.gitlab-ci.yml

# Only spawn workflows for MRs or branches without MRs
workflow:
  auto_cancel:
    on_job_failure: all
    on_new_commit: interruptible
  rules:
  - if: $CI_COMMIT_REF_PROTECTED == "true"
    auto_cancel:
      on_job_failure: none
      on_new_commit: none
    when: always
  - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_REF_PROTECTED != "true"
    when: never
  - when: always

stages:
- lint
- test
- package
- deploy

include:
# Scan for common secrets
- template: Security/Secret-Detection.gitlab-ci.yml
# Ensure pre-commit linters pass
- component: gitlab.com/blue42u/ci.pre-commit/lite@0.2

# Main image for building and testing
- component: &ci_predeps gitlab.com/blue42u/ci.predeps/buildah@1
  inputs:
    <<: &ci_predeps_shared
      fallback_registry: registry.gitlab.com/hpctoolkit/hpcviewer/ci.predeps
    name: main-jdk17-amd64
    build_args: JDK_OS=17-focal
- component: *ci_predeps
  inputs:
    <<: *ci_predeps_shared
    name: main-jdk17-arm64
    platform: linux/arm64
    job_tags: [saas-linux-medium-arm64]
    build_args: JDK_OS=17-focal

# Secondary images for different versions of the JDK
- component: *ci_predeps
  inputs:
    <<: *ci_predeps_shared
    name: main-jdk21-amd64
    build_args: JDK_OS=21-jammy
- component: *ci_predeps
  inputs:
    <<: *ci_predeps_shared
    name: main-jdk21-arm64
    platform: linux/arm64
    job_tags: [saas-linux-medium-arm64]
    build_args: JDK_OS=21-jammy

# Pre-build lightweight images to emulate an X11 server for testing
- component: *ci_predeps
  inputs:
    <<: *ci_predeps_shared
    name: xvfb-amd64
    containerfile: .ci.predeps/Containerfile.xvfb
    ignorefile: .ci.predeps/ignore.xvfb
- component: *ci_predeps
  inputs:
    <<: *ci_predeps_shared
    name: xvfb-arm64
    platform: linux/arm64
    job_tags: [saas-linux-medium-arm64]
    containerfile: .ci.predeps/Containerfile.xvfb
    ignorefile: .ci.predeps/ignore.xvfb


default:
  retry:
    max: 2
    when:
    - unknown_failure
    - api_failure
    - runner_system_failure

.maven:
  image: $PREDEPS_IMAGE_MAIN_JDK17_AMD64
  needs: ['predeps: [main-jdk17-amd64]']

  # Settings to cache Maven downloads
  before_script:
  - mkdir -p .m2-repository/ && rm -rf ~/.m2/repository
  - ln -s "`realpath .m2-repository/`" ~/.m2/repository
  cache:
    key: maven
    paths:
    - .m2-repository
    when: always


# Detect any secrets and report if there are problems
secret_detection:
  stage: lint
  interruptible: true
  needs: []
  tags: [saas-linux-small-amd64]
  rules:
  - when: always


# Lint the code with PMD and CMD
pmd:
  extends: .maven
  interruptible: true
  stage: lint
  image: $PREDEPS_IMAGE_MAIN_JDK17_AMD64
  tags: [saas-linux-small-amd64]
  needs: ['predeps: [main-jdk17-amd64]']

  allow_failure:
    exit_codes: 42
  script:
  - mvn package pmd:aggregate-pmd -Dformat=net.sourceforge.pmd.renderers.CodeClimateRenderer
  - mvn package pmd:aggregate-cpd -Dformat=xml
  # Convert from PMD's null-terminated list to a proper Code Climate report
  - python3 scripts/pmd2cq.py target/pmd.json > cq.json
  # Warn if CPD found any duplications, and refer to the HTML report if needed
  - |
    if grep -q '<duplication' target/cpd.xml; then
      echo "CPD found a duplication, see the HTML report for details:"
      echo "    ${CI_JOB_URL}/artifacts/file/target/site/cpd.html"
      exit 42
    else
      STATUS=$?
      if [ "$STATUS" -ne 1 ]; then
        exit $STATUS
      fi
    fi
  artifacts:
    when: always
    reports:
      codequality:
      - cq.json
    paths:
    - target/site


# Run all the tests within the Viewer and make sure everything passes
test jdk17 amd64:
  extends: .maven
  interruptible: true
  stage: test
  image: $PREDEPS_IMAGE_MAIN_JDK17_AMD64
  tags: [saas-linux-small-amd64]
  parallel:
    matrix:
    - WM: [metacity]
  needs:
  - 'predeps: [main-jdk17-amd64]'
  - 'predeps: [xvfb-amd64]'

  # A running X server is required for tests to complete, we use Xvfb
  services:
  - name: $PREDEPS_IMAGE_XVFB_AMD64
    alias: wm
  variables:
    DISPLAY: 'wm:99'
  script:
  # Run Maven to build and test everything, but delay the exit until the end
  - mvn --fail-at-end clean verify -Pjacoco || FAIL=1
  # Report the coverage % to the log
  - ./scripts/extract-coverage.sh tests/edu.rice.cs.hpctest.report/target/site/jacoco-aggregate/jacoco.xml
  # Convert the JaCoCo results into Cobertura for GitLab visualization
  - >-
    python3 scripts/cover2cover.py tests/edu.rice.cs.hpctest.report/target/site/jacoco-aggregate/jacoco.xml
    $CI_PROJECT_DIR/edu.rice.cs.*/src
    $CI_PROJECT_DIR/externals/*/src
    > coverage.xml
  # If Maven failed, we fail
  - test -z "$FAIL"
  coverage: '/COMPLEXITY coverage: .*%/'
  artifacts:
    when: always
    paths:
    - tests/edu.rice.cs.hpctest.report/target/site/jacoco-aggregate/
    reports:
      junit: tests/*/target/surefire-reports/TEST-*.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
test jdk21 amd64:
  extends: test jdk17 amd64
  image: $PREDEPS_IMAGE_MAIN_JDK21_AMD64
  needs:
  - 'predeps: [main-jdk21-amd64]'
  - 'predeps: [xvfb-amd64]'
test jdk17 arm64:
  extends: test jdk17 amd64
  image: $PREDEPS_IMAGE_MAIN_JDK17_ARM64
  needs:
  - 'predeps: [main-jdk17-arm64]'
  - 'predeps: [xvfb-arm64]'
  services:
  - name: $PREDEPS_IMAGE_XVFB_ARM64
    alias: wm
  tags: [saas-linux-medium-arm64]
test jdk21 arm64:
  extends: test jdk17 arm64
  image: $PREDEPS_IMAGE_MAIN_JDK21_ARM64
  needs:
  - 'predeps: [main-jdk21-arm64]'
  - 'predeps: [xvfb-arm64]'


# Build the Viewer and package the results for usage by users
package:
  extends: .maven
  interruptible: true
  stage: package
  image: $PREDEPS_IMAGE_MAIN_JDK17_AMD64
  tags: [saas-linux-small-amd64]
  needs: ['predeps: [main-jdk17-amd64]']
  variables:
    GIT_STRATEGY: clone
    GIT_DEPTH: 0
  script:
  - git describe --tags --debug --always --first-parent > ver.txt
  - VERSION=$(cat ver.txt)
  - rm ver.txt
  - echo "Building version $VERSION"
  # For tag pipelines the VERSION should always (always!) be the tag itself
  - test -z "$CI_COMMIT_TAG" || test "$VERSION" = "$CI_COMMIT_TAG"
  - ./build.sh --create --release "$VERSION"
  artifacts:
    expose_as: Packages
    expire_in: 3 days
    paths:
    - hpcviewer-linux.gtk.x86_64.tgz
    - hpcviewer-linux.gtk.aarch64.tgz
    - hpcviewer-linux.gtk.ppc64le.tgz
    - hpcviewer-macosx.cocoa.x86_64.zip
    - hpcviewer-macosx.cocoa.aarch64.zip
    - hpcviewer-win32.win32.x86_64.zip
    - hpcdata.tgz

package dmg:
  interruptible: true
  stage: package
  image: macos-14-xcode-15
  tags: [saas-macos-medium-m1]
  needs: [package]
  script:
  - macos/notarize.sh -i hpcviewer-macosx.cocoa.x86_64.zip
  - macos/notarize.sh -i  hpcviewer-macosx.cocoa.aarch64.zip
  artifacts:
    expose_as: MacOS Packages
    expire_in: 3 days
    paths:
    - hpcviewer-macosx.cocoa.x86_64.dmg
    - hpcviewer-macosx.cocoa.aarch64.dmg


# Upload the built artifacts to the package registry
upload:
  stage: deploy
  image: docker.io/alpine
  dependencies: [package, package dmg]
  rules:
  - if: $CI_COMMIT_REF_PROTECTED == "true" && $CI_COMMIT_TAG
  script:
  - apk add curl jq
  - >-
    curl
    --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file hpcviewer-linux.gtk.x86_64.tgz --fail-with-body --retry 7
    "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-linux.gtk.x86_64.tgz"
    --next
    --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file hpcviewer-linux.gtk.aarch64.tgz --fail-with-body --retry 7
    "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-linux.gtk.aarch64.tgz"
    --next
    --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file hpcviewer-linux.gtk.ppc64le.tgz --fail-with-body --retry 7
    "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-linux.gtk.ppc64le.tgz"
    --next
    --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file hpcviewer-macosx.cocoa.x86_64.dmg --fail-with-body --retry 7
    "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-macosx.cocoa.x86_64.dmg"
    --next
    --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file hpcviewer-macosx.cocoa.x86_64.zip --fail-with-body --retry 7
    "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-macosx.cocoa.x86_64.zip"
    --next
    --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file hpcviewer-macosx.cocoa.aarch64.dmg --fail-with-body --retry 7
    "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-macosx.cocoa.aarch64.dmg"
    --next
    --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file hpcviewer-macosx.cocoa.aarch64.zip --fail-with-body --retry 7
    "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-macosx.cocoa.aarch64.zip"
    --next
    --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file hpcviewer-win32.win32.x86_64.zip --fail-with-body --retry 7
    "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-win32.win32.x86_64.zip"
    > reponse.log
  after_script:
  - jq -C . < reponse.log


# Make a release for the tag, and add links to all the assets
create release:
  stage: deploy
  image: registry.gitlab.com/gitlab-org/release-cli:latest
  needs: [upload]
  tags: [saas-linux-small-amd64]
  rules:
  - if: $CI_COMMIT_REF_PROTECTED == "true" && $CI_COMMIT_TAG
  script:
  - echo "Creating release for tag $CI_COMMIT_TAG"
  release:
    tag_name: $CI_COMMIT_TAG
    name: Release $CI_COMMIT_TAG
    description: Release $CI_COMMIT_TAG
    assets:
      links:
      - name: for Windows x86_64
        link_type: package
        url: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-win32.win32.x86_64.zip
        filepath: /hpcviewer-win32.win32.x86_64.zip
      - name: for MacOS aarch64 (zip)
        link_type: package
        url: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-macosx.cocoa.aarch64.zip
        filepath: /hpcviewer-macosx.cocoa.aarch64.zip
      - name: for MacOS aarch64
        link_type: package
        url: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-macosx.cocoa.aarch64.dmg
        filepath: /hpcviewer-macosx.cocoa.aarch64.dmg
      - name: for MacOS x86_64 (zip)
        link_type: package
        url: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-macosx.cocoa.x86_64.zip
        filepath: /hpcviewer-macosx.cocoa.x86_64.zip
      - name: for MacOS x86_64
        link_type: package
        url: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-macosx.cocoa.x86_64.dmg
        filepath: /hpcviewer-macosx.cocoa.x86_64.dmg
      - name: for Linux ppc64le
        link_type: package
        url: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-linux.gtk.ppc64le.tgz
        filepath: /hpcviewer-linux.gtk.ppc64le.tgz
      - name: for Linux aarch64
        link_type: package
        url: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-linux.gtk.aarch64.tgz
        filepath: /hpcviewer-linux.gtk.aarch64.tgz
      - name: for Linux x86_64
        link_type: package
        url: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/hpcviewer/${CI_COMMIT_TAG}/hpcviewer-linux.gtk.x86_64.tgz
        filepath: /hpcviewer-linux.gtk.x86_64.tgz


# Render the documentation in HTML
documentation:
  extends: .maven
  stage: package
  script:
  - (cd doc/ && mvn site site:stage) || exit $?
  - mkdir -p target/
  - mv -T doc/target/staging/ target/staging/
  artifacts:
    expose_as: 'Rendered documentation'
    paths:
    - target/staging/


# Publish the rendered documentation to GitLab Pages for easy browsing from the web.
# FIXME: Currently this only happens for the default branch. Eventually we should extend this to
# include protected tags (releases) as well, once multiple deployments are easy.
# See https://gitlab.com/gitlab-org/gitlab/-/issues/422145 and https://gitlab.com/groups/gitlab-org/-/epics/10914.
pages:
  stage: deploy
  image: docker.io/alpine
  needs: [documentation]
  rules:
  - if: $CI_COMMIT_REF_PROTECTED == "true" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  script:
  - mv -T target/staging/ public/
  - echo "Deploying documentation to ${CI_PAGES_URL}"
  artifacts:
    paths: [public/]