.gitlab-ci.yml

stages:
  - quality
  - build
  - publish

workflow:
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH

.build_release_rules: &build_release_rules
  - if: $CI_COMMIT_TAG
  - if: '$CI_COMMIT_BRANCH == "release"'

default:
  interruptible: true
  before_script:
    - |
      if [ -n "${CI_COMMIT_TAG:-}" ]; then
        export WBEAM_VERSION="${CI_COMMIT_TAG#v}"
        export WBEAM_VERSION="${WBEAM_VERSION#V}"
      elif [ "${CI_COMMIT_BRANCH:-}" = "release" ]; then
        export WBEAM_VERSION="0.1.2.${CI_PIPELINE_IID}.${CI_COMMIT_SHORT_SHA}"
      else
        export WBEAM_VERSION="0.0.0.${CI_DEFAULT_BRANCH}.${CI_PIPELINE_IID}.${CI_COMMIT_SHORT_SHA}"
      fi
    - chmod +x scripts/ci/*.sh

quality_gates:
  stage: quality
  image: alpine:3.21
  script:
    - apk add --no-cache bash ripgrep
    - ./scripts/ci/check-repo-layout.sh
    - ./scripts/ci/check-boundaries.sh
    - ./scripts/ci/validate-e2e-matrix.sh
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH

sonar_scan_push_master:
  stage: quality
  image: sonarsource/sonar-scanner-cli:latest
  before_script: []
  variables:
    GIT_DEPTH: "0"
  script:
    - ': "${SONAR_HOST_URL:=http://192.168.100.208:9000}"'
    - ': "${SONAR_TOKEN:?Set SONAR_TOKEN in GitLab CI/CD variables}"'
    - sonar-scanner
      -Dsonar.projectBaseDir="${CI_PROJECT_DIR}"
      -Dsonar.host.url="${SONAR_HOST_URL}"
      -Dsonar.token="${SONAR_TOKEN}"
      -Dsonar.projectKey="wbeam"
      -Dsonar.projectName="WBeam"
      -Dsonar.qualitygate.wait=false
  rules:
    - if: '$CI_COMMIT_BRANCH == "master"'

build_deb:
  stage: build
  image: rust:bookworm
  script:
    - apt-get update
    - >
      DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends
      ca-certificates
      curl
      git
      jq
      pkg-config
      build-essential
      libssl-dev
      libdbus-1-dev
      libgstreamer1.0-dev
      libgstreamer-plugins-base1.0-dev
      libx11-dev
      libxrandr-dev
      libxfixes-dev
      libxext-dev
      libxrender-dev
      nodejs
      npm
      libwebkit2gtk-4.1-dev
      libgtk-3-dev
      libsoup-3.0-dev
      libayatana-appindicator3-dev
      dpkg-dev
    - ./scripts/ci/build_deb.sh
  artifacts:
    paths:
      - dist/*.deb
      - dist/VERSION.txt
    expire_in: 14 days
  rules: *build_release_rules

build_rpm:
  stage: build
  image: fedora:41
  script:
    - dnf -y install ca-certificates curl git jq rust cargo gcc gcc-c++ make pkgconf-pkg-config
    - dnf -y install openssl-devel dbus-devel gstreamer1-devel gstreamer1-plugins-base-devel nodejs webkit2gtk4.1-devel gtk3-devel libsoup3-devel libayatana-appindicator-gtk3-devel
    - dnf -y install libX11-devel libXrandr-devel libXfixes-devel libXext-devel libXrender-devel
    - dnf -y install rpm-build tar gzip findutils
    - ./scripts/ci/build_rpm.sh
  artifacts:
    paths:
      - dist/*.rpm
      - dist/VERSION.txt
    expire_in: 14 days
  rules: *build_release_rules

build_aarch64_tar:
  stage: build
  image: rust:bookworm
  script:
    - apt-get update
    - >
      DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends
      ca-certificates
      curl
      git
      jq
      pkg-config
      build-essential
      gcc-aarch64-linux-gnu
      libc6-dev-arm64-cross
      libssl-dev
      libdbus-1-dev
      libx11-dev
      libxrandr-dev
      libxfixes-dev
      libxext-dev
      libxrender-dev
      file
      tar
      gzip
    - ./scripts/ci/build_aarch64_tar.sh
  artifacts:
    paths:
      - dist/*aarch64*.tar.gz
      - dist/VERSION.txt
    expire_in: 14 days
  allow_failure: true
  rules: *build_release_rules

build_apk_release:
  stage: build
  image: eclipse-temurin:17-jdk-jammy
  variables:
    ANDROID_SDK_ROOT: "/opt/android-sdk"
    ANDROID_HOME: "/opt/android-sdk"
    GRADLE_USER_HOME: "${CI_PROJECT_DIR}/.gradle-user"
  script:
    - apt-get update
    - DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends curl unzip ca-certificates
    - mkdir -p "${ANDROID_SDK_ROOT}/cmdline-tools"
    - curl -fsSL https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -o /tmp/cmdline-tools.zip
    - unzip -q /tmp/cmdline-tools.zip -d /tmp
    - rm -rf "${ANDROID_SDK_ROOT}/cmdline-tools/latest"
    - mv /tmp/cmdline-tools "${ANDROID_SDK_ROOT}/cmdline-tools/latest"
    - |
      set +o pipefail
      yes | "${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager" --sdk_root="${ANDROID_SDK_ROOT}" --licenses >/dev/null
      set -o pipefail
    - '"${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager" --sdk_root="${ANDROID_SDK_ROOT}" "platform-tools" "platforms;android-35" "build-tools;35.0.0"'
    - ./scripts/ci/build_apk_release.sh
  artifacts:
    paths:
      - dist/*.apk
      - dist/VERSION.txt
    expire_in: 14 days
  rules: *build_release_rules

build_windows_server:
  stage: build
  tags:
    - windows
    - zerotier
    - build
  before_script:
    - |
      $ErrorActionPreference = "Stop"
      if ($env:CI_COMMIT_TAG) {
        $tag = $env:CI_COMMIT_TAG
        if ($tag.StartsWith("v") -or $tag.StartsWith("V")) {
          $tag = $tag.Substring(1)
        }
        $env:WBEAM_VERSION = $tag
      } elseif ($env:CI_COMMIT_BRANCH -eq "release") {
        $env:WBEAM_VERSION = "0.1.2.$($env:CI_PIPELINE_IID).$($env:CI_COMMIT_SHORT_SHA)"
      } else {
        $env:WBEAM_VERSION = "0.0.0.$($env:CI_DEFAULT_BRANCH).$($env:CI_PIPELINE_IID).$($env:CI_COMMIT_SHORT_SHA)"
      }
      cmd /c "C:\BuildTools\Common7\Tools\VsDevCmd.bat -host_arch=x64 -arch=x64 && set" |
        ForEach-Object {
          if ($_ -match "^(.*?)=(.*)$") {
            [System.Environment]::SetEnvironmentVariable($matches[1], $matches[2], "Process")
          }
        }
      $cargoBase = if ($env:CARGO_HOME) { $env:CARGO_HOME } else { "$env:USERPROFILE\.cargo" }
      $rustupBase = if ($env:RUSTUP_HOME) { $env:RUSTUP_HOME } else { "$env:USERPROFILE\.rustup" }
      if (Test-Path "$cargoBase\bin\cargo.exe") {
        $env:Path = "$cargoBase\bin;$env:Path"
      }
      if (Test-Path $rustupBase) {
        $env:RUSTUP_HOME = $rustupBase
      }
      if (Test-Path $cargoBase) {
        $env:CARGO_HOME = $cargoBase
      }
      rustup default stable | Out-Null
      cargo --version
  script:
    - |
      Set-Location "$env:CI_PROJECT_DIR\host\rust"
      cargo build --release -p wbeamd-server
      New-Item -ItemType Directory -Path "$env:CI_PROJECT_DIR\dist" -Force | Out-Null
      Copy-Item `
        "$env:CI_PROJECT_DIR\host\rust\target\release\wbeamd-server.exe" `
        "$env:CI_PROJECT_DIR\dist\wbeamd-server-$env:WBEAM_VERSION-windows-x86_64.exe" `
        -Force
      @(
        "WBEAM_VERSION=$env:WBEAM_VERSION"
        "CI_PIPELINE_ID=$env:CI_PIPELINE_ID"
        "CI_COMMIT_SHA=$env:CI_COMMIT_SHA"
        "CI_COMMIT_REF_NAME=$env:CI_COMMIT_REF_NAME"
      ) | Set-Content -Path "$env:CI_PROJECT_DIR\dist\VERSION.txt" -Encoding ascii
  artifacts:
    paths:
      - dist/*windows*.exe
      - dist/VERSION.txt
    expire_in: 14 days
  rules: *build_release_rules

build_windows_server:
  stage: build
  tags:
    - windows
    - zerotier
    - build
  before_script:
    - |
      $ErrorActionPreference = "Stop"
      if ($env:CI_COMMIT_TAG) {
        $tag = $env:CI_COMMIT_TAG
        if ($tag.StartsWith("v") -or $tag.StartsWith("V")) {
          $tag = $tag.Substring(1)
        }
        $env:WBEAM_VERSION = $tag
      } elseif ($env:CI_COMMIT_BRANCH -eq "release") {
        $env:WBEAM_VERSION = "0.1.2.$($env:CI_PIPELINE_IID).$($env:CI_COMMIT_SHORT_SHA)"
      } else {
        $env:WBEAM_VERSION = "0.0.0.$($env:CI_DEFAULT_BRANCH).$($env:CI_PIPELINE_IID).$($env:CI_COMMIT_SHORT_SHA)"
      }
      cmd /c "C:\BuildTools\Common7\Tools\VsDevCmd.bat -host_arch=x64 -arch=x64 && set" |
        ForEach-Object {
          if ($_ -match "^(.*?)=(.*)$") {
            [System.Environment]::SetEnvironmentVariable($matches[1], $matches[2], "Process")
          }
        }
      $cargoBase = if ($env:CARGO_HOME) { $env:CARGO_HOME } else { "$env:USERPROFILE\.cargo" }
      $rustupBase = if ($env:RUSTUP_HOME) { $env:RUSTUP_HOME } else { "$env:USERPROFILE\.rustup" }
      if (Test-Path "$cargoBase\bin\cargo.exe") {
        $env:Path = "$cargoBase\bin;$env:Path"
      }
      if (Test-Path $rustupBase) {
        $env:RUSTUP_HOME = $rustupBase
      }
      if (Test-Path $cargoBase) {
        $env:CARGO_HOME = $cargoBase
      }
      rustup default stable | Out-Null
      cargo --version
  script:
    - |
      Set-Location "$env:CI_PROJECT_DIR\host\rust"
      cargo build --release -p wbeamd-server
      New-Item -ItemType Directory -Path "$env:CI_PROJECT_DIR\dist" -Force | Out-Null
      Copy-Item `
        "$env:CI_PROJECT_DIR\host\rust\target\release\wbeamd-server.exe" `
        "$env:CI_PROJECT_DIR\dist\wbeamd-server-$env:WBEAM_VERSION-windows-x86_64.exe" `
        -Force
      @(
        "WBEAM_VERSION=$env:WBEAM_VERSION"
        "CI_PIPELINE_ID=$env:CI_PIPELINE_ID"
        "CI_COMMIT_SHA=$env:CI_COMMIT_SHA"
        "CI_COMMIT_REF_NAME=$env:CI_COMMIT_REF_NAME"
      ) | Set-Content -Path "$env:CI_PROJECT_DIR\dist\VERSION.txt" -Encoding ascii
  artifacts:
    paths:
      - dist/*windows*.exe
      - dist/VERSION.txt
    expire_in: 14 days
  rules: *build_release_rules

publish_github_release:
  stage: publish
  image: alpine:3.21
  variables:
    GIT_STRATEGY: fetch
  script:
    - apk add --no-cache bash curl jq
    - ./scripts/ci/publish_github_release.sh
  rules: *build_release_rules

ff_release_to_master:
  stage: publish
  image: alpine:3.21
  variables:
    GIT_STRATEGY: fetch
  needs:
    - publish_github_release
  script:
    - apk add --no-cache git
    - git config user.name "wbeam-ci"
    - git config user.email "ci@wbeam.local"
    - |
      if [ -n "${CI_SERVER_TLS_CA_FILE:-}" ] && [ -f "${CI_SERVER_TLS_CA_FILE}" ]; then
        git config --global http.sslCAInfo "${CI_SERVER_TLS_CA_FILE}"
      fi
    - |
      PUSH_TOKEN="${GITLAB_PUSH_TOKEN:-${GITLAB_TOKEN:-}}"
      if [ -n "${PUSH_TOKEN}" ]; then
        git remote set-url origin "https://oauth2:${PUSH_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git"
      fi
    - git fetch origin master release
    - git checkout -B master origin/master
    - git merge --ff-only origin/release
    - |
      if ! git push origin master; then
        echo "[ff_release_to_master] Push rejected (likely protected branch / missing rights)."
        echo "[ff_release_to_master] Set CI variable GITLAB_PUSH_TOKEN (or GITLAB_TOKEN) with push rights to enable auto-ff."
      fi
  allow_failure: true
  rules:
    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "release"'