.gitlab-ci.yml

include:
  - template: Code-Quality.gitlab-ci.yml
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml
  - component: ${CI_SERVER_FQDN}/gitlab-org/components/danger-review/danger-review@2.1.0
  - component: ${CI_SERVER_FQDN}/components/code-intelligence/golang-code-intel@v0.1.2
    inputs:
      golang_version: ${GO_VERSION}
      stage: post-test

stages:
  - prepare
  - lint
  - test
  - post-test

variables:
  FF_USE_FASTZIP: "true"
  TRANSFER_METER_FREQUENCY: "1s"
  GOPATH: $CI_PROJECT_DIR/.GOPATH
  DEBIAN_VERSION: "trixie"
  POLICY: pull
  CI_DEBUG_SERVICES: "true"
  DOCKER_VERSION: "20.10.15"
  GO_VERSION: "1.25"
  NILAWAY_VERSION: "v0.0.0-20260915140140-59aa42bdc591"
  UBI_VERSION: "9.6"
  GITLAB_ADVANCED_SAST_ENABLED: "true"
  IMAGE_TAG: "latest"
  DEFAULT_IMAGE: "registry.gitlab.com/gitlab-org/gitlab-build-images/debian-${DEBIAN_VERSION}-golang-${GO_VERSION}:${IMAGE_TAG}"
  FIPS_IMAGE_TAG: "latest"
  FIPS_IMAGE: "registry.gitlab.com/gitlab-org/gitlab-build-images/ubi-${UBI_VERSION}-golang-${GO_VERSION}:${FIPS_IMAGE_TAG}"
  GOTOOLCHAIN: local

workflow:
  rules: &workflow_rules # For merge requests, create a pipeline.
    - if: "$CI_MERGE_REQUEST_IID"
    # For `main` branch, create a pipeline (this includes on schedules, pushes, merges, etc.).
    - if: '$CI_COMMIT_BRANCH == "main"'
    # For tags, create a pipeline.
    - if: "$CI_COMMIT_TAG"

.rules:go-changes:
  rules:
    - changes: &go_change_paths
        - .gitlab-ci.yml
        - "go.mod"
        - "go.sum"
        - "**/*.go"

.rules:ssh-audit:
  rules:
    - changes: *go_change_paths
    - changes:
        - Makefile
        - "support/ssh-audit/**/*"

default:
  image: ${DEFAULT_IMAGE}
  tags:
    - gitlab-org

.use-docker-in-docker:
  image: docker:${DOCKER_VERSION}
  services:
    - docker:${DOCKER_VERSION}-dind
  tags:
    # See https://gitlab.com/gitlab-com/www-gitlab-com/-/issues/7019 for tag descriptions
    - gitlab-org-docker

.cached-go: &cached_go
  - key:
      prefix: "golang-${GO_VERSION}-cache"
      files:
        - go.mod
        - go.sum
    policy: $POLICY
    paths:
      - .GOPATH/pkg/mod/

.cached-go-job:
  variables:
    CACHE_COMPRESSION_LEVEL: "fastest"
  cache:
    - *cached_go

# The pinned ssh-audit download, cached so the ssh-audit jobs do not depend on
# github.com being reachable on every run. Keyed on the Makefile so bumping
# SSH_AUDIT_VERSION invalidates it.
.cached-ssh-audit: &cached_ssh_audit
  key:
    prefix: "ssh-audit"
    files:
      - Makefile
  paths:
    - support/bin/ssh-audit-*

.cached-job:
  cache:
    - *cached_go

.go-matrix-job:
  parallel:
    matrix:
      - GO_VERSION: ["1.25", "1.26", "1.27"]

################################################################################
# Prepare jobs
################################################################################

modules:download:
  stage: prepare
  extends:
    - .cached-go-job
    - .go-matrix-job
  variables:
    POLICY: pull-push
  script:
    - go mod download

################################################################################
# Test jobs
################################################################################

.test-job:
  needs: ["modules:download"]
  rules: !reference [".rules:go-changes", rules]
  variables:
    GITALY_CONNECTION_INFO: '{"address":"tcp://gitaly:8075", "storage":"default"}'
  before_script:
    # Set up the environment to run integration tests
    - make build
    - cp config.yml.example config.yml
    - go version
  services:
    - name: registry.gitlab.com/gitlab-org/build/cng/gitaly:master
      # Disable the hooks so we don't have to stub the GitLab API
      command:
        [
          "bash",
          "-c",
          "mkdir -p /home/git/repositories && rm -rf /srv/gitlab-shell/hooks/* && touch /srv/gitlab-shell/.gitlab_shell_secret && exec /usr/bin/env GITALY_TESTING_NO_GIT_HOOKS=1 /scripts/process-wrapper",
        ]
      alias: gitaly

tests:
  extends:
    - .cached-job
    - .go-matrix-job
    - .test-job
  script:
    - make verify test_fancy
  after_script:
    - make coverage
  coverage: '/\d+.\d+%/'
  artifacts:
    when: always
    paths:
      - cover.xml
    reports:
      junit: cover.xml

tests_without_cgo:
  extends:
    - .cached-job
    - .go-matrix-job
    - .test-job
  variables:
    CGO_ENABLED: 0
  script:
    - make verify test_fancy

tests:fips:
  image: ${FIPS_IMAGE}
  extends:
    - .cached-job
    - .test-job
  variables:
    FIPS_MODE: 1
    GOLANG_FIPS: 1
  script:
    - make test_fancy

race:
  extends:
    - .cached-go-job
    - .go-matrix-job
    - .test-job
  script:
    - make test_race

acceptance:
  stage: test
  extends:
    - .cached-go-job
    - .go-matrix-job
  needs: ["modules:download"]
  rules: !reference [".rules:go-changes", rules]
  script:
    - make acceptance-test

# Verify gitlab-sshd's negotiated SSH algorithms against a committed ssh-audit
# policy so a dependency bump that silently adds or drops a cipher, key exchange
# or MAC fails the pipeline. See support/ssh-audit/README.md.
.ssh-audit-base:
  stage: test
  extends:
    - .cached-go-job
  needs: ["modules:download"]
  rules: !reference [".rules:ssh-audit", rules]
  # Overriding cache replaces the list inherited from .cached-go-job, so
  # *cached_go must be listed again alongside the ssh-audit cache.
  cache:
    - *cached_go
    - *cached_ssh_audit
  script:
    - make ssh-audit-test

ssh-audit:
  extends: .ssh-audit-base

ssh-audit:fips:
  extends: .ssh-audit-base
  image: ${FIPS_IMAGE}
  variables:
    FIPS_MODE: 1
    GOLANG_FIPS: 1
    SSH_AUDIT_POLICY: support/ssh-audit/gitlab-sshd-fips.policy
    SSH_AUDIT_HOST_KEY_TYPES: "rsa ecdsa"
  before_script:
    # The FIPS UBI image ships neither ssh-keygen (from openssh) nor python3,
    # both of which the ssh-audit harness needs.
    - dnf install -y openssh python3

code_quality:
  stage: lint
  extends: .use-docker-in-docker
  rules: *workflow_rules

check_gitaly_version:
  stage: lint
  rules: *workflow_rules
  ## In case the job fails, mark the job as warning
  ## That way we don't block the pipeline but we warn the user
  allow_failure: true
  script:
    - chmod +x ./support/lint_gitaly_version.sh
    - ./support/lint_gitaly_version.sh

# SAST
semgrep-sast:
  stage: lint
  rules: *workflow_rules

gitlab-advanced-sast:
  stage: lint
  rules: *workflow_rules

# Dependency Scanning
gemnasium-dependency_scanning:
  stage: lint
  rules: *workflow_rules

# Secret Detection
secret_detection:
  stage: lint
  rules: *workflow_rules

build-package-and-qa:
  stage: post-test
  trigger:
    project: "gitlab-org/build/omnibus-gitlab-mirror"
    branch: "master"
    strategy: depend
  inherit:
    variables: false
  variables:
    GITLAB_SHELL_VERSION: $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA
    TOP_UPSTREAM_SOURCE_PROJECT: $CI_PROJECT_PATH
    TOP_UPSTREAM_SOURCE_REF: $CI_COMMIT_REF_NAME
    TOP_UPSTREAM_SOURCE_JOB: $CI_JOB_URL
    ee: "true"
  rules:
    # For MRs that change dependencies, we want to automatically ensure builds
    # aren't broken. In such cases, we don't want the QA tests to be run
    # automatically, but still available for developers to manually run.
    - if: "$CI_MERGE_REQUEST_IID"
      changes:
        - go.sum
      variables:
        BUILD_ON_ALL_OS: "true"
        MANUAL_QA_TEST: "true"
      allow_failure: false
    # For other MRs, we still provide this job as a manual job for developers
    # to obtain a package for testing and run QA tests.
    - if: "$CI_MERGE_REQUEST_IID"
      when: manual
      allow_failure: true
  needs: []

modules:tidy:
  stage: lint
  needs: ["modules:download"]
  script:
    - go mod tidy
    - git diff --exit-code go.mod go.sum

lint:
  stage: lint
  script:
    # Write the code coverage report to gl-code-quality-report.json
    # and print linting issues to stdout in the format: path/to/file:line description
    # remove `--issues-exit-code 0` or set to non-zero to fail the job if linting issues are detected
    - apt update && apt install -y jq
    - make lint GOLANGCI_LINT_ARGS="--output.code-climate.path=gl-code-quality-report-temp.json --output.text.path=stdout"
    - cat gl-code-quality-report-temp.json | jq '[ .[] | select(.severity == "warning").severity |= "minor" ]' > gl-code-quality-report.json
    - rm -f gl-code-quality-report-temp.json
  artifacts:
    reports:
      codequality: gl-code-quality-report.json
    paths:
      - gl-code-quality-report.json

nilaway:
  stage: lint
  rules: !reference [".rules:go-changes", rules]
  before_script:
    - go install go.uber.org/nilaway/cmd/nilaway@${NILAWAY_VERSION}
  script:
    - NILAWAY_EXIT_CODE=$(${GOPATH}/bin/nilaway -include-pkgs="gitlab.com/gitlab-org/gitlab-shell/v14" ./... > /tmp/out.txt 2>&1 ; echo $?) || true
    - cat /tmp/out.txt
    - exit ${NILAWAY_EXIT_CODE}

logging-field-validator:
  stage: test
  needs: ["modules:download"]
  rules:
    - changes:
        - .gitlab-ci.yml
        - "go.mod"
        - "go.sum"
        - "**/*.go"
        - .labkit_logging_todo.yml
  script:
    - make validate-log-fields