stages:
 - preliminaries  # signoff / static analysis
 - testing
 - deploy

variables:
  BUILD_IMAGES_PROJECT: openconnect/build-images
  ALPINE_BUILD: buildenv-alpine
  DEBIAN_BUILD: buildenv-debian
  DEBIAN_X86_CROSS_BUILD: buildenv-debian-x86
  FEDORA_BUILD: buildenv-fedora44
  UBUNTU22_BUILD: buildenv-ubuntu22
  UBUNTU26_BUILD: buildenv-ubuntu26
  CENTOS8_BUILD: buildenv-centos8
  CENTOS9_BUILD: buildenv-centos9
  CENTOS10_BUILD: buildenv-centos10
  MINIMAL_OPTIONS: >-
    -Dlocal-protobuf=true -Dlocal-talloc=true -Dlibnl=disabled
    -Dmaxmind=disabled -Dgeoip=disabled -Dliboath=disabled
    -Dpam=disabled -Dradius=disabled -Dutmp=disabled
    -Dlibwrap=disabled -Dseccomp=disabled -Dsystemd=disabled
    -Dlz4=disabled -Dgssapi=disabled
    -Danyconnect-compat=disabled -Dcompression=disabled
    -Droot-tests=false
  JOBS: 6

config-scope-check:
  stage: preliminaries
  script:
  - python3 tests/check-config-scope.py
  except:
  - tags
  - schedules

Signoff:
  stage: preliminaries
  script:
  # Quoted to work around https://gitlab.com/gitlab-org/gitlab-foss/-/issues/20177
  - 'echo "Checking for new commits without Signed-off-by: tags as described in https://gitlab.com/openconnect/ocserv/-/blob/master/CONTRIBUTING.md"'
  # Last bad commit
  - 'git log 6a65e3acdd3251fe20815cc2984a2781d9717173.. --grep "(^Signed-off-by)|(^Merge branch)|(^This reverts commit)" --extended-regexp --invert-grep --exit-code'
  - echo "None (good)"
  except:
  - tags
  - schedules

Debian:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
  script:
  - chmod -R o-w tests/data/raddb
  - git submodule update --init
  - meson setup build -Doidc-auth=enabled
  - ninja -C build -j$JOBS
  - export OCSERV_ALLOW_BROKEN_CLIENTS=1
  - meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/

i386/Debian:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_X86_CROSS_BUILD
  script:
  - git submodule update --init
  # Radius seems to be malfunctioning on i386 build
  - meson setup build -Doidc-auth=enabled -Dradius=disabled
  - ninja -C build -j$JOBS
  - VERBOSE=1 meson test -C build --num-processes $JOBS --no-rebuild --no-suite fw
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/

Ubuntu26.04:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$UBUNTU26_BUILD
  script:
  - git submodule update --init
  - meson setup build -Doidc-auth=enabled -Dlatency-stats=enabled
  - ninja -C build -j$JOBS
  - export MALLOC_CHECK_=3
  - meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/

Ubuntu22.04:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$UBUNTU22_BUILD
  script:
  - git submodule update --init
  - meson setup build -Doidc-auth=enabled -Dlatency-stats=enabled
  - ninja -C build -j$JOBS
  - export MALLOC_CHECK_=3
  # gssapi tests are skipped: openssl on Ubuntu22 doesn't support md4
  # See https://bugs.launchpad.net/ubuntu/+source/gss-ntlmssp/+bug/1995915
  - meson test -C build --num-processes $JOBS --no-rebuild --no-suite gssapi
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/

Centos8:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS8_BUILD
  script:
  - git submodule update --init
  - meson setup build
  - chmod og-w tests/data/raddb
  - chmod og-w tests/data/raddb/*
  - ninja -C build -j$JOBS
  - VERBOSE=1 meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/

Centos9:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS9_BUILD
  script:
  - git submodule update --init
  - meson setup build
  - chmod og-w tests/data/raddb
  - chmod og-w tests/data/raddb/*
  - ninja -C build -j$JOBS
  - VERBOSE=1 meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/

Centos10:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS10_BUILD
  script:
  - git submodule update --init
  - meson setup build
  - chmod og-w tests/data/raddb
  - chmod og-w tests/data/raddb/*
  - ninja -C build -j$JOBS
  - VERBOSE=1 meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/

Coverity:
  stage: preliminaries
  allow_failure: true
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS8_BUILD
  only:
  - schedules
  - coverity
  script:
  - wget --quiet https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$COVERITY_SCAN_PROJECT_NAME" -O /tmp/coverity_tool.tgz
  - tar xfz /tmp/coverity_tool.tgz
  - git submodule update --init
  - CFLAGS="-g -O0" meson setup build -Dlatency-stats=enabled
  - cov-analysis-linux64-*/bin/cov-build --dir cov-int ninja -C build -j$JOBS
  - tar cfz cov-int.tar.gz cov-int
  - curl https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME
    --form token=$COVERITY_SCAN_TOKEN --form email=n.mavrogiannopoulos@gmail.com
    --form file=@cov-int.tar.gz --form version="`git describe --tags`"
    --form description="CI build"
  tags:
  - saas-linux-small-amd64
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - cov-int/*.txt

# Test building with musl
musl/Alpine:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$ALPINE_BUILD
  script:
  - meson setup build -Dwith-werror=true
  - ninja -C build -j$JOBS
  tags:
  - saas-linux-small-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    untracked: true
    when: on_failure
    exclude:
      - "**/*.tmp"

Fedora:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  # ensure gcov scripts are writable
  - umask 000
  - chmod -R o-w tests/data/raddb
  - git submodule update --init
  - CFLAGS="-g -O0" meson setup build -Db_coverage=true -Dkerberos-tests=true -Doidc-auth=enabled
  - ninja -C build -j$JOBS
  - COVERAGE=1 VERBOSE=1 meson test -C build --num-processes $JOBS --no-rebuild
  - ninja -C build coverage
  coverage: '/lines[.]+: (\d+\.\d+)/'
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  artifacts:
    expire_in: 1 day
    untracked: true
    when: always
    exclude:
      - "**/*.tmp"

noprocfs/Fedora:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  - chmod -R o-w tests/data/raddb
  - git submodule update --init
  - meson setup build -Dnamespaces=disabled
  - ninja -C build -j$JOBS
  - meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-small-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    untracked: true
    when: on_failure
    exclude:
      - "**/*.tmp"

noprocfs/distcheck/Fedora:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  - chmod -R o-w tests/data/raddb
  - git submodule update --init
  - meson setup build -Dnamespaces=disabled
  - ninja -C build -j$JOBS
  - meson dist -C build --no-tests
  - mkdir dist-unpack
  - tar -xJf build/meson-dist/ocserv-*.tar.xz -C dist-unpack
  - meson setup dist-unpack/ocserv-* dist-build -Dnamespaces=disabled
  - ninja -C dist-build -j$JOBS
  tags:
  - saas-linux-small-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/
      - build/meson-dist/
      - dist-build/meson-logs/

clang/Fedora:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  - chmod -R o-w tests/data/raddb
  - git submodule update --init
  - CC=clang meson setup build -Dwith-werror=true
  - ninja -C build -j$JOBS
  - meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    untracked: true
    when: on_failure
    exclude:
      - "**/*.tmp"

# Tests seccomp filters by asking seccomp to fail with a trap
seccomp/Fedora:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  - chmod -R o-w tests/data/raddb
  - git submodule update --init
  - meson setup build -Dkerberos-tests=true -Doidc-auth=enabled -Dseccomp-trap=true
  - ninja -C build -j$JOBS
  - meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    untracked: true
    when: on_failure
    exclude:
      - "**/*.tmp"

# Tests per-worker RLIMIT_DATA by making setrlimit failures fatal
worker-memory-limit/Fedora:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  - chmod -R o-w tests/data/raddb
  - git submodule update --init
  - meson setup build -Dworker-memory-limit-test=true
  - ninja -C build -j$JOBS
  - meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    untracked: true
    when: on_failure
    exclude:
      - "**/*.tmp"

minimal:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS8_BUILD
  script:
  - git submodule update --init
  - meson setup build $MINIMAL_OPTIONS
  - ninja -C build -j$JOBS
  - meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/

# Build a minimal version with every optional feature disabled
minimal/Ubuntu26.04:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$UBUNTU26_BUILD
  script:
  - git submodule update --init
  - meson setup build $MINIMAL_OPTIONS
  - ninja -C build -j$JOBS
  - meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/

# We do not compile with PAM under address sanitizer since we are using co-routines
# without instrumentation for sanitizer.
asan/clang/Fedora:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  - chmod -R o-w tests/data/raddb
  - git submodule update --init
  - CC=clang CFLAGS="-fsanitize=address -fno-optimize-sibling-calls -fno-omit-frame-pointer -g -O1" meson setup build -Dpam=disabled -Db_lundef=false -Dserial-heavy-tests=true
  - ninja -C build -j$JOBS
  - DISABLE_ASAN_BROKEN_TESTS=1 meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/

ubsan/Fedora:
  stage: testing
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  - chmod -R o-w tests/data/raddb
  - git submodule update --init
  - export UBCFLAGS="-Wall -Wextra -fsanitize=undefined -fsanitize=bool -fsanitize=alignment -fsanitize=null -fsanitize=bounds-strict -fsanitize=enum -fno-sanitize-recover -g -O2 -Werror -Wno-unused-function -Wno-unused-parameter"
  - CFLAGS="$UBCFLAGS" meson setup build
  - ninja -C build -j$JOBS
  - meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/

static-analyzer/Fedora:
  stage: preliminaries
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  - meson setup build -Doidc-auth=enabled -Dlatency-stats=enabled -Dlocal-protobuf=true
  - scan-build --status-bugs -o scan-build-src ninja -C build -j$JOBS
  tags:
  - saas-linux-medium-amd64
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - scan-build-src/*

codingstyle/Fedora:
  stage: preliminaries
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  - find src/ tests/ -name '*.[ch]'| grep -Ev '^(src/http-heads.c|src/cfg.pb-c|src/ipc.pb-c|src/ctl.pb-c|src/pcl|src/protobuf|src/ccan|src/gnulib|src/inih|src/llhttp)'| xargs -I{} clang-format -style=file --dry-run {} -Werror
  tags:
  - saas-linux-small-amd64
  except:
  - tags
  - schedules

.FreeBSD:
  stage: testing
  script:
  - git submodule update --init
  - meson setup build -Droot-tests=false
  - ninja -C build -j$JOBS
  - meson test -C build --num-processes $JOBS --no-rebuild
  tags:
  - freebsd
  only:
  - branches@openconnect/ocserv
  except:
  - tags
  - schedules
  artifacts:
    expire_in: 1 week
    when: on_failure
    paths:
      - build/meson-logs/

pages:
  stage: deploy
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  - mkdir -p public/coverage
  - ninja -C build coverage-html
  - cp -r build/meson-logs/coveragereport/* public/coverage/
  tags:
  - saas-linux-small-amd64
  dependencies:
  - Fedora
  only:
  - master@openconnect/ocserv
  artifacts:
    paths:
    - public

triage:
  stage: preliminaries
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  - gem install gitlab-triage
  - gitlab-triage --source-id $CI_PROJECT_ID --token "$API_TOKEN" -d
  tags:
  - saas-linux-small-amd64
  only:
  - schedules

codespell/Fedora:
  stage: preliminaries
  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
  script:
  - git submodule update --init
  - codespell .
  tags:
  - saas-linux-small-amd64
  except:
  - tags
  - schedules