.gitlab-ci.yml

image: "ruby:2.7"

include:
  - template: 'Workflows/MergeRequest-Pipelines.gitlab-ci.yml'
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/License-Scanning.gitlab-ci.yml
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml

.tests:
  stage: test
  cache:
    paths:
      - vendor/ruby
  before_script:
    - ruby -v  # Print out ruby version for debugging
    - bundle install -j $(nproc) --path vendor/ruby/$RUBY_VERSION

rubocop:
  extends: .tests
  script:
    - bundle exec rubocop

.rspec:
  extends: .tests
  script:
    - bundle exec rspec

rspec:mri:
  extends: .rspec
  image: "ruby:$RUBY_VERSION"
  parallel:
    matrix:
      - RUBY_VERSION:
        - "2.7"
        - "3.0"

rspec:jruby:
  extends: .rspec
  image: "bitnami/jruby:latest"
  variables:
    RUBY_VERSION: jruby

rspec:truffleruby:
  extends: .rspec
  image: "flavorjones/truffleruby:latest"
  variables:
    RUBY_VERSION: truffleruby

danger-review:
  extends: .tests
  needs: []
  script:
    - >
      if [ -z "$DANGER_GITLAB_API_TOKEN" ]; then
        # Force danger to skip CI source GitLab and fallback to "local only git repo".
        unset GITLAB_CI
        # We need to base SHA to help danger determine the base commit for this shallow clone.
        bundle exec danger dry_run --fail-on-errors=true --verbose --base="$CI_MERGE_REQUEST_DIFF_BASE_SHA"
      else
        bundle exec danger --fail-on-errors=true --verbose
      fi

# run security jobs on MRs
# see: https://gitlab.com/gitlab-org/gitlab/-/issues/218444#note_478761991

brakeman-sast:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

gemnasium-dependency_scanning:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

bundler-audit-dependency_scanning:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

license_scanning:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

secret_detection:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'