.gitlab-ci.yml

# pattern: jobs are generally named according to '{emoji} {function}:{object}[:{category}]'
# pattern: jobs are generally ordered by execution stage; properties are ordered alphabetically
# ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
variables:
  POETRY_VIRTUALENVS_CREATE: "false"
  PYSPRY_BRANCH_TAG: $CI_COMMIT_REF_SLUG
  PYSPRY_IMAGE: $CI_REGISTRY_IMAGE/dev:$PYSPRY_TAG
  PYSPRY_TAG: $CI_COMMIT_SHORT_SHA

stages:
  - build
  - lint
  - test
  - docs
  - deploy

.dev image: &dev-image
  image: $PYSPRY_IMAGE

include:
  # ref https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Jobs/Container-Scanning.gitlab-ci.yml
  - template: Jobs/Container-Scanning.gitlab-ci.yml
  # ref https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Jobs/Dependency-Scanning.gitlab-ci.yml
  - template: Jobs/Dependency-Scanning.gitlab-ci.yml
  # ref https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Jobs/SAST.gitlab-ci.yml
  - template: Jobs/SAST.gitlab-ci.yml
  - local: .gitlab/docker-build.yml
    inputs:
      docker-version: "24"
      platforms: '["linux/amd64", "linux/arm64"]'
      service: dev

  - file: build.yml
    inputs: *dev-image
    project: poetry-tools/ci-cd
    ref: main

  - file: check.yml
    inputs: *dev-image
    project: poetry-tools/ci-cd
    ref: main

  - file: poethepoet.yml
    inputs:
      <<: *dev-image
      poetry-install: "false"
      before-script: |-
        pre-commit install --install-hooks || {
          rm -rf $PRE_COMMIT_HOME
          pre-commit install --install-hooks
        }
      stage: lint
      task: lint
    project: poetry-tools/ci-cd
    ref: main

  - file: poethepoet.yml
    inputs:
      <<: *dev-image
      POETRY_VIRTUALENVS_CREATE: "false"
      before-script: poetry install --only-root
      poetry-install: "false"
      stage: test
      task: test
    project: poetry-tools/ci-cd
    ref: main

  - file: poethepoet.yml
    inputs:
      <<: *dev-image
      POETRY_VIRTUALENVS_CREATE: "false"
      poetry-install: "false"
      stage: docs
      task: build-docs
    project: poetry-tools/ci-cd
    ref: main

  - file: publish.yml
    inputs: *dev-image
    project: poetry-tools/ci-cd
    ref: main

  - file: publish.yml
    inputs:
      <<: *dev-image
      env-tier: testing
      env-url: https://test.pypi.org/project/$CI_PROJECT_NAME/
      pypi-name: testpypi
      pypi-password: $TESTPYPI_PASSWORD
      pypi-url: https://test.pypi.org/legacy/
      pypi-username: $TESTPYPI_USERNAME
    project: poetry-tools/ci-cd
    ref: main

  - file: publish.yml
    inputs:
      <<: *dev-image
      env-tier: production
      env-url: https://pypi.org/project/$CI_PROJECT_NAME/
      pypi-name: pypi
      pypi-password: $PYPI_PASSWORD
      pypi-url: https://upload.pypi.org/legacy/
      pypi-username: $PYPI_USERNAME
    project: poetry-tools/ci-cd
    ref: main

semgrep-sast:
  needs: []

container_scanning:
  needs: [🏗 docker buildx bake]
  variables:
    GIT_STRATEGY: fetch

gemnasium-python-dependency_scanning:
  needs: [🏗 docker buildx bake]

🏗️ poetry build: &needs_docker-buildx-bake
  needs: [🏗 docker buildx bake]

✔️ poetry check: *needs_docker-buildx-bake

🪶 poe lint:
  <<: *needs_docker-buildx-bake

  artifacts:
    paths: [docs]
    reports:
      codequality: [docs/reports/pylint-gitlab.json]
    untracked: true
    when: always

🪶 poe test:
  <<: *needs_docker-buildx-bake

  artifacts:
    paths: [docs]
    reports:
      coverage_report:
        coverage_format: cobertura
        path: docs/reports/coverage.xml
      junit: [docs/reports/pytest.xml]
    untracked: true
    when: always
  coverage: '/Total coverage.*\s+(\d+(?:\.\d+)?)%/'

🪶 poe build-docs:
  artifacts:
    untracked: true
    when: on_success
  needs:
    - job: 🪶 poe lint
      artifacts: true
    - job: 🪶 poe test
      artifacts: true
  variables:
    GIT_DEPTH: "0"
    GIT_STRATEGY: "clone"

🌐 poetry publish gitlab:
  needs: &poetry-publish-needs
    - ✔️ poetry check
    - job: 🏗️ poetry build
      artifacts: true
    - 🪶 poe lint
    - 🪶 poe test
  rules:
    - if: $CI_COMMIT_REF_PROTECTED == "true"

pages:
  artifacts:
    paths: [public]
  needs:
    - 🌐 poetry publish gitlab
    - job: 🪶 poe build-docs
      artifacts: true
  rules: [if: $CI_COMMIT_REF_PROTECTED == "true"]
  script: mv ./docs ./public
  stage: deploy

🌐 poetry publish testpypi:
  needs: *poetry-publish-needs
  rules: &only-protected-tags
    - if: $CI_COMMIT_REF_PROTECTED == "true" && $CI_COMMIT_TAG

🌐 poetry publish pypi:
  needs: [🌐 poetry publish testpypi]
  rules: *only-protected-tags