.gitlab-ci.yml

---
image: gradle:jdk11

include:
  # Run pipeline on main branch, merge requests, tags.
  # this is equivalent to `workflow.rules:` that set this up.
  - template: 'Workflows/MergeRequest-Pipelines.gitlab-ci.yml'
  # Whitesource
  - project: 'swe/gitlab-ci'
    file: '/templates/whitesource-scanning.yml'

stages:
  - build
  - test
  - qa
  - deploy

# Cache the complete build directories
cache: &global_cache
  key:
    files:
      - build.gradle
  paths:
    - build
    - .gradle
  policy: pull-push

variables:
  GRADLE_USER_HOME: "${CI_PROJECT_DIR}/.gradle/"
  GRADLE_OPTS: "-Dorg.gradle.caching=true -Dorg.gradle.parallel=true -Dorg.gradle.daemon=false"

build:
  stage: build
  script: ./gradlew -i clean build
  artifacts:
    paths:
      - build/distributions/*
      - src/main/scripts/deploy.sh
    reports:
      junit:
        - build/test-results/test/*.xml
  except:
    refs:
      - tags@rpki/rpki-ta-0
    variables:
      - $CI_COMMIT_TAG =~ /^rpki-ta-0-\d+\.\d+$/

build-release:
  stage: build
  script:
    - RELEASE_VERSION="${CI_COMMIT_TAG/rpki-ta-0-}" ./gradlew -i clean build
  artifacts:
    paths:
      - build/distributions/*
      - src/main/scripts/deploy.sh
    reports:
      junit:
        - build/test-results/test/*.xml
  only:
    refs:
      - tags@rpki/rpki-ta-0
    variables:
      - $CI_COMMIT_TAG =~ /^rpki-ta-0-\d+\..+$/

######### Test stage #########
sonarqube:
  stage: qa
  cache:
    <<: *global_cache
    policy: pull
  needs: ["build"]
  dependencies: ["build"]
  variables:
    GIT_DEPTH: 0
  script:
    - ./gradlew -i -Dsonar.projectKey=rpki-ta-0 sonarqube
  allow_failure: true
  rules:
    - if: $CI_MERGE_REQUEST_IID
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

.deploy: &deploy
  stage: deploy
  image: docker-registry.ripe.net/swe/gitlab-ci/debian-deployenv
  # No caching of gradle data needed
  cache: []
  allow_failure: true
  script:
    # Preparation: Include in scripts because we want the output.
    - echo "Using SSH key from ${SSH_KEY}"
    - chmod 400 ${SSH_KEY}
    - chmod +x src/main/scripts/*.sh
    - mv build/distributions/rpki-ta-0-*.tgz .
    # Print public key
    - ssh-keygen -y -l -f ${SSH_KEY}
    - >
      src/main/scripts/deploy.sh ${SSH_KEY}
      rpki-ta-0-*.tgz "${NODES}"
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_MERGE_REQUEST_IID
      when: manual

localcert:
  <<: *deploy
  variables:
    NODES: "localcert-3.rpki.ripe.net"
  environment:
    name: localcert

prepdev:
  <<: *deploy
  variables:
    NODES: "core-5.rpki.prepdev.ripe.net"
  environment:
    name: prepdev