variables:
  PROJECT_NAME: glitchtip
  PIP_DISABLE_PIP_VERSION_CHECK: "on"
  POSTGRES_HOST_AUTH_METHOD: "trust"
  UV_VERSION: 0.9
  BASE_LAYER: trixie
  UV_SYSTEM_PYTHON: "true"
  UV_PYTHON_DOWNLOADS: "never"
  UV_PROJECT_ENVIRONMENT: "/usr/local"
  UV_CACHE_DIR: ".uv-cache"
  DEBUG: "true"

include:
  - template: SAST.gitlab-ci.yml
  - template: Dependency-Scanning.gitlab-ci.yml
  - template: Secret-Detection.gitlab-ci.yml

workflow:
  rules:
    # Run pipelines on pushes to default branch.
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    # Run pipelines for merge request events.
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    # Do not run pipelines for branch pushes if an MR exists.
    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
      when: never
    # Run pipelines for branches without MR (yet).
    - if: $CI_COMMIT_BRANCH
    # Run pipelines for pushed tags, web UI, and schedules.
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == 'web'
    - if: $CI_PIPELINE_SOURCE == 'schedule'

test:
  image: ghcr.io/astral-sh/uv:$UV_VERSION-python$PYTHON_VERSION-$BASE_LAYER
  variables:
    SECRET_KEY: testing
    ENABLE_TEST_API: "true"
    ENABLE_OPEN_USER_REGISTRATION: "true"
  services:
    - postgres:$POSTGRES_VERSION
  cache:
    - key:
        files:
          - uv.lock
      paths:
        - $UV_CACHE_DIR
  script:
    - uv sync --frozen --no-install-project
    - uv run ./manage.py test
    - uv cache prune --ci
  rules:
    - if: $CI_PIPELINE_SOURCE != "schedule"
  parallel:
    matrix:
      - PYTHON_VERSION: '3.11'
        POSTGRES_VERSION: '14'
      - PYTHON_VERSION: '3.13'
        POSTGRES_VERSION: '18'

lint:
  image: python:3.13-slim
  script:
    - pip install ruff
    - ruff check glitchtip/ apps/
  rules:
    - if: $CI_PIPELINE_SOURCE != "schedule"

build:
  image: docker:29
  rules:
    # Exclude merge requests and scheduled execution.
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_PIPELINE_SOURCE == "schedule"
      when: never
    # Run build only on protected branches and tags (master or v0.0.0).
    - if: $CI_COMMIT_REF_PROTECTED
  services:
    - docker:29-dind
  script:
    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN registry.gitlab.com
    - docker build -t ${CI_REGISTRY_IMAGE}:${CI_COMMIT_REF_NAME//\//-} --build-arg IS_CI="True" .
    - docker push ${CI_REGISTRY_IMAGE}:${CI_COMMIT_REF_NAME//\//-}

build_arm_x86:
  image: docker:29
  services:
    - docker:29-dind
  before_script:
    - docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
  script:
    - wget https://gitlab.com/api/v4/projects/15449363/jobs/artifacts/$CI_COMMIT_TAG/download?job=build-assets -O assets.zip
    - unzip assets.zip
    - rm assets.zip
    - mv dist/glitchtip-frontend/browser/* dist/
    - rmdir dist/glitchtip-frontend/browser/

    # --- Updated Version Parsing ---
    # Git tag (e.g., v5.0.1)
    - VERSION_V_FULL=${CI_COMMIT_REF_NAME}

    # No-v versions (e.g., 5.0.1, 5.0, 5)
    - VERSION_NO_V_FULL=${CI_COMMIT_REF_NAME#*v}
    - VERSION_NO_V_MINOR=${VERSION_NO_V_FULL%.*}
    - VERSION_NO_V_MAJOR=${VERSION_NO_V_FULL%%.*}

    # V-prefixed versions (e.g., v5.0, v5)
    - VERSION_V_MINOR="v${VERSION_NO_V_MINOR}"
    - VERSION_V_MAJOR="v${VERSION_NO_V_MAJOR}"

    # Quoted to handle colons in echo
    - 'echo "Building tags: latest, ${VERSION_NO_V_FULL}, ${VERSION_NO_V_MINOR}, ${VERSION_NO_V_MAJOR}, ${VERSION_V_FULL}, ${VERSION_V_MINOR}, ${VERSION_V_MAJOR}"'

    - docker login -u ${DOCKER_CI_REGISTRY_USER} -p ${DOCKER_CI_REGISTRY_PASSWORD}
    - docker buildx create --use
    - docker buildx build --platform linux/arm64/v8,linux/amd64 --push -t ${DOCKER_CI_REGISTRY_IMAGE}:latest -t ${DOCKER_CI_REGISTRY_IMAGE}:${VERSION_NO_V_FULL} -t ${DOCKER_CI_REGISTRY_IMAGE}:${VERSION_NO_V_MINOR} -t ${DOCKER_CI_REGISTRY_IMAGE}:${VERSION_NO_V_MAJOR} -t ${DOCKER_CI_REGISTRY_IMAGE}:${VERSION_V_FULL} -t ${DOCKER_CI_REGISTRY_IMAGE}:${VERSION_V_MINOR} -t ${DOCKER_CI_REGISTRY_IMAGE}:${VERSION_V_MAJOR} --build-arg IS_CI="True" --build-arg GLITCHTIP_VERSION=${VERSION_NO_V_FULL} --build-arg COLLECT_STATIC="True" .
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: never
    - if: '$CI_COMMIT_TAG =~ /^v\d+.\d+.\d+/ && $CI_COMMIT_REF_PROTECTED == "true"'

update_deps:
  image: renovate/renovate:42
  variables:
    RENOVATE_PLATFORM: gitlab
    RENOVATE_ENDPOINT: https://gitlab.com/api/v4
    RENOVATE_TOKEN: $GITLAB_ACCESS_TOKEN
    RENOVATE_REPOSITORIES: glitchtip/glitchtip-backend
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
  script: renovate