.gitlab-ci.yml

#
# iparapheur
# Copyright (C) 2019-2024 Libriciel-SCOP
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.
#


include:
  # Container-Scanning here are redundant, since they already are in every project.
  # We don't want duplicate vulnerability warnings.
  - template: Jobs/Secret-Detection.gitlab-ci.yml
  - project: "libriciel/integration-continue/templates"
    ref: update-software-on-server@1.0.0
    file: '/jobs/update-software-on-server/update-software-on-server.yml'


variables:
  NIGHTLY:
    value: "FALSE"
    description: "If set to TRUE, will start the nightly jobs"
  FORCE_RESET_DATA:
    value: "FALSE"
    description: "If set to TRUE, deploy jobs will wipe data even if it normally don't (acceptance, dev)"
  PACKAGE_NAME: iparapheur-${CI_COMMIT_REF_NAME}
  PACKAGE_NAME_WITH_EXTENSION: ${PACKAGE_NAME}.tar.gz


# Local generic deploy job, the remote one is software-agnostic.
# This is where we make it iparapheur-specific. All the following deploy jobs will extend this one.
# Note that we have deploys in the deploy AND the test stages.
.iparapheur-deploy:
  extends: [ .update-software-on-server ]
  needs: [ package-tar-gz ]
  tags: [ runner-signature-shell ]
  variables:
    INIT_SCRIPT: "ip5-compose-dev.sh"
    TARGETED_SOFTWARE: iparapheur
    TARGETED_ACTUATOR_SUB_PATH: /api/actuator/info
    PACKAGE_NAME_WITH_EXTENSION: ${PACKAGE_NAME}.tar.gz


# <editor-fold desc="Build">


package-tar-gz:
  stage: build
  script:
    - sed --in-place "s/%CI_COMMIT_REF_NAME%/$CI_COMMIT_REF_NAME/g" docker-compose.yml
    - mkdir ${PACKAGE_NAME}
    - mv --target-directory ${PACKAGE_NAME} docker-compose.yml .env.dist
    - mkdir ${PACKAGE_NAME}/docker-resources
    - mv --target-directory ${PACKAGE_NAME}/docker-resources src/main/resources/docker-resources/*
    - chmod +x ${PACKAGE_NAME}/docker-resources/*.sh
    - tar --create --gzip --file ${PACKAGE_NAME_WITH_EXTENSION} ${PACKAGE_NAME}
  artifacts:
    # The package is only needed for a while, to be used on the next deploy jobs.
    # This internal package is irrelevant after the next release is out.
    # It is already published on the public Nexus anyway.
    expire_in: 3 months
    name: ${PACKAGE_NAME}
    paths:
      - ${PACKAGE_NAME_WITH_EXTENSION}


# </editor-fold desc="Build">


# <editor-fold desc="Test">


e2e-deploy:
  extends: [ .iparapheur-deploy ]
  stage: test
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: never
    - if: $NIGHTLY == "TRUE"
      when: always
      variables:
        OVERRIDE_DOCKER_COMPOSE_FILE: "overrides/docker-compose.override.dev.yml"
    - if: $CI_COMMIT_BRANCH == 'develop'
      when: always
      variables:
        OVERRIDE_DOCKER_COMPOSE_FILE: "overrides/docker-compose.override.dev.yml"
    - if: $CI_COMMIT_TAG != null
      when: always
      variables:
        OVERRIDE_DOCKER_COMPOSE_FILE: "overrides/docker-compose.override.e2e-tag.yml"
    - when: manual
      variables:
        OVERRIDE_DOCKER_COMPOSE_FILE: "overrides/docker-compose.override.dev.yml"
  allow_failure: false
  variables:
    TARGETED_ENVIRONNEMENT_URL: charge.iparapheurubu22-5-0.recette.libriciel.net
    SSH_PRIVATE_KEY_B64: ${E2E_TESTS_SSH_PRIVATE_KEY_B64}
    SERVER_DIST_PATH: "/opt/iparapheur/dist-${CI_COMMIT_REF_NAME}-${CI_JOB_STARTED_AT}"
    RESET_DATA: "TRUE"
    OVERWRITE_ADMIN_PASSWORD: "TRUE"


.e2e-tests:
  image: markhobson/maven-chrome:jdk-11
  variables:
    LANG: fr_FR.UTF-8
  stage: test
  needs: [ e2e-deploy ]
  script:
    - set -eo pipefail
    - apt-get update && apt-get install --assume-yes --no-install-recommends --show-upgraded libpoppler118=22.02.* libxml2-utils=2.9.* locales=2.35-* locales-all=2.35-* python3-pip=22.0.* poppler-utils=22.02.* xmlsec1=1.2.* zip=3.0-12build2 && pip3 install jsonpath-ng==1.5.3 Pillow==9.2.0 PyPDF2==2.10.0 && locale-gen fr_FR.UTF-8
    - echo "Test ${CI_COMMIT_REF_NAME} deployed on ${E2E_TESTS_TARGET_SERVER_URL} with Karate - These tests mustn't fail"
    - ./gradlew test -Dkarate.options="${KARATE_ADDITIONAL_TAGS}" -Dkarate.adminUserPwd="${E2E_TESTS_INITIAL_ADMIN_PWD}" -Dkarate.headless=true -Dkarate.baseUrl="https://${E2E_TESTS_TARGET_SERVER_URL}" -Dkarate.chromeBin=/opt/google/chrome/google-chrome
    - python3 src/scripts/karate-tests-fixme-ip-tag.py | tee build/karate-tests-fixme-ip-tag.txt
  after_script:
    - if [ ! -f build/karate-tests-fixme-ip-tag.txt ] ; then python3 src/scripts/karate-tests-fixme-ip-tag.py | tee build/karate-tests-fixme-ip-tag.txt ; fi
  artifacts:
    when: always
    name: ${REPORT_NAME}
    paths:
      - build/ip5-folders
      - build/karate-reports
      - build/karate-tests-fixme-ip-tag.txt


e2e-setup:
  extends: [ .e2e-tests ]
  variables:
    REPORT_NAME: "Karate - tests strict - ${KARATE_TEST_SET}"
    KARATE_ADDITIONAL_TAGS: "--tags @before --tags ~@ignore "
  needs:
    - job: e2e-deploy
      optional: true
  allow_failure: false


e2e-strict-tests:
  extends: [ .e2e-tests ]
  variables:
    REPORT_NAME: "Karate - tests strict - ${KARATE_TEST_SET}"
    KARATE_ADDITIONAL_TAGS: "--tags @ip5 --tags @${KARATE_TEST_SET} --tags ~@fixme-ip5 --tags ~@ignore "
  needs:
    - job: e2e-setup
      optional: true
  allow_failure: false
  parallel:
    matrix:
      - KARATE_TEST_SET: [ "demo-simple-bde", "formats-de-signature", "legacy-bridge", "metadonnees" ]


e2e-tolerant-tests:
  extends: [ .e2e-tests ]
  variables:
    REPORT_NAME: "Karate - tests tolerant - ${KARATE_TEST_SET}"
    KARATE_ADDITIONAL_TAGS: "--tags @ip5 --tags @${KARATE_TEST_SET} --tags @fixme-ip5 --tags ~@ignore "
  needs: [ e2e-strict-tests ]
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_TAG != null
      when: never
    - when: manual
  allow_failure: true
  parallel:
    matrix:
      - KARATE_TEST_SET: [ "demo-simple-bde", "formats-de-signature", "legacy-bridge", "metadonnees" ]


# </editor-fold desc="Test">


# <editor-fold desc="Deploy">


publish:
  stage: deploy
  dependencies: [ package-tar-gz ]
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: never
    - if: $CI_COMMIT_TAG != null
      when: always
      variables:
        NEXUS_FINAL_PATH: ${NEXUS_PUBLIC_PATH}
    - when: manual
      variables:
        NEXUS_FINAL_PATH: ${NEXUS_PRIVATE_PATH}
  script:
    - echo "Publishing ${PACKAGE_NAME_WITH_EXTENSION} to https://${NEXUS_HOST}/repository/${NEXUS_FINAL_PATH}/${PACKAGE_NAME_WITH_EXTENSION}"
    - curl --user ${REGISTRY_CONTAINER_USER}:${REGISTRY_CONTAINER_PASSWORD} --upload-file ${PACKAGE_NAME_WITH_EXTENSION} https://${NEXUS_HOST}/repository/${NEXUS_FINAL_PATH}/${PACKAGE_NAME_WITH_EXTENSION}


acceptance-deploy:
  extends: [ .iparapheur-deploy ]
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: never
    - if: $CI_COMMIT_TAG != null
      when: always
    - when: manual
  variables:
    TARGETED_ENVIRONNEMENT_URL: iparapheur-5-1.recette.libriciel.net
    SSH_PRIVATE_KEY_B64: ${ACCEPTANCE_SSH_PRIVATE_KEY_B64}


dev-deploy:
  extends: [ .iparapheur-deploy ]
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: never
    - if: $NIGHTLY == "TRUE"
      when: always
    - when: manual
  variables:
    TARGETED_ENVIRONNEMENT_URL: iparapheur-5-0.dev.libriciel.net
    SSH_PRIVATE_KEY_B64: ${DEV_SSH_PRIVATE_KEY_B64}
    SERVER_DIST_PATH: "/opt/iparapheur/dist-${CI_COMMIT_REF_NAME}-${CI_JOB_STARTED_AT}"


# </editor-fold desc="Deploy">