Makes sure we do not create separate merge request and branch pipelines.
# See https://docs.gitlab.com/ee/ci/yaml/workflow.html#switch-between-branch-pipelines-and-merge-request-pipelines
workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
      when: never
    - if: '$CI_COMMIT_TAG != null'
      when: never
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

.gradle-cache-dev: &gradle-cache-dev
  key:
    prefix: gradle-cache-dev
    files:
      - gradle/wrapper/gradle-wrapper.properties
  paths:
    - .gradle
  policy: pull

.gradle-cache-alpha: &gradle-cache-alpha
  key:
    prefix: gradle-cache-alpha
    files:
      - gradle/wrapper/gradle-wrapper.properties
  paths:
    - .gradle
  policy: pull

.gradle-cache-prod: &gradle-cache-prod
  key:
    prefix: gradle-cache-prod
    files:
      - gradle/wrapper/gradle-wrapper.properties
  paths:
    - .gradle
  policy: pull

.ruby-cache: &ruby-cache
  key:
    prefix: ruby-cache
    files:
      - Gemfile.lock
  paths:
    - ${BUNDLE_GEM_PATH}
  policy: pull

stages:
  - analyse
  - danger-review
  - localise
  - build
  - startReview
  - test
  - deploy
  - tag
  - publish
  - stopReview

detekt:
  stage: analyse
  cache:
    - <<: *gradle-cache-dev
      policy: !reference [ .cache-policy, cache, policy ]
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  tags:
    - shared-medium
  script:
    - bundle exec fastlane analyse
  artifacts:
    expire_in: 1 month
    reports:
      codequality: config/detekt/reports/mergedReport.json
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
      when: manual
      allow_failure: true
    - when: always

danger-review:
  stage: danger-review
  cache:
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  tags:
    - shared-small
  when: always
  script:
    - bundle exec danger --fail-on-errors=false
  allow_failure: true
  variables:
    DANGER_GITLAB_API_TOKEN: $DANGER_GITLAB_API_TOKEN
  interruptible: true
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

i18n-send-crowdin:
  stage: localise
  extends: .i18n-sync-crowdin-shared
  tags:
    - shared-small
  variables:
    I18N_FILTER_OUT_ITEMS: 'proton-libs'
    I18N_SYNC_CROWDIN_PROJECT: 'android-mail-new'
    I18N_SYNC_BRANCH: 'main'

i18n-commit-locales:
  stage: localise
  extends: .i18n-commit-locales-shared
  tags:
    - shared-small
  variables:
    I18N_COMMIT_CROWDIN_PROJECT: 'android-mail-new'
    I18N_COMMIT_BRANCH_PUSH: 'main'
    I18N_COMMIT_BRANCH_ALLOWED: 'main'

build_dev_debug:
  extends: .build_job
  cache:
    - <<: *gradle-cache-dev
      policy: !reference [ .cache-policy, cache, policy ]
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  script:
    - base64 -d - < "$GOOGLE_SERVICES_JSON_FILE" > app/google-services.json
    - bundle exec fastlane setupUiTestsAssets
    - bundle exec fastlane assembleDevDebug
    - bundle exec fastlane assembleDevDebugAndroidTest

build_alpha_release:
  extends: .build_job
  cache:
    - <<: *gradle-cache-alpha
      policy: !reference [ .cache-policy, cache, policy ]
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  script:
    - base64 -d - < "$PRIVATE_PROPERTIES_FILE" > private.properties
    - base64 -d - < "$SENTRY_PROPERTIES_FILE" > sentry.properties
    - base64 -d - < "$PROTON_RELEASE_KEYSTORE_BASE64" > keystore/ProtonMail.keystore
    - base64 -d - < "$GOOGLE_SERVICES_JSON_FILE" > app/google-services.json
    - bundle exec fastlane assembleAlphaRelease
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      # Always build on merge requests
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_PIPELINE_SOURCE == "parent_pipeline"
      when: never

build_prod_release:
  extends: .build_job
  cache:
    - <<: *gradle-cache-prod
      policy: !reference [ .cache-policy, cache, policy ]
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  script:
    - base64 -d - < "$PRIVATE_PROPERTIES_FILE" > private.properties
    - base64 -d - < "$SENTRY_PROPERTIES_FILE" > sentry.properties
    - base64 -d - < "$PROTON_RELEASE_KEYSTORE_BASE64" > keystore/ProtonMail.keystore
    - base64 -d - < "$GOOGLE_SERVICES_JSON_FILE" > app/google-services.json
    - bundle exec fastlane assembleProdRelease
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      # Always build on merge requests
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_PIPELINE_SOURCE == "parent_pipeline"
      when: never

startReview:
  stage: startReview
  tags:
    - shared-small
  before_script:
    - export REVIEW_APP_ARTIFACT_PATH="app/build/outputs/apk/alpha/release/app-alpha-release.apk"
    - echo ${REVIEW_APP_ARTIFACT_PATH}
  extends: .startReview
  dependencies:
    - build_alpha_release
  only:
    - merge_requests

stopReview:
  stage: stopReview
  cache:
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  extends: .stopReview
  tags:
    - shared-small
  before_script: [ ]
  rules:
    # The cleanup is always manual on a Merge Request
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: manual
      allow_failure: true
    # But it's not needed when not on a Merge Request
    - when: never

run_unit_test:
  stage: test
  cache:
    - <<: *gradle-cache-dev
      policy: !reference [ .cache-policy, cache, policy ]
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  tags:
    - xlarge-k8s
  dependencies:
    - build_dev_debug
  script:
    - base64 -d - < "$GOOGLE_SERVICES_JSON_FILE" > app/google-services.json
    - bundle exec fastlane unitTest
    - bundle exec fastlane coverageReport
  coverage: /TotalLineCoverage.*?(\d{1,3}\.\d{0,2})%/
  interruptible: true
  artifacts:
    when: always
    expire_in: 1 week
    paths:
      - '**/build/reports/kover/cobertura*.xml'
      - './coverage/build/reports/kover/html/'
    reports:
      junit: ./**/test-results/*/TEST-*.xml
      coverage_report:
        coverage_format: cobertura
        path: '**/build/reports/kover/cobertura*.xml'
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
      when: manual
      allow_failure: true
    - when: always

run_firebase_proton_core_libs_tests:
  extends: .firebase_test_job
  cache:
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  allow_failure: true # Temporary, as long as we don't have a more specific test environment.
  script:
    - bundle exec fastlane coreLibsTest
  rules:
    - if: ('$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH') && ($NIGHTLY_ALPHA_BUILD == "true" || $INTERNAL_ALPHA_RELEASE == "true")

run_firebase_smoke_tests:
  extends: .firebase_test_job
  cache:
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  script:
    - bundle exec fastlane smokeTest
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: ('$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH') || $NIGHTLY_ALPHA_BUILD == "true"
      when: never
    - when: on_success

run_firebase_full_regression_tests:
  extends: .firebase_test_job
  cache:
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  script:
    - bundle exec fastlane fullRegressionTest
  rules:
    - if: ('$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH') && ($NIGHTLY_ALPHA_BUILD == "true" || $INTERNAL_ALPHA_RELEASE == "true")
    # Allow manual regression test runs on MRs if needed.
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: manual
      allow_failure: true

tag_release:
  stage: tag
  cache:
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  tags:
    - shared-small
  script:
    - bundle exec fastlane tagRelease
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    - if: ('$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH') && ($INTERNAL_ALPHA_RELEASE != "true")
      when: manual
      allow_failure: true
    - if: ('$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH') && ($INTERNAL_ALPHA_RELEASE == "true")

deploy_to_firebase_dev:
  extends: .firebase_deploy_job
  cache:
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  script:
    - bundle exec fastlane deployToFirebaseDevGroup
  rules:
    - !reference [ .firebase_deploy_job, rules ]
    - if: $NIGHTLY_ALPHA_BUILD == "true"
      when: never
    - if: $INTERNAL_ALPHA_RELEASE == "true"
      when: never
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: manual
      allow_failure: true

deploy_to_firebase_nightly:
  extends: .firebase_deploy_job
  cache:
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  script:
    - bundle exec fastlane deployToFirebaseNightlyGroup
  rules:
    - !reference [ .firebase_deploy_job, rules ]
    - if: $NIGHTLY_ALPHA_BUILD == "true"

deploy_to_firebase_alpha:
  extends: .firebase_deploy_job
  cache:
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  script:
    - bundle exec fastlane deployToFirebaseInternalAlphaGroup
  rules:
    - !reference [ .firebase_deploy_job, rules ]
    - if: $INTERNAL_ALPHA_RELEASE == "true"

deploy_play_store_internal:
  stage: deploy
  cache:
    - <<: *ruby-cache
      policy: !reference [ .cache-policy, cache, policy ]
  dependencies:
    - build_prod_release
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: never
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: manual
      allow_failure: true
  script:
    - base64 -d - < "$PLAY_STORE_SERVICE_ACCOUNT_JSON" > /tmp/play_store_service_account.json
    - bundle exec fastlane deployToPlayStoreInternal

distribute_debug_mr:
  stage: deploy
  image: $CI_REGISTRY/tpe/test-scripts
  dependencies:
    - build_dev_debug
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      allow_failure: true
  before_script: []
  script:
    - MAIN_APK=app/build/outputs/apk/dev/debug/app-dev-debug.apk
    - TEST_APK=app/build/outputs/apk/androidTest/dev/debug/app-dev-debug-androidTest.apk
    - /usr/local/bin/nexus/mr_created_commit_pushed.py
      --token "$MAIL_ANDROID_READ_ACCESS_TOKEN"
      --component "/Mail/Android"
      --file_paths "$MAIN_APK" "$TEST_APK"
      --file_names "mail-dev-debug.apk" "mail-dev-debug-test.apk"

distribute_debug_post_merge:
  stage: deploy
  image: $CI_REGISTRY/tpe/test-scripts
  dependencies:
    - build_dev_debug
  rules:
    - if: '$CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
      allow_failure: true
  before_script: []
  script:
    - MAIN_APK=app/build/outputs/apk/dev/debug/app-dev-debug.apk
    - TEST_APK=app/build/outputs/apk/androidTest/dev/debug/app-dev-debug-androidTest.apk
    - /usr/local/bin/nexus/mr_merged_with_post_merge_pipeline.py
      --token "$MAIL_ANDROID_READ_ACCESS_TOKEN"
      --component "/Mail/Android"
      --file_paths "$MAIN_APK" "$TEST_APK"
      --file_names "mail-dev-debug.apk" "mail-dev-debug-test.apk"

release_publish_github:
  stage: publish
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: manual
    - when: never
  script:
    - ./tools/private/publish/publish-to-github.sh
  tags:
    - shared-medium

include:
  # Push the cache if it's the default branch
  - rules:
      - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
    local: /ci/cache-policy-push-pull.yml

  # Do not push the cache if it's not the default branch (e.g. MRs)
  - rules:
      - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
    local: /ci/cache-policy-pull.yml

  - component: gitlab.protontech.ch/proton/devops/cicd-components/kits/devsecops/generic@0.0.14
    inputs:
      stage: analyse

  - component: gitlab.protontech.ch/proton/devops/cicd-components/community/gradle-wrapper/validate@0.0.3
    inputs:
      stage: analyse

  - project: 'translations/generator'
    ref: master
    file: '/jobs/sync-crowdin.gitlab-ci.yml'

  - project: 'translations/generator'
    ref: master
    file: '/jobs/commit-locales.gitlab-ci.yml'

  - project: 'proton/mobile/android/proton-libs'
    ref: main
    file: '/ci/templates-shared/appetize-integration.yml'

  - local: '/ci/templates/base-jobs.gitlab-ci.yml'