.gitlab-ci.yml

stages:
  - bots
  - lint
  - checks
  - build
  - test
  - e2e
variables:
  DOCKER_HOST: tcp://docker:2375
  DOCKER_BASE_IMAGE: $CI_REGISTRY_GO/haproxy-debian
  BATS_VERSION: v1.10.0
  GO_VERSION: "1.26"
  DOCKER_VERSION: "29.1"
  JUNIT_FILE: "junit-report.xml"

pipelines-check:
  stage: bots
  needs: []
  image:
    name: $CI_REGISTRY_GO/golang:latest-alpine
    entrypoint: [""]
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  tags:
    - go
  script:
    - go run cmd/gitlab-mr-pipelines/main.go
  after_script:
    - |
      if [ "$CI_JOB_STATUS" == "success" ]; then
        junit-report add --status=ok --message="pipelines check passed"
      else
        junit-report add --status=failed --message="pipelines check failed"
      fi
  artifacts:
    when: on_failure
    paths:
      - junit-report.xml
    reports:
      junit: junit-report.xml
mr-backport-question:
  stage: bots
  needs: []
  image:
    name: $CI_REGISTRY_GO/golang:latest-alpine
    entrypoint: [ "" ]
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event' && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH
  tags:
    - go
  script:
    - go run cmd/gitlab-mr-checker/main.go
  after_script:
    - |
      if [ "$CI_JOB_STATUS" == "success" ]; then
        junit-report add --status=ok --message="backport check passed"
      else
        junit-report add --status=failed --message="backport check failed"
      fi
  artifacts:
    when: on_failure
    paths:
      - junit-report.xml
    reports:
      junit: junit-report.xml
diff:
  stage: lint
  needs: [pipelines-check]
  image:
    name: $CI_REGISTRY_GO/docker:$DOCKER_VERSION-go$GO_VERSION
    entrypoint: [""]
  services:
    - name: $CI_REGISTRY_GO/docker:$DOCKER_VERSION-dind
      alias: docker
  tags:
    - go
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_PIPELINE_SOURCE == 'push'
  script:
    #- apk add make curl bash jq
    - SWAGGER_VERSION=$(curl -s https://raw.githubusercontent.com/haproxytech/client-native/master/Makefile | grep SWAGGER_VERSION -m 1 | awk -F"=" '{print $2}')
    - wget -q "https://github.com/go-swagger/go-swagger/releases/download/${SWAGGER_VERSION}/swagger_linux_amd64" -O /usr/local/bin/swagger && chmod +x /usr/local/bin/swagger
    - make generate-native
    - test -z "$(git diff 2> /dev/null)" || exit "Specification is not generated, issue \`make generate\` and commit the result"
    - test -z "$(git ls-files --others --exclude-standard 2> /dev/null)" || exit "Specification generation created untracked files, cannot proceed"
diff-spec-parent:
  stage: lint
  needs: [pipelines-check]
  image:
    name: $CI_REGISTRY_GO/golang:latest-alpine
    entrypoint: [""]
  tags:
    - go
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_PIPELINE_SOURCE == 'push'
  script:
    - make generate-parent-aliases
    - test -z "$(git diff 2> /dev/null)" || exit "Parent aliases are not generated, issue \`make generate-parent-aliases\` and commit the result"
    - test -z "$(git ls-files --others --exclude-standard 2> /dev/null)" || exit "Parent aliases created untracked files, cannot proceed"
  after_script:
    - |
      if [ "$CI_JOB_STATUS" == "success" ]; then
        junit-report add --status=ok --message="parent aliases diff is clean"
      else
        junit-report add --status=failed --message="parent aliases not generated" --description="$(git diff)"
      fi
  artifacts:
    when: on_failure
    paths:
      - junit-report.xml
    reports:
      junit: junit-report.xml
golangci-lint:
  stage: lint
  needs: [pipelines-check]
  image:
    name: $CI_REGISTRY_GO/golang:latest-alpine
    entrypoint: [""]
  tags:
    - go
  script:
    - make lint
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_PIPELINE_SOURCE == 'push'
  after_script:
    - |
      if [ "$CI_JOB_STATUS" == "success" ]; then
        junit-report add --status=ok --message="linting passed successfully"
      else
        junit-report add --status=failed --message="linting failed"
      fi
  artifacts:
    when: on_failure
    paths:
      - build
      - junit-report.xml
    reports:
      junit: junit-report.xml
gofumpt:
  stage: lint
  needs: [pipelines-check]
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_PIPELINE_SOURCE == 'push'
  image:
    name: $CI_REGISTRY_GO/golang:latest-alpine
    entrypoint: [""]
  tags:
    - go
  script:
    - make gofumpt
    - test -z "$(git diff 2> /dev/null)" || exit 'Go code not formatted, issue \`make gofumpt\` and commit the result'
  after_script:
    - |
      if [ "$CI_JOB_STATUS" == "success" ]; then
        junit-report add --status=ok --message="format check passed successfully"
      else
        junit-report add --status=failed --message="go code not formatted" --description="$(git diff)"
      fi
  artifacts:
    when: on_failure
    paths:
      - junit-report.xml
    reports:
      junit: junit-report.xml
commit-policy:
  stage: lint
  needs: [pipelines-check]
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  image:
    name: $CI_REGISTRY_GO/commit-check:latest
    entrypoint: [""]
  tags:
    - go
  script:
    - /check
  artifacts:
    when: on_failure
    paths:
      - junit-report.xml
    reports:
      junit: junit-report.xml
check-dependencies:
  stage: lint
  allow_failure: true
  needs: [pipelines-check]
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  image:
    name: $CI_REGISTRY_GO/golang:latest-alpine
    entrypoint: [""]
  tags:
    - go
  script:
    - |
      git fetch origin ${CI_MERGE_REQUEST_TARGET_BRANCH_NAME}
      # skip check if all go.mod changes are from Gopher Bot
      BOT_COMMITS=$(git log --author="noreply-gopher@haproxy.com" --format='%H' origin/${CI_MERGE_REQUEST_TARGET_BRANCH_NAME}..HEAD -- go.mod || true)
      ALL_COMMITS=$(git log --format='%H' origin/${CI_MERGE_REQUEST_TARGET_BRANCH_NAME}..HEAD -- go.mod || true)
      if [ -n "$ALL_COMMITS" ] && [ "$BOT_COMMITS" = "$ALL_COMMITS" ]; then
        echo "All go.mod changes are from Gopher Bot, skipping."
        junit-report add --status=ok --file="go.mod" --message="go.mod changes from Gopher Bot, skipped" --description="go.mod dependency check skipped"
        exit 0
      fi
      NEW_DEPS=$(git diff origin/${CI_MERGE_REQUEST_TARGET_BRANCH_NAME}...HEAD -- go.mod \
        | grep -E '^\+\s' \
        | grep -v '^\+\+\+' \
        | grep -v '^\+\s*\/\/' \
        || true)
      if [ -n "$NEW_DEPS" ]; then
        echo "New dependencies detected in go.mod:"
        echo "$NEW_DEPS"
        junit-report add --status=failed --file="go.mod" --message="new dependencies added to go.mod" --description="$(printf "The following dependencies were added:\n\n%s" "$NEW_DEPS")"
        exit 1
      else
        echo "No new dependencies added to go.mod."
        junit-report add --status=ok --file="go.mod" --message="no new dependencies added to go.mod" --description="go.mod dependency check passed"
      fi
  artifacts:
    when: on_failure
    paths:
      - junit-report.xml
    reports:
      junit: junit-report.xml
check-committer:
  stage: lint
  allow_failure: true
  needs: [pipelines-check]
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  image:
    name: $CI_REGISTRY_GO/golang:latest-alpine
    entrypoint: [ "" ]
  tags:
    - go
  script:
    - |
      git fetch origin ${CI_MERGE_REQUEST_TARGET_BRANCH_NAME}
      BAD_EMAILS=""
      for COMMIT in $(git log --format='%H' origin/${CI_MERGE_REQUEST_TARGET_BRANCH_NAME}..HEAD); do
        EMAIL=$(git log -1 --format='%ae' "$COMMIT")
        MSG=$(git log -1 --format='%s' "$COMMIT")
        case "$EMAIL" in
          *@haproxy.com) ;;
          *)
            SHORT=$(echo "$COMMIT" | cut -c1-8)
            BAD_EMAILS="${BAD_EMAILS}${SHORT} ${MSG} (${EMAIL})\n"
            junit-report add --status=failed --file="$EMAIL" --message="$EMAIL: $MSG" --description="$(printf "committer email not @haproxy.com\n\n%s\n%s" "$MSG" "$EMAIL")"
            ;;
        esac
      done
      CO_AUTHORED=""
      ASSISTED=""
      SIGNED_OFF=""
      for COMMIT in $(git log --format='%H' origin/${CI_MERGE_REQUEST_TARGET_BRANCH_NAME}..HEAD); do
        BODY=$(git log -1 --format='%b' "$COMMIT")
        MSG=$(git log -1 --format='%s' "$COMMIT")
        MATCHED=$(echo "$BODY" | grep -i 'Co-authored-by' || true)
        if [ -n "$MATCHED" ]; then
          SHORT=$(echo "$COMMIT" | cut -c1-8)
          CO_AUTHORED="${CO_AUTHORED}${SHORT} ${MSG}\n$(echo "$MATCHED" | sed 's/^/  /')\n"
          junit-report add --status=failed --file="co-authored-by" --message="$MSG" --description="$(printf "commit contains Co-authored-by trailer\n\n%s\n%s" "$MSG" "$MATCHED")"
        fi
        MATCHED=$(echo "$BODY" | grep -i 'Assisted-by' || true)
        if [ -n "$MATCHED" ]; then
          SHORT=$(echo "$COMMIT" | cut -c1-8)
          ASSISTED="${ASSISTED}${SHORT} ${MSG}\n$(echo "$MATCHED" | sed 's/^/  /')\n"
          junit-report add --status=failed --file="assisted-by" --message="$MSG" --description="$(printf "commit contains Assisted-by trailer\n\n%s\n%s" "$MSG" "$MATCHED")"
        fi
        MATCHED=$(echo "$BODY" | grep -i 'Signed-off-by' || true)
        if [ -n "$MATCHED" ]; then
          SHORT=$(echo "$COMMIT" | cut -c1-8)
          SIGNED_OFF="${SIGNED_OFF}${SHORT} ${MSG}\n$(echo "$MATCHED" | sed 's/^/  /')\n"
          junit-report add --status=failed --file="signed-off-by" --message="$MSG" --description="$(printf "commit contains Signed-off-by trailer\n\n%s\n%s" "$MSG" "$MATCHED")"
        fi
      done
      FAILED=""
      if [ -n "$BAD_EMAILS" ]; then
        echo "The following committer emails are not @haproxy.com:"
        printf "$BAD_EMAILS"
        FAILED=1
      else
        echo "All committer emails end with @haproxy.com."
        junit-report add --status=ok --file=committer-email --description="all emails valid" --message="All committer emails end with @haproxy.com."
      fi
      if [ -n "$CO_AUTHORED" ]; then
        echo "The following commits contain Co-authored-by:"
        printf "$CO_AUTHORED"
        FAILED=1
      else
        echo "No commits contain Co-authored-by."
        junit-report add --status=ok --file=co-authored-by --description="no co-authored-by found" --message="No commits contain Co-authored-by."
      fi
      if [ -n "$ASSISTED" ]; then
        echo "The following commits contain Assisted-by:"
        printf "$ASSISTED"
        FAILED=1
      else
        echo "No commits contain Assisted-by."
        junit-report add --status=ok --file=assisted-by --description="no assisted-by found" --message="No commits contain Assisted-by."
      fi
      if [ -n "$SIGNED_OFF" ]; then
        echo "The following commits contain Signed-off-by:"
        printf "$SIGNED_OFF"
        FAILED=1
      else
        echo "No commits contain Signed-off-by."
        junit-report add --status=ok --file=signed-off-by --description="no signed-off-by found" --message="No commits contain Signed-off-by."
      fi
      if [ -n "$FAILED" ]; then
        exit 1
      fi
  artifacts:
    when: on_failure
    paths:
      - junit-report.xml
    reports:
      junit: junit-report.xml
build:
  stage: build
  needs: []
  image:
    name: $CI_REGISTRY_GO/golang:latest-alpine
    entrypoint: [""]
  tags:
    - go
  script:
    - go env
    - go mod verify
    - make build
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_PIPELINE_SOURCE == 'push'
  after_script:
    - |
      if [ "$CI_JOB_STATUS" == "success" ]; then
        junit-report add --status=ok --message="build passed successfully"
      else
        junit-report add --status=failed --message="build failed"
      fi
  artifacts:
    paths:
      - build
    reports:
      junit: junit-report.xml

test:
  stage: test
  needs: [pipelines-check]
  image:
    name: $CI_REGISTRY_GO/golang:latest-alpine
    entrypoint: [ "" ]
  tags:
    - go
  before_script:
    - go env -w "GONOSUMDB=gitlab.int.haproxy.com/*" "GOPROXY=http://goproxy.int.haproxy.com"
  script:
    - go test ./...
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: "$CI_PROJECT_NAMESPACE == 'haproxy-controller' && $CI_PIPELINE_SOURCE == 'push'"
  after_script:
    - |
      if [ "$CI_JOB_STATUS" == "success" ]; then
        junit-report add --status=ok --message="tests passed successfully"
      else
        junit-report add --status=failed --message="tests failed"
      fi
  artifacts:
    when: on_failure
    paths:
      - junit-report.xml
    reports:
      junit: junit-report.xml

.e2e:
  stage: e2e
  needs: [pipelines-check, build]
  artifacts:
    paths:
      - build
      - e2e/logs/*
    when: on_failure
  image:
    name: $CI_REGISTRY_GO/docker:$DOCKER_VERSION
    entrypoint: [""]
  services:
    - name: $CI_REGISTRY_GO/docker:$DOCKER_VERSION-dind
      alias: docker
  variables:
    LOCAL_IP_ADDRESS: docker
  tags:
    - go
  before_script:
    - apk add git bash curl jq git
    - git clone https://github.com/bats-core/bats-core.git && cd bats-core && git checkout $BATS_VERSION && ./install.sh /usr/local && cd ..
    - docker login -u='$app' -p $CI_REGISTRY_TOKEN $CI_REGISTRY_GO
  script:
    - bash -x ./e2e/run.bash
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_PIPELINE_SOURCE == 'push'

govulncheck:
  stage: checks
  needs: []
  image:
    name: $CI_REGISTRY_GO/golang:latest-alpine
    entrypoint: [ "" ]
  rules:
    - if: $CI_PIPELINE_SOURCE == 'schedule' && $SCHEDULE_TYPE == 'daily'
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      changes:
        - go.mod
    - if: "$CI_PROJECT_NAMESPACE == 'haproxy-controller' && $CI_PIPELINE_SOURCE == 'push'"
      changes:
        - go.mod
  tags:
    - go
  script:
    - go install golang.org/x/vuln/cmd/govulncheck@latest
    - govulncheck -version
    - go mod tidy
    - go run cmd/govulncheck-report/main.go
  after_script:
    - |
      if [ "$CI_JOB_STATUS" == "success" ]; then
        junit-report add --status=ok --message="govulncheck passed"
      else
        junit-report add --status=failed --message="govulncheck found vulnerabilities"
      fi
  artifacts:
    when: on_failure
    paths:
      - junit-report.xml
    reports:
      junit: junit-report.xml

HAProxy_3.4:
  extends: .e2e
  parallel:
    matrix:
      - TESTPART: ["1/4", "2/4", "3/4", "4/4"]
        HAPROXY_VERSION: "3.4"