zammad/.gitlab/ci/pre.yml

# Workaround to enable usage of mixed SSH and Docker GitLab CI runners
.template_pre: &template_pre
  stage: pre
  interruptible: true
  extends:
    - .tags_docker
    - .rules_singletest
    - .artifacts_error
  before_script:
    - source /etc/profile.d/rvm.sh # ensure RVM is loaded

.template_pre_rails: &template_pre_rails
  stage: pre
  interruptible: true
  extends:
    - .tags_docker
    - .rules_singletest
    - .services_postgresql
    - .artifacts_error
  before_script:
    - source /etc/profile.d/rvm.sh # ensure RVM is loaded
    - echo -e "\\e[0Ksection_start:`date +%s`:bundle_install[collapsed=true]\\r\\e[0Kbundle install"
    - bundle config set --local frozen 'true'
    - bundle config set --local path 'vendor'
    - bundle install -j $(nproc)
    - echo -e "\\e[0Ksection_end:`date +%s`:bundle_install\\r\\e[0K"
    - bundle exec ruby .gitlab/configure_environment.rb
    - source .gitlab/environment.env
    - echo -e "\\e[0Ksection_start:`date +%s`:zammad_db_init[collapsed=true]\\r\\e[0Kbundle exec rake zammad:db:init"
    - bundle exec rake zammad:db:init
    - echo -e "\\e[0Ksection_end:`date +%s`:zammad_db_init\\r\\e[0K"

# Must be a separate job because it uses a custom image.
'lint: shellcheck':
  <<: *template_pre
  image: koalaman/shellcheck-alpine:stable
  before_script:
    - echo "Disable default before_script."
  script:
    - shellcheck -S warning $(find . -name "*.sh" -o -name "functions" | grep -v "/vendor/")
  after_script:
    - echo "Disable default before_script."

'lint: i18n, rails & security':
  <<: *template_pre_rails
  artifacts:
    expire_in: 1 week
    paths:
      - tmp/brakeman-report.html
    when: on_failure
  script:
    - yarn install
    - echo "Checking .po file syntax..."
    - for FILE in i18n/*.pot i18n/*.po; do echo "Checking $FILE"; msgfmt -o /dev/null -c $FILE; done
    - echo "Checking .pot catalog consistency..."
    - bundle exec rails generate translation_catalog --check
    - echo "Brakeman security check..."
    - bundle exec brakeman -o /dev/stdout -o tmp/brakeman-report.html
    - echo "bundler-audit security check..."
    - gem install bundler-audit
    - bundle-audit update
    - bundle-audit --ignore CVE-2015-9284
    - echo "Rails zeitwerk:check autoloader check..."
    - bundle exec rails zeitwerk:check
    - .gitlab/check_graphql_api_consistency.sh

'lint: ruby, js & css':
  <<: *template_pre
  script:
    - echo "Coffeelint check..."
    - coffeelint --rules ./.coffeelint/rules/* app/
    - echo "Stylelint check..."
    - yarn install
    - yarn lint:css
    - echo "ESLint check..."
    - yarn install --cwd .storybook
    - yarn lint
    - echo "Storybook build..."
    - yarn storybook:build
    - echo "Rubocop check..."
    - echo -e "\\e[0Ksection_start:`date +%s`:bundle_install[collapsed=true]\\r\\e[0Kbundle install"
    - bundle config set --local frozen 'true'
    - bundle config set --local path 'vendor'
    - bundle install -j $(nproc)
    - echo -e "\\e[0Ksection_end:`date +%s`:bundle_install\\r\\e[0K"
    - bundle exec rubocop --parallel

# Must be a separate job because it may fail and is only executed for develop.
'lint: orphaned ruby gems':
  <<: *template_pre_rails
  allow_failure: true
  rules:
    - if: $CI_MERGE_REQUEST_ID
      when: never
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: always
    - when: manual
  script:
    - bundle exec rake zammad:ci:bundle:orphaned 5

# Executed on a dedicated runner.
'push to github':
  <<: *template_pre
  tags:
    - deploy
  before_script:
    - '' # no RVM present in deploy ENV
  script:
    - git fetch --unshallow
    - script/build/sync_repo.sh git@github.com:zammad/zammad.git

global_refresh_envs:
  extends:
    - .tags_docker
    - .services_postgresql
  stage: pre
  interruptible: true
  # ensure that only one Job runs in the whole project (branches etc.)
  resource_group: global_refresh_envs
  # allow download via the web UI to restore ENVs in case global cache got deleted (see: `.gitlab-ci.yml`)
  artifacts:
    expire_in: 1 week
    paths:
      - fresh.env
  rules:
    - if: $CI_MERGE_REQUEST_ID
      when: never
    - if: '$CI_COMMIT_BRANCH =~ /^private/'
      when: manual
      allow_failure: true
    - when: on_success

  script:
    - bundle exec rake zammad:ci:refresh_envs