.gitlab-ci.yml

default:
  image: ${PROTON_CI_REGISTRY}/android-shared/docker-android/oci-ndk:v2.1.6
  tags:
    - shared-small
  before_script:
    # We must keep these variables here. We can't do it inside the entrypoint, as idk how but
    # gitlab is going to convert them as a variable content instead of a variable file...
    - mkdir -p app
    - base64 -d -  < "$SERVICE_ACCOUNT_FILE" > app/service_account.json
    - md5sum app/service_account.json
    - echo "" >> gradle.properties # ensure a new line
    - base64 -d - < "$GRADLE_PROPERTIES_FILE2" >> gradle.properties
    - git fetch origin development
    - if [[ -f /load-env.sh ]]; then source /load-env.sh; fi
    - if [ "$CI_JOB_STAGE" == "build" ] || [ "$CI_JOB_STAGE" == "publish" ]; then python3 $CI_PREPARE_TEST_ASSETS_PY; fi
  interruptible: true

variables:
  ATLAS_DEPLOY_SCOPE: $CI_PIPELINE_IID
  ATLAS_DEPLOY_LIST:
    value: fe-vpn:branch-main
    description: List of components to deploy (fe-vpn:v4.7.0:prod+t to use a tag)
  GIT_FETCH_EXTRA_FLAGS: --tags
  ORG_GRADLE_PROJECT_useCoreGitSubmodule: "false"
  NEXUS_GROUP: "/Vpn/Android/SLI/Latest/Stable"
  NEXUS_REPO: "test-productivity-builds-distribution"

workflow:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"' # Run scheduled pipelines without deploying atlas for tests.
    - if: '"true" == "true"' # Run all other pipelines with test env deployed to atlas.
      variables:
        ATLAS_DEPLOY_ENV: "true"
        ATLAS_DEPLOY_PREP: "true"

stages:
  - prepare
  - build
  - sign
  - startReview
  - deploy
  - test
  - report
  - bot
  - mirror
  - publish
  - cleanup

# Make development and master uninterruptible.
# Based on https://gitlab.com/gitlab-org/gitlab/-/issues/194023#note_928958193
prevent-interrupt:
  stage: .pre
  rules:
    - if: $CI_COMMIT_BRANCH == "development" || $CI_COMMIT_BRANCH == "master"
      when: always
  interruptible: false
  cache: []
  before_script: []
  variables:
    GIT_STRATEGY: none
  script:
    - echo "$CI_COMMIT_BRANCH is uninterruptible"

.gradle-build-cache: &gradle-build-cache
  key:
    prefix: gradle-build-cache
    files:
      - gradle/wrapper/gradle-wrapper.properties
  paths:
    - ${CI_PROJECT_DIR}/build/gradle-build-cache
  policy: pull

cache:
  - key: $CI_COMMIT_REF_SLUG
    policy: pull
    paths:
      - .gradle

  - <<: *gradle-build-cache

deploy:review:
  needs:
    - claim:review
  after_script:
    - sleep 10
    - !reference [ .deploy:review, after_script ]
    - 'curl -s -o /dev/null --show-error -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "_method=put&mockConfig=GET+%2Fcore%2Fv4%2Fnotifications%3A%0D%0A++-+type%3A+json%0D%0A++++body%3A%0D%0A++++++Notifications%3A+%5B%5D%0D%0A" "https://${DYNAMIC_DOMAIN}/api/internal/mock"'

detekt analysis:
  stage: prepare
  cache:
    - key: $CI_COMMIT_REF_SLUG
      policy: pull-push
      paths:
        - .gradle
  except:
    - schedules
  tags:
    - shared-large
  script:
    - ./gradlew :app:detekt
  artifacts:
    expire_in: 4 weeks
    paths:
      - app/build/reports/detekt/
    reports:
      codequality: app/build/reports/detekt/detekt.json

# Any jobs which needs ARCHIVES_BASE_NAME should add this job as dependency
# Unless the job is building the app from gradle, then it will be calculated on it's own
export archive name:
  stage: prepare
  tags:
    - shared-medium
  script:
    - export ARCHIVES_BASE_NAME=$(./gradlew -q getArchivesName | tail -n 1)
    - echo ${ARCHIVES_BASE_NAME}
    - echo "ARCHIVES_BASE_NAME=${ARCHIVES_BASE_NAME}" >> deploy.env
    - export VERSION_NAME=$(./gradlew -q getVersionName | tail -n 1)
    - echo ${VERSION_NAME}
    - echo "VERSION_NAME=${VERSION_NAME}" >> deploy.env
    - export VERSION_CODE=$(./gradlew -q getVersionCode | tail -n 1)
    - if [ $? -ne 0 ] || [ -z "${VERSION_CODE}" ]; then echo "VERSION_CODE is empty, something went wrong"; exit 1; fi
    - echo ${VERSION_CODE}
    - echo "VERSION_CODE=${VERSION_CODE}" >> deploy.env
  artifacts:
    reports:
      dotenv: deploy.env

build google debug:
  stage: build
  rules:
    - if: $ROBO_TEST == "true"
      when: always
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    - when: always
  tags:
    - xlarge-k8s
  script:
    # Build additionally the vanilla and Amazon flavors to check that they compile.
    # Don't include them in artifacts.
    - >
      ./gradlew assembleProductionGooglePlayStoreDebug \
                assembleProductionVanillaOpenSourceDebug \
                assembleProductionVanillaAmazonDebug \
                assembleProductionGooglePlayStoreDebugAndroidTest
  artifacts:
    expire_in: 1 week
    paths:
    - app/build/outputs/apk/productionGooglePlayStore
    - app/build/outputs/apk/androidTest/productionGooglePlayStore

.build test:
  stage: build
  tags:
    - xlarge-k8s
  except:
    - schedules
  script:
    - export BLACK_TOKEN="$(curl --silent $BLACK_TOKEN_URL)"
    - echo "API host ${TEST_ENV_DOMAIN}"
    - echo "API token ${BLACK_TOKEN}"
    - |
      if [[ "$BLACK_TOKEN" == *$'\n'* || "$BLACK_TOKEN" == *" "* ]]; then
        echo "Invalid token: ${BLACK_TOKEN}"
        exit 1
      fi
    - mkdir -p app/src/androidTest/assets/sensitive
    - cat $TEST_INTERNAL_API > app/src/androidTest/assets/sensitive/internal_apis.json
    - >
      ./gradlew assembleBlackGooglePlayStoreDebug \
                  assembleBlackGooglePlayStoreDebugAndroidTest
  artifacts:
    expire_in: 1 week
    paths:
    - app/build/outputs/apk
    - app/build/tmp/kotlin-classes

build test-env:
  variables:
    TEST_ENV_DOMAIN: $DYNAMIC_DOMAIN
  extends: .build test

build black:
  extends: .build test
  variables:
    TEST_ENV_DOMAIN: $BLACK_DOMAIN
  after_script:
    # Avoid build files clashing with the test ones.
    - mkdir artifactsBlack
    - mv app/build/outputs/apk/* artifactsBlack
  when: manual
  artifacts:
    expire_in: 1 week
    paths:
      - artifactsBlack

build BTI:
  stage: build
  when: manual
  except:
    - schedules
  tags:
    - xlarge-k8s
  script:
    - ./gradlew assembleBlackGooglePlayStoreDebug
  after_script:
    # Avoid build files clashing with the test ones.
    - mkdir artifactsBti
    - mv app/build/outputs/apk/* artifactsBti
  artifacts:
    expire_in: 3 week
    paths:
      - artifactsBti

build google play release:
  stage: build
  when: manual
  tags:
    - xlarge-k8s
  script:
    - >
      ./gradlew openvpn:assembleRelease \
                assembleProductionGooglePlayStoreRelease
  except:
    - schedules
  interruptible: false
  artifacts:
    expire_in: 1 week
    paths:
    - app/build/outputs/apk

build google play dev (monitoring release):
  stage: build
  rules:
    - if: $ROBO_TEST == "true"
      when: always
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    - when: always
  tags:
    - xlarge-k8s
  script:
    - >
      ./gradlew openvpn:assembleRelease \
                assembleProductionGoogleDevRelease \
                :release_tests:assembleRelease
  interruptible: false
  artifacts:
    expire_in: 1 week
    paths:
      - app/build/outputs/apk
      - release_tests/build/outputs/apk

unit tests:
  stage: test
  tags:
    - xlarge-k8s
  except:
    - schedules
  script:
    - ./gradlew testBlackGooglePlayStoreDebug
  artifacts:
    expire_in: 1 day
    paths:
    - app/build/test-results
    - app/build/outputs/unit_test_code_coverage
    - app/build/reports/tests

coverage report:
  stage: report
  tags:
    - shared-large
  script:
    - ./gradlew coverageReport
    - python3 jacocoConverter.py app/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml app/src/main/java > app/build/reports/cobertura-coverage.xml
    # create top level artifact index to direct users to the deep index
    - echo "<script>window.location='app/build/reports/jacoco/jacocoTestReport/html/index.html'</script>" > index.html
    - echo "<a href='app/build/reports/jacoco/jacocoTestReport/html/index.html'>go here</a>" >> index.html
  only:
    - branches
  except:
    - schedules
  allow_failure: true
  coverage: '/Total coverage: \d+.\d+/'
  artifacts:
    expire_in: 1 week
    expose_as: 'Coverage html'
    paths:
      - app/build/reports/jacoco/jacocoTestReport/html
      - index.html
    reports:
      coverage_report:
        coverage_format: cobertura
        path: app/build/reports/cobertura-coverage.xml

pages:
  stage: publish
  only:
    refs:
      - development
  except:
    - schedules
  script:
    - mkdir public
    - mv app/build/reports/jacoco/jacocoTestReport/html/* public
  artifacts:
    paths:
      - public

owasp check:
  stage: prepare
  tags:
    - shared-large
  script:
    - ./gradlew dependencyCheckAggregate
  when: manual
  interruptible: false
  artifacts:
    expire_in: 1 week
    paths:
      - build/reports

startReview:
  before_script:
    - export REVIEW_APP_ARTIFACT_PATH="app/build/outputs/apk/productionGooglePlayStore/debug/"${ARCHIVES_BASE_NAME}-production-google-playStore-debug.apk
    - echo ${REVIEW_APP_ARTIFACT_PATH}
  extends: .startReview
  needs: ["build google debug", "export archive name"]
  except:
    - schedules

stopReview:
  before_script: []
  extends: .stopReview

include:
  - project: 'translations/generator'
    ref: master
    file: '/jobs/sync-crowdin.gitlab-ci.yml'

  - component: gitlab.protontech.ch/proton/devops/cicd-components/devsecops/gitleaks/scan-repository@0.0.17
    inputs:
      stage: prepare

  - project: 'translations/generator'
    ref: master
    file: '/jobs/commit-locales.gitlab-ci.yml'

  - project: 'proton/mobile/android/proton-libs'
    ref: main
    file: '/ci/templates-shared/appetize-integration.yml'

  - local: '/.gitlab-ci-firebase.yml'

  - local: '/.gitlab-ci-release.yml'

  - project: 'proton/devops/atlas-deploy'
    ref: main
    file: '/scenarios/pipeline-env.yml'

  - project: 'proton/devops/tooling/templates'
    ref: main
    file: '/packaging/signing/artifact-signing.gitlab-ci.yml'

i18n-sync-crowdin:
  variables:
      I18N_SYNC_BRANCH: development
      I18N_SYNC_CROWDIN_PROJECT: 'android-vpn'
  extends: .i18n-sync-crowdin-shared

i18n-commit-locales:
  variables:
      I18N_COMMIT_BRANCH_PUSH: development
      I18N_COMMIT_BRANCH_ALLOWED: development
      I18N_COMMIT_CROWDIN_PROJECT: 'android-vpn'
  extends: .i18n-commit-locales-shared