.gitlab-ci.yml

image: clojure:tools-deps

services:
  - docker:dind

stages:
  - test
  - package
  - deploy

cache: &global_cache
  key: ${CI_JOB_NAME}
  paths:
    - node_modules/
    - .m2
    - .yarn

include:
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/License-Scanning.gitlab-ci.yml
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml

variables:
  DS_EXCLUDED_ANALYZERS: "retire.js"

cljs-test:
  image: ghcr.io/schnaq/clojure-yarn-chrome
  before_script:
    - yarn install --non-interactive --frozen-lockfile
    - clojure -Sdeps '{:mvn/local-repo ".m2"}' -M:dev -m "shadow.cljs.devtools.cli" compile ci-tests
  script:
    - yarn karma start --single-run --reporters junit
  artifacts:
    when: always
    reports:
      junit: target/TESTS.xml

clj-test:
  cache:
    key: ${CI_JOB_NAME}
    paths:
      - .m2
  before_script:
    - apt-get update
    - apt-get upgrade -y
    - apt-get install -y git
  script:
    - clojure -J-Dguardrails.enabled=true -Sdeps '{:mvn/local-repo ".m2"}' -M:dev:clj-tests --profile :ci
  artifacts:
    when: always
    reports:
      junit: junit.xml

build_latest_images:
  needs: [ "clj-test", "cljs-test" ]
  stage: package
  image: docker
  interruptible: true
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker pull $CI_REGISTRY_IMAGE:latest || true
    - docker build --cache-from $CI_REGISTRY_IMAGE:latest --tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA --tag $CI_REGISTRY_IMAGE:latest --tag $CI_REGISTRY_IMAGE:staging .
    - docker push $CI_REGISTRY_IMAGE:latest
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
    - docker push $CI_REGISTRY_IMAGE:staging
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH


.setup_ssh: &setup_ssh
  - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
  - eval $(ssh-agent -s)
  - echo "$SSH_STAGING_PRIVATE_KEY" | tr -d '\r' | ssh-add -
  - mkdir -p ~/.ssh
  - chmod 700 ~/.ssh
  - echo "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
  - chmod 644 ~/.ssh/known_hosts

deploy_staging:
  needs: [ "build_latest_images" ]
  image: ubuntu
  stage: deploy
  environment:
    name: staging
    url: https://staging.decide.ebbinghaus.me
  before_script: *setup_ssh
  script:
    - ssh $DEPLOY_TARGET 'cd decide-staging ; ./deploy_staging.sh'
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

deploy_production:
  needs: [ "build_latest_images" ]
  image: ubuntu
  stage: deploy
  when: manual
  environment:
    name: production
    url: https://decide.ebbinghaus.me
  before_script: *setup_ssh
  script:
    - ssh $DEPLOY_TARGET 'cd decide ; ./deploy.sh'
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH