.gitlab-ci.yml

variables:
  SAST_EXCLUDED_ANALYZERS: "brakeman,kubesec,mobsf,nodejs-scan,pmd-apex,security-code-scan,sobelow,spotbugs"

stages:
  - visual_pre
  - integration
  - compare
  - accessibility
  - test
  - unit
  - style
 
include:
  - template: Security/Secret-Detection.gitlab-ci.yml
  - template: Dependency-Scanning.gitlab-ci.yml
  - template: SAST.gitlab-ci.yml
  - template: License-Scanning.gitlab-ci.yml

.retry_config: &retry_job
  retry:
    max: 0 #Max is 2, set when gitlab is flacky
    when:
      - always

.retry_config: &matrix_retry_job
  retry:
    max: 2 #Max is 2, set when gitlab is flacky
    when:
      - always

.clean_ordering: &clean_ordering
  needs: []
# These seem to be overwritten when a job actually specifies these

.retry_time: &tiny_job
  <<: *clean_ordering
  timeout: 3m

.retry_time: &short_job
  <<: *clean_ordering
  timeout: 7m

.retry_time: &normal_job
  <<: *clean_ordering
  timeout: 15m

.retry_time: &long_job
  <<: *clean_ordering
  timeout: 30m
# Due to the retry this will be worst case 3*timeout before the job fails

webstandard_check_role:
  <<: *matrix_retry_job
  <<: *short_job
  parallel:
    matrix:
      - ROLE: public
        TEST: [w3cval,WCAG2A,WCAG2AA]
      - ROLE: team
        TEST: [w3cval,WCAG2A,WCAG2AA]
      - ROLE: balloon
        TEST: [w3cval,WCAG2A,WCAG2AA]
      - ROLE: jury
        TEST: [w3cval]
  stage: accessibility
  image: domjudge/gitlabci:2.1
  services:
    - mariadb
  variables:
    MYSQL_ROOT_PASSWORD: password
  script:
    - ./gitlab/webstandard.sh
  artifacts:
    when: always
    paths:
      - public
      - w3chtmlpublic.json
      - w3ccsspublic.json
      - w3csvgpublic.json

check syntax:
  <<: *retry_job
  <<: *short_job
  stage: style
  image: domjudge/gitlabci:2.1
  script:
    - ./gitlab/syntax.sh

check static codecov:
  <<: *retry_job
  <<: *tiny_job
  stage: style
  script:
    - curl -s https://codecov.io/bash > newcodecov
    - diff newcodecov gitlab/uploadcodecov.sh

run unit tests:
  <<: *retry_job
  <<: *normal_job
  stage: unit
  image: domjudge/gitlabci:2.1
  # Disabled for now as it drastically speeds up running unit tests and we don't use it yet
  # before_script:
  #   - apt-get update -yqq
  #   - apt-get install php-xdebug -yqq
  services:
    - mariadb
  variables:
    MYSQL_ROOT_PASSWORD: password
  script:
    - ./gitlab/unit-tests.sh
  artifacts:
    when: always
    paths:
      - unit-tests.xml
      - coverage-html
      - deprecation.txt
    reports:
      junit:
        - unit-tests.xml
  cache:
    key: unit-tests
    paths:
      - lib/vendor/

visual_pr:
  <<: *retry_job
  <<: *long_job
  stage: visual_pre
  image: domjudge/gitlabci:2.1
  services:
    - mariadb
  variables:
    MYSQL_ROOT_PASSWORD: password
    DOCKER_HOST: tcp://docker:2375/
    DOCKER_DRIVER: overlay2
  parallel:
    matrix:
      - URL: team
        ROLE: [jury,admin,team]
      - URL: public
        ROLE: [none,jury,admin,balloon,team]
  script:
    - git fetch
    - git config --global user.email "never@commits.ci"
    - git config --global user.name "Rebase against main"
    - echo -e "section_start:`date +%s`:diff[collapsed=true]\r\e[0K'Git Diff'"
    - git diff origin/main
    - echo -e "section_end:`date +%s`:diff\r\e[0K"
    - git pull origin main
    - ./gitlab/visualpr.sh pr
  artifacts:
    when: always
    paths:
      - screenshotspr
      - html
      - wget.log

visual_main:
  <<: *retry_job
  <<: *long_job
  stage: visual_pre
  image: domjudge/gitlabci:2.1
  services:
    - mariadb
  variables:
    MYSQL_ROOT_PASSWORD: password
    DOCKER_HOST: tcp://docker:2375/
    DOCKER_DRIVER: overlay2
  parallel:
    matrix:
      - URL: team
        ROLE: [jury,admin,team]
      - URL: public
        ROLE: [none,jury,admin,balloon,team]
  script:
    - git fetch
    - git checkout -B main origin/main
    - git branch --set-upstream-to=origin/main main
    - git pull
    - git checkout $CI_COMMIT_SHA -- gitlab/visualpr.sh # Always compare with the same tests
    - git checkout $CI_COMMIT_SHA -- gitlab/default-nginx
    - git checkout $CI_COMMIT_SHA -- gitlab/visualreg.css
    - ./gitlab/visualpr.sh main
  artifacts:
    when: always
    paths:
      - screenshotsmain
      - html
    
visual_compare:
  <<: *retry_job
  <<: *normal_job
  stage: compare
  image: domjudge/gitlabci:2.1
  needs:
    - visual_pr
    - visual_main
  script:
    - ./gitlab/visualcompare.sh
  artifacts:
    when: always
    paths:
      - visualchanges
      - addrem.log

.job_template: &job_integration
  <<: *retry_job
  <<: *long_job
  stage: integration
  image: domjudge/gitlabci:2.1
  variables:
    MYSQL_ROOT_PASSWORD: password
    MARIADB_PORT_3306_TCP_ADDR: sqlserver
  script:
    - timeout --signal=15 40m ./gitlab/integration.sh
  artifacts:
    when: always
    paths:
      - gitlabartifacts
  cache:
    key: integration
    paths:
      - lib/vendor/

# TODO: Re-enable when gitlab is in better shape...
#  cache:
#    key: integration
#    paths:
#      - chroot

integration_mysql:
  <<: *job_integration
  services:
    - name: mysql
      command: ["--default-authentication-plugin=mysql_native_password"]
      alias: sqlserver

integration_mariadb:
  <<: *job_integration
  services:
    - name: mariadb
      alias: sqlserver

phpcs_compatibility:
  <<: *tiny_job
  stage: style
  image: pipelinecomponents/php-codesniffer:latest
  before_script:
    - set -euxo pipefail
    - export PS4='[$?] $'
  parallel:
    matrix:
      - PHPVERSION: ["7.2","7.3","7.4"]
  script:
    - >
      phpcs -s -p --colors
      --standard=PHPCompatibility
      --extensions=php
      --runtime-set testVersion $PHPVERSION
      lib/lib.*.php
      etc
      judge
      webapp/src
      webapp/tests
      webapp/public
      webapp/config

# This finds different problems from codesniffer
php linter:
  <<: *tiny_job
  stage: style
  image: pipelinecomponents/php-linter:latest
  script:
    - ls
    - >
      parallel-lint --colors
      lib/lib.*.php
      etc
      judge
      webapp/src
      webapp/tests
      webapp/public
      webapp/config

php-cs-fixer:
  <<: *tiny_job
  stage: style
  image:
    name: cytopia/php-cs-fixer
    entrypoint: [""]
  artifacts:
    when: always
    reports:
      codequality: code-quality.json
    paths:
      - code_quality_debug.json
  script:
    - /usr/bin/php-cs-fixer fix --format=gitlab --dry-run --diff . > code-quality.json || true
    - cp code-quality.json code_quality_debug.json

codespell:
  <<: *tiny_job
  stage: style
  image: domjudge/gitlabci:2.1
  script:
    - pip install codespell
    - python3 gitlab/codespell_gitlab.py

detect dump:
  <<: *tiny_job
  stage: style
  image: domjudge/gitlabci:2.1
  script:
    - OUT=$(grep -H -n --exclude-dir=.git -r "dump(" ./ | grep -v "js/ace\|Yaml::dump")
    - echo $OUT
    - exit $(($(wc -l <<< $OUT)-1))