.gitlab-ci.yml

image: $REGISTRY_CI/gitlab-ci-base:buster

# Static Application Security Testing (SAST)
include:
  - template: Security/SAST.gitlab-ci.yml

variables:
  SAST_EXCLUDED_ANALYZERS: 'eslint,semgrep'
  DOCKWARE_VERSION: '6.6.8.2'
  GIT_DEPTH: 10
  RELEASE_NAME: ${DOCKER_STACK}-${DOCKER_SERVICE}-${CI_COMMIT_REF_SLUG}

stages:
  - test-init
  - test
  - analyse
  - package
  - release
  - build
  - deploy

.login_to_registry:
  before_script:
    - 'mkdir /tmp'
    - 'touch /tmp/credentials.json'
    - 'echo ${SA_REGISTRY_CD} > /tmp/credentials.json'
    - 'export GOOGLE_APPLICATION_CREDENTIALS=/tmp/credentials.json'

.login_to_cd:
  before_script:
    # Connect GCP with deploy service account
    - mkdir -p /tmp
    - touch /tmp/credentials.json
    - echo ${SA_DEPLOY_CD} > /tmp/credentials.json
    - gcloud auth activate-service-account "${SA_DEPLOY_NAME}" --key-file="/tmp/credentials.json"
    - gcloud config set project "${GCP_CD_PROJECT_ID}"
    - gcloud config set compute/zone "${GCP_CD_CLUSTER_REGION}"
    - gcloud container clusters get-credentials "${GCP_CD_CLUSTER_NAME}"

# Configure vendors cache
# policy: push on composer install only
.test-dependencies:
  variables:
    PATH_VENDOR: vendor
  cache:
    key: ${CI_COMMIT_REF_SLUG}-vendor-test
    paths:
      - $PATH_VENDOR
    policy: pull

# For job with report
# set artifact lifetime
# set $PATH_REPORTS, where reports are generate
.reportable:
  variables:
    PATH_REPORTS: reports
  artifacts:
    expire_in: 1 day

# For job with phpunit
# set PATH_REPORTS_PHPUNIT, folder where phpunit report are saved
.phpunit-conf:
  extends:
    - .reportable
  variables:
    PATH_REPORTS_PHPUNIT: $PATH_REPORTS/phpunit

# For job with phpstan
# set PATH_REPORTS_PHPUNIT, folder where phpstan report are saved
.phpstan-conf:
  extends:
    - .reportable
  variables:
    PATH_REPORTS_PHPSTAN: $PATH_REPORTS/phpstan

# Activate Xdebug
# set XDEBUG_MODE to coverage
.xdebug:
  variables:
    XDEBUG_MODE: coverage
  before_script:
    - chmod 755 /var/www/scripts/bin/xdebug_enable.sh
    - /var/www/scripts/bin/xdebug_enable.sh

########################
####      JOBS      ####
########################

#### TEST INIT ####

# Build image
build-test:
  stage: test-init
  image:
    name: gcr.io/kaniko-project/executor:v1.6.0-debug
  variables:
    TZ: Europe/Paris
    NODE_VERSION: 20
    COMPOSER_HOME: /var/www/html/var/cache/composer
    APP_URL: http://web
  script:
    - /kaniko/executor
      --cache=true
      --context "dir://${CI_PROJECT_DIR}"
      --dockerfile "./bin/docker/images/shopware/Dockerfile"
      --build-arg DOCKWARE_VERSION=$DOCKWARE_VERSION
      --destination "$REGISTRY_CI/test-jobs-${DOCKER_STACK}-${DOCKER_SERVICE}_web:${CI_COMMIT_REF_SLUG}"
  except:
    variables:
      - $ONLY_DEPLOY
  tags:
    - small

# Install dependencies for test
install-test:
  stage: test-init
  needs:
    - build-test
  image:
    name: $REGISTRY_CI/test-jobs-${DOCKER_STACK}-${DOCKER_SERVICE}_web:${CI_COMMIT_REF_SLUG}
    entrypoint: ['']
  extends:
    - .test-dependencies
  cache:
    policy: push
  script:
    - composer install
  except:
    variables:
      - $ONLY_DEPLOY
  tags:
    - small

# Code style
code-style:
  stage: test
  extends:
    - .test-dependencies
  needs:
    - install-test
  image:
    name: $REGISTRY_CI/test-jobs-${DOCKER_STACK}-${DOCKER_SERVICE}_web:${CI_COMMIT_REF_SLUG}
    entrypoint: ['']
  script:
    - $PATH_VENDOR/bin/php-cs-fixer fix src --dry-run --rules=@Symfony
  allow_failure: true
  except:
    variables:
      - $ONLY_DEPLOY

# Smoke test
smoke-test:
  stage: test
  needs:
    - build-test
  variables:
    TZ: Europe/Paris
    NODE_VERSION: 20
    COMPOSER_HOME: /var/www/html/var/cache/composer
    APP_URL: http://web
  services:
    - name: $REGISTRY_CI/test-jobs-${DOCKER_STACK}-${DOCKER_SERVICE}_web:${CI_COMMIT_REF_SLUG}
      alias: web
  script:
    - curl --retry 20 --retry-delay 10 --retry-connrefused --output /dev/null http://web
  allow_failure: true
  except:
    variables:
      - $ONLY_DEPLOY
  tags:
    - small

# Unit test and coverage
phpunit:
  stage: test
  extends:
    - .test-dependencies
    - .phpunit-conf
    - .xdebug
  needs:
    - install-test
  image:
    name: $REGISTRY_CI/test-jobs-${DOCKER_STACK}-${DOCKER_SERVICE}_web:${CI_COMMIT_REF_SLUG}
    entrypoint: ['']
  script:
    - php -d xdebug.mode=coverage $PATH_VENDOR/bin/phpunit
      --coverage-clover $PATH_REPORTS_PHPUNIT/coverage-clover.xml
      --log-junit $PATH_REPORTS_PHPUNIT/phpunit-junit.xml
  except:
    variables:
      - $ONLY_DEPLOY
  artifacts:
    paths:
      - $PATH_REPORTS_PHPUNIT

# Check Code
phpstan:
  stage: test
  extends:
    - .test-dependencies
    - .phpstan-conf
    - .xdebug
  needs:
    - install-test
  image:
    name: $REGISTRY_CI/test-jobs-${DOCKER_STACK}-${DOCKER_SERVICE}_web:${CI_COMMIT_REF_SLUG}
    entrypoint: ['']
  script:
    - mkdir -p $PATH_REPORTS_PHPSTAN
    - $PATH_VENDOR/bin/phpstan --version
    - $PATH_VENDOR/bin/phpstan analyse src
      --level 1
      --xdebug
      --no-progress
      -vvv
      --error-format=json > $PATH_REPORTS_PHPSTAN/phpstan-junit.xml
  allow_failure: true
  except:
    variables:
      - $ONLY_DEPLOY
  artifacts:
    paths:
      - $PATH_REPORTS_PHPSTAN
    when: always

# Mutation test
infection:
  stage: test
  extends:
    - .test-dependencies
    - .xdebug
    - .reportable
  needs:
    - install-test
  image:
    name: $REGISTRY_CI/test-jobs-${DOCKER_STACK}-${DOCKER_SERVICE}_web:${CI_COMMIT_REF_SLUG}
    entrypoint: ['']
  script:
    - $PATH_VENDOR/bin/infection
      --logger-html=$PATH_REPORTS/infection.html
      --min-covered-msi=80
  artifacts:
    paths:
      - $PATH_REPORTS/infection.html
  cache:
    policy: pull
  except:
    variables:
      - $ONLY_DEPLOY

# Sonar
sonarqube:
  stage: analyse
  extends:
    - .phpstan-conf
    - .phpunit-conf
  needs:
    - phpunit
    - phpstan
  image:
    name: sonarsource/sonar-scanner-cli:latest
    entrypoint: ['']
  variables:
    SONAR_USER_HOME: '${CI_PROJECT_DIR}/.sonar' # Defines the location of the analysis task cache
    GIT_DEPTH: '0' # Tells git to fetch all the branches of the project, required by the analysis task
  cache:
    policy: pull
  allow_failure: true
  except:
    variables:
      - $ONLY_DEPLOY
  script:
    - sonar-scanner
      -Dsonar.host.url=$SONAR_URL
      -Dsonar.login=${NEW_SONAR_AUTH_TOKEN}
      -Dsonar.projectVersion=$CI_BUILD_ID
      -Dsonar.gitlab.project_id=$CI_PROJECT_ID
      -Dsonar.gitlab.commit_sha=$CI_BUILD_REF
      -Dsonar.php.coverage.reportPaths=$PATH_REPORTS_PHPUNIT/coverage-clover.xml
      -Dsonar.php.test.reportPath=$PATH_REPORTS_PHPUNIT/phpunit-junit.xml
      -Dsonar.php.phpstan.reportPaths=$PATH_REPORTS_PHPSTAN/phpstan-junit.xml
      -Dsonar.qualitygate.wait=true

# Package into zip
package:
  stage: package
  image:
    name: $REGISTRY_CI/test-jobs-${DOCKER_STACK}-${DOCKER_SERVICE}_web:${CI_COMMIT_REF_SLUG}
    entrypoint: ['']
  needs:
    - build-test
  script:
    - echo "Package module $CI_COMMIT_REF_SLUG"
    - ./package-ready-for-shopware/builder/module_builder.sh -v $CI_COMMIT_REF_SLUG
  artifacts:
    paths:
      - ./package-ready-for-shopware
  tags:
    - small
  when: manual
  except:
    variables:
      - $ONLY_DEPLOY

# Job to get JIRA tickets of the release
get-jira-tickets:
  stage: release
  image: node:latest
  needs:
    - code-style
    - phpstan
    - phpunit
    - smoke-test
  rules:
    - if: $CI_COMMIT_TAG
  script:
    - |
      node <<EOF
      (async () => {
        try {
          const gitlabResponse = await fetch("${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/merge_requests?state=merged&target_branch=develop-6-6&milestone=${CI_COMMIT_TAG}", {
            method: "GET",
            headers: {
              "Private-Token": "$GITLAB_API_TOKEN"
            }
          });

          if (!gitlabResponse.ok) {
            const err = await gitlabResponse.json();
            throw new Error("Failed to send GitLab request: " + JSON.stringify(err));
          }

          const mergeRequests = await gitlabResponse.json();
          let tickets = [];

          mergeRequests.forEach((mr) => {
            const matches = mr.source_branch.match(/EC-\d+/i);
            const matchesTitle = mr.title.match(/(EC-\d+)/ig);
            if(matches?.length) {
              tickets.push(matches[0].toUpperCase());
            }
            matchesTitle?.forEach((match) => {
                tickets.push(match.toUpperCase());
            });
          });

          tickets = [...new Set(tickets)];

          console.log("tickets", tickets);

          const payload = {
            "event_type": "trigger-artifact-workflow",
            "client_payload": {
              "tickets": tickets
            }
          };

          console.log("payload", JSON.stringify(payload));

          const githubResponse = await fetch("https://api.github.com/repos/${GITHUB_ORGANIZATION}/${GITHUB_PROJECT}/dispatches", {
            method: "POST",
            headers: {
              "Content-Type": "application/json",
              "Authorization": "Bearer ${GITHUB_TOKEN}",
              "User-Agent": "Node.js"
            },
            body: JSON.stringify(payload)
          });

          if (!githubResponse.ok) {
            const err = await githubResponse.json();
            throw new Error("Failed to send GitHub event: " + JSON.stringify(err));
          }
        } catch (error) {
          throw new Error("Request error: " + error.message);
        }
      })();
      EOF

# Release note job
release-job:
  stage: release
  image: registry.gitlab.com/gitlab-org/release-cli:latest
  needs:
    - get-jira-tickets
  variables:
    TEMP_CHANGELOG_FILE: 'release_changelog.txt'
  rules:
    - if: $CI_COMMIT_TAG
  script:
    - |
      # Extract changelog part according to tag version
      CHANGELOG=$(awk -v version="## Version $CI_COMMIT_TAG" '
        $0 ~ version {printit=1; next}
        printit && /^## / {exit}
        printit {print}
      ' CHANGELOG.md)

      {
        echo "# CHANGE LOG"
        echo "$CHANGELOG"
      } > "$TEMP_CHANGELOG_FILE"
    - cat "$TEMP_CHANGELOG_FILE"
  release:
    tag_name: $CI_COMMIT_TAG
    name: Version $CI_COMMIT_TAG
    description: '$TEMP_CHANGELOG_FILE'
    milestones:
      - $CI_COMMIT_TAG

#### BUILD ####

build:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:v1.6.0-debug
  needs: []
  rules:
    - if: $ONLY_DEPLOY
      when: on_success
    - if: $CI_PIPELINE_SOURCE == "push"
      when: manual
  extends: .login_to_registry
  script:
    - /kaniko/executor
      --cache=true
      --context "dir://${CI_PROJECT_DIR}"
      --dockerfile "./bin/docker/images/shopware/Dockerfile"
      --build-arg DOCKWARE_VERSION=$DOCKWARE_VERSION
      --destination "${REGISTRY_CD}/${DOCKER_STACK}-${DOCKER_SERVICE}-web:${CI_COMMIT_REF_SLUG}"
  tags:
    - small

#### DEPLOY ####

deploy2recette:
  stage: deploy
  image: $REGISTRY_CI/gitlab-ci-base:deployment
  needs:
    - build
  rules:
    - if: $ONLY_DEPLOY
      when: on_success
    - if: $CI_PIPELINE_SOURCE == "push"
      when: manual
  variables:
    GPC_ACCOUNT: ''
  extends: .login_to_cd
  script:
    - echo $RELEASE_NAME
    - >
      helm install $RELEASE_NAME ./bin/docker/kubernetes/helm/
      --namespace default
      --set proxy_image="${REGISTRY_CD}/${DOCKER_STACK}-${DOCKER_SERVICE}-proxy"
      --set proxy_tag="${CI_COMMIT_REF_SLUG}"
      --set shopware_image="${REGISTRY_CD}/${DOCKER_STACK}-${DOCKER_SERVICE}-web"
      --set shopware_tag="${CI_COMMIT_REF_SLUG}"
      --set shopware_url="${DOCKER_STACK}-${DOCKER_SERVICE}-${CI_COMMIT_REF_SLUG}.${URL_CD}"
      --set private_login_stage="$HIPAY_API_USER_RE7"
      --set private_password_stage="$HIPAY_API_PASSWORD_RE7"
      --set public_login_stage="$HIPAY_TOKENJS_USERNAME_RE7"
      --set public_password_stage="$HIPAY_TOKENJS_PUBLICKEY_RE7"
      --set passphrase_stage="$HIPAY_SECRET_PASSPHRASE_RE7"
      --set private_applepay_login_stage="$HIPAY_APPLEPAY_USERNAME_RE7"
      --set private_applepay_password_stage="$HIPAY_APPLEPAY_PASSWORD_RE7"
      --set public_applepay_login_stage="$HIPAY_APPLEPAY_TOKENJS_USERNAME_RE7"
      --set public_applepay_password_stage="$HIPAY_APPLEPAY_TOKENJS_PUBLICKEY_RE7"
      --set applepay_passphrase_stage="$HIPAY_APPLEPAY_SECRET_PASSPHRASE_RE7"
      --set branch="$CI_COMMIT_REF_NAME"
  allow_failure: true
  environment:
    name: review/${CI_COMMIT_REF_SLUG}
    url: https://${DOCKER_STACK}-${DOCKER_SERVICE}-${CI_COMMIT_REF_SLUG}.${URL_CD}
    on_stop: stop_review
  tags:
    - small

stop_review:
  stage: deploy
  image: $REGISTRY_CI/gitlab-ci-base:deployment
  needs:
    - deploy2recette
  rules:
    - if: $ONLY_DEPLOY
      when: manual
    - if: $CI_PIPELINE_SOURCE == "push"
      when: manual
  variables:
    GIT_STRATEGY: none
  extends: .login_to_cd
  script:
    - helm uninstall $RELEASE_NAME --namespace=default
  allow_failure: true
  environment:
    name: review/${CI_COMMIT_REF_SLUG}
    action: stop
  tags:
    - small