.gitlab-ci.yml

---
################################################################################
# COMMON PARAMETERS
################################################################################
before_script:
  - unset http_proxy ; unset https_proxy
  - env | grep ^CI_

################################################################################
# STAGES
################################################################################
# build_images covers BOTH the pfbuild base images (consumed via `image:` by
# the build_artifacts stage) AND the service container images (built by Kaniko,
# pushed to GHCR). Intra-stage ordering is enforced by `needs:`, not by stage
# boundaries.
stages:
  - check
  - build_images
  - build_artifacts
  - sign
  - publish
  - pretest
  - test
  - deploy
  - build_pf_img

################################################################################
# VARIABLES
################################################################################
variables:
  # synced with Pipeline timeout in GitLab UI
  PIPELINE_TIMEOUT_SCRIPT: 160m
  PIPELINE_TIMEOUT_CLEANUP: 10m
  BUILD_PFAPPSERVER_VUE: "yes"
  PFBUILD_RHEL_IMG: ghcr.io/inverse-inc/packetfence/pfbuild-centos-8
  PFBUILD_DEB_IMG: ghcr.io/inverse-inc/packetfence/pfbuild-debian-bookworm
  KANIKO_DEBUG_IMG: ghcr.io/inverse-inc/packetfence/kaniko-executor:debug
  KANIKOBUILD_IMG: ghcr.io/inverse-inc/packetfence/kaniko-build
  KNK_REGISTRY: ghcr.io
  KNK_REGISTRY_URL: ${KNK_REGISTRY}/inverse-inc/packetfence
  PFBUILD_DEFAULT_DEV_TAG: latest
  # Default IMAGE_TAG for jobs whose rules don't set it explicitly.
  # Overridden per-context by .context_rules, .build_img_container_rules, etc.
  IMAGE_TAG: $CI_COMMIT_REF_SLUG
  CIDIR: ci
  CILIBDIR: ci/lib
  CHECKDIR: ${CILIBDIR}/check
  BUILDDIR: ${CILIBDIR}/build
  RELEASEDIR: ${CILIBDIR}/release
  TESTCIDIR: ${CILIBDIR}/test
  PACKERDIR: $CIDIR/packer
  ZENDIR: $CIDIR/packer/zen
  ISODIR: $CIDIR/cd-iso
  DVD_USB_ISODIR: $CIDIR/dvd-usb-iso
  VAGRANT_IMG_DIR: $CIDIR/packer/vagrant_img
  # Absolute: consumed by test-wrapper.sh under `make -C t/venom` (cwd != repo root).
  VAGRANT_LIB_DIR: ${CI_PROJECT_DIR}/$CIDIR/lib/vagrant
  TESTDIR: t/venom
  CONTAINER_DIR: containers
  UPLOAD_DIR: $CILIBDIR/upload
  SF_ZEN_REPO_URL: https://sourceforge.net/projects/packetfence/files/PacketFence%20ZEN
  # env variables
  ANSIBLE_FORCE_COLOR: 1
  ANSIBLE_STDOUT_CALLBACK: yaml
  VAGRANT_FORCE_COLOR: "true"
  # Selective test execution
  # Run only tests matching this pattern (grep -E regex). Empty = all tests.
  # Examples: configurator, mac_auth, configurator|pfappserver, .*_el8
  TEST_ONLY: ""


################################################################################
# TEMPLATES
################################################################################

########################################
# RULES
########################################
# === CONTEXT DERIVATION ===
# Single source of truth for $CONTEXT, $IMAGE_TAG, and per-context image-build /
# deploy variable overrides. Rule order is load-bearing (most specific first):
#   1. $CI_COMMIT_TAG                → release     (IMAGE_TAG = tag)
#   2. maintenance/X.Y branch        → maintenance (IMAGE_TAG = slug)
#   3. devel branch                  → devel       (IMAGE_TAG = latest)
#   4. (default — any other branch)  → branches    (IMAGE_TAG = slug)
#
# Composed into concrete jobs via `!reference [.context_rules, rules]`
# (GitLab ≥14.3) so they can mix context arms with per-job feature gates.
.context_rules:
  rules:
    - if: '$CI_COMMIT_TAG'
      variables:
        CONTEXT: release
        IMAGE_TAG: $CI_COMMIT_TAG
        # Release pfbuild-base builds switch to stable Ansible groups.
        ANSIBLE_CENTOS_GROUP: common_centos
        ANSIBLE_CENTOS8_GROUP: stable_centos8
        ANSIBLE_DEBIAN_GROUP: common_debian
        ANSIBLE_RUBYGEMS_GROUP: stable_rubygems
        DEPLOY_ENV_NAME: pf-stable
        DEB_DEPLOY_DIR: debian
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/'
      variables:
        CONTEXT: maintenance
        IMAGE_TAG: $CI_COMMIT_REF_SLUG
        DEPLOY_ENV_NAME: maintenance
        DEB_DEPLOY_DIR: debian
    - if: '$CI_COMMIT_REF_NAME == "devel"'
      variables:
        CONTEXT: devel
        IMAGE_TAG: latest
        # Emit both tags (slug + latest) for devel-context container pushes.
        IMAGE_TAGS_DEVEL: "${CI_COMMIT_REF_SLUG},latest"
        DOCKER_TAGS_DEVEL: "latest,devel,maintenance-99-9"
        DEPLOY_ENV_NAME: pf-devel
        DEB_DEPLOY_DIR: debian
        PF_CI_LIB_DEB_DEST_NAME: packetfence-ci-lib_devel.deb
    - when: always
      variables:
        CONTEXT: branches
        IMAGE_TAG: $CI_COMMIT_REF_SLUG
        DEPLOY_ENV_NAME: pf-branches
        DEB_DEPLOY_DIR: debian-branches
        RPM_DEPLOY_DIR: branches/x86_64
        PKG_DEST_NAME: packetfence-release-branches.el8.noarch.rpm
        PF_EXPORT_RPM_DEST_NAME: packetfence-export-branches.el8.noarch.rpm
        PF_EXPORT_DEB_DEST_NAME: packetfence-export_branches.deb
        PF_CI_LIB_DEB_DEST_NAME: packetfence-ci-lib_branches.deb

# === RELEASE-ONLY RULES (used by _pristine test jobs) ===
# run only jobs on release tag (vX.Y.Z) (push and web)
.release_only_rules:
  rules:
    - if: '$CI_COMMIT_TAG'

# === FEATURE-GATE RULE FRAGMENTS ===
# Each gate is a single rules list capturing a BUILD_*=no (or =yes positive)
# short-circuit. Concrete jobs compose them via `!reference [.gated_by_X, rules]`
# together with `!reference [.context_rules, rules]`.

.gated_by_build_artifacts_pkg:
  rules:
    - if: '$BUILD_ARTIFACTS_PKG == "no"'
      when: never

.gated_by_build_img_container:
  rules:
    - if: '$BUILD_IMG_CONTAINER == "no"'
      when: never
    - if: '$CI_COMMIT_MESSAGE =~ /build_img_container=no/'
      when: never

.gated_by_build_img_docker:
  # The devel POSITIVE trigger lives in the concrete job's inline rules.
  rules:
    - if: '$BUILD_IMG_DOCKER == "no"'
      when: never

.gated_by_publish_ppa:
  rules:
    - if: '$PUBLISH_PPA == "yes" || $CI_COMMIT_MESSAGE =~ /publish_ppa=yes/'
    - if: '$CI_COMMIT_TAG'
    - if: '($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api") && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ || $TEST_ONLY != "" )'
    - if: '$CI_PIPELINE_SOURCE == "schedule" && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ || $TEST_ONLY != "" )'
    - if: '($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api") && ($BUILD_PF_IMG_DVD_USB_ISO == "yes" || $CI_COMMIT_MESSAGE =~ /build_pf_img_dvd_usb_iso=yes/)'
    - if: '$BUILD_PF_IMG_VAGRANT == "yes" || $CI_COMMIT_MESSAGE =~ /build_pf_img_vagrant=yes/'

.gated_by_test_yes:
  rules:
    - if: '$TEST != "yes" && $CI_COMMIT_MESSAGE !~ /test=yes/'
      when: never

.gated_by_build_pf_img_vagrant:
  rules:
    - if: '$BUILD_PF_IMG_VAGRANT != "yes" && $CI_COMMIT_MESSAGE !~ /build_pf_img_vagrant=yes/'
      when: never

.gated_by_build_pf_img_zen:
  rules:
    - if: '$BUILD_PF_IMG_ZEN != "yes" && $CI_COMMIT_MESSAGE !~ /build_pf_img_zen=yes/'
      when: never

.gated_by_build_pf_img_iso:
  rules:
    - if: '$BUILD_PF_IMG_ISO != "yes" && $CI_COMMIT_MESSAGE !~ /build_pf_img_iso=yes/'
      when: never

.gated_by_build_pf_img_usb_iso:
  rules:
    - if: '$BUILD_PF_IMG_USB_ISO != "yes" && $CI_COMMIT_MESSAGE !~ /build_pf_img_usb_iso=yes/'
      when: never

.gated_by_build_artifacts_website:
  rules:
    - if: '$BUILD_ARTIFACTS_WEBSITE != "yes" && $CI_COMMIT_MESSAGE !~ /build_artifacts_website=yes/'
      when: never

.gated_by_build_artifacts_material:
  rules:
    - if: '$BUILD_ARTIFACTS_MATERIAL != "yes" && $CI_COMMIT_MESSAGE !~ /build_artifacts_material=yes/'
      when: never

.gated_by_build_artifacts_doc:
  rules:
    - if: '$BUILD_ARTIFACTS_DOC != "yes" && $CI_COMMIT_MESSAGE !~ /build_artifacts_doc=yes/'
      when: never

.gated_by_deploy_pkg:
  rules:
    - if: '$DEPLOY_PKG == "no"'
      when: never

# === SHARED CONTAINER-BUILD RULES ===
# Container-build jobs (kaniko, pfdebian, pfdebian_related, radiusd,
# radiusd_related) share the same per-context filter + IMAGE_TAGS override
# pattern. pfdebian_related uses a parallel-matrix anchor and reuses this
# same rule set (release context included — all service images are built in
# every context).
.build_img_container_rules:
  rules:
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'
      variables:
        IMAGE_TAG: ${CI_COMMIT_REF_SLUG}
        IMAGE_TAGS: ${CI_COMMIT_REF_SLUG}
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'
      variables:
        IMAGE_TAG: ${CI_COMMIT_REF_SLUG}
        IMAGE_TAGS: ${CI_COMMIT_REF_SLUG}
    - if: '$CI_COMMIT_TAG'
      variables:
        IMAGE_TAG: ${CI_COMMIT_TAG}
        IMAGE_TAGS: ${CI_COMMIT_TAG}
    - if: '$CI_COMMIT_REF_NAME == "devel"'
      variables:
        IMAGE_TAG: latest
        IMAGE_TAGS: "${CI_COMMIT_REF_SLUG},latest"

# Rules for ci_related image builds (pfbuild, signing, publish-ppa).
# Devel arm lives in each job's inline rules (opt-in via BUILD_IMG_DOCKER).
# IMAGE_TAG is set alongside IMAGE_TAGS so jobs using .build_img_container_job
# (which references ${IMAGE_TAG} for the kaniko-build image) resolve correctly.
.build_img_docker_rules:
  rules:
    - if: '$CI_COMMIT_TAG'
      variables:
        IMAGE_TAG: ${CI_COMMIT_TAG}
        IMAGE_TAGS: ${CI_COMMIT_TAG}
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'
      variables:
        IMAGE_TAG: ${CI_COMMIT_REF_SLUG}
        IMAGE_TAGS: ${CI_COMMIT_REF_SLUG}
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'
      variables:
        IMAGE_TAG: ${CI_COMMIT_REF_SLUG}
        IMAGE_TAGS: ${CI_COMMIT_REF_SLUG}

# Shared rules for devel-or-branches-or-release jobs (no maintenance):
# build_artifacts_website, build_artifacts_material, deploy_website_artifacts.
# Each arm mirrors the IMAGE_TAG value from .context_rules so that
# `image: …:${IMAGE_TAG}` resolves correctly in consuming jobs.
.devel_or_branches_or_release_rules:
  rules:
    - if: '$CI_COMMIT_REF_NAME == "devel"'
      variables:
        IMAGE_TAG: latest
    - if: '$CI_COMMIT_TAG'
      variables:
        IMAGE_TAG: $CI_COMMIT_TAG
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'
      variables:
        IMAGE_TAG: $CI_COMMIT_REF_SLUG

# Shared rules for deploy_* (rpm, deb, pkg_friendly_names) — runs on
# devel push/web/schedule, release tag, branches via web/api/schedule,
# maintenance via web/api/schedule. Used together with .gated_by_deploy_pkg.
# Mirror DEPLOY_ENV_NAME and the deploy-dir vars (DEB_DEPLOY_DIR / RPM_DEPLOY_DIR)
# from .context_rules — .deploy_pkg_rules is the only rule path the deploy_* jobs
# traverse, and .context_rules' when:always fallback can't be composed in without
# breaking branch/source filtering. Without DEB_DEPLOY_DIR set here, deploy-artifacts.sh
# falls back to its :-foo default and publishes under .../PacketFence/foo/<version>/.
# (Pre-matrix maintenance branches set these per explicit deploy job; this block is
# the single-matrix equivalent.) RPM_DEPLOY_DIR is only overridden for feature
# branches; devel/maintenance/release rely on the script default
# (${PF_MINOR_RELEASE}/x86_64), and PF_MINOR_RELEASE (from conf/pf-release) is not
# available at YAML rule-evaluation time.
.deploy_pkg_rules:
  rules:
    - if: '$CI_COMMIT_REF_NAME == "devel"'
      variables:
        DEPLOY_ENV_NAME: pf-devel
        IMAGE_TAG: latest
        DEB_DEPLOY_DIR: debian
        # packetfence-release/export/upgrade deploy into the shared debian/ + RHEL*
        # dirs regardless of context, so the context is encoded in the filename.
        # Only ci-lib gets a devel-specific name; the rest use versioned defaults.
        PF_CI_LIB_DEB_DEST_NAME: packetfence-ci-lib_devel.deb
    - if: '$CI_COMMIT_TAG'
      variables:
        DEPLOY_ENV_NAME: pf-stable
        IMAGE_TAG: $CI_COMMIT_TAG
        DEB_DEPLOY_DIR: debian
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api" || $CI_PIPELINE_SOURCE == "schedule")'
      variables:
        DEPLOY_ENV_NAME: maintenance
        IMAGE_TAG: $CI_COMMIT_REF_SLUG
        DEB_DEPLOY_DIR: debian
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api" || $CI_PIPELINE_SOURCE == "schedule") && $DEPLOY_PKG == "yes"'
      variables:
        DEPLOY_ENV_NAME: pf-branches
        IMAGE_TAG: $CI_COMMIT_REF_SLUG
        DEB_DEPLOY_DIR: debian-branches
        RPM_DEPLOY_DIR: branches/x86_64
        # release/export/ci-lib deploy into the shared debian/ + RHEL* dirs; the
        # *-branches filenames keep feature-branch builds from overwriting the
        # versioned release artifacts that live alongside them.
        PKG_DEST_NAME: packetfence-release-branches.el8.noarch.rpm
        PF_EXPORT_RPM_DEST_NAME: packetfence-export-branches.el8.noarch.rpm
        PF_EXPORT_DEB_DEST_NAME: packetfence-export_branches.deb
        PF_CI_LIB_DEB_DEST_NAME: packetfence-ci-lib_branches.deb

# === TEST-STAGE RULES ===
# .test_rules merges the former .test_devel_and_maintenance_rules and
# .test_branches_only_rules into a single template. For feature-branch runs
# (not devel, not maintenance, no tag) it emits VAGRANT_COMMON_DOTFILE_PATH
# as a rule variable so the job uses the devel-compatible Vagrant common state.
# On devel/maintenance it overrides BOX_NAME to pfdeb12dev (flat bucket layout).
# NOTE: TEST_ONLY filtering is done in .test_script_job via shell script
# because GitLab CI doesn't expand variables inside regex patterns.
.test_rules:
  rules:
    # Run on devel branch (push, web, not schedule) — use flat pfdeb12dev box
    - if: '$CI_COMMIT_REF_NAME == "devel" && $CI_PIPELINE_SOURCE != "schedule" && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ || $TEST_ONLY != "" )'
      variables:
        BOX_NAME: pfdeb12dev
    # Run on maintenance branches (web/api only) — use flat pfdeb12dev box
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api") && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ || $TEST_ONLY != "" )'
      variables:
        BOX_NAME: pfdeb12dev
    # Run on devel/maintenance with schedule — use flat pfdeb12dev box
    - if: '( $CI_COMMIT_REF_NAME == "devel" || $CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/) && $CI_PIPELINE_SOURCE == "schedule" && $CI_COMMIT_TAG == null && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ || $TEST_ONLY != "" )'
      variables:
        BOX_NAME: pfdeb12dev
    # Run on feature branches (web/api) — pfdeb12branch box + VAGRANT_COMMON_DOTFILE_PATH override
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api") && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ || $TEST_ONLY != "" )'
      variables:
        VAGRANT_COMMON_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-common-devel
    # Run on feature branches via schedule — pfdeb12branch box + VAGRANT_COMMON_DOTFILE_PATH override
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && $CI_PIPELINE_SOURCE == "schedule" && ( $TEST == "yes" || $CI_COMMIT_MESSAGE =~ /test=yes/ || $TEST_ONLY != "" )'
      variables:
        VAGRANT_COMMON_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-common-devel

########################################
# JOBS TEMPLATES
########################################
.check_job:
  stage: check
  dependencies: []
  script:
    - ${CHECKDIR}/run-pipeline-if-necessary.sh
  tags:
    - docker

.build_img_container_job:
  # $IMAGE_TAG comes from .context_rules.
  stage: build_images
  dependencies: []
  image: ${KANIKOBUILD_IMG}:${IMAGE_TAG}
  script:
    - /bin/kanikobuild
  tags:
    - docker

.build_img_container_kanikobuild_job:
  stage: build_images
  dependencies: []
  image:
    name: ${KANIKO_DEBUG_IMG}
    entrypoint: [""]
  script:
    - ${CONTAINER_DIR}/kanikobuild
  tags:
    - docker

# The packer build and the Linode upload run inside the vagrant-build image
# via vagrant-in-docker.sh (shell executors ignore `image:`).
.build_pf_img_vagrant_job:
  stage: build_pf_img
  variables:
    RESULT_DIR: ${CI_PROJECT_DIR}/ci/packer/vagrant_img/results
    # ci_related pushes the slug tag in every context; tag pipelines
    # override IMAGE_TAG (release tags are pushed unslugified).
    VAGRANT_BUILD_IMAGE: ${KNK_REGISTRY_URL}/vagrant-build:${IMAGE_TAG}
    UPLOAD_BOX: "yes"
  script:
    - export PF_MINOR_RELEASE="$(perl -ne 'print $1 if (m/.*?(\d+\.\d+)/)' conf/pf-release)"
    - export BOX_VERSION="${PF_MINOR_RELEASE}.$(date -u +%Y%m%d%H%M%S)"
    - export BOX_DESC="PacketFence ${PF_MINOR_RELEASE} - ${BOX_VERSION}"
    - timeout ${PIPELINE_TIMEOUT_SCRIPT} make -e -C ${VAGRANT_IMG_DIR} ${BOX_NAME} BOX_VERSION=${BOX_VERSION}
  # implicit timeout = 5 minutes, see https://gitlab.com/gitlab-org/gitlab-runner/-/issues/2716
  after_script:
    - make -e -C ${VAGRANT_IMG_DIR} clean
  dependencies: []
  tags:
    - shell-v7

# Strict gate: build_artifacts must not start if lint_ci_yaml failed or if any
# build_images job failed. lint_ci_yaml is non-optional (always present) so a
# lint failure blocks every artifact job. Every concrete build_images job is
# listed as optional: true so a gated-out job (rules → when:never) does not
# block — only jobs that actually ran and failed will skip the dependents.
.needs_all_build_images:
  needs:
    - job: lint_ci_yaml
    - job: kaniko
      optional: true
    - job: pfdebian
      optional: true
    - job: pfdebian_related
      optional: true
    - job: radiusd
      optional: true
    - job: radiusd_related
      optional: true
    - job: pfconfig_material_builder
      optional: true
    - job: ci_related
      optional: true

.build_artifacts_pkg_job:
  stage: build_artifacts
  needs: !reference [.needs_all_build_images, needs]
  artifacts:
    expire_in: 1 day
    paths:
      - result/*
  tags:
    - docker

.build_artifacts_website_job:
  stage: build_artifacts
  needs: !reference [.needs_all_build_images, needs]
  dependencies: []
  script:
    - make -e website
  artifacts:
    expire_in: 1 day
    paths:
      - website/*
  tags:
    - docker

.build_artifacts_material_job:
  stage: build_artifacts
  needs: !reference [.needs_all_build_images, needs]
  image: ${KNK_REGISTRY_URL}/pfconfig-material-builder:${IMAGE_TAG}
  dependencies: []
  variables:
    # Git credentials (GIT_USER_NAME, GIT_USER_PASSWORD, GIT_USER_MAIL) set in generate-material.sh from Psono
    GIT_REPO: github.com/akainverse/website-pfcom
    SRC_FILE: result/switches.json
    DST_FILE: data/switches.json
    # Git credentials fetched from Psono (secret IDs hardcoded in script)
    # PSONO_WEBSITE_PFCOM_API_KEY_ID: provided through CI/CD variables
    # PSONO_WEBSITE_PFCOM_API_SECRET_KEY: provided through CI/CD variables
  script:
    - ${BUILDDIR}/generate-material.sh
  artifacts:
    expire_in: 1 day
    paths:
      - result/switches.json
  tags:
    - docker

.build_artifacts_doc_job:
  stage: build_artifacts
  needs: !reference [.needs_all_build_images, needs]
  dependencies: []
  script:
    - make -C html/pfappserver/root/ vendor
    - make -C html/pfappserver/root/ light-dist
    - make html
    - make pdf
  artifacts:
    expire_in: 1 day
    paths:
      - docs/*.html
      - docs/*.pdf
      - docs/images/*
      - docs/styles/*.min.css
  tags:
    - docker


.test_job:
  stage: test
  dependencies: []
  artifacts:
    when: always
    expire_in: 1 day
    paths:
      - results/*
  tags:
    - test-shell-v7

.deploy_packages_job:
  stage: deploy
  image: ghcr.io/inverse-inc/packetfence/publish-ppa:${IMAGE_TAG}
  dependencies:
    - sign_packages
  variables:
    DEPLOY_USER: reposync
    DEPLOY_HOST: web.inverse.ca
    DEPLOY_SRPMS: "no"
    DEPLOY_PORT: 444
    PSONO_SSH_DEPLOY_KEY_SECRET_ID: ed9a0533-4da0-4cdb-ab5f-ac7e061c281c
  before_script:
    - |
      set -euo pipefail
      echo "=== Import SSH deploy key from Psono ==="
      mkdir -p ~/.ssh && chmod 700 ~/.ssh
      python3 addons/packetfence-perl/psono.py \
        --api_key_id="$PSONO_API_KEY_ID" \
        --api_key_secret_key="$PSONO_API_KEY_SECRET_KEY" \
        --secret_id="$PSONO_SSH_DEPLOY_KEY_SECRET_ID" \
        --return_value=password_notes \
      > ~/.ssh/id_rsa
      chmod 600 ~/.ssh/id_rsa
      echo "SSH deploy key imported successfully"
  script:
    - ./${UPLOAD_DIR}/deploy-artifacts.sh ${DEPLOY_TYPE}
  tags:
    - docker

.deploy_website_artifacts_job:
  stage: deploy
  image: ghcr.io/inverse-inc/packetfence/publish-ppa:${IMAGE_TAG}
  dependencies:
    - build_artifacts_website
  variables:
    DEPLOY_USER: reposync
    DEPLOY_HOST: web.inverse.ca
    DEPLOY_PORT: 444
    PSONO_SSH_DEPLOY_KEY_SECRET_ID: ed9a0533-4da0-4cdb-ab5f-ac7e061c281c
  before_script:
    - |
      set -euo pipefail
      echo "=== Import SSH deploy key from Psono ==="
      mkdir -p ~/.ssh && chmod 700 ~/.ssh
      python3 addons/packetfence-perl/psono.py \
        --api_key_id="$PSONO_API_KEY_ID" \
        --api_key_secret_key="$PSONO_API_KEY_SECRET_KEY" \
        --secret_id="$PSONO_SSH_DEPLOY_KEY_SECRET_ID" \
        --return_value=password_notes \
      > ~/.ssh/id_rsa
      chmod 600 ~/.ssh/id_rsa
      echo "SSH deploy key imported successfully"
  script:
    - ./${UPLOAD_DIR}/deploy-artifacts.sh website
  tags:
    - docker

.build_pf_img_job:
  stage: build_pf_img
  script:
    - timeout ${PIPELINE_TIMEOUT_SCRIPT} make -e -C ${BUILD_DIR} ${BUILD_TARGET}
  # implicit timeout = 5 minutes, see https://gitlab.com/gitlab-runner/-/issues/2716
  after_script:
    - make -e -C ${BUILD_DIR} ${CLEAN_TARGET}
  dependencies: []
  tags:
    - shell-v7

.build_pf_img_vagrant_release_job:
  extends:
    - .build_pf_img_vagrant_job

.rpm_script_job:
  script:
    - make -e build_rpm

.deb_script_job:
  script:
    - make -e build_deb

# Gating templates: downstream test scenarios that previously ran the
# `configurator` venom suite as a prep step now import the matching arch's
# exportable backup. Each consumer extends the matching template so its
# job only starts after the producer has uploaded.
.needs_configurator_deb12:
  needs:
    - job: configurator_deb12
      artifacts: false

.needs_configurator_el8:
  needs:
    - job: configurator_el8
      artifacts: false

# Producer template: run the configurator scenario, then export a
# PacketFence backup tarball (addons/exportable-backup.sh) to Linode only
# if the suite passes. Applied to both configurator_deb12 and
# configurator_el8 — the bucket key is suffixed with the arch (last
# underscore-segment of CI_JOB_NAME) so deb12 and el8 don't collide.
# Downstream test jobs import the matching tarball instead of running
# configurator again.
# Runs in `pretest` (before the test stage) — listed last in each producer's
# extends so this stage overrides the `stage: test` from .test_job.
.configurator_producer_job:
  stage: pretest
  script:
    # Producer always runs when .test_rules selects the pipeline (TEST/TEST_ONLY
    # gate lives there). Both arches are baked unconditionally; cheaper than
    # parsing TEST_ONLY tokens to decide which export downstream needs.
    - timeout ${PIPELINE_TIMEOUT_SCRIPT} make -e -C ${TESTDIR} MAKE_TARGET=run ${CI_JOB_NAME} || EXIT_CODE=$?
    # Export only on success; capture upload failure so teardown still runs.
    - |
      if [ -z "${EXIT_CODE:-}" ]; then
        ${VAGRANT_LIB_DIR}/upload-pf-export.sh || EXIT_CODE=$?
      fi
    # Teardown always runs (get_logs + destroy VM); job still fails via JOB_STATUS.
    - JOB_STATUS=${EXIT_CODE:-} timeout ${PIPELINE_TIMEOUT_CLEANUP} ${TESTCIDIR}/clean-test-environment.sh

.test_script_job:
  variables:
    VAGRANT_COMMON_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-common-${CI_COMMIT_REF_SLUG}
  script:
    # Check TEST_ONLY filter (shell-based since GitLab rules don't expand variables in regex)
    - |
      # Validate TEST_ONLY to prevent malicious patterns
      if [ -n "$TEST_ONLY" ]; then
        # Reject TEST_ONLY if it contains a newline or single quote (basic sanitization)
        if printf '%s' "$TEST_ONLY" | grep -qP "[\n']"; then
          echo "Error: TEST_ONLY contains invalid characters (newline or single quote)."
          exit 1
        fi
        # Accept comma-separated list (e.g. auth,virtual) by translating to regex alternation
        # Filter out empty items to prevent empty alternation (e.g., "mac_auth," -> "mac_auth|" matches everything)
        TEST_ONLY_PATTERN=$(printf '%s' "$TEST_ONLY" | tr ',' '\n' | grep -v '^[[:space:]]*$' | tr '\n' '|' | sed 's/|$//')
        # Guard against empty pattern (e.g., TEST_ONLY="," or only whitespace) which would match everything
        if [ -z "$TEST_ONLY_PATTERN" ]; then
          echo "Error: TEST_ONLY contains no valid test names (only commas/whitespace)."
          exit 1
        fi
        if echo "$CI_JOB_NAME" | grep -qE -- "$TEST_ONLY_PATTERN"; then
          echo "Running: $CI_JOB_NAME matches TEST_ONLY pattern: $TEST_ONLY"
        else
          echo "Skipping: $CI_JOB_NAME does not match TEST_ONLY pattern: $TEST_ONLY"
          exit 0
        fi
      fi
    # || EXIT_CODE=$? prevents script to finish at first command
    - timeout ${PIPELINE_TIMEOUT_SCRIPT} make -e -C ${TESTDIR} MAKE_TARGET=run ${CI_JOB_NAME} || EXIT_CODE=$?
    - JOB_STATUS=$EXIT_CODE timeout ${PIPELINE_TIMEOUT_CLEANUP} ${TESTCIDIR}/clean-test-environment.sh

########################################
# MATRIX ANCHORS
########################################
# Single YAML anchor for the full service-image matrix. All contexts
# (devel, branches, maintenance, release) build the full set — production
# consumers can pull any image, so trimming by context is incorrect.
.service_images_full: &service_images_full
  - pfconfig
  - httpd.dispatcher
  - httpd.portal
  - api-frontend
  - pfacct
  - pfcmd
  - pfqueue
  - httpd.aaa
  - httpd.admin_dispatcher
  - httpd.webservices
  - pfsetacls
  - pfsso
  - pfperl-api
  - pfconnector
  - pfpki
  - pfcron
  - haproxy-portal
  - haproxy-admin
  - proxysql
  - pfldapexplorer
  - kafka
  - ntlm-auth-api
  - ntlm-join-remote
  - netdata
  - git-sync
  - github-apps-token
  - pfstats
  - caddy-l4
  - pfdns-connector

################################################################################
# JOBS
################################################################################

########################################
# CHECK JOBS
########################################
run_pipeline_if_necessary:
  image: ${PFBUILD_DEB_IMG}:${PFBUILD_DEFAULT_DEV_TAG}
  extends:
    - .check_job
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_COMMIT_TAG == null'

# Catches YAML regressions before any other stage runs. allow_failure: false
# because lint errors here break every downstream job — fail fast is the point.
# TODO: upgrade to `glab ci lint --strict` once the auth path is decided.
lint_ci_yaml:
  extends:
    - .check_job
  needs:
    - job: run_pipeline_if_necessary
      optional: true
  image: python:3-alpine
  rules:
    - when: always
  script:
    - pip install --quiet yamllint
    - >
      yamllint
      -d '{extends: relaxed, rules: {line-length: disable, truthy: disable}}'
      .gitlab-ci.yml
  allow_failure: false

########################################
# BUILD_IMG_CONTAINER JOBS (kaniko / pfdebian / pfdebian_related / radiusd / radiusd_related)
########################################
kaniko:
  # NOTE: Not gated by BUILD_IMG_CONTAINER - kaniko is pipeline infrastructure
  # (needed by ci_related for sign_packages/publish_ppa).
  extends:
    - .build_img_container_kanikobuild_job
  variables:
    IMAGE_NAME: "kaniko-build"
    # IMAGE_TAGS is always set by the matching .build_img_container_rules arm:
    # devel → "${CI_COMMIT_REF_SLUG},latest"; tag → tag; branches → slug.
    # The placeholder below is never used at runtime (the job only runs when
    # a .build_img_container_rules arm matches and sets IMAGE_TAGS itself).
    IMAGE_TAGS: ${CI_COMMIT_REF_SLUG}
  rules:
    - !reference [.build_img_container_rules, rules]

pfdebian:
  extends:
    - .build_img_container_job
  needs: ["kaniko"]
  variables:
    IMAGE_NAME: "pfdebian"
    IMAGE_TAGS: ${CI_COMMIT_REF_SLUG}
  rules:
    - !reference [.gated_by_build_img_container, rules]
    - !reference [.build_img_container_rules, rules]

pfdebian_related:
  extends:
    - .build_img_container_job
  needs:
    - pfdebian
    - job: ci_related
      optional: true
  variables:
    IMAGE_TAGS: ${CI_COMMIT_REF_SLUG}
  parallel:
    matrix:
      - IMAGE_NAME: *service_images_full
      - IMAGE_NAME:
          - "fingerbank-db"
  rules:
    - !reference [.gated_by_build_img_container, rules]
    - !reference [.build_img_container_rules, rules]

radiusd:
  extends:
    - .build_img_container_job
  needs: ["pfdebian"]
  variables:
    IMAGE_TAGS: ${CI_COMMIT_REF_SLUG}
  parallel:
    matrix:
      - IMAGE_NAME:
          - "radiusd"
  rules:
    - !reference [.gated_by_build_img_container, rules]
    - !reference [.build_img_container_rules, rules]

radiusd_related:
  extends:
    - .build_img_container_job
  needs: ["radiusd"]
  variables:
    IMAGE_TAGS: ${CI_COMMIT_REF_SLUG}
  parallel:
    matrix:
      - IMAGE_NAME:
          - "radiusd-auth"
          - "radiusd-acct"
          - "radiusd-cli"
          - "radiusd-load-balancer"
          - "radiusd-eduroam"
          - "pfconnector-remote"
  rules:
    - !reference [.gated_by_build_img_container, rules]
    - !reference [.build_img_container_rules, rules]

# CI-only wrapper around pfconfig: adds gh + python3-nacl + git for
# .build_artifacts_material_job. The customer-facing pfconfig image stays
# slim; CI tooling lives here. Gated by .gated_by_build_artifacts_material
# so the wrapper only builds when the material job is going to consume it
# (no waste on pipelines that don't request material). needs:[pfdebian_related]
# enforces that pfconfig is in GHCR before this FROM-clause resolves.
pfconfig_material_builder:
  extends:
    - .build_img_container_job
  needs: ["pfdebian_related"]
  variables:
    IMAGE_NAME: "pfconfig-material-builder"
    IMAGE_TAGS: ${CI_COMMIT_REF_SLUG}
  rules:
    - !reference [.gated_by_build_img_container, rules]
    - !reference [.gated_by_build_artifacts_material, rules]
    - !reference [.build_img_container_rules, rules]

########################################
# ci_related image build jobs
# (pfbuild, signing-packages, publish-ppa, vagrant-build)
########################################
ci_related:
  extends:
    - .build_img_container_job
  needs:
    - kaniko
  variables:
    IMAGE_TAGS: ${CI_COMMIT_REF_SLUG}
  parallel:
    matrix:
      - IMAGE_NAME:
          - "pfbuild-centos-8"
          - "signing-packages"
          - "publish-ppa"
      - IMAGE_NAME: "pfbuild-debian-bookworm"
        DOCKFILE_PATH: "${CI_PROJECT_DIR}/containers/pfbuild-bookworm/Dockerfile"
      - IMAGE_NAME: "vagrant-build"
  rules:
    - if: '$CI_COMMIT_REF_NAME == "devel" && ($BUILD_IMG_DOCKER == "yes" || $CI_COMMIT_MESSAGE =~ /build_img_docker=yes/)'
      variables:
        IMAGE_TAG: latest
        IMAGE_TAGS: "latest,devel,maintenance-99-9"
    # build_pf_img_* on devel depends on signed/published packages, so the
    # signing-packages and publish-ppa images must exist in this pipeline.
    - if: '$CI_COMMIT_REF_NAME == "devel" && ($BUILD_PF_IMG_ZEN == "yes" || $BUILD_PF_IMG_CD_ISO == "yes" || $BUILD_PF_IMG_DVD_USB_ISO == "yes" || $BUILD_PF_IMG_VAGRANT == "yes" || $CI_COMMIT_MESSAGE =~ /build_pf_img_(zen|cd_iso|dvd_usb_iso|vagrant)=yes/)'
      variables:
        IMAGE_TAG: latest
        IMAGE_TAGS: "latest,devel,maintenance-99-9"
    - !reference [.gated_by_build_img_docker, rules]
    - !reference [.build_img_docker_rules, rules]


########################################
#  BUILD_ARTIFACTS JOBS
########################################
# Consolidated per-OS pkg-build jobs.
build_artifacts_pkg_centos_8:
  image: ${PFBUILD_RHEL_IMG}:${IMAGE_TAG}
  extends:
    - .build_artifacts_pkg_job
    - .rpm_script_job
  rules:
    - !reference [.gated_by_build_artifacts_pkg, rules]
    # Override: maintenance/branches need web/api/schedule, default branch rule
    # in .context_rules matches all branches — we narrow here:
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && ($CI_PIPELINE_SOURCE != "web" && $CI_PIPELINE_SOURCE != "api" && $CI_PIPELINE_SOURCE != "schedule")'
      when: never
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE != "web" && $CI_PIPELINE_SOURCE != "api" && $CI_PIPELINE_SOURCE != "schedule")'
      when: never
    - !reference [.context_rules, rules]

build_artifacts_pkg_debian_bookworm:
  image: ${PFBUILD_DEB_IMG}:${IMAGE_TAG}
  extends:
    - .build_artifacts_pkg_job
    - .deb_script_job
  rules:
    - !reference [.gated_by_build_artifacts_pkg, rules]
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && ($CI_PIPELINE_SOURCE != "web" && $CI_PIPELINE_SOURCE != "api" && $CI_PIPELINE_SOURCE != "schedule")'
      when: never
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE != "web" && $CI_PIPELINE_SOURCE != "api" && $CI_PIPELINE_SOURCE != "schedule")'
      when: never
    - !reference [.context_rules, rules]

# build_artifacts_website (devel/branches/release)
build_artifacts_website:
  image: ${PFBUILD_DEB_IMG}:${IMAGE_TAG}
  extends:
    - .build_artifacts_website_job
  rules:
    - if: '$CI_COMMIT_TAG'
      variables:
        IMAGE_TAG: $CI_COMMIT_TAG
    - !reference [.gated_by_build_artifacts_website, rules]
    - !reference [.devel_or_branches_or_release_rules, rules]

# build_artifacts_material (devel/branches/release; no maintenance)
# Image comes from .build_artifacts_material_job (pfconfig-material-builder).
build_artifacts_material:
  extends:
    - .build_artifacts_material_job
  rules:
    # Gate first: the pfconfig-material-builder image is built by the
    # pfconfig_material_builder job, which is gated by .gated_by_build_img_container.
    # Without the same gate, BUILD_ARTIFACTS_MATERIAL=yes + BUILD_IMG_CONTAINER=no
    # would schedule this job with no image to pull (needs: is optional).
    - !reference [.gated_by_build_img_container, rules]
    - if: '$CI_COMMIT_TAG'
      variables:
        IMAGE_TAG: $CI_COMMIT_TAG
    - !reference [.gated_by_build_artifacts_material, rules]
    - !reference [.devel_or_branches_or_release_rules, rules]

# build_artifacts_doc (devel/branches/maintenance/release)
build_artifacts_doc:
  image: ${PFBUILD_DEB_IMG}:${IMAGE_TAG}
  extends:
    - .build_artifacts_doc_job
  rules:
    - if: '$CI_COMMIT_TAG'
      variables:
        IMAGE_TAG: $CI_COMMIT_TAG
    - !reference [.gated_by_build_artifacts_doc, rules]
    - if: '$CI_COMMIT_REF_NAME == "devel"'
      variables:
        IMAGE_TAG: latest
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'
      variables:
        IMAGE_TAG: $CI_COMMIT_REF_SLUG
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'
      variables:
        IMAGE_TAG: $CI_COMMIT_REF_SLUG

########################################
# SIGN JOBS
########################################
sign_packages:
  image: ghcr.io/inverse-inc/packetfence/signing-packages:${IMAGE_TAG}
  stage: sign
  needs:
    - job: ci_related
      optional: true
    - job: build_artifacts_pkg_centos_8
    - job: build_artifacts_pkg_debian_bookworm
  variables:
    # GPG_KEY_FINGERPRINT, GPG_USER_ID, PSONO_API_KEY_ID,
    # PSONO_API_KEY_SECRET_KEY, PSONO_GPG_PRIVATE_KEY_SECRET_ID:
    # set via GitLab CI/CD variables.
    RESULT_DIR: result
  script:
    - |
      set -euo pipefail

      echo "=== Import GPG private key from Psono ==="
      python3 addons/packetfence-perl/psono.py \
        --api_key_id="$PSONO_API_KEY_ID" \
        --api_key_secret_key="$PSONO_API_KEY_SECRET_KEY" \
        --secret_id="$PSONO_GPG_PRIVATE_KEY_SECRET_ID" \
        --return_value=password_notes \
      | gpg --batch --pinentry-mode loopback --import
      echo "GPG key imported successfully"
      gpg --list-keys

      echo "=== Sign Debian packages ==="
      deb_count=0
      for deb in $(find "$RESULT_DIR" -type f -name '*.deb'); do
        echo "Signing: $deb"
        dpkg-sig -k "$GPG_KEY_FINGERPRINT" --sign builder "$deb"
        dpkg-sig --list "$deb"
        deb_count=$((deb_count + 1))
      done
      echo "Signed $deb_count Debian package(s)"
      if [ "$deb_count" -eq 0 ]; then
        echo "ERROR: no .deb files found in $RESULT_DIR" >&2
        exit 1
      fi

      echo "=== Regenerate .changes file checksums after signing ==="
      for changes_file in $(find "$RESULT_DIR" -type f -name '*.changes'); do
        echo "Updating checksums in: $changes_file"
        python3 ci/lib/update-changes-checksums.py "$changes_file"
      done

      echo "=== Sign RPM packages ==="
      rpm_count=0
      # Import the public key into RPM's keyring for verification
      gpg --batch --yes --output /tmp/pubkey.pub --armor --export "$GPG_USER_ID"
      rpm --import /tmp/pubkey.pub
      for rpm_file in $(find "$RESULT_DIR" -type f -name '*.rpm' ! -name '*.src.rpm'); do
        echo "Signing: $rpm_file"
        rpm --define "_gpg_name $GPG_USER_ID" --define '_signature gpg' --addsign "$rpm_file"
        rpm --checksig "$rpm_file"
        rpm_count=$((rpm_count + 1))
      done
      echo "Signed $rpm_count RPM package(s)"
      if [ "$rpm_count" -eq 0 ]; then
        echo "ERROR: no .rpm files found in $RESULT_DIR" >&2
        exit 1
      fi

      echo "=== Signing complete: $deb_count DEB + $rpm_count RPM ==="
  artifacts:
    expire_in: 1 day
    paths:
      - result/*
  tags:
    - docker
  rules:
    - !reference [.gated_by_build_artifacts_pkg, rules]
    - if: '$CI_COMMIT_REF_NAME == "devel"'
      variables:
        IMAGE_TAG: latest
    - if: '$CI_COMMIT_TAG'
      variables:
        IMAGE_TAG: $CI_COMMIT_TAG
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api" || $CI_PIPELINE_SOURCE == "schedule")'
      variables:
        IMAGE_TAG: $CI_COMMIT_REF_SLUG
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'
      variables:
        IMAGE_TAG: $CI_COMMIT_REF_SLUG
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      variables:
        IMAGE_TAG: $CI_COMMIT_REF_SLUG

########################################
# PUBLISH JOBS
########################################
publish_ppa:
  stage: publish
  image: ghcr.io/inverse-inc/packetfence/publish-ppa:${IMAGE_TAG}
  needs:
    - job: sign_packages
  environment:
    name: PPA
    url: http://inverse.ca/downloads/PacketFence/gitlab/${CI_PIPELINE_ID}
  script:
    - generate-pages
    - ./${UPLOAD_DIR}/deploy-artifacts.sh ppa
  tags:
    - docker
  variables:
    DEPLOY_USER: reposync
    DEPLOY_HOST: web.inverse.ca
    DEPLOY_PORT: 444
    PPA_ID: ${CI_PIPELINE_ID}
    PSONO_SSH_DEPLOY_KEY_SECRET_ID: ed9a0533-4da0-4cdb-ab5f-ac7e061c281c
  before_script:
    - |
      set -euo pipefail
      echo "=== Import GPG key for repo signing ==="
      python3 addons/packetfence-perl/psono.py \
        --api_key_id="$PSONO_API_KEY_ID" \
        --api_key_secret_key="$PSONO_API_KEY_SECRET_KEY" \
        --secret_id="$PSONO_GPG_PRIVATE_KEY_SECRET_ID" \
        --return_value=password_notes \
      | gpg --batch --pinentry-mode loopback --import
      gpg --list-keys

      echo "=== Import SSH deploy key from Psono ==="
      mkdir -p ~/.ssh && chmod 700 ~/.ssh
      python3 addons/packetfence-perl/psono.py \
        --api_key_id="$PSONO_API_KEY_ID" \
        --api_key_secret_key="$PSONO_API_KEY_SECRET_KEY" \
        --secret_id="$PSONO_SSH_DEPLOY_KEY_SECRET_ID" \
        --return_value=password_notes \
      > ~/.ssh/id_rsa
      chmod 600 ~/.ssh/id_rsa
      echo "SSH deploy key imported successfully"
  rules:
    - !reference [.gated_by_build_artifacts_pkg, rules]
    - if: '$CI_COMMIT_REF_NAME == "devel"'
      variables:
        IMAGE_TAG: latest
    - if: '$CI_COMMIT_TAG'
      variables:
        IMAGE_TAG: $CI_COMMIT_TAG
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api" || $CI_PIPELINE_SOURCE == "schedule")'
      variables:
        IMAGE_TAG: $CI_COMMIT_REF_SLUG
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'
      variables:
        IMAGE_TAG: $CI_COMMIT_REF_SLUG
    - !reference [.gated_by_publish_ppa, rules]

########################################
# TEST JOBS
########################################
### development and maintenance
unit_tests_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_el8

unit_tests_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

configurator_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .configurator_producer_job

configurator_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .configurator_producer_job

pfappserver_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules

pfappserver_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules

dot1x_eap_peap_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_el8

dot1x_eap_peap_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

mac_auth_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_el8

mac_auth_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

dot1x_eap_tls_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_el8

dot1x_eap_tls_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

fingerbank_invalid_db_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

security_events_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

cli_login_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

cli_login_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_el8

external_integrations_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

captive_portal_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_el8

captive_portal_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

inline_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

inline_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_el8

mac_auth_virtualswitch_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_el8

mac_auth_virtualswitch_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

device_profiling_virtualswitch_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_el8

device_profiling_virtualswitch_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

dot1x_wired_computer_auth_virtualswitch_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_el8

dot1x_wired_computer_auth_virtualswitch_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

pfacct_bandwidth_virtualswitch_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_el8

pfacct_bandwidth_virtualswitch_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

security_event_virtualswitch_el8:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_el8

security_event_virtualswitch_deb12:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_JOB_NAME}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .test_rules
    - .needs_configurator_deb12

### release
configurator_el8_pristine:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_COMMIT_TAG}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .release_only_rules

configurator_deb12_pristine:
  variables:
    VAGRANT_PF_DOTFILE_PATH: /var/local/gitlab-runner/vagrant/vagrant-${CI_COMMIT_TAG}-${CI_JOB_ID}
  extends:
    - .test_job
    - .test_script_job
    - .release_only_rules


########################################
# DEPLOY JOBS
########################################
deploy_packages:
  extends:
    - .deploy_packages_job
  environment:
    name: $DEPLOY_ENV_NAME
  parallel:
    matrix:
      - DEPLOY_TYPE:
          - rpm
          - deb
          - packetfence-release
          - packetfence-export
          - packetfence-upgrade
          - packetfence-ci-lib
  rules:
    - !reference [.gated_by_deploy_pkg, rules]
    - !reference [.deploy_pkg_rules, rules]

# website artifacts
deploy_website_artifacts:
  extends:
    - .deploy_website_artifacts_job
  rules:
    - if: '$CI_COMMIT_TAG'
      variables:
        IMAGE_TAG: $CI_COMMIT_TAG
    - !reference [.gated_by_build_artifacts_website, rules]
    - !reference [.devel_or_branches_or_release_rules, rules]

########################################
# BUILD_PF_IMG JOBS
########################################
build_pf_img_zen:
  extends:
    - .build_pf_img_job
  environment:
    name: sourceforge
    url: ${SF_ZEN_REPO_URL}/${CI_COMMIT_REF_NAME}
  variables:
    BUILD_DIR: ci/packer/zen
    BUILD_TARGET: zen-deb12
    CLEAN_TARGET: clean_all
  tags:
    - shell
  rules:
    - if: '$CI_COMMIT_TAG'
      when: manual
      allow_failure: true
    - if: '$CI_COMMIT_REF_NAME == "devel" && ($BUILD_PF_IMG_ZEN == "yes" || $CI_COMMIT_MESSAGE =~ /build_pf_img_zen=yes/)'
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api") && ($BUILD_PF_IMG_ZEN == "yes" || $CI_COMMIT_MESSAGE =~ /build_pf_img_zen=yes/)'
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api") && ($BUILD_PF_IMG_ZEN == "yes" || $CI_COMMIT_MESSAGE =~ /build_pf_img_zen=yes/)'

build_pf_img_cd_iso:
  extends:
    - .build_pf_img_job
  environment:
    name: sourceforge
    url: ${RCLONE_LINODE_URL}/packetfence-iso/${CI_COMMIT_REF_SLUG}
  variables:
    BUILD_DIR: ci/cd-iso
    BUILD_TARGET: cd-iso
    CLEAN_TARGET: clean
  rules:
    - if: '$CI_COMMIT_TAG'
      variables:
        PF_VERSION: ${CI_COMMIT_TAG}
      when: manual
      allow_failure: true
    - if: '$CI_COMMIT_REF_NAME == "devel" && ($BUILD_PF_IMG_CD_ISO == "yes" || $CI_COMMIT_MESSAGE =~ /build_pf_img_cd_iso=yes/)'
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api") && ($BUILD_PF_IMG_CD_ISO == "yes" || $CI_COMMIT_MESSAGE =~ /build_pf_img_cd_iso=yes/)'
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api") && ($BUILD_PF_IMG_CD_ISO == "yes" || $CI_COMMIT_MESSAGE =~ /build_pf_img_cd_iso=yes/)'

build_pf_img_dvd_usb_iso:
  extends:
    - .build_pf_img_job
  needs:
    - job: publish_ppa
      optional: true
  environment:
    name: sourceforge
    url: ${RCLONE_LINODE_URL}/packetfence-iso/${CI_COMMIT_REF_SLUG}
  variables:
    PF_VERSION: ${CI_COMMIT_REF_NAME}
    PF_REPO_TYPE: gitlab/${CI_PIPELINE_ID}
    BUILD_DIR: ci/dvd-usb-iso
    BUILD_TARGET: upload
    CLEAN_TARGET: clean
  rules:
    - if: '($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api") && ($BUILD_PF_IMG_DVD_USB_ISO == "yes" || $CI_COMMIT_MESSAGE =~ /build_pf_img_dvd_usb_iso=yes/)'

### build_pf_img_vagrant jobs
# Devel box: packages already deployed to the public inverse.ca repo.
build_pf_img_vagrant_devel_debian_bookworm:
  extends:
    - .build_pf_img_vagrant_job
  variables:
    BOX_NAME: pfdeb12dev
  needs:
    - job: deploy_packages
      parallel:
        matrix:
          - DEPLOY_TYPE: deb
      artifacts: false
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  rules:
    - !reference [.gated_by_build_pf_img_vagrant, rules]
    - if: '$CI_COMMIT_REF_NAME == "devel"'

# Maintenance branches: stable box namespace, shared with tag releases.
build_pf_img_vagrant_maintenance_debian_bookworm:
  extends:
    - .build_pf_img_vagrant_job
  variables:
    BOX_NAME: pfdeb12stable
  needs:
    - job: deploy_packages
      parallel:
        matrix:
          - DEPLOY_TYPE: deb
      artifacts: false
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  rules:
    - !reference [.gated_by_build_pf_img_vagrant, rules]
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'

# Feature branches: packages come from the pipeline PPA (publish_ppa); all
# feature branches share the same Linode prefix. Each branch uploads under its
# own <BOX_NAME>/<CI_COMMIT_REF_SLUG>/ sub-prefix via REF_SLUG=<slug>; the
# pipeline ID (BOX_VERSION) versions builds and lets a user pin a specific one.
build_pf_img_vagrant_branch_debian_bookworm:
  extends:
    - .build_pf_img_vagrant_job
  script:
    - export PF_MINOR_RELEASE="$(perl -ne 'print $1 if (m/.*?(\d+\.\d+)/)' conf/pf-release)"
    - export BOX_VERSION="${PF_MINOR_RELEASE}-ci-${CI_PIPELINE_ID}"
    - export BOX_NAME="pfdeb12branch"
    - export REF_SLUG="${CI_COMMIT_REF_SLUG}"
    - export BOX_DESC="PacketFence ${PF_MINOR_RELEASE} - ${CI_COMMIT_REF_SLUG} - ${BOX_VERSION}"
    - export CI_PAGES_URL="http://inverse.ca/downloads/PacketFence/gitlab/${CI_PIPELINE_ID}"
    - timeout ${PIPELINE_TIMEOUT_SCRIPT} make -e -C ${VAGRANT_IMG_DIR}
        BOX_NAME="${BOX_NAME}" BOX_VERSION="${BOX_VERSION}"
        pfdebian12dev_generic
  needs:
    - job: publish_ppa
      artifacts: false
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  rules:
    - !reference [.gated_by_build_pf_img_vagrant, rules]
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'

# AD (Samba4) devel box: packages already deployed to the public inverse.ca repo.
build_pf_img_vagrant_ad_devel_debian_bullseye:
  extends:
    - .build_pf_img_vagrant_job
  variables:
    BOX_NAME: pfad11dev
  needs:
    - job: deploy_packages
      parallel:
        matrix:
          - DEPLOY_TYPE: deb
      artifacts: false
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  rules:
    - !reference [.gated_by_build_pf_img_vagrant, rules]
    - if: '$CI_COMMIT_REF_NAME == "devel"'

# AD (Samba4) maintenance branches: stable namespace.
build_pf_img_vagrant_ad_maintenance_debian_bullseye:
  extends:
    - .build_pf_img_vagrant_job
  variables:
    BOX_NAME: pfad11stable
  needs:
    - job: deploy_packages
      parallel:
        matrix:
          - DEPLOY_TYPE: deb
      artifacts: false
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  rules:
    - !reference [.gated_by_build_pf_img_vagrant, rules]
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'

# AD (Samba4) feature-branch box: shared branch namespace.
build_pf_img_vagrant_ad_branch_debian_bullseye:
  extends:
    - .build_pf_img_vagrant_job
  script:
    - export PF_MINOR_RELEASE="$(perl -ne 'print $1 if (m/.*?(\d+\.\d+)/)' conf/pf-release)"
    - export BOX_VERSION="${PF_MINOR_RELEASE}-ci-${CI_PIPELINE_ID}"
    - export BOX_NAME="pfad11branch"
    - export BOX_DESC="PacketFence AD ${PF_MINOR_RELEASE} - ${CI_COMMIT_REF_SLUG} - ${BOX_VERSION}"
    - export CI_PAGES_URL="http://inverse.ca/downloads/PacketFence/gitlab/${CI_PIPELINE_ID}"
    - timeout ${PIPELINE_TIMEOUT_SCRIPT} make -e -C ${VAGRANT_IMG_DIR}
        BOX_NAME="${BOX_NAME}" BOX_VERSION="${BOX_VERSION}"
        pfad11dev_generic
  needs:
    - job: publish_ppa
      artifacts: false
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  rules:
    - !reference [.gated_by_build_pf_img_vagrant, rules]
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'

# Shared node+wireless box (bullseye). Bakes only stock packages, so unlike the
# PF/AD boxes these need neither deploy_packages nor publish_ppa.
build_pf_img_vagrant_node_devel_debian_bullseye:
  extends:
    - .build_pf_img_vagrant_job
  variables:
    BOX_NAME: pfnode11dev
  needs:
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  rules:
    - !reference [.gated_by_build_pf_img_vagrant, rules]
    - if: '$CI_COMMIT_REF_NAME == "devel"'

build_pf_img_vagrant_node_maintenance_debian_bullseye:
  extends:
    - .build_pf_img_vagrant_job
  script:
    - export PF_MINOR_RELEASE="$(perl -ne 'print $1 if (m/.*?(\d+\.\d+)/)' conf/pf-release)"
    - export BOX_VERSION="${PF_MINOR_RELEASE}.$(date -u +%Y%m%d%H%M%S)"
    - export BOX_NAME="pfnode11stable"
    - export BOX_DESC="PacketFence node+wireless ${PF_MINOR_RELEASE} - ${CI_COMMIT_REF_SLUG} - ${BOX_VERSION}"
    - timeout ${PIPELINE_TIMEOUT_SCRIPT} make -e -C ${VAGRANT_IMG_DIR}
        BOX_NAME="${BOX_NAME}" BOX_VERSION="${BOX_VERSION}"
        pfnode11dev_generic
  needs:
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  rules:
    - !reference [.gated_by_build_pf_img_vagrant, rules]
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'

build_pf_img_vagrant_node_branch_debian_bullseye:
  extends:
    - .build_pf_img_vagrant_job
  script:
    - export PF_MINOR_RELEASE="$(perl -ne 'print $1 if (m/.*?(\d+\.\d+)/)' conf/pf-release)"
    - export BOX_VERSION="${PF_MINOR_RELEASE}-ci-${CI_PIPELINE_ID}"
    - export BOX_NAME="pfnode11branch"
    - export BOX_DESC="PacketFence node+wireless ${PF_MINOR_RELEASE} - ${CI_COMMIT_REF_SLUG} - ${BOX_VERSION}"
    - timeout ${PIPELINE_TIMEOUT_SCRIPT} make -e -C ${VAGRANT_IMG_DIR}
        BOX_NAME="${BOX_NAME}" BOX_VERSION="${BOX_VERSION}"
        pfnode11dev_generic
  needs:
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  rules:
    - !reference [.gated_by_build_pf_img_vagrant, rules]
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'

# Release (tag): stable box with PacketFence installed, manual trigger.
build_pf_img_vagrant_release_debian_bookworm:
  extends:
    - .build_pf_img_vagrant_release_job
  variables:
    BOX_NAME: pfdeb12stable
  needs:
    - job: deploy_packages
      parallel:
        matrix:
          - DEPLOY_TYPE: deb
      artifacts: false
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  # workaround for https://forum.gitlab.com/t/specify-when-at-job-level-with-a-job-that-has-rules/4769
  rules:
    - if: '$CI_COMMIT_TAG'
      when: manual
      allow_failure: true

# EL 8 devel box: packages already deployed to the public inverse.ca repo.
build_pf_img_vagrant_devel_el8:
  extends:
    - .build_pf_img_vagrant_job
  variables:
    BOX_NAME: pfel8dev
  needs:
    - job: deploy_packages
      parallel:
        matrix:
          - DEPLOY_TYPE: rpm
      artifacts: false
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  rules:
    - !reference [.gated_by_build_pf_img_vagrant, rules]
    - if: '$CI_COMMIT_REF_NAME == "devel"'

# EL 8 maintenance branches: stable namespace, shared with tag releases.
build_pf_img_vagrant_maintenance_el8:
  extends:
    - .build_pf_img_vagrant_job
  variables:
    BOX_NAME: pfel8stable
  needs:
    - job: deploy_packages
      parallel:
        matrix:
          - DEPLOY_TYPE: rpm
      artifacts: false
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  rules:
    - !reference [.gated_by_build_pf_img_vagrant, rules]
    - if: '$CI_COMMIT_REF_NAME =~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'

# EL 8 feature branches: packages come from the pipeline PPA (publish_ppa); all
# feature branches share the same Linode prefix, the pipeline ID (BOX_VERSION)
# distinguishes builds and lets a user pin a specific pipeline's box.
build_pf_img_vagrant_branch_el8:
  extends:
    - .build_pf_img_vagrant_job
  script:
    - export PF_MINOR_RELEASE="$(perl -ne 'print $1 if (m/.*?(\d+\.\d+)/)' conf/pf-release)"
    - export BOX_VERSION="${PF_MINOR_RELEASE}-ci-${CI_PIPELINE_ID}"
    - export BOX_NAME="pfel8branch"
    - export BOX_DESC="PacketFence ${PF_MINOR_RELEASE} - ${CI_COMMIT_REF_SLUG} - ${BOX_VERSION}"
    - export CI_PAGES_URL="http://inverse.ca/downloads/PacketFence/gitlab/${CI_PIPELINE_ID}"
    - timeout ${PIPELINE_TIMEOUT_SCRIPT} make -e -C ${VAGRANT_IMG_DIR}
        BOX_NAME="${BOX_NAME}" BOX_VERSION="${BOX_VERSION}"
        pfel8dev_generic
  needs:
    - job: publish_ppa
      artifacts: false
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  rules:
    - !reference [.gated_by_build_pf_img_vagrant, rules]
    - if: '$CI_COMMIT_REF_NAME != "devel" && $CI_COMMIT_REF_NAME !~ /^maintenance\/[[:digit:]]+\.[[:digit:]]+$/ && $CI_COMMIT_TAG == null && ($CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api")'

# EL 8 release (tag): stable box with PacketFence installed, manual trigger.
build_pf_img_vagrant_release_el8:
  extends:
    - .build_pf_img_vagrant_release_job
  variables:
    BOX_NAME: pfel8stable
  needs:
    - job: deploy_packages
      parallel:
        matrix:
          - DEPLOY_TYPE: rpm
      artifacts: false
    - job: ci_related
      parallel:
        matrix:
          - IMAGE_NAME: "vagrant-build"
      artifacts: false
      optional: true
  # workaround for https://forum.gitlab.com/t/specify-when-at-job-level-with-a-job-that-has-rules/4769
  rules:
    - if: '$CI_COMMIT_TAG'
      when: manual
      allow_failure: true