.gitlab-ci.yml

---
################################################################################
# COMMON PARAMETERS
################################################################################
before_script:
  - unset http_proxy ; unset https_proxy
  - env | grep ^CI_

################################################################################
# STAGES
################################################################################
stages:
  - build_img
  - build_pkg
  - sign
  - publish
  - test
  - deploy
  - build_pf_img

################################################################################
# VARIABLES
################################################################################
variables:
  PFBUILD_CENTOS_8_IMG: inverseinc/pfbuild-centos-8
  PFBUILD_DEB_BULLSEYE_IMG: inverseinc/pfbuild-debian-bullseye
  PFBUILD_DEFAULT_DEV_TAG: latest
  CIDIR: ci
  CILIBDIR: ci/lib
  PACKERDIR: $CIDIR/packer
  ZENDIR: $CIDIR/packer/zen
  VAGRANT_IMG_DIR: $CIDIR/packer/vagrant_img
  TESTDIR: $CILIBDIR/test
  UPLOAD_DIR: $CILIBDIR/upload
  SF_REPO_URL: https://sourceforge.net/projects/packetfence/files/PacketFence%20ZEN
  # env variables
  ANSIBLE_FORCE_COLOR: 1
  ANSIBLE_STDOUT_CALLBACK: yaml
  VAGRANT_FORCE_COLOR: "true"


################################################################################
# TEMPLATES
################################################################################

########################################
# RULES
########################################
# run only jobs on release tag (vX.Y.Z) (push and web)
# no schedule on tag
.release_only_rules:
  rules:
    - if: '$CI_COMMIT_TAG'

# run only jobs on "devel" branch (push, schedule and web)
.devel_only_rules:
  rules:
    - if: '$CI_COMMIT_REF_NAME == "devel"'

# run jobs on any branches only via "Run pipeline", except:
# - devel branch
# - maintenance/X.Y branches
# don't run on tag
.branches_only_rules:
  rules:
   - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && $CI_PIPELINE_SOURCE == "web"'

# run only on maintenance jobs (schedule and web, not on push)
.maintenance_only_rules:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "web" && $CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/'
    - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/'

# run jobs on "devel" branch (push, schedule and web)
# run jobs on any branches except maintenance/X.Y branches
# don't run on tag
# we used same kind of rules below but we add variable checks to add jobs to pipeline
.devel_and_branches_rules:
  rules:
    - if: '$CI_COMMIT_REF_NAME == "devel"'
    - if: '$CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && $CI_PIPELINE_SOURCE == "web"'

# run jobs on "devel" branch *or* vX.Y.Z tag (push, schedule and web)
# run jobs on any branches/tags via "Run pipeline"
# run jobs on any branches/tags via "Schedule"
.devel_release_branches_and_maintenance_rules:
  rules:
    - if: '$CI_COMMIT_REF_NAME == "devel"'
    - if: '$CI_COMMIT_TAG'
    - if: '$CI_PIPELINE_SOURCE == "web"'
    - if: '$CI_PIPELINE_SOURCE == "schedule"'

# only run this job on devel branch with build_img_docker variable defined or build_img_docker in commit message
.build_img_docker_devel_rules:
  rules:
    - if: '$CI_COMMIT_REF_NAME == "devel" && ($BUILD_IMG_DOCKER == "yes" || $CI_COMMIT_MESSAGE =~ /build_img_docker=yes/)'

# only run this job on branch different from devel (all branches, maintenance/X.Y branches included) with build_img_docker variable defined or build_img_docker in commit message
.build_img_docker_branches_and_maintenance_rules:
  rules:
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_TAG == null && $CI_PIPELINE_SOURCE == "web" && ( $BUILD_IMG_DOCKER == "yes" || $CI_COMMIT_MESSAGE =~ /build_img_docker=yes/ )'
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_TAG == null && $CI_PIPELINE_SOURCE == "schedule" && ( $BUILD_IMG_DOCKER == "yes" || $CI_COMMIT_MESSAGE =~ /build_img_docker=yes/ )'

# run jobs only when:
# - on devel branch (push,web,schedule) if variable BUILD_IMG_VAGRANT sets to yes or if CI_COMMIT_MESSAGE contains "build_img_vagrant=yes".
# - on all branches, except maintenance/X.Y (web) if variable BUILD_IMG_VAGRANT sets to yes or if CI_COMMIT_MESSAGE contains "build_img_vagrant=yes".
# don't run on tag
.build_img_vagrant_devel_and_branches_rules:
  rules:
    - if: '$CI_COMMIT_REF_NAME == "devel" && ( $BUILD_IMG_VAGRANT == "yes" || $CI_COMMIT_MESSAGE =~ /build_img_vagrant=yes/ )'
    - if: '$CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && $CI_PIPELINE_SOURCE == "web" && ( $BUILD_IMG_VAGRANT == "yes" || $CI_COMMIT_MESSAGE =~ /build_img_vagrant=yes/ )'

# run jobs only when:
# - on a tag (push, schedule, web)
# - on all branches (web and schedule) if variable TEST sets to yes or if CI_COMMIT_MESSAGE contains "test=yes".
# - on devel branch (push) if variable TEST sets to yes or if CI_COMMIT_MESSAGE contains "test=yes".
# Web pipelines launch on devel branch will be catched by previous rules
.test_rules:
  rules:
    - if: '$CI_COMMIT_TAG'
    - if: '$CI_PIPELINE_SOURCE == "web" && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ )'
    - if: '$CI_PIPELINE_SOURCE == "schedule" && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ )'
    - if: '$CI_COMMIT_REF_NAME == "devel" && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ )'

# run jobs only when:
# - on devel branch (push, web, *not* schedule) if variable TEST sets to yes or if CI_COMMIT_MESSAGE contains "test=yes".
# - on all branches, except maintenance/X.Y and devel (web) if variable TEST sets to yes or if CI_COMMIT_MESSAGE contains "test=yes".
# don't run on tag
.test_devel_and_branches_rules:
  rules:
    - if: '$CI_COMMIT_REF_NAME == "devel" && $CI_PIPELINE_SOURCE != "schedule" && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ )'
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && $CI_PIPELINE_SOURCE == "web" && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ )'

# run this job on all branches (schedule) with test variable defined or test=yes in commit message
.test_nightly_rules:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule" && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ )'

# run this job on devel branch with build_pf_img_zen variable defined or build_pf_img_zen=yes in commit message
# ZEN build is not configured to run on branches
.build_pf_img_zen_devel_rules:
  rules:
    - if: '$CI_COMMIT_REF_NAME == "devel" && ( $BUILD_PF_IMG_ZEN == "yes" || $CI_COMMIT_MESSAGE =~ /build_pf_img_zen=yes/ )'

########################################    
# JOBS
########################################
.build_img_docker_job:
  stage: build_img
  script:
    - make -e -C ${PACKERDIR} build_img_docker_pfbuild
  tags:
    - shell

.build_img_vagrant_devel_and_branches_job:
  stage: build_img
  variables:
    RESULT_DIR: /var/local/gitlab-runner/vagrant_img
    BOX_DESC: ${CI_PIPELINE_URL}
  script:
    - make -e -C ${VAGRANT_IMG_DIR} ${BOX_NAME}
  after_script:
    - make -e -C ${VAGRANT_IMG_DIR} clean
  tags:
    - shell
    - inverse.ca

.build_pkg_job:
  stage: build_pkg
  artifacts:
    expire_in: 1 day
    paths:
      - result/*
  tags:
    - docker-inverse

.publish_job:
  stage: publish
  environment:
    name: PPA
    url: http://inverse.ca/downloads/PacketFence/gitlab/${CI_PIPELINE_ID}
  script:
    - ci-pages-ppa
    - ci-pages-home
    - ci-pages-tree
    - ./${UPLOAD_DIR}/deploy-artifacts.sh ppa
  variables:
    DEPLOY_USER: reposync
    DEPLOY_HOST: web.inverse.ca
    GITLAB_DEPLOY_DIR: ${CI_PIPELINE_ID}
  tags:
    - shell

.test_job:
  stage: test
  dependencies: []
  tags:
    - inverse.ca
    - shell

.deploy_deb_job:
  stage: deploy
  dependencies:
    - sign_devel_release_branches_and_maintenance
  variables:
    DEPLOY_USER: reposync
    DEPLOY_HOST: web.inverse.ca
  script:
    - ./${UPLOAD_DIR}/deploy-artifacts.sh deb
  tags:
    - shell

.deploy_maintenance_deb_job:
  stage: deploy
  dependencies:
    - sign_devel_release_branches_and_maintenance
  variables:
    DEPLOY_USER: reposync
    DEPLOY_HOST: web.inverse.ca
  script:
    - ./${UPLOAD_DIR}/deploy-artifacts.sh deb
  tags:
    - shell

.deploy_rpm_job:
  stage: deploy
  dependencies:
    - sign_devel_release_branches_and_maintenance
  variables:
    DEPLOY_USER: reposync
    DEPLOY_HOST: web.inverse.ca
    DEPLOY_SRPMS: "no"
  script:
    - ./${UPLOAD_DIR}/deploy-artifacts.sh rpm
  tags:
    - shell

.deploy_rpm_maintenance_job:
  stage: deploy
  dependencies:
    - sign_devel_release_branches_and_maintenance
  variables:
    DEPLOY_USER: reposync
    DEPLOY_HOST: web.inverse.ca
    DEPLOY_SRPMS: "no"
  script:
    - ./${UPLOAD_DIR}/deploy-artifacts.sh rpm
  tags:
    - shell

.deploy_rpm_packetfence-release_job:
  stage: deploy
  dependencies:
    - sign_devel_release_branches_and_maintenance
  variables:
    DEPLOY_USER: reposync
    DEPLOY_HOST: web.inverse.ca
  script:
    - ./${UPLOAD_DIR}/deploy-artifacts.sh packetfence-release
  tags:
    - shell

.build_pf_img_zen_job:
  stage: build_pf_img
  environment:
    name: sourceforge
    url: ${SF_REPO_URL}/${CI_COMMIT_REF_NAME}
  after_script:
    - make -e -C ${ZENDIR} clean
    - make -e -C ${ZENDIR} clean_cache
  dependencies: []
  tags:
    - shell

.build_pf_img_vagrant_release_job:
  stage: build_pf_img
  variables:
    RESULT_DIR: /var/local/gitlab-runner/vagrant_img
    BOX_DESC: ${CI_PIPELINE_URL}
  script:
    - make -e -C ${VAGRANT_IMG_DIR} ${BOX_NAME}
  after_script:
    - make -e -C ${VAGRANT_IMG_DIR} clean
  dependencies: []
  tags:
    - inverse.ca
    - shell

.rpm_script_job:
  script:
    - make -e build_rpm

.deb_script_job:
  script:
    - make -e build_deb

.test_script_job:
  variables:
    INT_TEST_VM_NAMES: ad switch01 node01 wireless01
  script:
    - make -e -C ${TESTDIR} test
  after_script:
    - make -e -C ${TESTDIR} halt

########################################
# VARIABLES
########################################
.test_el_8_vars:
  variables:
    PF_VM_NAME: pfel8dev

.test_debian_bullseye_vars:
  variables:
    PF_VM_NAME: pfdeb11dev

################################################################################
# JOBS
################################################################################

########################################
# BUILD_IMG JOBS
########################################
### build_img_docker jobs
build_img_docker_devel:
  extends:
    - .build_img_docker_job
    - .build_img_docker_devel_rules
  variables:
    DOCKER_TAGS: latest,maintenance-99-9

build_img_docker_branches_and_maintenance:
  extends:
    - .build_img_docker_job
    - .build_img_docker_branches_and_maintenance_rules
  variables:
    DOCKER_TAGS: ${CI_COMMIT_REF_SLUG}

# build a docker image at release
# used to build release and maintenance packages
build_img_docker_release:
  extends:
    - .build_img_docker_job
    - .release_only_rules
  variables:
    DOCKER_TAGS: ${CI_COMMIT_TAG}
    ANSIBLE_CENTOS_GROUP: common_centos
    ANSIBLE_CENTOS8_GROUP: stable_centos8
    ANSIBLE_DEBIAN_GROUP: common_debian
    ANSIBLE_RUBYGEMS_GROUP: stable_rubygems
    ACTIVE_BUILDS: 'pfbuild-centos-8,pfbuild-bullseye'

### build_img_vagrant jobs
build_img_vagrant_devel_and_branches_el_8:
  extends:
    - .build_img_vagrant_devel_and_branches_job
    - .build_img_vagrant_devel_and_branches_rules
  variables:
    BOX_NAME: pfel8dev

build_img_vagrant_devel_and_branches_debian_bullseye:
  extends:
    - .build_img_vagrant_devel_and_branches_job
    - .build_img_vagrant_devel_and_branches_rules
  variables:
    BOX_NAME: pfdeb11dev

########################################
#  BUILD_PKG JOBS
########################################
# build_pkg jobs for development
build_pkg_devel_and_branches_centos_8:
  image: ${PFBUILD_CENTOS_8_IMG}:${PFBUILD_DEFAULT_DEV_TAG}
  extends:
    - .build_pkg_job
    - .rpm_script_job
    - .devel_and_branches_rules

build_pkg_devel_and_branches_debian_bullseye:
  image: ${PFBUILD_DEB_BULLSEYE_IMG}:${PFBUILD_DEFAULT_DEV_TAG}
  extends:
    - .build_pkg_job
    - .deb_script_job
    - .devel_and_branches_rules

# build_pkg jobs for release
# CI_COMMIT_TAG contains vX.Y.X
build_pkg_release_centos_8:
  image: ${PFBUILD_CENTOS_8_IMG}:${CI_COMMIT_TAG}
  extends:
    - .build_pkg_job
    - .rpm_script_job
    - .release_only_rules

build_pkg_release_debian_bullseye:
  image: ${PFBUILD_DEB_BULLSEYE_IMG}:${CI_COMMIT_TAG}
  extends:
    - .build_pkg_job
    - .deb_script_job
    - .release_only_rules

# CI_COMMIT_REF_SLUG contains maintenance-X-Y
build_pkg_maintenance_centos_8:
  image: ${PFBUILD_CENTOS_8_IMG}:${CI_COMMIT_REF_SLUG}
  extends:
    - .build_pkg_job
    - .rpm_script_job
    - .maintenance_only_rules

build_pkg_maintenance_debian_bullseye:
  image: ${PFBUILD_DEB_BULLSEYE_IMG}:${CI_COMMIT_REF_SLUG}
  extends:
    - .build_pkg_job
    - .deb_script_job
    - .maintenance_only_rules

########################################
# SIGN JOBS
########################################
sign_devel_release_branches_and_maintenance:
  # GPG_USER_ID see GitLab variable
  # only use when executor is docker
  image: buildpkg/debian:buster
  stage: sign
  script:
    - ci-sign-pkg
  dependencies:
    - build_pkg_devel_and_branches_centos_8
    - build_pkg_devel_and_branches_debian_bullseye
    - build_pkg_release_centos_8
    - build_pkg_release_debian_bullseye
    - build_pkg_maintenance_centos_8
    - build_pkg_maintenance_debian_bullseye
  artifacts:
    expire_in: 1 day
    paths:
      - result/*
  tags:
    - shell
  extends:
    - .devel_release_branches_and_maintenance_rules

########################################
# PUBLISH JOBS
########################################g
publish_ppa_devel_release_branches_and_maintenance::
  # only use when executor is docker
  image: buildpkg/debian:buster
  dependencies:
    - sign_devel_release_branches_and_maintenance
  extends:
    - .publish_job
    - .test_rules

########################################
# TEST JOBS
########################################
test_devel_and_branches_el_8:
  variables:
    PERL_UNIT_TESTS: 'yes'
    GOLANG_UNIT_TESTS: 'yes'
    INTEGRATION_TESTS: 'no'
    VAGRANT_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-el-8-${CI_COMMIT_REF_SLUG}
  extends:
    - .test_job
    - .test_el_8_vars
    - .test_script_job
    - .test_devel_and_branches_rules

test_devel_and_branches_debian_bullseye:
  variables:
    PERL_UNIT_TESTS: 'no'
    GOLANG_UNIT_TESTS: 'yes'
    INTEGRATION_TESTS: 'no'
    VAGRANT_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-debian-bullseye-${CI_COMMIT_REF_SLUG}
  extends:
    - .test_job
    - .test_debian_bullseye_vars
    - .test_script_job
    - .test_devel_and_branches_rules

test_release_el_8:
  variables:
    PERL_UNIT_TESTS: 'no'
    GOLANG_UNIT_TESTS: 'no'
    INTEGRATION_TESTS: 'no'
    # provision VM and run configurator test
    RUN_TESTS: 'yes'
    VAGRANT_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-el-8-${CI_COMMIT_TAG}
  extends:
    - .test_job
    - .test_el_8_vars
    - .test_script_job
    - .release_only_rules

test_release_debian_bullseye:
  variables:
    PERL_UNIT_TESTS: 'no'
    GOLANG_UNIT_TESTS: 'no'
    INTEGRATION_TESTS: 'no'
    # provision VM and run configurator test
    RUN_TESTS: 'yes'
    VAGRANT_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-debian-bullseye-${CI_COMMIT_TAG}
  extends:
    - .test_job
    - .test_debian_bullseye_vars
    - .test_script_job
    - .release_only_rules

# used on devel and maintenance branches
test_nightly_el_8:
  variables:
    PERL_UNIT_TESTS: 'yes'
    GOLANG_UNIT_TESTS: 'yes'
    INTEGRATION_TESTS: 'yes'
    VAGRANT_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-el-8-${CI_COMMIT_REF_SLUG}
  extends:
    - .test_job
    - .test_el_8_vars
    - .test_script_job
    - .test_nightly_rules

# used on devel and maintenance branches
test_nightly_debian_bullseye:
  variables:
    PERL_UNIT_TESTS: 'no'
    GOLANG_UNIT_TESTS: 'yes'
    INTEGRATION_TESTS: 'yes'
    VAGRANT_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-debian-bullseye-${CI_COMMIT_REF_SLUG}
  extends:
    - .test_job
    - .test_debian_bullseye_vars
    - .test_script_job
    - .test_nightly_rules

########################################
# DEPLOY JOBS
########################################
### RPM jobs
deploy_devel_rpm:
  extends:
    - .deploy_rpm_job
    - .devel_only_rules
  environment:
    name: pf-devel

# we deploy packetfence-release RPM with
# a fixed name *outside* a RPM repo
# for first installation
deploy_devel_rpm_packetfence-release:
  extends:
    - .deploy_rpm_packetfence-release_job
    - .devel_only_rules
  environment:
    name: pf-devel
  variables:
    PKG_DEST_NAME: packetfence-release-devel.el8.noarch.rpm

deploy_branches_rpm:
  extends:
    - .deploy_rpm_job
    - .branches_only_rules
  environment:
    name: pf-branches
  variables:
    RPM_DEPLOY_DIR: branches/x86_64

deploy_branches_rpm_packetfence-release:
  extends:
    - .deploy_rpm_packetfence-release_job
    - .branches_only_rules
  environment:
    name: pf-branches
  variables:
    PKG_DEST_NAME: packetfence-release-branches.el8.noarch.rpm

deploy_release_rpm:
  extends:
    - .deploy_rpm_job
    - .release_only_rules
  environment:
    name: pf-stable

# we deploy packetfence-release RPM with
# a fixed name *outside* a RPM repo
# for first installation
deploy_release_rpm_packetfence-release:
  extends:
    - .deploy_rpm_packetfence-release_job
    - .release_only_rules
  environment:
    name: pf-stable

deploy_maintenance_rpm:
  extends:
    - .deploy_rpm_maintenance_job
    - .maintenance_only_rules
  environment:
    name: maintenance

### Debian jobs
deploy_devel_deb:
  extends:
    - .deploy_deb_job
    - .devel_only_rules
  environment:
    name: pf-devel
  variables:
    DEB_DEPLOY_DIR: debian

deploy_branches_deb:
  extends:
    - .deploy_deb_job
    - .branches_only_rules
  environment:
    name: pf-branches
  variables:
    DEB_DEPLOY_DIR: debian-branches

deploy_release_deb:
  extends:
    - .deploy_deb_job
    - .release_only_rules
  environment:
    name: pf-stable
  variables:
    DEB_DEPLOY_DIR: debian

deploy_maintenance_deb:
  extends:
    - .deploy_maintenance_deb_job
    - .maintenance_only_rules
  environment:
    name: maintenance

########################################
# BUILD_PF_IMG JOBS
########################################
### build_pf_img_zen jobs
build_pf_img_zen_devel:
  extends:
    - .build_pf_img_zen_job
    - .build_pf_img_zen_devel_rules
  script:
    - make -e -C ${ZENDIR} zen-devel

build_pf_img_zen_release:
  extends:
    - .build_pf_img_zen_job
  script:
    - make -e -C ${ZENDIR} zen-release
  # workaround for https://forum.gitlab.com/t/specify-when-at-job-level-with-a-job-that-has-rules/4769
  rules:
    - if: '$CI_COMMIT_TAG'
      when: manual
      allow_failure: true

### build_pf_img_vagrant jobs
build_pf_img_vagrant_release_el_8:
  extends:
    - .build_pf_img_vagrant_release_job
  variables:
    BOX_NAME: pfel8stable
  # workaround for https://forum.gitlab.com/t/specify-when-at-job-level-with-a-job-that-has-rules/4769
  rules:
    - if: '$CI_COMMIT_TAG'
      when: manual
      allow_failure: true

build_pf_img_vagrant_release_debian_bullseye:
  extends:
    - .build_pf_img_vagrant_release_job
  variables:
    BOX_NAME: pfdeb11stable
  # workaround for https://forum.gitlab.com/t/specify-when-at-job-level-with-a-job-that-has-rules/4769
  rules:
    - if: '$CI_COMMIT_TAG'
      when: manual
      allow_failure: true