.gitlab-ci.yml

stages:
  - check
  - ai_review
  - metrics
  - coverage
  - bump

variables:
  # GitLab API for posting MR comments
  GITLAB_API_URL: "${CI_API_V4_URL}"
  CODEX_QA_PATH: "gl-code-quality-report.json"
  CODEX_RAW_LOG: "artifacts/codex-raw.log"

codex-code-review:
  stage: ai_review
  tags:
    - nix
  allow_failure: true
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_SOURCE_PROJECT_ID != $CI_PROJECT_ID'
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $OPENAI_API_KEY'
      when: on_success
    - when: never
  script:
    - set -euo pipefail
    - mkdir -p artifacts
    - ': > "${CODEX_RAW_LOG}"'
    - ': > "${CODEX_QA_PATH}"'
    - |
      PROMPT=$'Review this repository and output ONLY GitLab Code Quality JSON between markers.\n=== BEGIN_CODE_QUALITY_JSON ===\n<JSON ARRAY HERE>\n=== END_CODE_QUALITY_JSON ===\nRules: output a single CodeClimate JSON array, use existing repo-relative file paths, no markdown, no prose, no placeholders. If no issues, output [] between markers.'
      FILE_LIST="$(git ls-files | sed 's/^/- /')"
      PROMPT="${PROMPT}\nOnly report issues in these files:\n${FILE_LIST}"
      export PROMPT
      nix shell nixpkgs#nodejs-24_x nixpkgs#git nixpkgs#gnused nixpkgs#gawk nixpkgs#util-linux nixpkgs#bash --command bash -c '
        set -euo pipefail
        npm -g i @openai/codex@latest
        codex --version
        set +e
        script -q -c "codex exec --full-auto \"$PROMPT\"" | tee "${CODEX_RAW_LOG}" >/dev/null
        CODEX_RC=${PIPESTATUS[0]}
        set -e
        echo "Codex exit code: ${CODEX_RC}"
        TMP_OUT="$(mktemp)"
        sed -E "s/\\x1B\\[[0-9;]*[A-Za-z]//g" "${CODEX_RAW_LOG}" \
          | tr -d "\\r" \
          | awk " /^\\s*=== BEGIN_CODE_QUALITY_JSON ===\\s*$/ {grab=1; next} /^\\s*=== END_CODE_QUALITY_JSON ===\\s*$/ {grab=0} grab " > "${TMP_OUT}"
        if ! node -e "const f=process.argv[1]; const s=require(\"fs\").readFileSync(f,\"utf8\").trim(); if(!s || /(<JSON ARRAY HERE>|BEGIN_CODE_QUALITY_JSON|END_CODE_QUALITY_JSON)/.test(s)) process.exit(2); JSON.parse(s);" "${TMP_OUT}"; then
          echo "[]" > "${TMP_OUT}"
        fi
        mv -f "${TMP_OUT}" "${CODEX_QA_PATH}"
      '
  artifacts:
    when: always
    reports:
      codequality: gl-code-quality-report.json
    paths:
      - artifacts/codex-raw.log
      - gl-code-quality-report.json
    expire_in: 14 days

# Post coverage report as MR comment
.coverage-mr-comment:
  stage: coverage
  tags:
    - nix
  image: alpine:latest
  before_script:
    - apk add --no-cache curl jq
  script:
    - |
      # Read the summary markdown
      SUMMARY=$(cat coverage-report/summary.md)

      # Escape for JSON
      SUMMARY_ESCAPED=$(echo "$SUMMARY" | jq -Rs '.')

      # Post or update MR comment
      if [ -n "${CI_MERGE_REQUEST_IID}" ]; then
        # Check for existing comment
        EXISTING_COMMENTS=$(curl -s --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
          "${GITLAB_API_URL}/projects/${CI_PROJECT_ID}/merge_requests/${CI_MERGE_REQUEST_IID}/notes")

        COMMENT_ID=$(echo "$EXISTING_COMMENTS" | jq -r '.[] | select(.body | contains("Code Coverage Report")) | .id')

        if [ -n "$COMMENT_ID" ] && [ "$COMMENT_ID" != "null" ]; then
          # Update existing comment
          curl -s -X PUT --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
            --header "Content-Type: application/json" \
            --data "{\"body\": $SUMMARY_ESCAPED}" \
            "${GITLAB_API_URL}/projects/${CI_PROJECT_ID}/merge_requests/${CI_MERGE_REQUEST_IID}/notes/$COMMENT_ID"
          echo "Updated existing MR comment"
        else
          # Create new comment
          curl -s -X POST --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
            --header "Content-Type: application/json" \
            --data "{\"body\": $SUMMARY_ESCAPED}" \
            "${GITLAB_API_URL}/projects/${CI_PROJECT_ID}/merge_requests/${CI_MERGE_REQUEST_IID}/notes"
          echo "Posted new MR comment"
        fi
      fi
  dependencies:
    - coverage-check
  only:
    - merge_requests

coverage-check:
  stage: coverage
  tags:
    - nix
  before_script:
    - echo "machine ${CI_SERVER_HOST}" > ~/.netrc
    - echo "login gitlab-ci-token" >> ~/.netrc
    - echo "password ${CI_JOB_TOKEN}" >> ~/.netrc
    - chmod 600 ~/.netrc
  script:
    - nix run .#coverage.coverage-report
  artifacts:
    when: always
    expire_in: 30 days
    paths:
      - coverage-report/
    expose_as: "Code Coverage Report"
    reports:
      junit: coverage-report/junit-report.xml
  only:
    - merge_requests
    - main

# Post complexity report as MR comment
.complexity-mr-comment:
  stage: metrics
  tags:
    - nix
  image: alpine:latest
  before_script:
    - apk add --no-cache curl jq
  script:
    - |
      # Read the summary markdown
      SUMMARY=$(cat complexity-report/summary.md)

      # Escape for JSON
      SUMMARY_ESCAPED=$(echo "$SUMMARY" | jq -Rs '.')

      # Post or update MR comment
      if [ -n "${CI_MERGE_REQUEST_IID}" ]; then
        # Check for existing comment
        EXISTING_COMMENTS=$(curl -s --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
          "${GITLAB_API_URL}/projects/${CI_PROJECT_ID}/merge_requests/${CI_MERGE_REQUEST_IID}/notes")
        
        COMMENT_ID=$(echo "$EXISTING_COMMENTS" | jq -r '.[] | select(.body | contains("Code Complexity Report")) | .id')
        
        if [ -n "$COMMENT_ID" ] && [ "$COMMENT_ID" != "null" ]; then
          # Update existing comment
          curl -s -X PUT --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
            --header "Content-Type: application/json" \
            --data "{\"body\": $SUMMARY_ESCAPED}" \
            "${GITLAB_API_URL}/projects/${CI_PROJECT_ID}/merge_requests/${CI_MERGE_REQUEST_IID}/notes/$COMMENT_ID"
          echo "Updated existing MR comment"
        else
          # Create new comment
          curl -s -X POST --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
            --header "Content-Type: application/json" \
            --data "{\"body\": $SUMMARY_ESCAPED}" \
            "${GITLAB_API_URL}/projects/${CI_PROJECT_ID}/merge_requests/${CI_MERGE_REQUEST_IID}/notes"
          echo "Posted new MR comment"
        fi
      fi
  dependencies:
    - complexity-check
  only:
    - merge_requests

complexity-check:
  stage: metrics
  tags:
    - nix
  before_script:
    - echo "machine ${CI_SERVER_HOST}" > ~/.netrc
    - echo "login gitlab-ci-token" >> ~/.netrc
    - echo "password ${CI_JOB_TOKEN}" >> ~/.netrc
    - chmod 600 ~/.netrc
  script:
    - nix run .#code-metrics.complexity-report
  artifacts:
    when: always
    expire_in: 30 days
    paths:
      - complexity-report/
    expose_as: "Code Complexity Report"
    reports:
      junit: complexity-report/junit-report.xml
  only:
    - merge_requests
    - main

auto-bump-patch:
  stage: bump
  tags:
    - nix
  before_script:
    - git remote set-url origin "https://oauth2:${GITLAB_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git"
  script:
    - nix run .#ci.bump-patch
    - nix run .#ci.cleanup-patch-tags -- 5 # Keep latest 5 patch tags
  only:
    - main
  when: on_success

manual-version-bump:
  stage: bump
  tags:
    - nix
  before_script:
    - git remote set-url origin "https://oauth2:${GITLAB_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git"
  script:
    - nix run .#ci.bump-version -- $NEW_VERSION
  only:
    - main
  when: manual
  variables:
    NEW_VERSION: ""

flake-check:
  stage: check
  tags:
    - nix
  retry:
    max: 2
    when:
      - runner_system_failure
  parallel:
    matrix:
      - CHECK_NAME:
          - integration
          - oidc-auth
          - web-ui
  before_script:
    # Create .netrc using CI job token (more secure)
    - echo "machine ${CI_SERVER_HOST}" > ~/.netrc
    - echo "login gitlab-ci-token" >> ~/.netrc
    - echo "password ${CI_JOB_TOKEN}" >> ~/.netrc
    - chmod 600 ~/.netrc
  script:
    - nix build ".#checks.x86_64-linux.${CHECK_NAME}" -L --show-trace
  only:
    - merge_requests
    - main