.gitlab-ci.yml

variables:
  REPO_NAME: github.com/mendersoftware/mender-demo-artifact
  GITHUB_RELEASE_BINARY: mender-demo-artifact
  GITHUB_RELEASE_DEPLOY_REPO: mendersoftware/mender-demo-artifact
  MENDER_ARTIFACT_VERSION: '4.4.0'
  S3_BUCKET_NAME: "mender-demo-artifacts"
  DOCKER_HOST:
    value: 'tcp://docker:2376'
    description: "Required to run dind inside k8s runners with TLS"
  DOCKER_TLS_CERTDIR:
    value: '/certs'
    description: "The cert dir inside the gitlab runner. Don't change this."
  DOCKER_TLS_VERIFY:
    value: 1
    description: "Enable TLS verification for docker in dind"
  DOCKER_CERT_PATH:
    value: "$DOCKER_TLS_CERTDIR/client"
    description: "Used for docker entrypoints. See https://gitlab.com/gitlab-org/gitlab-runner/-/issues/4125"


stages:
  - renovate
  - build
  - test
  - publish

include:
  - project: Northern.tech/Mender/mendertesting
    file:
      - qa-common/runner.yml
      - qa-common/retry.yml
  - component: gitlab.com/Northern.tech/Mender/mendertesting/commit-lint@master
  - project: 'Northern.tech/Mender/mendertesting'
    file: '.gitlab-ci-github-status-updates.yml'
  - project: "Northern.tech/Mender/mendertesting"
    file: "qa-common/send-results-to-mantra.yml"
  - component: gitlab.com/Northern.tech/Mender/mendertesting/renovate@master
    inputs:
      stage: "renovate"

default:
  tags: !reference [.qa-common-default-runner, tags]
  retry: !reference [.qa-common-default-retry, retry]

build:
  stage: build
  image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:28.5.2
  services:
    - name: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:dind
      alias: docker
  before_script:
    - !reference [.qa-common-wait-for-dind, before_script]
  script:
    - ARTIFACT_NAME="mender-demo-artifact-$(date +%Y%m%d)-$(git rev-parse --short HEAD)"
    - docker build -t mender-demo-artifact --build-arg MENDER_ARTIFACT_VERSION=$MENDER_ARTIFACT_VERSION --build-arg ARTIFACT_NAME=$ARTIFACT_NAME .
    # Extract artifact
    - mkdir output
    - docker run --rm -v $PWD/output:/output mender-demo-artifact
    - echo "ARTIFACT_NAME=$ARTIFACT_NAME" > build.env
  artifacts:
    paths:
      - output/mender-demo-artifact.mender
    reports:
      dotenv: build.env

test:acceptance:
  stage: test
  image: docker:dind
  tags:
    - mender-qa-worker-generic
  dependencies:
    - build
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  before_script:
    # DinD setup in Mender CI runners
    - unset DOCKER_HOST
    - unset DOCKER_TLS_VERIFY
    - unset DOCKER_CERT_PATH
    # Start dockerd in the background
    - /usr/local/bin/dockerd &
    # Wait for dockerd to start
    - |-
      MAX_WAIT=30
      while [ ! -e "/var/run/docker.sock" ] && [ $MAX_WAIT -gt 0 ]; do
        MAX_WAIT=$(($MAX_WAIT - 1))
        sleep 1
      done
    # Verify that the docker server is up and running
    - docker version
    # Git submodules
    - apk add git
    - git submodule sync --recursive
    - git submodule update --init --recursive
    # Log in to pull test image from registry.gitlab.com
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
  script:
    - apk add --update python3 py3-pip bash gcc openssh-client make openssl-dev curl jq
      libffi-dev libc-dev python3-dev musl-dev rust cargo
    - pip3 install --break-system-packages --upgrade pip
    - cd tests
    - pip3 install --break-system-packages -r requirements.txt
    - python3 -m pytest --verbose --junitxml=results.xml
  after_script:
    - export MANTRA_PROJECT_NAME="client_general"
    - !reference [.mantra-push-results]

publish:s3:
  stage: publish
  image: debian:bookworm
  dependencies:
    - build
  id_tokens:
    AWS_OIDC_TOKEN:
      aud: https://gitlab.com
  before_script:
    - !reference [.qa-common-network-apt-retry, before_script]
    - apt update && apt install -yyq awscli
  script:
    - >-
      export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s"
      $(aws sts assume-role-with-web-identity
      --role-arn "arn:aws:iam::175683096866:role/nt-mender-demo-artifact-s3-publishing"
      --role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}"
      --web-identity-token ${AWS_OIDC_TOKEN}
      --duration-seconds 900
      --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]'
      --output text))
    - aws sts get-caller-identity
    - echo "Publishing ${ARTIFACT_NAME} version to S3"
    - aws s3 cp output/mender-demo-artifact.mender
        s3://$S3_BUCKET_NAME/mender-demo-artifact.mender
    - aws s3api put-object-acl --acl public-read --bucket $S3_BUCKET_NAME
        --key mender-demo-artifact.mender
    - aws s3 cp output/mender-demo-artifact.mender
        s3://$S3_BUCKET_NAME/$ARTIFACT_NAME/mender-demo-artifact.mender
    - aws s3api put-object-acl --acl public-read --bucket $S3_BUCKET_NAME
        --key $ARTIFACT_NAME/mender-demo-artifact.mender
  only:
    - master