.gitlab-ci.yml

stages:
  - prepare
  - qa
  - build
  - docker
  - deploy

variables:
  MYSQL_ROOT_PASSWORD: "rootpassword"
  MYSQL_USER: ssorder
  MYSQL_PASSWORD: ssorderpassword
  MYSQL_DATABASE: ssorder
  PHP_EXTENSIONS: bcmath xdebug

api_pipeline:
  stage: qa
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
    - changes:
        - api/*
  trigger:
    include:
      - local: api/.gitlab-ci.yml
    strategy: depend

commit-message:
  stage: prepare
  image: morawskim/pipeline-scripts
  script:
    - /pipeline/scripts/check-commit-title.rb $CI_COMMIT_TITLE

branch-name:
  stage: prepare
  image: morawskim/pipeline-scripts
  script:
    - /pipeline/scripts/check-branch-name.rb $CI_COMMIT_REF_NAME
  only:
    - branches
  except:
    refs:
      - /^dependabot\/.*$/

version:
  stage: prepare
  image: morawskim/pipeline-scripts
  script:
    - |
      BRANCH_NAME=$CI_COMMIT_REF_NAME
      if echo $BRANCH_NAME | grep -E '^dependabot\/.*$' ; then
        BRANCH_NAME=develop
      fi
      VERSION=$(/pipeline/scripts/get-version.rb $CI_PROJECT_DIR/.git $BRANCH_NAME $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME)
      echo "VERSION=$VERSION" | tee VERSION
      echo "COMMIT=$CI_COMMIT_SHA" | tee -a VERSION
      echo "PIPELINE=$CI_PIPELINE_ID" | tee -a VERSION
  only:
    - branches
    - merge_requests
  artifacts:
    paths:
      - VERSION
    expire_in: 30 days

composer:
  stage: prepare
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - php -v
    - composer config -g cache-dir "$CI_PROJECT_DIR/.composer-cache"
    - composer install --prefer-dist --no-ansi --no-interaction --no-progress --no-scripts
    - cd vendor && cp -r bower-asset bower
  artifacts:
    paths:
      - vendor/
    expire_in: 30 days
    when: on_success
  cache:
    key: "$CI_COMMIT_REF_SLUG"
    paths:
      - .composer-cache

yarn:
  stage: prepare
  image: edbizarro/gitlab-ci-pipeline-php:7.3
  script:
    - yarn -v
    - cd frontend && yarn install --frozen-lock-file
  artifacts:
    paths:
      - frontend/node_modules/
    expire_in: 5 days
    when: on_success
  cache:
    key: "$CI_COMMIT_REF_SLUG"
    paths:
      - /home/php/.cache/yarn/v1

diff-composer-packages:
  stage: prepare
  image: morawskim/pipeline-scripts
  script:
    - /pipeline/scripts/prev-file-content.rb $CI_PROJECT_DIR/.git composer.lock > /tmp/composer.lock.old || (test $? -eq 101 && exit 0)
    - /pipeline/scripts/diff-composer.rb /tmp/composer.lock.old > /tmp/composer.old.diff
    - /pipeline/scripts/diff-composer.rb composer.lock > /tmp/composer.diff
    - cat /tmp/composer.old.diff
    - cat /tmp/composer.diff
    - diff -u /tmp/composer.old.diff /tmp/composer.diff || test $? -eq 1
  only:
    changes:
      - composer.lock

codestyle:
  stage: qa
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - composer run phpcs | tee phpcs-report.xml
  dependencies:
    - composer
  artifacts:
    when: on_failure
    reports:
      junit: phpcs-report.xml

composer-normalizer:
  stage: qa
  image: jakzal/phpqa:alpine
  script:
    - composer normalize --dry-run
  dependencies: []

phpmd:
  stage: qa
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - composer run phpmd
  dependencies:
    - composer

phploc:
  stage: qa
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - composer run phploc
  dependencies:
    - composer

phpcpd:
  stage: qa
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - composer run phpcpd
  dependencies:
    - composer

php-lint:
  stage: qa
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - composer run phplint
  dependencies:
    - composer

phpstan:
  stage: qa
  image: jakzal/phpqa:alpine
  script:
    - phpstan analyse --no-progress --no-interaction ./frontend ./common ./console
  dependencies:
    - composer

phpdd:
  stage: qa
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - composer run phpdd
  dependencies:
    - composer

openapi:
  stage: qa
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - composer run openapi
  dependencies:
    - composer
  artifacts:
    paths:
      - docs/openapi.yml
    expire_in: 30 days
    when: on_success

sonarcloud:
  stage: qa
  image:
    name: sonarsource/sonar-scanner-cli
    entrypoint: [""]
  variables:
    SONAR_TOKEN: '$SONAR_PROJECT_TOKEN'
    SONAR_HOST_URL: "https://sonarcloud.io"
    SONAR_PROJECT_BASE_DIR: '$CI_PROJECT_DIR'
    GIT_DEPTH: 0
  script:
    - sonar-scanner -Dsonar.qualitygate.wait=true -Dsonar.organization=morawskim -Dsonar.projectKey=ssorder
  allow_failure: true
  only:
    - merge_requests
    - master

assets:
  stage: build
  image: thecodingmachine/php:8.1-v4-cli-node14
  script:
    - ln -s config-prod.js frontend/webpack/config.js
    - cd frontend && yarn build
    - yarn pwa:build
    - npx webpack-bundle-analyzer $CI_PROJECT_DIR/frontend/webpack/stats.json $CI_PROJECT_DIR/frontend/web/assets/build/ --no-open --mode static --report $CI_PROJECT_DIR/docs/webpack-bundle-analyzer.html
    - find web/assets/build -iname '*.css' -exec npx doiuse -b '>1%, not dead, not ie>0, not ie_mob>0, not op_mini all' {} \;
  dependencies:
    - yarn
  artifacts:
    paths:
      - frontend/web/assets/build
      - frontend/web/assets/pwa
      - frontend/web/sw.js
      - frontend/webpack/stats.json
      - docs/webpack-bundle-analyzer.html
    expire_in: 30 days
    when: on_success

redoc:
  stage: build
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - composer run redoc
  dependencies:
    - openapi
  artifacts:
    paths:
      - docs/redoc/
    expire_in: 30 days
    when: on_success

swagger:
  stage: build
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - cp -rv ./vendor/swagger-api/swagger-ui/dist ./docs/swagger
    - cp docs/openapi.yml ./docs/swagger
    - sed -i -e's#https://petstore.swagger.io/v2/swagger.json#openapi.yml#' docs/swagger/index.html
  dependencies:
    - composer
    - openapi
  artifacts:
    paths:
      - docs/swagger/
    expire_in: 30 days
    when: on_success

pretier:
  stage: qa
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - cd frontend && yarn run prettier
  dependencies:
    - yarn

stylelint:
  stage: qa
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - cd frontend && yarn run stylelint
  dependencies:
    - yarn

eslint:
  stage: qa
  image: thecodingmachine/php:8.1-v4-cli-node16
  script:
    - cd frontend && yarn run eslint
  dependencies:
    - yarn

hadolint:
  stage: qa
  image: hadolint/hadolint:v1.16.3-debian
  script:
    - find -iname 'Dockerfile*' | xargs --max-lines=1 hadolint
  dependencies: []
  only:
    changes:
      - frontend/Dockerfile
      - node-cron/Dockerfile
      - docs/Dockerfile

cve_dependencies_php:
  stage: qa
  image: registry.gitlab.com/savadenn-public/runners/local-php-security-checker:latest
  script:
    - local-php-security-checker -update-cache
    - local-php-security-checker
  allow_failure: true
  dependencies: []

npm-audit:
  stage: qa
  image: node:8.9-alpine
  script:
    - npm install -g yarn
    - cd frontend && yarn run audit-ci
  allow_failure: true
  dependencies:
    - yarn

codeception:
  stage: qa
  image: thecodingmachine/php:8.1-v4-cli-node16
  services:
    - mysql:5.6
  script:
    - cp .env.ci .env
    - ./yii migrate/up --interactive 0
    - composer run codecept-common
    - composer run codecept-frontend
  dependencies:
    - composer
  artifacts:
    paths:
      - docs/codecept-frontend/
      - docs/codecept-common/
    expire_in: 30 days
    when: on_success

sitespeed:
  stage: qa
  variables:
    URL: https://order.snlb.pl
    SITESPEED_VERSION: 11.9.3
  before_script:
    - TMPFILE=$(mktemp /tmp/sistespeed.XXXXXX)
    - CSRF=$(curl -s --cookie-jar $TMPFILE $URL/site/login | grep 'meta name="csrf-token"'| grep -E -o 'content="(.*?)"' | cut -c10- | rev | cut -c2- | rev)
    - curl -H X-CSRF-Token:${CSRF} --cookie-jar $TMPFILE --cookie $TMPFILE -X POST -d"LoginForm%5Busername%5D=sitespeed&LoginForm%5Bpassword%5D=${SISTESPEED_PASSWORD}&LoginForm%5BrememberMe%5D=0&LoginForm%5BrememberMe%5D=1&login-button="  $URL/site/login
    - SESSION=$(cat  $TMPFILE | grep advanced-frontend | awk '{print $7}')
    - SITESPEED_OPTIONS="--cookie advanced-frontend=${SESSION}"
    - rm $TMPFILE
  script:
    - echo Use sitespeed at version "$SITESPEED_VERSION" with options "$SITESPEED_OPTIONS" and check url "$URL"
    - mkdir gitlab-exporter
    - wget -O ./gitlab-exporter/index.js https://gitlab.com/gitlab-org/gl-performance/raw/master/index.js
    - mkdir docs/sitespeed
    - docker run --shm-size=1g --rm -v "$(pwd)":/sitespeed.io sitespeedio/sitespeed.io:$SITESPEED_VERSION --plugins.add ./gitlab-exporter --outputFolder docs/sitespeed $URL $SITESPEED_OPTIONS
  artifacts:
    paths:
      - docs/sitespeed/
    reports:
      performance: docs/sitespeed/data/performance.json
  only:
    - schedules
  tags:
    - packer

.newman:
  stage: qa
  image:
    name: postman/newman:alpine
    entrypoint: [""]
  script:
    - npm install -g newman-reporter-html
    - echo "$DEV_CONFIG" > .env
    - source .env
    - >
      for dir in integration-tests/tests/*/; do
        newman run --env-var "rocketChatToken=${ROCKET_CHAT_BOT_TOKEN}" --env-var "userName=${POSTMAN_USERNAME}" --env-var "password=${POSTMAN_PASSWORD}" --globals integration-tests/globals.json --environment integration-tests/environments/develop.postman_environment.json --iteration-data ${dir}/data.csv  --reporters cli,html --reporter-html-export docs/newman/$(basename ${dir}).html ${dir}/ssorder.postman_collection.json
      done
  artifacts:
    paths:
      - docs/newman/
    when: always
  only:
    - schedules

.cypress:
  image: cypress/browsers:node14.7.0-chrome84
  stage: qa
  script:
    - pushd frontend/e2e
    - npm ci
    - $(npm bin)/cypress verify
    - $(npm bin)/cypress run --headless --browser chrome --env "configFile=ssorder-develop,ROCKET_CHAT_BOT_TOKEN=${ROCKET_CHAT_BOT_TOKEN}"
  after_script:
    - mkdir -p docs/cypress/ frontend/e2e/cypress/{screenshots,videos}
    - mv frontend/e2e/cypress/screenshots docs/cypress/
    - mv frontend/e2e/cypress/videos docs/cypress/
  artifacts:
    expire_in: 1 week
    when: always
    paths:
      - docs/cypress/
  variables:
    npm_config_cache: "$CI_PROJECT_DIR/.npm"
    CYPRESS_CACHE_FOLDER: "$CI_PROJECT_DIR/cache/Cypress"
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - .npm
      - cache/Cypress
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'

.docker:
  stage: docker
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  dependencies:
    - composer
    - assets
    - version
  before_script:
    - source $CI_PROJECT_DIR/VERSION
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json
    - echo "" > $CI_PROJECT_DIR/.env

docker:node:
  extends: .docker
  script:
      - /kaniko/executor --context $CI_PROJECT_DIR/node-cron --dockerfile $CI_PROJECT_DIR/node-cron/Dockerfile --destination ${CI_REGISTRY}/${CI_PROJECT_PATH}/scheduler:latest
  rules:
    - if: $CI_COMMIT_BRANCH == "develop"
      changes:
        - "node-cron/*"
        - .gitlab-ci.yml
    - if: $CI_PIPELINE_SOURCE == "push"
      when: manual
      allow_failure: true

docker:develop:
  extends: .docker
  script:
    - >
      [[ "$CI_COMMIT_BRANCH" -eq "develop" ]] && IMAGE_TAG=latest || IMAGE_TAG=`echo $CI_COMMIT_BRANCH  | tr ' /_' '-' | tr -cd 'a-zA-Z0-9-' | tr -s '-' `
    - echo "IMAGE_TAG - $IMAGE_TAG (CI_COMMIT_BRANCH - $CI_COMMIT_BRANCH)"
    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/frontend/Dockerfile --destination $CI_REGISTRY_IMAGE:$IMAGE_TAG
  rules:
    - if: $CI_COMMIT_BRANCH == "develop"
    - if: $CI_PIPELINE_SOURCE == "push"
      when: manual
      allow_failure: true

docker:master:
  extends: .docker
  script:
    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/frontend/Dockerfile --destination $CI_REGISTRY_IMAGE:stable --destination $CI_REGISTRY_IMAGE:$VERSION
  rules:
    - if: $CI_COMMIT_BRANCH == "master"

docker:rc:
  extends: .docker
  script:
    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/frontend/Dockerfile --destination $CI_REGISTRY_IMAGE:$VERSION
  rules:
    - if: $CI_COMMIT_BRANCH =~ /^release-/

docker:docs:
  stage: docker
  variables:
    UPSTREAM_PIPELINE: $CI_PIPELINE_ID
  trigger:
    include:
      - local: docs/.gitlab-ci.yml
    strategy: depend
  only:
    - schedules

.trivy:
  stage: qa
  allow_failure: true
  before_script:
    - echo CACHE_DIR - $CACHE_DIR
    - trivy --version
    - trivy --clear-cache --cache-dir $CACHE_DIR
  dependencies: []
  variables:
    TRIVY_AUTH_URL: $CI_REGISTRY
    TRIVY_USERNAME: $CI_REGISTRY_USER
    TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD
    CACHE_DIR: $CI_PROJECT_DIR/.trivycache/
  only:
    - schedules
  tags:
    - packer

trivy:develop:
  extends: .trivy
  script:
    - trivy --debug --timeout=2m --exit-code 1 --cache-dir $CACHE_DIR --severity CRITICAL $CI_REGISTRY_IMAGE:latest

tag_release:
  stage: deploy
  image: edbizarro/gitlab-ci-pipeline-php:7.2
  only:
    - master
  except:
    - tags
    - api
    - external
    - pipelines
    - schedules
    - triggers
    - web
    - merge_requests
    - chats
  before_script:
    - 'which ssh-agent || ( apt-get update -y && apt-get install openssh-client -y )'
    - eval $(ssh-agent -s)
    - ssh-add <(echo "$SSH_PRIVATE_KEY_FOR_TAGGING")
    - mkdir -p ~/.ssh
    - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'
  script:
    - source ./VERSION
    - echo "GITLAB_USER $GITLAB_USER_NAME GITLAB_EMAIL $GITLAB_USER_EMAIL VERSION $VERSION"
    - git --version
    - git config --add user.name "${GITLAB_USER_NAME}"
    - git config --add user.email "${GITLAB_USER_EMAIL}"
    - git remote set-url --push origin ssh://git@gitlab.com/morawskim/ssorder.git
    - git remote -v
    - git tag -a $VERSION -m "Releasing version v${VERSION} (by gitlab-ci)"
    - git push -o ci.skip origin --tags
  dependencies:
    - version
  variables:
    GIT_STRATEGY: clone