.gitlab-ci.yml

stages:
  - init
  - test
  - build
  - release

workflow:
  rules:
    # Run pipeline for merge requests
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    # Run pipeline for pushes to default branch
    - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
    # Run pipeline for pushes to branches without open merge requests
    - if: "$CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS"
      when: never
    # Run pipeline for all other branch pushes
    - if: "$CI_COMMIT_BRANCH"
    # Run pipeline for web/api triggers
    - if: '$CI_PIPELINE_SOURCE == "web"'

variables:
  BINARY_NAME: "fleeting-plugin-upcloud"
  PACKAGE_REGISTRY_URL: "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/${BINARY_NAME}"
  CGO_ENABLED: "0"
  GIT_DEPTH: "0"
  GIT_STRATEGY: clone
  # Keep mise tools and the Go module cache inside the project dir so they can be cached
  MISE_DATA_DIR: "$CI_PROJECT_DIR/.mise"
  GOPATH: "$CI_PROJECT_DIR/.go"
  # Trust mise.toml without an interactive prompt (idempotent, unlike `mise trust`)
  MISE_TRUSTED_CONFIG_PATHS: "$CI_PROJECT_DIR"

# Toolchain comes from mise.toml (same as local dev)
default:
  image:
    name: ghcr.io/jdx/mise:latest
    entrypoint: [""]
  tags:
    - upcloud
  before_script:
    - mise install
    - eval "$(mise env -s bash)"
  cache:
    key: mise-toolchain
    paths:
      - .mise
      - .go/pkg/mod

# ──────────────────────────────────────────────
# Init
# ──────────────────────────────────────────────

# Dry-run semantic-release to determine the next version and generate changelog.
# Writes VERSION to build.env (dotenv artifact) so downstream jobs receive it
# as a CI variable. VERSION is empty when there are no releasable commits.
bump-version:
  stage: init
  image:
    name: registry.gitlab.com/go-semantic-release/semantic-release:latest
    entrypoint: [""]
  interruptible: true
  before_script: []
  cache: []
  artifacts:
    paths:
      - .version-unreleased
      - CHANGELOG.md
      - build.env
    reports:
      dotenv: build.env
    expire_in: 1 week
  script:
    - semantic-release --version-file --changelog CHANGELOG.md --dry || true
    - export VERSION=$(cat .version-unreleased 2>/dev/null || echo "")
    - echo "VERSION=${VERSION}" > build.env
    - |
      if [ -n "$VERSION" ]; then
        echo "Next release: v${VERSION}"
        cat CHANGELOG.md
      else
        echo "No releasable commits found; skipping release."
      fi

# ──────────────────────────────────────────────
# Test
# ──────────────────────────────────────────────

test:
  stage: test
  needs: []
  script:
    - mise run vet
    - mise run lint
    - mise run test

# ──────────────────────────────────────────────
# Build (cross-compiled; darwin binaries are unsigned — sign locally after download)
# ──────────────────────────────────────────────

# No `changes:` filter: semantic-release considers any fix:/feat: commit
# releasable (including ones that only touch scripts or CI), so build+release
# must run whenever bump-version computes a VERSION.
.build-common:
  stage: build
  rules:
    - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
  needs:
    - job: bump-version
      artifacts: true
    - job: test
      artifacts: false
  script:
    - |
      COMMIT="${CI_COMMIT_SHORT_SHA}"
      DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
      BUILD_VERSION="${VERSION:-${CI_COMMIT_SHORT_SHA}}"
      LDFLAGS="-X main.buildVersion=${BUILD_VERSION} -X main.buildCommit=${COMMIT} -X main.buildDate=${DATE}"
      GOOS=${TARGET_OS} GOARCH=amd64 go build -ldflags "${LDFLAGS}" -o "bin/${TARGET_OS}-amd64/${BINARY_NAME}" .
      GOOS=${TARGET_OS} GOARCH=arm64 go build -ldflags "${LDFLAGS}" -o "bin/${TARGET_OS}-arm64/${BINARY_NAME}" .
    # Upload only for releasable versions: BUILD_VERSION falls back to the
    # commit SHA (always set), which used to push SHA-versioned binaries to
    # the package registry on every default-branch push.
    - |
      if [ -n "${VERSION}" ]; then
        for GOARCH in amd64 arm64; do
          ASSET="${BINARY_NAME}-${TARGET_OS}-${GOARCH}"
          BIN="bin/${TARGET_OS}-${GOARCH}/${BINARY_NAME}"
          sha256sum "${BIN}" | awk -v name="${ASSET}" '{print $1 "  " name}' > "${BIN}.sha256"
          echo "Uploading ${ASSET}..."
          curl --fail --silent --show-error \
            --header "JOB-TOKEN: ${CI_JOB_TOKEN}" \
            --upload-file "${BIN}" \
            "${PACKAGE_REGISTRY_URL}/${VERSION}/${ASSET}"
          curl --fail --silent --show-error \
            --header "JOB-TOKEN: ${CI_JOB_TOKEN}" \
            --upload-file "${BIN}.sha256" \
            "${PACKAGE_REGISTRY_URL}/${VERSION}/${ASSET}.sha256"
        done
      else
        echo "VERSION is empty — no releasable commits. Skipping upload."
      fi

build-linux:
  extends: .build-common
  variables:
    TARGET_OS: linux

build-darwin:
  extends: .build-common
  variables:
    TARGET_OS: darwin

# ──────────────────────────────────────────────
# Release
# ──────────────────────────────────────────────

# Creates the Git tag and GitLab release in one step using the version and
# changelog from bump-version, then attaches the binaries as asset links.
# Uses CI_JOB_TOKEN — no custom GITLAB_TOKEN required.
# Skips gracefully when VERSION is empty (no releasable commits).
create-release:
  stage: release
  image: registry.gitlab.com/gitlab-org/release-cli:latest
  before_script: []
  cache: []
  rules:
    - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
  needs:
    - job: bump-version
      artifacts: true
    - job: build-linux
      artifacts: false
    - job: build-darwin
      artifacts: false
  script:
    - |
      if [ -z "$VERSION" ]; then
        echo "VERSION is empty — no releasable commits. Skipping release."
        exit 0
      fi

      release-cli create \
        --name "v${VERSION}" \
        --tag-name "v${VERSION}" \
        --ref "${CI_COMMIT_SHA}" \
        --description "CHANGELOG.md" \
        --assets-link "{\"name\":\"${BINARY_NAME}-linux-amd64\",\"url\":\"${PACKAGE_REGISTRY_URL}/${VERSION}/${BINARY_NAME}-linux-amd64\",\"link_type\":\"package\"}" \
        --assets-link "{\"name\":\"${BINARY_NAME}-linux-amd64.sha256\",\"url\":\"${PACKAGE_REGISTRY_URL}/${VERSION}/${BINARY_NAME}-linux-amd64.sha256\",\"link_type\":\"other\"}" \
        --assets-link "{\"name\":\"${BINARY_NAME}-linux-arm64\",\"url\":\"${PACKAGE_REGISTRY_URL}/${VERSION}/${BINARY_NAME}-linux-arm64\",\"link_type\":\"package\"}" \
        --assets-link "{\"name\":\"${BINARY_NAME}-linux-arm64.sha256\",\"url\":\"${PACKAGE_REGISTRY_URL}/${VERSION}/${BINARY_NAME}-linux-arm64.sha256\",\"link_type\":\"other\"}" \
        --assets-link "{\"name\":\"${BINARY_NAME}-darwin-amd64\",\"url\":\"${PACKAGE_REGISTRY_URL}/${VERSION}/${BINARY_NAME}-darwin-amd64\",\"link_type\":\"package\"}" \
        --assets-link "{\"name\":\"${BINARY_NAME}-darwin-amd64.sha256\",\"url\":\"${PACKAGE_REGISTRY_URL}/${VERSION}/${BINARY_NAME}-darwin-amd64.sha256\",\"link_type\":\"other\"}" \
        --assets-link "{\"name\":\"${BINARY_NAME}-darwin-arm64\",\"url\":\"${PACKAGE_REGISTRY_URL}/${VERSION}/${BINARY_NAME}-darwin-arm64\",\"link_type\":\"package\"}" \
        --assets-link "{\"name\":\"${BINARY_NAME}-darwin-arm64.sha256\",\"url\":\"${PACKAGE_REGISTRY_URL}/${VERSION}/${BINARY_NAME}-darwin-arm64.sha256\",\"link_type\":\"other\"}"