stages:
  - verify
  - container
  - package
  - release

workflow:
  rules:
    - if: '$CI_COMMIT_TAG'
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH'

variables:
  CARGO_HOME: "$CI_PROJECT_DIR/.cargo"
  CARGO_TERM_COLOR: never
  RUST_BACKTRACE: "1"

.rust-job:
  image: rust:1.88.0-bookworm
  before_script:
    - apt-get update
    - >-
      apt-get install --no-install-recommends -y
      libpam0g-dev libpam-modules pkg-config xauth xvfb util-linux
    - rustup component add rustfmt clippy
  cache:
    key:
      files:
        - Cargo.lock
        - rust-toolchain.toml
    paths:
      - .cargo/registry/index/
      - .cargo/registry/cache/
      - .cargo/git/db/
      - .cargo/bin/
      - target/

rust-verify:
  extends: .rust-job
  stage: verify
  script:
    - make check COLOR=0
    - make version COLOR=0
  artifacts:
    when: always
    expire_in: 7 days
    paths:
      - target/debug/deps/

security-audit:
  image: rust:1.88.0-bookworm
  stage: verify
  cache:
    key: cargo-audit-0.22.2
    paths:
      - .cargo/bin/
      - .cargo/registry/index/
      - .cargo/registry/cache/
  before_script:
    - export PATH="$CARGO_HOME/bin:$PATH"
    - command -v cargo-audit >/dev/null || cargo install cargo-audit --locked --version 0.22.2
  script:
    - cargo audit

docker-verify:
  image: docker:27.5.1-cli
  stage: container
  services:
    - name: docker:27.5.1-dind
      alias: docker
  variables:
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: "/certs"
    DOCKER_TLS_VERIFY: "1"
    DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"
  before_script:
    - until docker info >/dev/null 2>&1; do sleep 1; done
  script:
    - ./scripts/test-docker.sh
  rules:
    - if: '$CI_COMMIT_BRANCH'
    - if: '$CI_COMMIT_TAG'
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

package:
  extends: .rust-job
  stage: package
  needs:
    - job: rust-verify
      artifacts: false
    - job: docker-verify
      artifacts: false
    - job: security-audit
      artifacts: false
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v?[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$/'
  script:
    - VERSION="${CI_COMMIT_TAG#v}" make package COLOR=0 TAG="$CI_COMMIT_TAG"
    - (cd dist && sha256sum --check "$(basename "$(ls *.tar.gz)").sha256")
    - printf 'PACKAGE_JOB_ID=%s\n' "$CI_JOB_ID" >> dist/release.env
  artifacts:
    name: "latchd-${CI_COMMIT_TAG}"
    expire_in: 30 days
    paths:
      - dist/
    reports:
      dotenv: dist/release.env

release:
  image: registry.gitlab.com/gitlab-org/cli:v1.103.0
  stage: release
  needs:
    - job: package
      artifacts: true
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v?[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$/'
  script:
    - test -n "$PACKAGE_JOB_ID"
    - test -f dist/release.env
  release:
    tag_name: "$CI_COMMIT_TAG"
    name: "latchd ${CI_COMMIT_TAG}"
    description: "Production artifacts and checksums are attached from the reproducible package job."
    assets:
      links:
        - name: "latchd package and SHA-256"
          url: "${CI_PROJECT_URL}/-/jobs/${PACKAGE_JOB_ID}/artifacts/download?file_type=archive"
          link_type: package