.gitlab-ci.yml

variables:
  SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar" # Defines the location of the analysis task cache
  GIT_DEPTH: "100" # Tells git to fetch all the branches of the project, required by the analysis task
  CLAIR_OUTPUT: High
  # Tell docker CLI how to talk to Docker daemon; see
  # https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#use-docker-in-docker-executor
  DOCKER_HOST: tcp://thedockerhost:2375/
  # Use the overlayfs driver for improved performance:
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: ""
  DOCKER_IMAGE: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA
  # MySQL test credentials
  DB_HOST: mysql
  MYSQL_DATABASE: homestead
  MYSQL_USER: homestead
  MYSQL_PASSWORD: secret
  MYSQL_ROOT_PASSWORD: secret
  REDIS_PORT: 6379
  # SOKETI
  SOKETI_DEBUG: '1'
  SOKETI_METRICS_SERVER_PORT: '9601'
include:
  - template: Code-Quality.gitlab-ci.yml
  - template: Jobs/Code-Intelligence.gitlab-ci.yml # https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Jobs/Code-Intelligence.gitlab-ci.yml
  - template: Security/Dependency-Scanning.gitlab-ci.yml # https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/Container-Scanning.gitlab-ci.yml # https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml
  - template: Security/License-Scanning.gitlab-ci.yml # https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Security/License-Scanning.gitlab-ci.yml
  - template: Security/SAST.gitlab-ci.yml # https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml # https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Security/Secret-Detection.gitlab-ci.yml
stages:
  - pre-build
  - build
  - test
  - analyse
  - deploy

build-docker:
  stage: pre-build
  image:
    # An alpine-based image with the `docker` CLI installed.
    name: docker:stable
  # This will run a Docker daemon in a container (Docker-In-Docker), which will
  # be available at thedockerhost:2375. If you make e.g. port 5000 public in Docker
  # (`docker run -p 5000:5000 yourimage`) it will be exposed at thedockerhost:5000.
  services:
    - name: docker:stable-dind
      alias: thedockerhost
  script:
    # GitLab has a built-in Docker image registry, whose parameters are set automatically.
    # See https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#using-the-gitlab-contai
    # CHANGEME: You can use some other Docker registry though by changing the
    # login and image name.
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
    - docker build -t $DOCKER_IMAGE .
    - docker push $DOCKER_IMAGE
build-composer:
  image: cimg/php:8.2
  stage: build
  script:
    - composer install
  only:
    - pull_request
    - push
    - master
    - staging
    - production
  artifacts:
    paths:
      - vendor
    expire_in: 1 week
  cache:
    key: "${CI_JOB_NAME}-composer"
    paths:
      - .env
      - vendor
  needs:
    - build-docker

artisan-test-feature:
  image:
    name: $DOCKER_IMAGE
    entrypoint: [""]
  stage: test
  parallel: 2
  services:
    - name: mysql:8.0
    - name: redis:latest
    - name: quay.io/soketi/soketi:latest-16-alpine
      alias: soketi
    - name: mailhog/mailhog:latest
      alias: mailhog
  before_script:
    - cp .env.example .env
    - cp .env.testing.example .env.testing
    - php artisan config:clear
    - php artisan route:clear
    - php artisan key:generate
    - php artisan key:generate --env=testing
    - php artisan migrate
    - output=$(php artisan passport:install)
    - client_id=$(echo "$output" | awk '/Client ID:/{print $3; exit}')
    - client_secret=$(echo "$output" | awk '/Client secret:/{print $3; exit}')
    - sed -i "s/^PASSPORT_PERSONAL_ACCESS_CLIENT_ID=.*/PASSPORT_PERSONAL_ACCESS_CLIENT_ID=${client_id}/" .env
    - sed -i "s/^PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET=.*/PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET=${client_secret}/" .env
    - sed -i "s/^PASSPORT_PERSONAL_ACCESS_CLIENT_ID=.*/PASSPORT_PERSONAL_ACCESS_CLIENT_ID=${client_id}/" .env.testing
    - sed -i "s/^PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET=.*/PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET=${client_secret}/" .env.testing
    - php artisan config:cache
    - php artisan config:cache --env=testing
    - php artisan route:cache
    - php artisan db:seed
  script:
    - php artisan queue:work >> storage/logs/queue.log &
    - php artisan serve &
    - php artisan test --env=testing --testsuite=Feature
  only:
    - pull_request
    - push
    - master
    - staging
    - production
  artifacts:
    paths:
      - .env
      - .env.testing
      - bootstrap/cache/
      - storage/logs/
    expire_in: 1 day
    when: always
  dependencies:
    - build-docker
    - build-composer
  needs:
    - build-docker
    - build-composer
artisan-test-unit:
  image:
    name: $DOCKER_IMAGE
    entrypoint: [""]
  stage: test
  parallel: 2
  services:
    - name: mysql:8.0
    - name: redis:latest
    - name: quay.io/soketi/soketi:latest-16-alpine
      alias: soketi
    - name: mailhog/mailhog:latest
      alias: mailhog
  before_script:
    - cp .env.example .env
    - cp .env.testing.example .env.testing
    - php artisan config:clear
    - php artisan route:clear
    - php artisan key:generate
    - php artisan key:generate --env=testing
    - php artisan migrate
    - output=$(php artisan passport:install)
    - client_id=$(echo "$output" | awk '/Client ID:/{print $3; exit}')
    - client_secret=$(echo "$output" | awk '/Client secret:/{print $3; exit}')
    - sed -i "s/^PASSPORT_PERSONAL_ACCESS_CLIENT_ID=.*/PASSPORT_PERSONAL_ACCESS_CLIENT_ID=${client_id}/" .env
    - sed -i "s/^PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET=.*/PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET=${client_secret}/" .env
    - sed -i "s/^PASSPORT_PERSONAL_ACCESS_CLIENT_ID=.*/PASSPORT_PERSONAL_ACCESS_CLIENT_ID=${client_id}/" .env.testing
    - sed -i "s/^PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET=.*/PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET=${client_secret}/" .env.testing
    - php artisan config:cache
    - php artisan config:cache --env=testing
    - php artisan route:cache
    - php artisan db:seed
  script:
    - php artisan queue:work >> storage/logs/queue.log &
    - php artisan serve &
    - php artisan test --env=testing --testsuite=Unit
  only:
    - pull_request
    - push
    - master
    - staging
    - production
  artifacts:
    paths:
      - .env
      - .env.testing
      - bootstrap/cache/
      - storage/logs/
    expire_in: 1 day
    when: always
  dependencies:
    - build-docker
    - build-composer
  needs:
    - build-docker
    - build-composer
php-lint:
  image:
    name: $DOCKER_IMAGE
    entrypoint: [""]
  stage: test
  script:
    - ./vendor/bin/phplint
  dependencies:
    - build-docker
    - build-composer
  needs:
    - build-docker
    - build-composer
deploy_staging:
  image:
    name: $DOCKER_IMAGE
    entrypoint: [""]
  stage: deploy
  script:
    - php vendor/bin/envoy run deploy --branch=staging --refresh=true --host=${{PROJECT_STAGING_HOST}}
  only:
    - staging
  dependencies:
    - artisan-test-feature
    - artisan-test-unit
  needs:
    - artisan-test-feature
    - artisan-test-unit
deploy_production:
  image:
    name: $DOCKER_IMAGE
    entrypoint: [""]
  stage: deploy
  script:
    - php vendor/bin/envoy run deploy --branch=production --host=${{PROJECT_PRODUCTION_HOST}}
  only:
    - production
  dependencies:
    - artisan-test-feature
    - artisan-test-unit
  needs:
    - artisan-test-feature
    - artisan-test-unit
sonarcloud-check:
  stage: analyse
  image:
    name: sonarsource/sonar-scanner-cli:latest
    entrypoint: [""]
  cache:
    key: "${CI_JOB_NAME}"
    paths:
      - .sonar/cache
  allow_failure: true
  script:
    - sonar-scanner
  only:
    - master
  dependencies:
    - artisan-test-feature
    - artisan-test-unit
  needs:
    - artisan-test-feature
    - artisan-test-unit
code_intelligence_go:
  stage: analyse
  rules:
    # Run code_intelligence_go in pipelines on the master branch (but not in other branch pipelines)
    - if: '$CI_COMMIT_BRANCH == "master"'
    # Run code_intelligence_go in pipelines for tags
    - if: "$CI_COMMIT_TAG"

gemnasium-dependency_scanning:
  stage: analyse
  rules:
    # Run gemnasium-dependency_scanning in pipelines on the master branch (but not in other branch pipelines)
    - if: '$CI_COMMIT_BRANCH == "master"'
    # Run gemnasium-dependency_scanning in pipelines for tags
    - if: "$CI_COMMIT_TAG"

retire-js-dependency_scanning:
  stage: analyse
  rules:
    # Run retire-js-dependency_scanning in pipelines on the master branch (but not in other branch pipelines)
    - if: '$CI_COMMIT_BRANCH == "master"'
    # Run retire-js-dependency_scanning in pipelines for tags
    - if: "$CI_COMMIT_TAG"

container_scanning:
  stage: analyse
  rules:
    # Run container_scanning in pipelines on the master branch (but not in other branch pipelines)
    - if: '$CI_COMMIT_BRANCH == "master"'
    # Run container_scanning in pipelines for tags
    - if: "$CI_COMMIT_TAG"

phpcs-security-audit-sast:
  stage: analyse
  rules:
    # Run phpcs-security-audit-sast in pipelines on the master branch (but not in other branch pipelines)
    - if: '$CI_COMMIT_BRANCH == "master"'
    # Run phpcs-security-audit-sast in pipelines for tags
    - if: "$CI_COMMIT_TAG"

nodejs-scan-sast:
  stage: analyse
  rules:
    # Run nodejs-scan-sast in pipelines on the master branch (but not in other branch pipelines)
    - if: '$CI_COMMIT_BRANCH == "master"'
    # Run nodejs-scan-sast in pipelines for tags
    - if: "$CI_COMMIT_TAG"

eslint-sast:
  stage: analyse
  rules:
    # Run eslint-sast in pipelines on the master branch (but not in other branch pipelines)
    - if: '$CI_COMMIT_BRANCH == "master"'
    # Run eslint-sast in pipelines for tags
    - if: "$CI_COMMIT_TAG"

semgrep-sast:
  stage: analyse
  rules:
    - if: '$CI_COMMIT_BRANCH == "master"' # Run eslint-sast in pipelines on the master branch (but not in other branch pipelines)
    - if: "$CI_COMMIT_TAG" # Run eslint-sast in pipelines for tags

secret_detection:
  stage: analyse
  variables:
    SECRET_DETECTION_HISTORIC_SCAN: "true"
    GIT_DEPTH: 100
  rules:
    # Run secret_detection in pipelines on the master branch (but not in other branch pipelines)
    - if: '$CI_COMMIT_BRANCH == "master"'
    # Run secret_detection in pipelines for tags
    - if: "$CI_COMMIT_TAG"
  dependencies:
    - artisan-test-feature
    - artisan-test-unit
  needs:
    - artisan-test-feature
    - artisan-test-unit

license_scanning:
  stage: analyse
  rules:
    # Run license_scanning in pipelines on the master branch (but not in other branch pipelines)
    - if: '$CI_COMMIT_BRANCH == "master"'
    # Run license_scanning in pipelines for tags
    - if: "$CI_COMMIT_TAG"