ldc-boutique-cnc-sable/.gitlab-ci.yml

stages:
  - install
  - lint
  - test
  - security
  - build
  - deploy

include:
  - project: "ldc-web/shared-ci"
    ref: "main"
    file: "security/composer.yml"
  - project: "ldc-web/shared-ci"
    ref: "main"
    file: "build/composer.yml"
  - project: "ldc-web/shared-ci"
    ref: "main"
    file: "build/docker-multistage.yml"
  - project: "ldc-web/shared-ci"
    ref: "main"
    file: "test/test.yml"
  - project: "ldc-web/shared-ci"
    ref: "main"
    file: "deploy/deploy.yml"

# * LINT --------------------------------------------------------------------

.php-lint-base: &php-lint-base
  image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/uwil-ci-8.5:latest
  variables:
    COMPOSER_CACHE_DIR: ".composer-cache"
  cache:
    key:
      files:
        - composer.lock
      prefix: "composer"
    policy: pull
    paths:
      - .composer-cache/
      - vendor/
  before_script:
    - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
    - composer install --no-scripts --no-interaction --no-ansi --no-progress --prefer-dist
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "develop"

parallel-lint:
  <<: *php-lint-base
  stage: lint
  script:
    - vendor/bin/parallel-lint --exclude vendor --exclude storage --exclude bootstrap --exclude node_modules .
  allow_failure: false

pint:
  <<: *php-lint-base
  stage: lint
  script:
    - vendor/bin/pint --test
  allow_failure: false

phpcs:
  <<: *php-lint-base
  stage: lint
  script:
    - vendor/bin/phpcs --standard=phpcs.xml --extensions=php --ignore=vendor/*,storage/*,bootstrap/*,node_modules/* --report=junit --report-file=phpcs-report.xml
  artifacts:
    when: on_failure
    expose_as: 'phpcs'
    paths:
      - phpcs-report.xml
    reports:
      junit: phpcs-report.xml
  allow_failure: false

phpstan:
  <<: *php-lint-base
  stage: lint
  variables:
    PHP_MEMORY_LIMIT: "512M"
    COMPOSER_CACHE_DIR: ".composer-cache"
  script:
    - php -d memory_limit=512M vendor/bin/phpstan --error-format=junit > phpstan-report.xml
  artifacts:
    when: on_failure
    expose_as: 'phpstan'
    paths:
      - phpstan-report.xml
    reports:
      junit: phpstan-report.xml
  allow_failure: false

eslint:
  stage: lint
  image: oven/bun:1
  variables:
    BUN_INSTALL_CACHE_DIR: ".bun-cache"
  cache:
    key:
      files:
        - bun.lock
      prefix: "bun"
    policy: pull
    paths:
      - .bun-cache/
  before_script:
    - echo "@ldc-web:registry=https://${CI_SERVER_HOST}/api/v4/packages/npm/" >> .npmrc
    - echo "//${CI_SERVER_HOST}/api/v4/packages/npm/:_authToken=${CI_DEPLOY_PASSWORD}" >> .npmrc
    - echo "@uwil:registry=https://lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/" >> .npmrc
    - echo "//lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/:_authToken=${CI_DEPLOY_PASSWORD}" >> .npmrc
    - bun install --no-save
  script:
    - bun run eslint-ci --quiet --output-file=eslint-junit.xml
  artifacts:
    when: on_failure
    expose_as: 'eslint'
    paths:
      - eslint-junit.xml
    reports:
      junit: eslint-junit.xml
  allow_failure: false
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "develop"

stylelint:
  stage: lint
  image: oven/bun:1
  variables:
    BUN_INSTALL_CACHE_DIR: ".bun-cache"
  cache:
    key:
      files:
        - bun.lock
      prefix: "bun"
    policy: pull
    paths:
      - .bun-cache/
  before_script:
    - echo "@ldc-web:registry=https://${CI_SERVER_HOST}/api/v4/packages/npm/" >> .npmrc
    - echo "//${CI_SERVER_HOST}/api/v4/packages/npm/:_authToken=${CI_DEPLOY_PASSWORD}" >> .npmrc
    - echo "@uwil:registry=https://lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/" >> .npmrc
    - echo "//lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/:_authToken=${CI_DEPLOY_PASSWORD}" >> .npmrc
    - bun install --no-save
  script:
    - bun run stylelint-ci --quiet --output-file=stylelint-junit.xml
  artifacts:
    when: on_failure
    expose_as: 'stylelint'
    paths:
      - stylelint-junit.xml
    reports:
      junit: stylelint-junit.xml
  allow_failure: false
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "develop"

# * TESTS -------------------------------------------------------------------

bun-build-test:
  stage: test
  image: oven/bun:1
  variables:
    BUN_INSTALL_CACHE_DIR: ".bun-cache"
  cache:
    key:
      files:
        - bun.lock
      prefix: "bun"
    policy: pull
    paths:
      - .bun-cache/
  before_script:
    - echo "@ldc-web:registry=https://${CI_SERVER_HOST}/api/v4/packages/npm/" >> .npmrc
    - echo "//${CI_SERVER_HOST}/api/v4/packages/npm/:_authToken=${CI_DEPLOY_PASSWORD}" >> .npmrc
    - echo "@uwil:registry=https://lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/" >> .npmrc
    - echo "//lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/:_authToken=${CI_DEPLOY_PASSWORD}" >> .npmrc
    - bun install --no-save
  script:
    - timeout 300 bun run prod
  artifacts:
    expose_as: 'front-build-test'
    paths:
      - public/build/manifest.json
  allow_failure: false
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_TAG != null

tests_front:
  stage: test
  image: oven/bun:1
  variables:
    BUN_INSTALL_CACHE_DIR: ".bun-cache"
  cache:
    key:
      files:
        - bun.lock
      prefix: "bun"
    policy: pull
    paths:
      - .bun-cache/
  before_script:
    - echo "@ldc-web:registry=https://${CI_SERVER_HOST}/api/v4/packages/npm/" >> .npmrc
    - echo "//${CI_SERVER_HOST}/api/v4/packages/npm/:_authToken=${CI_DEPLOY_PASSWORD}" >> .npmrc
    - echo "@uwil:registry=https://lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/" >> .npmrc
    - echo "//lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/:_authToken=${CI_DEPLOY_PASSWORD}" >> .npmrc
    - bun install --no-save
  script:
    - bun run test:unit
  artifacts:
    when: always
    expose_as: 'vitest'
    paths:
      - coverage/junit-vitest.xml
    reports:
      junit: coverage/junit-vitest.xml
  allow_failure: false
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_TAG != null

tests_laravel:
  stage: test
  image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/uwil-ci-8.5:latest
  allow_failure: false
  variables:
    COMPOSER_CACHE_DIR: ".composer-cache"
    # MYSQL SERVICE VARS
    MYSQL_DATABASE: testing_db
    MYSQL_ROOT_PASSWORD: password

    # LARAVEL VARS
    DB_CONNECTION: mysql
    DB_HOST: mysql
    DB_PORT: 3306
    DB_DATABASE: testing_db
    DB_USERNAME: root
    DB_PASSWORD: password
  cache:
    - key:
        files:
          - composer.lock
        prefix: "composer"
      policy: pull
      paths:
        - .composer-cache/
        - vendor/
  services:
    - name: mysql:8.0
      alias: mysql
  before_script:
    - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
    - composer install --no-scripts --no-interaction --no-ansi --no-progress --prefer-dist
  script:
    - cp .env.example .env
    - php artisan key:generate
    - php -r "while(true){try{new PDO('mysql:host=mysql;dbname=testing_db','root','password');break;}catch(Exception){sleep(1);}}"
    - php artisan config:clear
    - php artisan test --coverage --colors=never --log-junit=coverage/junit.xml --coverage-cobertura=coverage/cobertura.xml --coverage-html=coverage/html
  after_script:
    - if [ "$CI_JOB_STATUS" == "failed" ]; then cat storage/logs/laravel.log; fi
  artifacts:
    when: always
    expose_as: 'coverage'
    paths:
      - coverage/html/
    reports:
      junit: coverage/junit.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura.xml
  coverage: '/^\s*Total:\s*([\d\.]+)%/'
  needs:
    - job: bun-build-test
      optional: false
      artifacts: true
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_TAG != null

# * SECURITY ----------------------------------------------------------------

bun-security:
  stage: security
  image: oven/bun:1
  before_script:
    - echo "@ldc-web:registry=https://${CI_SERVER_HOST}/api/v4/packages/npm/" >> .npmrc
    - echo "//${CI_SERVER_HOST}/api/v4/packages/npm/:_authToken=${CI_DEPLOY_PASSWORD}" >> .npmrc
    - echo "@uwil:registry=https://lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/" >> .npmrc
    - echo "//lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/:_authToken=${CI_DEPLOY_PASSWORD}" >> .npmrc
  script:
    - bun audit --json > bun-security-checker-report.json
  artifacts:
    when: on_failure
    expose_as: 'bun-security-checker'
    paths:
      - bun-security-checker-report.json
  allow_failure: true
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_TAG != null

# * BUILD -------------------------------------------------------------------

npm-build:
  stage: build
  script:
    - echo "Frontend is built directly within Docker multi-stage build"

npm-security:
  stage: security
  script:
    - echo "Npm security would run bun security"
  dependencies:
    - bun-security
  needs:
    - job: bun-security
      optional: true
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_TAG != null