.gitlab-ci.yml

stages:
  - lint
  - build
  - test
  - publish
  - cleanup
  - report

shellcheck:
  stage: lint
  before_script:
    - pacman -Syu --needed --noconfirm shellcheck
  script:
    - shopt -s globstar
    - shellcheck **/*.sh

shfmt:
  stage: lint
  before_script:
    - pacman -Syu --needed --noconfirm shfmt
  script:
    - shopt -s globstar
    - shfmt -i 2 -ci -d **/*.sh

.build:
  stage: build
  before_script:
    - pacman -Syu --needed --noconfirm gptfdisk btrfs-progs dosfstools arch-install-scripts qemu-img jq
  script:
    - echo "BUILD_VERSION=$(date +%Y%m%d).$CI_JOB_ID" > build.env
    - export $(< build.env)
    - ./build.sh "${BUILD_VERSION}"
  after_script:
    - echo "image_size_megabytes{image=\"basic\"} $(du -m output/*basic*qcow2)" > metrics.txt
    - echo "image_size_megabytes{image=\"cloudimg\"} $(du -m output/*cloudimg*qcow2)" >> metrics.txt
    - echo "image_size_megabytes{image=\"libvirt-executor\"} $(du -m output/*libvirt-executor*qcow2)" >> metrics.txt
  artifacts:
    name: "output"
    paths:
      - "output/*"
      # Workaround until https://gitlab.com/gitlab-org/gitlab/-/issues/352644 is sorted
      - build.env
    expire_in: 2d
    reports:
      metrics: metrics.txt
      dotenv: build.env

build:
  extends: .build
  tags:
    - vm
  except:
    - master@archlinux/arch-boxes
    - schedules@archlinux/arch-boxes

build:secure:
  extends: .build
  tags:
    - secure
    - vm
  only:
    - master@archlinux/arch-boxes
    - schedules@archlinux/arch-boxes
  script:
    - !reference [.build, script]
    - gpg --import < <(echo "${GPG_PRIVATE_KEY}")
    - |
      for file in output/*; do
        gpg --detach-sign "${file}"
      done

test-basic-qemu-bios:
  stage: test
  variables:
    SSHPASS: arch
  before_script:
    - pacman -Syu --needed --noconfirm qemu-base sshpass socat jq
  script:
    - qemu-system-x86_64
        -m 512 -net nic -net user,hostfwd=tcp::2222-:22
        -drive file=$(ls output/Arch-Linux-x86_64-basic-*.qcow2),if=virtio
        -chardev socket,path=/tmp/qga.sock,server=on,wait=off,id=qga0
        -device virtio-serial
        -device virtserialport,chardev=qga0,name=org.qemu.guest_agent.0
        -nographic &
    - timeout 15m sh -c "while ! sshpass -e ssh -o ConnectTimeout=2 -o StrictHostKeyChecking=no arch@localhost -p 2222 sudo true; do sleep 1; done"
    - 'echo "{\"execute\": \"guest-network-get-interfaces\"}" | socat -T0 -,ignoreeof unix-connect:/tmp/qga.sock | jq -e "any(.return.[]; .name == \"lo\")"'

test-cloudimg-qemu-bios:
  stage: test
  variables:
    SSHPASS: passw0rd
  before_script:
    - pacman -Syu --needed --noconfirm qemu-base cdrtools sshpass socat jq
  script:
    - |
      cat > user-data <<EOF
      #cloud-config
      password: '${SSHPASS}'
      chpasswd: { expire: False }
      ssh_pwauth: True
      packages:
        - tmux
        - tree
      runcmd:
        - [ echo, 'Install more packages using runcmd.' ]
        - [ pacman, --noconfirm, -Syu, bat ]
        - [ touch, /runcmd_successful ]
      EOF
    - |
      cat > meta-data <<EOF
      instance-id: iid-local01
      local-hostname: cloudimg
      EOF
    - cat user-data meta-data
    - genisoimage -output seed.iso -volid cidata -joliet -rock user-data meta-data
    - qemu-system-x86_64
        -m 512 -net nic -net user,hostfwd=tcp::2222-:22
        -drive file=$(ls output/Arch-Linux-x86_64-cloudimg-*.qcow2),if=virtio
        -drive file=seed.iso,if=virtio
        -chardev socket,path=/tmp/qga.sock,server=on,wait=off,id=qga0
        -device virtio-serial
        -device virtserialport,chardev=qga0,name=org.qemu.guest_agent.0
        -nographic &
    - timeout 15m sh -c "while ! sshpass -e ssh -o ConnectTimeout=2 -o StrictHostKeyChecking=no arch@localhost -p 2222 true; do sleep 1; done"
    - timeout 15m sh -c "while ! sshpass -e ssh -o ConnectTimeout=2 -o StrictHostKeyChecking=no arch@localhost -p 2222 pacman -Q bat tmux tree; do sleep 1; done"
    - timeout 15m sh -c "while ! sshpass -e ssh -o ConnectTimeout=2 -o StrictHostKeyChecking=no arch@localhost -p 2222 test -f /runcmd_successful ; do sleep 1; done"
    - 'echo "{\"execute\": \"guest-network-get-interfaces\"}" | socat -T0 -,ignoreeof unix-connect:/tmp/qga.sock | jq -e "any(.return.[]; .name == \"lo\")"'

test-basic-qemu-uefi-x64:
  stage: test
  variables:
    SSHPASS: arch
  before_script:
    - pacman -Syu --needed --noconfirm qemu-base edk2-ovmf sshpass socat jq
  script:
    - cp /usr/share/edk2/x64/OVMF_VARS.4m.fd ./
    - qemu-system-x86_64
        -m 512 -net nic -net user,hostfwd=tcp::2222-:22
        -drive file=$(ls output/Arch-Linux-x86_64-basic-*.qcow2),if=virtio
        -drive if=pflash,format=raw,unit=0,file=/usr/share/edk2/x64/OVMF_CODE.4m.fd,read-only=on
        -drive if=pflash,format=raw,unit=1,file=OVMF_VARS.4m.fd
        -chardev socket,path=/tmp/qga.sock,server=on,wait=off,id=qga0
        -device virtio-serial
        -device virtserialport,chardev=qga0,name=org.qemu.guest_agent.0
        -nographic &
    - timeout 15m sh -c "while ! sshpass -e ssh -o ConnectTimeout=2 -o StrictHostKeyChecking=no arch@localhost -p 2222 sudo true; do sleep 1; done"
    - 'echo "{\"execute\": \"guest-network-get-interfaces\"}" | socat -T0 -,ignoreeof unix-connect:/tmp/qga.sock | jq -e "any(.return.[]; .name == \"lo\")"'

test-cloudimg-qemu-uefi-x64:
  stage: test
  variables:
    SSHPASS: passw0rd
  before_script:
    - pacman -Syu --needed --noconfirm qemu-base edk2-ovmf cdrtools sshpass socat jq
  script:
    - |
      cat > user-data <<EOF
      #cloud-config
      password: '${SSHPASS}'
      chpasswd: { expire: False }
      ssh_pwauth: True
      packages:
        - tmux
        - tree
      runcmd:
        - [ echo, 'Install more packages using runcmd.' ]
        - [ pacman, --noconfirm, -Syu, bat ]
        - [ touch, /runcmd_successful ]
      EOF
    - |
      cat > meta-data <<EOF
      instance-id: iid-local01
      local-hostname: cloudimg
      EOF
    - cat user-data meta-data
    - genisoimage -output seed.iso -volid cidata -joliet -rock user-data meta-data
    - cp /usr/share/edk2/x64/OVMF_VARS.4m.fd ./
    - qemu-system-x86_64
        -m 512 -net nic -net user,hostfwd=tcp::2222-:22
        -drive file=$(ls output/Arch-Linux-x86_64-cloudimg-*.qcow2),if=virtio
        -drive file=seed.iso,if=virtio
        -drive if=pflash,format=raw,unit=0,file=/usr/share/edk2/x64/OVMF_CODE.4m.fd,read-only=on
        -drive if=pflash,format=raw,unit=1,file=OVMF_VARS.4m.fd
        -chardev socket,path=/tmp/qga.sock,server=on,wait=off,id=qga0
        -device virtio-serial
        -device virtserialport,chardev=qga0,name=org.qemu.guest_agent.0
        -nographic &
    - timeout 15m sh -c "while ! sshpass -e ssh -o ConnectTimeout=2 -o StrictHostKeyChecking=no arch@localhost -p 2222 true; do sleep 1; done"
    - timeout 15m sh -c "while ! sshpass -e ssh -o ConnectTimeout=2 -o StrictHostKeyChecking=no arch@localhost -p 2222 pacman -Q bat tmux tree; do sleep 1; done"
    - timeout 15m sh -c "while ! sshpass -e ssh -o ConnectTimeout=2 -o StrictHostKeyChecking=no arch@localhost -p 2222 test -f /runcmd_successful ; do sleep 1; done"
    - 'echo "{\"execute\": \"guest-network-get-interfaces\"}" | socat -T0 -,ignoreeof unix-connect:/tmp/qga.sock | jq -e "any(.return.[]; .name == \"lo\")"'

publish:
  stage: publish
  tags:
    - secure
    - docker
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule" && $SCHEDULED_PUBLISH == "TRUE"
  script:
    - shopt -s extglob
    - |
      # The libvirt-executor image is not meant for external consumption!
      for file in output/!(*libvirt-executor*); do
          base="$(basename "${file}")"
          curl -sSf --header "JOB-TOKEN: ${CI_JOB_TOKEN}" --upload-file "${file}" "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/images/v${BUILD_VERSION}/${base}"
      done

cleanup:
  stage: cleanup
  needs: []
  tags:
    - secure
    - docker
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule" && $CLEANUP_PACKAGE_REGISTRY == "TRUE"
  before_script:
    - pacman -Syu --noconfirm jq
  script:
    - |
      for id in $(curl --silent --fail --show-error "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages?per_page=100&order_by=created_at&sort=asc" | jq '.[] | select(.created_at | split("T")[0] | . < (now-60*60*24*90|strflocaltime("%Y-%m-%d"))) | .id'); do
        curl --silent --fail --show-error --request DELETE --header "PRIVATE-TOKEN: ${GITLAB_PROJECT_TOKEN}" "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/${id}"
      done

issue-bot:
  stage: report
  tags:
    - secure
    - docker
  image: registry.gitlab.com/gitlab-org/distribution/issue-bot:latest
  script: /issue-bot
  rules:
    - if: $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH
      when: on_failure