.gitlab-ci.yml

stages:
  - build
  - test
  - publish

variables:
  GODEBUG: "http2client=0"  # https://github.com/GoogleContainerTools/kaniko/issues/2751

.full-matrix:
  parallel:
    matrix:
      - OS: ubuntu-22.04
        LLVM: [12, 13, 14, 15]
      - OS: ubuntu-24.04
        LLVM: [14, 15, 16, 17, 18]

build-base:
  stage: build
  needs: []
  image:
    name: gcr.io/kaniko-project/executor:v1.22.0-debug
    entrypoint: [""]
  before_script:
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"auth\":\"$(printf "%s:%s" "${CI_REGISTRY_USER}" "${CI_REGISTRY_PASSWORD}" | base64 | tr -d '\n')\"},\"$CI_DEPENDENCY_PROXY_SERVER\":{\"auth\":\"$(printf "%s:%s" ${CI_DEPENDENCY_PROXY_USER} "${CI_DEPENDENCY_PROXY_PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
  extends: .full-matrix
  script:
      # we also enable two less-than-stable features (`--use-new-run` and `--snapshot-mode=redo`) purely for performance
    - /kaniko/executor
      --image-fs-extract-retry 5
      --build-arg REGISTRY=${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}
      --context "${CI_PROJECT_DIR}"
      --cache
      --cache-repo ${CI_REGISTRY_IMAGE}/cache
      --use-new-run
      --snapshot-mode=redo
      --skip-unused-stages
      --dockerfile "${CI_PROJECT_DIR}/dockerfiles/${OS}.dockerfile"
      --build-arg LLVM=${LLVM}
      --build-arg JOBS=4
      --target base
      --destination "${CI_REGISTRY_IMAGE}/ci/base:${CI_COMMIT_SHA}-${OS}-llvm-${LLVM}"

build-prebuilt:
  stage: build
  needs: [build-base]
  image:
    name: gcr.io/kaniko-project/executor:v1.22.0-debug
    entrypoint: [""]
  before_script:
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"auth\":\"$(printf "%s:%s" "${CI_REGISTRY_USER}" "${CI_REGISTRY_PASSWORD}" | base64 | tr -d '\n')\"},\"$CI_DEPENDENCY_PROXY_SERVER\":{\"auth\":\"$(printf "%s:%s" ${CI_DEPENDENCY_PROXY_USER} "${CI_DEPENDENCY_PROXY_PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
  extends: .full-matrix
  script:
      # we also enable two less-than-stable features (`--use-new-run` and `--snapshot-mode=redo`) purely for performance
    - /kaniko/executor
      --image-fs-extract-retry 5
      --build-arg REGISTRY=${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}
      --context "${CI_PROJECT_DIR}"
      --cache
      --cache-repo ${CI_REGISTRY_IMAGE}/cache
      --use-new-run
      --snapshot-mode=redo
      --skip-unused-stages
      --dockerfile "${CI_PROJECT_DIR}/dockerfiles/${OS}.dockerfile"
      --build-arg LLVM=${LLVM}
      --build-arg JOBS=4
      --target prebuilt
      --no-push-cache
      --destination "${CI_REGISTRY_IMAGE}/ci/prebuilt:${CI_COMMIT_SHA}-${OS}-llvm-${LLVM}"

test:
  stage: test
  needs: ["build-prebuilt"]  # we should make this better once https://gitlab.com/gitlab-org/gitlab/-/issues/423553 gets resolved
  extends: .full-matrix
  image: ${CI_REGISTRY_IMAGE}/ci/prebuilt:${CI_COMMIT_SHA}-${OS}-llvm-${LLVM}
  variables:
    GIT_STRATEGY: none
  script:
    - cd /norman/build
    - CTEST_OUTPUT_ON_FAILURE=1 ninja test
  after_script:
    - > # save output on failure
      if [ $CI_JOB_STATUS == 'failed' ]; then
        rm -rf "${CI_PROJECT_DIR}/output"
        cp -r /norman/build/test "${CI_PROJECT_DIR}/output"
      fi
  artifacts:
    when: on_failure
    paths:
      - output
    expire_in: 1 week

format:
  stage: test
  needs:
    - job: "build-base"
      parallel:
        matrix:
          - OS: ubuntu-22.04
            LLVM: 12
  image: ${CI_REGISTRY_IMAGE}/ci/base:${CI_COMMIT_SHA}-ubuntu-22.04-llvm-12
  script:
    - find src -iname '*.cpp' -or -iname '*.h' -print | xargs clang-format-12 --dry-run --Werror

publish:
  stage: publish
  # we want to wait until the full "test" stage completes successfully before publishing, so no "needs:" here
  variables:
    GIT_STRATEGY: none
  only:
    refs:
      - main
  extends: .full-matrix
  image:
    name: gcr.io/go-containerregistry/crane:debug
    entrypoint: [""]
  before_script:
    - crane auth login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - crane cp "${CI_REGISTRY_IMAGE}/ci/prebuilt:${CI_COMMIT_SHA}-${OS}-llvm-${LLVM}" "${CI_REGISTRY_IMAGE}:${OS}-llvm-${LLVM}"

publish-latest:
  stage: publish
  # we want to wait until the full "test" stage completes successfully before publishing, so no "needs:" here
  variables:
    GIT_STRATEGY: none
  only:
    refs:
      - main
  image:
    name: gcr.io/go-containerregistry/crane:debug
    entrypoint: [""]
  before_script:
    - crane auth login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - crane cp "${CI_REGISTRY_IMAGE}/ci/prebuilt:${CI_COMMIT_SHA}-ubuntu-22.04-llvm-12" "${CI_REGISTRY_IMAGE}:latest"