.gitlab-ci.yml

variables:
  CARGO_HOME_REL: .cargo-${RUST_VERSION}
  CARGO_HOME: ${CI_PROJECT_DIR}/${CARGO_HOME_REL}
  CARGO_CACHE: ${CI_COMMIT_REF_SLUG}-cargo
  CARGO_INCREMENTAL: false
  CARGO_BUILD_JOBS: 4
  TEST_IMAGE: $CI_REGISTRY_IMAGE/test:$CI_PIPELINE_ID
  RUSTFLAGS: -Dwarnings
  # renovate: datasource=github-releases depName=rust-lang/rust
  RUST_VERSION: 1.97.1
  # renovate: datasource=crate depName=cargo-cache
  CARGO_CACHE_VERSION: 0.8.3
  # renovate: datasource=crate depName=cargo-nextest
  CARGO_NEXTEST_VERSION: 0.9.143
  # renovate: datasource=crate depName=cargo-hack
  CARGO_HACK_VERSION: 0.6.45
  # renovate: datasource=crate depName=cargo-sweep
  CARGO_SWEEP_VERSION: 0.8.0
  # renovate: datasource=crate depName=zipsign
  ZIPSIGN_VERSION: 0.2.1
  # l'installation de binstall a besoin de cette variable là
  # renovate: datasource=crate depName=cargo-binstall
  BINSTALL_VERSION: 1.21.1
  BINSTALL_DISABLE_TELEMETRY: true

default:
  interruptible: true
  # yamllint disable-line rule:line-length
  image: docker.io/library/rust:1.97.1

# TODO: gérer le cache pour les composants dans rustup

.rust-cache-paths: &rust-cache-path
  - ${CARGO_HOME_REL}

.cache:
  needs:
    - cargo fetch
  dependencies:
    - cargo fetch
  cache:
    - key: ${CARGO_CACHE}
      policy: pull
      paths: *rust-cache-path
      unprotect: true
      fallback_keys:
        - ${CI_DEFAULT_BRANCH_SLUG}-cargo
    - key: ${CI_COMMIT_REF_SLUG}-${CI_JOB_NAME_SLUG}-target
      policy: pull-push
      when: always
      paths:
        - target
      unprotect: true
      fallback_keys:
        - ${CI_DEFAULT_BRANCH_SLUG}-${CI_JOB_NAME_SLUG}-target

.cargo sweep:
  # before_script:
  #   - cargo sweep --verbose --stamp
  after_script:
    # - cargo sweep --verbose --file
    - cargo sweep --verbose --time 1

cargo fetch:
  stage: .pre
  needs: []
  cache:
    - key: ${CARGO_CACHE}
      policy: pull-push
      paths: *rust-cache-path
      unprotect: true
      fallback_keys:
        - ${CI_DEFAULT_BRANCH_SLUG}-cargo
  rules:
    - if: $CI_COMMIT_BRANCH
  script:
    - apt update && apt install -y cmake
    # yamllint disable rule:line-length
    - |
      if [ -x ${CARGO_HOME_REL}/bin/cargo-binstall ]; then
        cargo binstall --locked cargo-binstall@${BINSTALL_VERSION}
      else
        curl -L --proto '=https' --tlsv1.2 -sSf \
          https://raw.githubusercontent.com/cargo-bins/cargo-binstall/v${BINSTALL_VERSION}/install-from-binstall-release.sh \
          | bash
      fi
    # yamllint enable rule:line-length
    - cargo binstall --locked cargo-cache@${CARGO_CACHE_VERSION}
    - cargo binstall --locked cargo-nextest@${CARGO_NEXTEST_VERSION}
    - cargo binstall --locked cargo-hack@${CARGO_HACK_VERSION}
    - cargo binstall --locked cargo-sweep@${CARGO_SWEEP_VERSION}
    - cargo fetch
    - "cargo cache clean-unref || :"

cargo fmt:
  needs: []
  rules:
    - if: $CI_COMMIT_BRANCH
  image: docker.io/rustlang/rust:nightly
  script:
    - rustup component add rustfmt
    - cargo fmt --check --all

cargo clippy:
  extends:
    - .cache
    - .cargo sweep
  rules:
    - if: $CI_COMMIT_BRANCH
  script:
    - rustup component add clippy
    - |
      if [ -x ./clippy.sh ]; then
        ./clippy.sh clippy --all-targets --release
      else
        cargo hack --feature-powerset clippy --all-targets --release
      fi

cargo clippy nightly:
  image: docker.io/rustlang/rust:nightly
  extends:
    - cargo clippy
  allow_failure: true

cargo nextest:
  needs:
    - cargo fetch
  extends:
    - .cache
    - .cargo sweep
  script:
    - cargo nextest run --workspace --profile ci --release
  rules:
    - if: $CI_COMMIT_BRANCH
  artifacts:
    when: always
    reports:
      # point GitLab to the junit test report: it will automatically display it in a dashboard
      junit: $CI_PROJECT_DIR/target/nextest/ci/junit.xml

.cross:
  parallel:
    matrix:
      - TARGET: x86_64-unknown-linux-musl
      - TARGET: x86_64-unknown-linux-gnu
      - TARGET: x86_64-pc-windows-gnu
  image: ghcr.io/cross-rs/$TARGET:edge
  stage: build
  variables:
    RUSTUP_HOME_REL: .rustup-${RUST_VERSION}
    RUSTUP_HOME: ${CI_PROJECT_DIR}/${RUSTUP_HOME_REL}
    CARGO_PROFILE_RELEASE_OPT_LEVEL: z
    CARGO_PROFILE_RELEASE_LTO: "true"
    CARGO_PROFILE_RELEASE_CODEGEN_UNITS: "1"
    CARGO_CACHE_POLICY: pull-push
    PROJECT_NAME: dnstracer
  cache:
    - key: ${CI_COMMIT_REF_SLUG}-cross-rustup-${TARGET}
      policy: ${CARGO_CACHE_POLICY}
      paths:
        - ${RUSTUP_HOME_REL}
        - ${CARGO_HOME_REL}
      unprotect: true
      fallback_keys:
        - ${CI_DEFAULT_BRANCH_SLUG}-cross-rustup-${TARGET}
    - key: ${CI_COMMIT_REF_SLUG}-cross-target-${TARGET}
      policy: ${CARGO_CACHE_POLICY}
      when: always
      paths:
        - target
      unprotect: true
      fallback_keys:
        - ${CI_DEFAULT_BRANCH_SLUG}-cross-target-${TARGET}
  needs: []
  script:
    - apt-get update && apt-get install --yes nasm zip
    - >
      if [ ! -f "$RUSTUP_HOME/settings.toml" ]; then
        curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs |
          sh -s -- -y --quiet --default-toolchain $RUST_VERSION --profile minimal --target $TARGET
      fi
    - source $CARGO_HOME/env
    - cargo install --locked zipsign@${ZIPSIGN_VERSION}
    - cargo build --target $TARGET --release
    - |
      case $TARGET in
      *-windows-*)
        name=${PROJECT_NAME}.exe
        ;;
      *)
        name=${PROJECT_NAME}
        ;;
      esac
      zip -j -v -9 $ARCHIVE_FILE.zip target/$TARGET/release/$name
      ls -l target/$TARGET/release/$name $ARCHIVE_FILE.*
    # TODO: simplifier tout ça quand zipsign supportera les PEM
    - |
      if [ -n "$ZIPSIGN_PRIVATE_KEYS" ] && [ -f "$ZIPSIGN_PRIVATE_KEYS" ]; then
        # Découper l'entrée en une clef par fichier
        awk '
          /^-----BEGIN/ { n++; file="key_" n ".pem" }
          !/^# clef/ { print > file }
        ' $ZIPSIGN_PRIVATE_KEYS

        # Extraire le PEM base64 en brut
        for file in key_*.pem; do
          openssl base64 -d -in <(grep -v "^-----" $file) > ${file}.key
        done

        # Signer
        zipsign sign zip $ARCHIVE_FILE.zip key_*.pem.key
      fi
    - ls -l $ARCHIVE_FILE.*
  after_script:
    - |
      source $CARGO_HOME/env
      cargo install --locked cargo-sweep@${CARGO_SWEEP_VERSION}
      cargo sweep --verbose --time 1
  artifacts:
    expire_in: 1 hour
    paths:
      - ${ARCHIVE_FILE}.zip

cross:
  extends: .cross
  variables:
    ARCHIVE_FILE: ${PROJECT_NAME}-${CI_COMMIT_SHORT_SHA}-${TARGET}
  rules:
    - if: $CI_COMMIT_BRANCH

release:
  stage: .pre
  image: registry.gitlab.com/gitlab-org/cli:latest
  rules:
    - if: $CI_COMMIT_TAG
  script:
    - echo "Releasing $CI_COMMIT_TAG"
  release:                               # See https://docs.gitlab.com/ci/yaml/#release for available properties
    tag_name: '$CI_COMMIT_TAG'
    description: 'Release $CI_COMMIT_TAG'

cross release:
  extends: .cross
  variables:
    ARCHIVE_FILE: ${PROJECT_NAME}-${CI_COMMIT_TAG}-${TARGET}
    CARGO_CACHE_POLICY: pull
    PACKAGE_REGISTRY_URL: "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/${PROJECT_NAME}/${CI_COMMIT_TAG}"
  needs:
    - release
  rules:
    - if: $CI_COMMIT_TAG
  script:
    - !reference [.cross, script]
    - >
      for file in ${ARCHIVE_FILE}.zip; do
        curl --fail \
          --header "JOB-TOKEN: ${CI_JOB_TOKEN}" \
          --upload-file $file \
          "${PACKAGE_REGISTRY_URL}/$file"
        curl --fail \
          --request POST \
          --header "JOB-TOKEN: ${CI_JOB_TOKEN}" \
          --data name="$file" \
          --data url="${PACKAGE_REGISTRY_URL}/$file" \
          --data direct_asset_path="/$file" \
          --data link_type="package" \
          "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/releases/${CI_COMMIT_TAG}/assets/links"
      done
  interruptible: false

publish:
  image: rust:alpine
  stage: deploy
  environment: release
  interruptible: false
  needs: []
  rules:
    - if: $CI_COMMIT_TAG
  id_tokens:
    CRATES_IO_ID_TOKEN:
      aud: crates.io
  before_script:
    - apk add --no-cache bash curl jq
  script:
    - |
      set -e

      # Exchange JWT token
      echo "Exchanging OIDC token..." >&2
      RESPONSE=$(curl -s -X POST https://crates.io/api/v1/trusted_publishing/tokens \
        -H "Content-Type: application/json" \
        -H "User-Agent: gitlab-trusted-publishing (crates.io@m.mat.cc) $CI_PROJECT_URL" \
        -d "{\"jwt\": \"$CRATES_IO_ID_TOKEN\"}")

      # Extract publish token
      CRATES_IO_PUBLISH_TOKEN=$(echo "$RESPONSE" | jq -r '.token')

      if [ "$CRATES_IO_PUBLISH_TOKEN" = "null" ] || [ -z "$CRATES_IO_PUBLISH_TOKEN" ]; then
        echo "Failed to get upload token" >&2
        echo "$RESPONSE" >&2
        exit 1
      fi

      echo "Token received, running cargo publish"

      unset CARGO_HOME
      CARGO_REGISTRY_TOKEN="$CRATES_IO_PUBLISH_TOKEN" cargo publish