include:
  - local: .gitlab/templates/common.yml

stages:
  - pretest
  - build_deps
  - plan
  - dynamic_ci
  - triggers

lint:
  stage: pretest
  tags:
    - ci-builder
  cache:
    key:
      files:
        - yarn.lock
    paths:
      - .yarn/cache/
      - .yarn/unplugged/
      - .pnp.*
      - packages/*/dist
    policy: pull-push
  extends: .cache_template
  variables:
    NODE_OPTIONS: --max_old_space_size=4096
  before_script:
    - yarn install --immutable
  script:
    - yarn lint
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: always
    - if: $CI_COMMIT_BRANCH == "master"
      when: always
    - if: $CI_COMMIT_BRANCH =~ /^releases\/(\d+\.\d+\.\d+)(-.*)?/
      when: always

sast-scan:
  stage: pretest
  image: registry.tekoapis.com/teko-registry-asia/teko-registry/sre/teko-semgrep:2023-05-24T08-38-43Z
  script:
    - /run/teko-semgrep
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /master|main|^releases\/(\d+\.\d+\.\d+)(-.*)?/
      allow_failure: true
  tags:
    - ci-general-k8s

test:detect-secrets:
  stage: pretest
  script:
    - set +e
    - git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_NAME
    - rt=$(git diff --name-only refs/remotes/origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME | egrep -vw $NO_SCAN_FILES)
    - echo "Checking secrets in files ${rt}"
    - if [ -z "${rt}" ]; then exit 0; fi
    - git diff --name-only refs/remotes/origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME | egrep -vw $NO_SCAN_FILES | xargs detect-secrets-hook
  allow_failure: true
  image:
    name: tekohub/detect-secrets:v1.0
  rules:
    - if: $CI_PIPELINE_SOURCE =~ /merge_request_event|parent_pipeline/
    - if: $CI_PIPELINE_SOURCE =~ /web|push|parent_pipeline/ && $CI_COMMIT_REF_NAME =~ /master|main|^releases\/(\d+\.\d+\.\d+)(-.*)?/ && $CI_COMMIT_MESSAGE !~ /^Merge branch.*/

test:validate-mr:
  stage: pretest
  image:
    name: registry.tekoapis.com/dockerhub-vendor/curlimages/curl:latest
  variables:
    GIT_STRATEGY: none
  before_script:
    - echo "Empty"
  script: |
    body=$(printf '{"project_id":"%s", "mr_id":"%s", "action_by": "%s"}' ${CI_PROJECT_ID} ${CI_MERGE_REQUEST_IID} ${GITLAB_USER_EMAIL})
    echo $body
    curl --silent --fail-with-body -X 'POST' -H "Content-Type:application/json" -H "CI-JOB-TOKEN: ${CI_JOB_TOKEN}" "${WORKFLOW_MANAGER_DOMAIN}/v1/cicd/validate_mr" -d "${body}"
  after_script:
    - echo "Empty"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  tags:
    - ci-general-k8s

build:packages:
  stage: build_deps
  extends:
    - .cache_template
    - .env_variables
  cache:
    key:
      files:
        - yarn.lock
    paths:
      - .yarn/cache/
      - .yarn/unplugged/
      - .pnp.*
      - packages/*/dist
    policy: pull-push
  tags:
    - ci-builder
  before_script:
    - yarn install --immutable
  script:
    - yarn build:packages
  rules:
    - if: $CI_COMMIT_BRANCH == "master"
      when: on_success
    - if: $CI_COMMIT_BRANCH =~ /^releases\/(\d+\.\d+\.\d+)(-.*)?/
      when: on_success
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: manual
  allow_failure: true

dynamic_ci:
  stage: dynamic_ci
  before_script:
    - !reference [.env_variables, before_script]
  script:
    - echo "Generating dynamic CI with DEPLOY_ENV=$DEPLOY_ENV and COMPARE_TO_SHA=$COMPARE_TO_SHA"
    - node ./.gitlab/scripts/gen-dynamic-ci.js $DEPLOY_ENV $COMPARE_TO_SHA
    - cat dynamic-gitlab-ci.yml
  artifacts:
    expire_in: 1 week
    paths:
      - dynamic-gitlab-ci.yml
  needs:
    - build:packages
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: manual
    - if: $CI_COMMIT_BRANCH == "master"
      when: on_success
    - if: $CI_COMMIT_BRANCH =~ /^releases\/(\d+\.\d+\.\d+)(-.*)?/
      when: on_success

triggers:
  stage: triggers
  needs:
    - job: dynamic_ci
      artifacts: true
  trigger:
    include:
      - artifact: dynamic-gitlab-ci.yml
        job: dynamic_ci
  allow_failure: true
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: on_success
    - if: $CI_COMMIT_BRANCH == "master"
      when: on_success
    - if: $CI_COMMIT_BRANCH =~ /^releases\/(\d+\.\d+\.\d+)(-.*)?/
      when: on_success

publish:packages:
  stage: plan
  cache:
    key:
      files:
        - yarn.lock
    paths:
      - .yarn/cache/
      - .yarn/unplugged/
      - .pnp.*
      - packages/*/dist
    policy: pull
  rules:
    - if: $CI_COMMIT_BRANCH == "master"
      when: manual
  allow_failure: true
  script:
    - NODE_ENV=production
    - yarn install --immutable
    - yarn build:packages
    - yarn publish:gitlab-registry

release:
  stage: plan
  image: curlimages/curl:7.87.0
  variables:
    GIT_STRATEGY: none
    RELEASE_TYPE: minor
  tags:
    - ci-general-k8s
  rules:
    - if: $CI_COMMIT_BRANCH == "master"
      when: manual
  allow_failure: true
  script:
    - body=$(printf '{"project_id":"%s", "release_type":"%s", "new_release_sha":"%s"}' ${CI_PROJECT_ID} ${RELEASE_TYPE} ${CI_COMMIT_SHA})
    - echo ${body}
    - curl --fail-with-body -s  -H "Content-Type:application/json" "https://workflow-manager.tekoapis.com/v1/cicd/releases" -H "CI-JOB-TOKEN:${CI_JOB_TOKEN}" -d "${body}"
  needs:
    - lint