.gitlab-ci.yml

image: python:3.11

stages:
  - setup
  - lint
  - test
  - integration-test
  - bump
  - build
  - release
  - deploy


# Pipeline rules
workflow:
  rules:
      # Prevent running a push pipeline for a release commit that's not a tag
    - if: $CI_COMMIT_MESSAGE =~ /^chore\(release\):.*/ && $CI_COMMIT_TAG == null
      when: never
      # If a push to branch with open merge request then ignore
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: never
      # If source is push and no open merge request then run
    - if: $CI_COMMIT_BRANCH
      # Run tag pipelines
    - if: $CI_COMMIT_TAG

# Change pip's cache directory to be inside the project directory since we can
# only cache local items.
variables:
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
  VERSION_FILE: ".version"
  CI_GHCR_IMAGE: ${CI_GHCR_REGISTRY}/${CI_GHCR_REPO}


# Default cache values
default:
  cache: &global_cache
    key: $CI_COMMIT_REF_SLUG
    paths:
      - .cache/pypoetry
      - .cache/pip
      - .venv/
      - ./task
    policy: pull-push


# Anchor to use pull only cache
.use_cached_venv: &use_cached_venv
  before_script:
    - source .venv/bin/activate
  cache:
    <<: *global_cache
    policy: pull


.only_tag: &only_tag
  rules:
    - if: $CI_COMMIT_TAG
      when: on_success
    - when: never


.no_tag: &no_tag
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - when: on_success


.only_protected: &only_protected
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_COMMIT_TAG == null
      when: on_success
    - when: never


.k8s-job:
  image: dtzar/helm-kubectl:3.12
  before_script:
    - kubectl config use-context $AGENT_CONFIG
    - kubectl version
    - helm version


.deploy-common:
  extends: .k8s-job
  stage: deploy
  # variables:
  #   DEPLOY_HOSTS
  #   NAMESPACE
  #   RELEASE_NAME
  #   REPLICAS
  #   CHART_PATH
  #   IMAGE_TAG (optional)
  needs:
    - get-version
  script:
    - TLS_SECRET="$RELEASE_NAME-tls"
    - HOSTS_ARR=(${DEPLOY_HOSTS//,/ })
    # If Tag is set use that, if not use CI_COMMIT_TAG or CI_COMMIT_SHORT_SHA if the CI tag isn't available
    - IMAGE_TAG=${IMAGE_TAG:-${CI_COMMIT_TAG:-$CI_COMMIT_SHORT_SHA}}
    - HELM_SET_ARGS="--set image.tag=${IMAGE_TAG} --set image.repository=$CI_GHCR_IMAGE --set ingress.tlsSecretName=$TLS_SECRET --set replicas=$REPLICAS"
    - |
      for i in "${!HOSTS_ARR[@]}"; do
        HELM_SET_ARGS="$HELM_SET_ARGS --set ingress.hosts[$i]=${HOSTS_ARR[$i]}"
      done
    - helm upgrade --install --namespace $NAMESPACE $HELM_SET_ARGS $RELEASE_NAME $CHART_PATH
    - kubectl wait --namespace $NAMESPACE --for=condition=available --timeout=180s deployment/$RELEASE_NAME


# Anchor for docker jobs
.docker-job:
  image: docker:latest
  services:
    - docker:dind


# Setup job to recreate venv when dependencies change
# or there is no existing cache already
build-env:
  stage: .pre
  script:
    # Setup virtual environment
    - python -m venv .venv/
    - pip install -U pip
    - pip install poetry
    - poetry install --all-extras
    # Install go-task
    - sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b .
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: never
      # If project dependencies were changed then run
    - changes:
      - pyproject.toml
      - poetry.lock
      when: always
      # If .venv exists then skip
    - exists: 
      - .venv/
      when: never
    # Default to manual, but continue
    # pipeline if not run
    - when: manual
      allow_failure: true


# Main Jobs
# ------------


lint:
  <<: *use_cached_venv
  <<: *no_tag
  stage: lint
  script:
    - ./task lint


lint-commit:
  <<: *use_cached_venv
  <<: *no_tag
  stage: lint
  script:
    - |
      # Get the commit message of the last commit
      commit_message=$(git log -1 --pretty=format:%s)

      # If the commit message starts with "Merge branch", it is a merge commit, so skip the linting.
      if [[ $commit_message == 'Merge branch'* ]]; then
        echo "Merge commit detected, skipping lint."
        exit 0
      fi

      pip install gitlint
      # Ensure the commit message is valid
      # We should always pass this as long as the pusher has the pre-commit hooks installed
      # but just as a sanity check we'll run it here
      git log -1 --pretty=%B | gitlint


# We need to always run the unit-tests job so the build-docs-docker job
# can access the artifact since downloading via API is broken:
# https://gitlab.com/gitlab-org/gitlab/-/issues/352644
unit-tests:
  <<: *use_cached_venv
  stage: test
  script:
    - ./task unit-tests
  coverage: '/(?i)total.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
      junit: report.xml
    paths:
      - coverage-report/


bump-version:
  <<: *use_cached_venv
  <<: *only_protected
  variables:
    REPO_URL: "https://release-token:${RELEASE_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git"
  stage: bump
  before_script:
    - pip install -U commitizen
      # Set git info
    - git config --global user.email "$GIT_COMMIT_EMAIL"
    - git config --global user.name "$GIT_COMMIT_USER"
      # NOTE: Must be set to CLONE strategy in gitlab CI otherwise there will be
      # excess commits and tags from a dirty cache
    - git checkout $CI_COMMIT_BRANCH
    - git pull $REPO_URL $CI_COMMIT_BRANCH
      # Explicitly checkout branch since gitlab CI detaches
  script:
    # Bump the version
    - export CZ_BUMP_OUTPUT=$(cz bump --yes 2>&1)
    - export CZ_BUMP_EXIT_CODE=$?
    - echo $CZ_BUMP_OUTPUT
    - echo $CZ_BUMP_EXIT_CODE
    # Push new tag to trigger release workflow if bumped
    - |
      if [[ $CZ_BUMP_OUTPUT == *"[NO_COMMITS_TO_BUMP]"* ]]; then
        echo "Version unchanged."
      else
        echo "Version changed."
        git push $REPO_URL $CI_COMMIT_BRANCH --tags
      fi


get-version:
  <<: *use_cached_venv
  stage: setup
  script:
    - export PROJECT_VERSION=$(poetry version --short)
    - 'echo "Project: ${PROJECT_VERSION}"'
    - echo "PROJECT_VERSION=$PROJECT_VERSION" >> $VERSION_FILE
  artifacts:
    reports:
      dotenv: $VERSION_FILE


build-wheel:
  <<: *use_cached_venv
  <<: *only_tag
  image: mateusoliveira43/poetry:1.5.1-python3.11.4
  stage: build
  script:
    - poetry build --format wheel
  artifacts:
    name: dist
    paths:
      - dist/


build-docs:
  <<: *use_cached_venv
  <<: *only_protected
  stage: build
  script:
    - ./task build-docs
  artifacts:
    paths:
      - site/
    expire_in: 1 week


build-docker:
  <<: *use_cached_venv
  extends: .docker-job
  stage: build
  rules:
    - if: $CI_COMMIT_TAG
      when: on_success
    - when: manual
      allow_failure: true
  needs: ["get-version"]
  script:
    - export COMMIT_TAG=${CI_COMMIT_TAG:-$CI_COMMIT_SHORT_SHA}
    - echo $CI_GHCR_PAT | docker login $CI_GHCR_REGISTRY -u $CI_GHCR_USER --password-stdin
    - ./task build-docker-base IMAGE_NAME=$CI_GHCR_IMAGE IMAGE_TAG=$COMMIT_TAG PYTHON_VERSION=3.11 DOCKER_BUILD_ARGS="--pull"
    - if [ -n "$CI_COMMIT_TAG" ]; then
        docker tag "$CI_GHCR_IMAGE:$COMMIT_TAG" "$CI_GHCR_IMAGE:latest";
      fi
    - docker push "$CI_GHCR_IMAGE" --all-tags


build-docker-full:
  <<: *use_cached_venv
  extends: .docker-job
  stage: build
  rules:
    - if: $CI_COMMIT_TAG
      when: on_success
    - when: manual
      allow_failure: true
  needs: ["get-version", "build-docker"]
  script:
    - export COMMIT_TAG=${CI_COMMIT_TAG:-$CI_COMMIT_SHORT_SHA}
    - echo $CI_GHCR_PAT | docker login $CI_GHCR_REGISTRY -u $CI_GHCR_USER --password-stdin
    - ./task build-docker-full IMAGE_NAME=$CI_GHCR_IMAGE IMAGE_TAG=$COMMIT_TAG PYTHON_VERSION=3.11 DOCKER_BUILD_ARGS="--pull"
    - if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
        docker tag "$CI_GHCR_IMAGE:$COMMIT_TAG" "$CI_GHCR_IMAGE:latest";
      fi
    - docker push "$CI_GHCR_IMAGE" --all-tags


build-docker-gpu:
  <<: *use_cached_venv
  extends: .docker-job
  stage: build
  rules:
    - if: $CI_COMMIT_TAG
      when: on_success
    - when: manual
      allow_failure: true
  needs: ["get-version", "build-docker", "build-docker-full"]
  script:
    - export COMMIT_TAG=${CI_COMMIT_TAG:-$CI_COMMIT_SHORT_SHA}
    - echo $CI_GHCR_PAT | docker login $CI_GHCR_REGISTRY -u $CI_GHCR_USER --password-stdin
    - ./task build-docker-gpu IMAGE_NAME=$CI_GHCR_IMAGE IMAGE_TAG=$COMMIT_TAG PYTHON_VERSION=3.11 DOCKER_BUILD_ARGS="--pull"
    - if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
        docker tag "$CI_GHCR_IMAGE:$COMMIT_TAG" "$CI_GHCR_IMAGE:latest";
      fi
    - docker push "$CI_GHCR_IMAGE" --all-tags


build-docs-docker:
  <<: *use_cached_venv
  <<: *only_protected
  extends: .docker-job
  stage: build
  needs: ["build-docs", "unit-tests"]
  script:
    - echo $CI_GHCR_PAT | docker login $CI_GHCR_REGISTRY -u $CI_GHCR_USER --password-stdin
    - ./task build-docker-docs IMAGE_NAME=$CI_GHCR_IMAGE IMAGE_TAG=$CI_COMMIT_SHORT_SHA PYTHON_VERSION=3.11 DOCKER_BUILD_ARGS="--pull"
    - docker push "$CI_GHCR_IMAGE" --all-tags


make-release:
  <<: *only_tag
  stage: release
  image: registry.gitlab.com/gitlab-org/release-cli:latest
  script:
    - echo "Building release $CI_COMMIT_TAG"
  release:
    name: Release $CI_COMMIT_TAG
    tag_name: $CI_COMMIT_TAG
    description: $CHANGELOG


publish-wheel:
  <<: *use_cached_venv
  <<: *only_tag
  stage: release
  needs: ["build-wheel"]
  image: mateusoliveira43/poetry:1.5.1-python3.11.4
  variables:
    PACKAGE_NAME: flowdapt
  script: |
      # Publish the built wheel to the registry
      poetry config pypi-token.pypi $PYPI_TOKEN
      poetry publish


deploy-docs:
  <<: *only_protected
  stage: deploy
  extends: .deploy-common
  environment:
    name: documentation
    url: https://docs.flowdapt.ai
  needs: ["build-docs-docker", "get-version"]
  variables:
    DEPLOY_HOSTS: docs.flowdapt.ai
    RELEASE_NAME: flowdapt-docs
    NAMESPACE: website
    REPLICAS: 1
    CHART_PATH: charts/docs
    IMAGE_TAG: docs-latest