kde-linux/.gitlab-ci.yml

# SPDX-License-Identifier: BSD-2-Clause
# SPDX-FileCopyrightText: None

include:
  - project: sysadmin/ci-utilities
    file:
      - /gitlab-templates/reuse-lint.yml
      - /gitlab-templates/blocks/workflow.yml

stages:
  - validate
  - start
  - test
  - publish

imaging:
  stage: start
  tags:
    - VM
    - amd64
  # IMAGING_MODE selects what we do with the built image:
  #   test  - throwaway image, uploaded to ci-artifacts and given to OpenQA for testing.
  #   stage - signed and staged to storage for publishing, gated on OpenQA tests.
  rules:
    - if: $CI_MERGE_REQUEST_DRAFT == "true"
      when: manual
      variables:
        IMAGING_MODE: test
    - if: $CI_COMMIT_BRANCH =~ /^work\//
      when: manual
      variables:
        IMAGING_MODE: test
    - if: $CI_COMMIT_REF_PROTECTED == 'true' && $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME && $CI_PROJECT_PATH == 'kde-linux/kde-linux'
      when: always
      variables:
        IMAGING_MODE: stage
    - when: always
      variables:
        IMAGING_MODE: test
  allow_failure: false
  image: storage.kde.org/vm-images/kde-linux-builder
  id_tokens: &tokens
    MINIO_OIDC:
      aud: https://tokens.kde.org
  variables: &variables
    RUNNER_AFTER_SCRIPT_TIMEOUT: 1h
  before_script: &before_script
    - python3 -m venv .venv --system-site-packages
    - . .venv/bin/activate
    - python3 -m pip install --upgrade pip
    - python3 -m pip install 'BuildStream>=2.7' dulwich tomlkit
    - sudo ln -sf "$PWD/.venv/bin/bst" /usr/bin/bst
    - sudo pacman --sync --noconfirm lzip # needed by gettext apparently
  script:
    - if [ "$IMAGING_MODE" = stage ]; then curl -s https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer | bash; fi
    - sudo ./build.sh --force --debug
    - if [ "$IMAGING_MODE" = stage ]; then ./upload.sh --stage; fi
    - if [ "$IMAGING_MODE" = test ]; then ./upload-to-storage.sh; fi # Need this to have something to pass to OpenQA.
  after_script:
    - sudo cp --archive /root/.cache/buildstream/logs buildstream-logs || true
    - sudo chown --recursive "$(id --user):$(id --group)" buildstream-logs || true
    - if [ "$IMAGING_MODE" = stage ] && [ "$CI_JOB_STATUS" = success ]; then exit 0; fi
    - if [ "$IMAGING_MODE" = test ]; then exit 0; fi
    - ./upload-to-storage.sh || true
  artifacts:
    expire_in: 4 weeks
    when: always
    paths:
      - "**/erofs.log"
    reports:
      dotenv: build.env

# Run OpenQA testing on the built image.
trigger-openqa:
  stage: test
  rules:
    - if: $CI_PROJECT_PATH != 'kde-linux/kde-linux'
      when: never
    - if: $CI_MERGE_REQUEST_DRAFT == "true"
      when: manual
    - if: $CI_COMMIT_BRANCH =~ /^work\//
      when: manual
    - when: on_success
  needs:
    - job: imaging
      artifacts: true
  trigger:
    project: kde-linux/os-autoinst-distri-kdelinux
    branch: $OPENQA_BRANCH
    strategy: depend
  variables:
    IMAGE_URL: $IMAGE_URL
    STAGING_CHANNEL_URL: $STAGING_CHANNEL_URL
    SYSUPDATE_PUBKEY_B64: $SYSUPDATE_PUBKEY_B64
    OPENQA_BRANCH: master

# Publish the staged image in storage.
publish:
  stage: publish
  tags:
    - VM
    - amd64
  rules:
    - if: $CI_COMMIT_REF_PROTECTED == 'true' && $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME && $CI_PROJECT_PATH == 'kde-linux/kde-linux'
      when: on_success
    - when: never
  needs:
    - job: imaging
      artifacts: true
    - job: trigger-openqa
      artifacts: false
  allow_failure: false
  image: storage.kde.org/vm-images/kde-linux-builder
  id_tokens: *tokens
  variables: *variables
  resource_group: kde-linux-publish
  script:
    - curl -s https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer | bash
    - ./upload.sh --publish
  artifacts:
    expire_in: 4 weeks
    when: always
    paths:
      - "**/erofs.log"
      - "buildstream-logs/**/*.log"
    reports:
      dotenv: build.env

# Manual override for publishing a staged image when OpenQA breaks.
publish-manual:
  stage: publish
  tags:
    - VM
    - amd64
  rules:
    - if: $CI_COMMIT_REF_PROTECTED == 'true' && $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME && $CI_PROJECT_PATH == 'kde-linux/kde-linux'
      when: manual
      allow_failure: true
    - when: never
  needs:
    - job: imaging
      artifacts: true
  image: storage.kde.org/vm-images/kde-linux-builder
  id_tokens: *tokens
  variables: *variables
  resource_group: kde-linux-publish
  before_script: *before_script
  script:
    - curl -s https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer | bash
    - ./upload.sh --publish
  after_script:
    - sudo cp --archive /root/.cache/buildstream/logs buildstream-logs || true
    - sudo chown --recursive "$(id --user):$(id --group)" buildstream-logs || true
    # Upload broken images to Harald for inspection
    - "[ $CI_JOB_STATUS == 'success' ] || ./upload-to-storage.sh || true"
  artifacts: *artifacts