.gitlab-ci.yml

# =============================================================================
# CubeOS API Pipeline - Build, Package, Deploy
# =============================================================================
stages:
  - lint
  - test
  - build
  - package
  - deploy

variables:
  GOPROXY: "https://proxy.golang.org,direct"
  GHCR_IMAGE: "ghcr.io/cubeos-app/api"
  BUILDER_IMAGE: "ghcr.io/cubeos-app/api-builder:latest"

# -----------------------------------------------------------------------------
# CONSISTENCY CHECK — CubeOS critical rules gate
# -----------------------------------------------------------------------------
lint:consistency:
  stage: lint
  image: alpine:latest
  tags: [multiarch]
  variables:
    GIT_DEPTH: 50
  before_script:
    - apk add --no-cache git bash
  script:
    - |
      bash <<'CONSISTENCY_CHECK'
      if [ "$CI_COMMIT_BRANCH" = "main" ]; then
        DIFF=$(git diff HEAD~1 HEAD -- . ':!.gitlab-ci.yml' 2>/dev/null || echo "")
      else
        git fetch origin main --depth=50 2>/dev/null || true
        DIFF=$(git diff origin/main...HEAD -- . ':!.gitlab-ci.yml' 2>/dev/null || git diff HEAD~1 HEAD -- . ':!.gitlab-ci.yml' 2>/dev/null || echo "")
      fi

      # Filter out the consistency check script's own lines to prevent false positives
      DIFF=$(echo "$DIFF" | grep -v 'VIOLATIONS+=\|WARNINGS+=\|CONSISTENCY_CHECK\|grep.*-[cq]E' || echo "$DIFF")

      if [ -z "$DIFF" ]; then
        echo "No diff to check. Skipping."
        exit 0
      fi

      REPO_NAME="api"
      VIOLATIONS=()
      WARNINGS=()

      # Rule 1: HAL boundary
      if echo "$DIFF" | grep -qE '^\+.*\bnsenter\b'; then
        VIOLATIONS+=("HAL boundary: nsenter found — all host ops must go through HAL")
      fi
      if echo "$DIFF" | grep -qE '^\+.*exec\.Command.*systemctl'; then
        VIOLATIONS+=("HAL boundary: direct systemctl call — use HAL REST endpoint")
      fi

      # Rule 2: CGO
      if echo "$DIFF" | grep -qE '^\+.*import "C"'; then
        VIOLATIONS+=("CGO: import C found — all Go must compile with CGO_ENABLED=0")
      fi

      # Rule 3: docker run
      if echo "$DIFF" | grep -E '^\+\s*docker run ' | grep -qvE '(#|comment)'; then
        VIOLATIONS+=("Orchestration: docker run found — use docker stack deploy")
      fi

      # Rule 4: Swagger annotations on new handlers
      NEW_HANDLERS=$(echo "$DIFF" | grep -cE '^\+func [A-Z][a-zA-Z]*(Handler|Handle|Endpoint)\(' || true)
      NEW_SWAGGER=$(echo "$DIFF" | grep -cE '^\+.*@Summary' || true)
      if [ "$NEW_HANDLERS" -gt 0 ] && [ "$NEW_SWAGGER" -eq 0 ]; then
        WARNINGS+=("Swagger: $NEW_HANDLERS new handler(s) with no @Summary annotation")
      fi

      # Rule 5: Migration edits (append-only)
      if echo "$DIFF" | grep -qE '^--- .*migrations\.go'; then
        EDITED=$(echo "$DIFF" | grep -cE '^\-.*migration|^\-.*CREATE TABLE|^\-.*ALTER TABLE' || true)
        if [ "$EDITED" -gt 0 ]; then
          VIOLATIONS+=("Database: existing migration modified — migrations are append-only")
        fi
      fi

      # Rule 6: Pi-hole deprecated CLI
      if echo "$DIFF" | grep -qE '^\+.*(pihole -a|pihole --|pihole reloaddns|docker exec.*pihole.*--config)'; then
        VIOLATIONS+=("Pi-hole: deprecated CLI — use v6 REST API at port 6001")
      fi

      # Rule 7: YouTrack issue ID
      if ! echo "$CI_COMMIT_MESSAGE" | grep -qE '\[CUBEOS-[0-9]+\]'; then
        if ! echo "$CI_COMMIT_MESSAGE" | grep -qE '^chore: bump version'; then
          WARNINGS+=("Traceability: commit has no [CUBEOS-XX] reference")
        fi
      fi

      echo ""
      echo "=== Consistency Check: $REPO_NAME ==="
      if [ ${#VIOLATIONS[@]} -gt 0 ]; then
        echo "VIOLATIONS (pipeline blocked):"
        for v in "${VIOLATIONS[@]}"; do echo "  [BLOCK] $v"; done
      fi
      if [ ${#WARNINGS[@]} -gt 0 ]; then
        echo "WARNINGS (review recommended):"
        for w in "${WARNINGS[@]}"; do echo "  [WARN]  $w"; done
      fi
      if [ ${#VIOLATIONS[@]} -eq 0 ] && [ ${#WARNINGS[@]} -eq 0 ]; then
        echo "  All checks passed."
      fi
      echo ""
      if [ ${#VIOLATIONS[@]} -gt 0 ]; then
        echo "FAILED: ${#VIOLATIONS[@]} violation(s). Fix before merging."
        exit 1
      fi
      echo "PASSED"
      CONSISTENCY_CHECK
  rules:
    - when: always
  allow_failure: false

# -----------------------------------------------------------------------------
# LINT
# -----------------------------------------------------------------------------
lint:
  stage: lint
  tags: [multiarch]
  image: ${BUILDER_IMAGE}
  script:
    - cp -r . /app/
    - cd /app
    - go vet ./...
    - test -z "$(gofmt -l . | grep -v vendor)" || (echo "Code not formatted" && gofmt -l . && exit 1)
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "main"

# -----------------------------------------------------------------------------
# TEST
# -----------------------------------------------------------------------------
test:
  stage: test
  tags: [multiarch]
  image: ${BUILDER_IMAGE}
  script:
    - cp -r . /app/
    - cd /app
    - go clean -modcache
    - go mod download
    - go test -v -coverprofile=coverage.out ./...
    - cp coverage.out ${CI_PROJECT_DIR}/ || true
  artifacts:
    paths:
      - coverage.out
    expire_in: 1 week
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "main"

verify-routes:
  stage: test
  tags: [multiarch]
  image: ${BUILDER_IMAGE}
  before_script:
    - apk add --no-cache bash grep
  script:
    - cp -r . /app/
    - cd /app
    - go install github.com/swaggo/swag/cmd/swag@latest
    - export PATH=$PATH:$(go env GOPATH)/bin
    - swag init --generalInfo cmd/cubeos-api/main.go --dir ./ --output docs --parseDependency --parseInternal
    - bash scripts/verify-routes.sh
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "main"

# -----------------------------------------------------------------------------
# BUILD - Generate Swagger docs and compile binaries
# -----------------------------------------------------------------------------
build:
  stage: build
  tags: [multiarch]
  image: ${BUILDER_IMAGE}
  script:
    - cp -r . /app/
    - cd /app
    - go clean -modcache
    - go mod download
    - go install github.com/swaggo/swag/cmd/swag@latest
    - export PATH=$PATH:$(go env GOPATH)/bin
    - |
      echo "Generating Swagger documentation..."
      swag init \
        --generalInfo cmd/cubeos-api/main.go \
        --dir ./ \
        --output docs \
        --parseDependency \
        --parseInternal
    - ls -la docs/
    - GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -ldflags="-s -w -X main.Version=${CI_COMMIT_SHORT_SHA}" -o cubeos-api-arm64 ./cmd/cubeos-api/
    - GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w -X main.Version=${CI_COMMIT_SHORT_SHA}" -o cubeos-api-amd64 ./cmd/cubeos-api/
    - cp cubeos-api-arm64 cubeos-api-amd64 ${CI_PROJECT_DIR}/
    - cp -r docs ${CI_PROJECT_DIR}/
    - ls -lh ${CI_PROJECT_DIR}/cubeos-api-*
    - echo "Swagger docs generated and binaries built"
  artifacts:
    paths:
      - cubeos-api-arm64
      - cubeos-api-amd64
      - docs/
    expire_in: 1 week
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# -----------------------------------------------------------------------------
# PACKAGE - Build multi-arch Docker image and push to ghcr.io
# -----------------------------------------------------------------------------
package:
  stage: package
  tags: [multiarch]
  image: docker:28
  before_script:
    - echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USER" --password-stdin
    - echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USER" --password-stdin
    - docker buildx create --name mybuilder --driver docker-container --use
    - docker buildx inspect --bootstrap
  script:
    - |
      docker buildx build --no-cache \
        --platform linux/amd64,linux/arm64 \
        --push \
        -t ${GHCR_IMAGE}:${CI_COMMIT_SHORT_SHA} \
        -t ${GHCR_IMAGE}:latest \
        .
    - echo "Pushed multi-arch ${GHCR_IMAGE}:${CI_COMMIT_SHORT_SHA}"
  after_script:
    - docker buildx rm mybuilder || true
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# -----------------------------------------------------------------------------
# DEPLOY - Host-mode Swarm service deployment via SSH
# -----------------------------------------------------------------------------
# Host-mode ports require the old container to fully stop before the new one
# can bind. The Pi-side script (scripts/ci-deploy.sh) handles three failure modes:
#   1. Port held by zombie container -> force-remove before update
#   2. Service stuck at 0/1 from previous failure -> recover and redeploy
#   3. Service deleted entirely -> fresh stack deploy
# -----------------------------------------------------------------------------
deploy:
  stage: deploy
  tags: [multiarch]
  image: alpine:latest
  timeout: 8m
  needs:
    - package
  before_script:
    - apk add --no-cache openssh-client curl
    - eval $(ssh-agent -s)
    - echo "$CI_DEPLOY_SSH_KEY" | tr -d '\r' | ssh-add -
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    # Resolve deploy target — try primary, fall back to alt interface
    - |
      _RESOLVED=""
      for ADDR in ${PI_DEPLOY_ADDR} ${PI_DEPLOY_ADDR_ALT}; do
        [ -z "$ADDR" ] && continue
        ssh-keyscan -H "$ADDR" >> ~/.ssh/known_hosts 2>/dev/null || true
        if ssh -o ConnectTimeout=5 -o BatchMode=yes "cubeos@${ADDR}" true 2>/dev/null; then
          _RESOLVED="$ADDR"
          break
        fi
      done
      if [ -z "$_RESOLVED" ]; then
        echo "ERROR: Pi unreachable at ${PI_DEPLOY_ADDR} / ${PI_DEPLOY_ADDR_ALT}"
        exit 1
      fi
      export PI_DEPLOY_ADDR="$_RESOLVED"
      export PI_DEPLOY_HOST="cubeos@${_RESOLVED}"
      echo "Deploy target: ${PI_DEPLOY_HOST}"
  script:
    - scp scripts/ci-deploy.sh ${PI_DEPLOY_HOST}:/tmp/ci-deploy-api.sh
    - |
      ssh -o ServerAliveInterval=15 ${PI_DEPLOY_HOST} \
        "GHCR_TOKEN='${GHCR_TOKEN}' \
         GHCR_USER='${GHCR_USER}' \
         GHCR_IMAGE='${GHCR_IMAGE}' \
         CI_COMMIT_SHORT_SHA='${CI_COMMIT_SHORT_SHA}' \
         bash /tmp/ci-deploy-api.sh"
    - ssh ${PI_DEPLOY_HOST} "rm -f /tmp/ci-deploy-api.sh"
  after_script:
    - kill $SSH_AGENT_PID 2>/dev/null || true
  environment:
    name: production
    url: http://nllei01mule01:6010
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: on_success

# -----------------------------------------------------------------------------
# INTEGRATION TEST - Run API integration tests against deployed Pi
# -----------------------------------------------------------------------------
# P1-18: Runs after deploy succeeds. Tests all API endpoints on the live Pi.
# allow_failure: true — CI stays green while we stabilize the test suite.
# The test script already exists at scripts/api-integration-tests.sh.
# -----------------------------------------------------------------------------
integration-test:
  stage: deploy
  tags: [multiarch]
  image: alpine:latest
  timeout: 5m
  needs:
    - deploy
  before_script:
    - apk add --no-cache openssh-client curl jq bash
    - eval $(ssh-agent -s)
    - echo "$CI_DEPLOY_SSH_KEY" | tr -d '\r' | ssh-add -
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    # Resolve deploy target — try primary, fall back to alt interface
    - |
      _RESOLVED=""
      for ADDR in ${PI_DEPLOY_ADDR} ${PI_DEPLOY_ADDR_ALT}; do
        [ -z "$ADDR" ] && continue
        ssh-keyscan -H "$ADDR" >> ~/.ssh/known_hosts 2>/dev/null || true
        if ssh -o ConnectTimeout=5 -o BatchMode=yes "cubeos@${ADDR}" true 2>/dev/null; then
          _RESOLVED="$ADDR"
          break
        fi
      done
      if [ -z "$_RESOLVED" ]; then
        echo "ERROR: Pi unreachable at ${PI_DEPLOY_ADDR} / ${PI_DEPLOY_ADDR_ALT}"
        exit 1
      fi
      export PI_DEPLOY_ADDR="$_RESOLVED"
      export PI_DEPLOY_HOST="cubeos@${_RESOLVED}"
      echo "Deploy target: ${PI_DEPLOY_HOST}"
  script:
    - |
      echo "============================================================"
      echo "  API Integration Tests — Post-Deploy"
      echo "============================================================"

      # Wait for API to settle after deploy
      echo "Waiting 15s for API to stabilize..."
      sleep 15

      # Verify API is responding before running full suite
      API_URL="http://${PI_DEPLOY_ADDR}:6010"
      if ! curl -sf --max-time 10 "${API_URL}/health" > /dev/null 2>&1; then
        echo "ERROR: API not responding at ${API_URL}/health"
        echo "Skipping integration tests."
        exit 1
      fi
      echo "API health: OK"

      # Copy and run integration test script on Pi
      scp scripts/api-integration-tests.sh ${PI_DEPLOY_HOST}:/tmp/api-integration-tests.sh
      ssh -o ServerAliveInterval=15 ${PI_DEPLOY_HOST} \
        "bash /tmp/api-integration-tests.sh http://127.0.0.1:6010 http://127.0.0.1:6005 admin ${CUBEOS_API_PASSWORD:-admin}"
      ssh ${PI_DEPLOY_HOST} "rm -f /tmp/api-integration-tests.sh"
  after_script:
    - kill $SSH_AGENT_PID 2>/dev/null || true
  allow_failure: true
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: on_success