.gitlab-ci.yml

# =============================================================================
# CubeOS HAL Pipeline — Build, Package, Deploy
# =============================================================================
# Builds Go binary, generates OpenAPI docs, builds multi-arch Docker image,
# pushes to GHCR, and deploys to Pi via SSH.
# =============================================================================

stages:
  - validate
  - build
  - package
  - deploy

variables:
  HAL_IMAGE: "ghcr.io/cubeos-app/hal"
  BUILDER_IMAGE: "ghcr.io/cubeos-app/api-builder:latest"

# -----------------------------------------------------------------------------
# CONSISTENCY CHECK — CubeOS critical rules gate
# -----------------------------------------------------------------------------
lint:consistency:
  stage: validate
  image: alpine:latest
  tags: [multiarch]
  variables:
    GIT_DEPTH: 50
  before_script:
    - apk add --no-cache git bash
  script:
    - |
      bash <<'CONSISTENCY_CHECK'
      if [ "$CI_COMMIT_BRANCH" = "main" ]; then
        DIFF=$(git diff HEAD~1 HEAD -- . ':!.gitlab-ci.yml' 2>/dev/null || echo "")
      else
        git fetch origin main --depth=50 2>/dev/null || true
        DIFF=$(git diff origin/main...HEAD -- . ':!.gitlab-ci.yml' 2>/dev/null || git diff HEAD~1 HEAD -- . ':!.gitlab-ci.yml' 2>/dev/null || echo "")
      fi

      # Filter out the consistency check script's own lines to prevent false positives
      DIFF=$(echo "$DIFF" | grep -v 'VIOLATIONS+=\|WARNINGS+=\|CONSISTENCY_CHECK\|grep.*-[cq]E' || echo "$DIFF")

      if [ -z "$DIFF" ]; then
        echo "No diff to check. Skipping."
        exit 0
      fi

      REPO_NAME="hal"
      VIOLATIONS=()
      WARNINGS=()

      # Rule 1: HAL boundary
      if echo "$DIFF" | grep -qE '^\+.*\bnsenter\b'; then
        VIOLATIONS+=("HAL boundary: nsenter found — all host ops must go through HAL")
      fi
      if echo "$DIFF" | grep -qE '^\+.*exec\.Command.*systemctl'; then
        VIOLATIONS+=("HAL boundary: direct systemctl call — use HAL REST endpoint")
      fi

      # Rule 2: CGO
      if echo "$DIFF" | grep -qE '^\+.*import "C"'; then
        VIOLATIONS+=("CGO: import C found — all Go must compile with CGO_ENABLED=0")
      fi

      # Rule 3: docker run
      if echo "$DIFF" | grep -E '^\+\s*docker run ' | grep -qvE '(#|comment)'; then
        VIOLATIONS+=("Orchestration: docker run found — use docker stack deploy")
      fi

      # Rule 4: Swagger annotations on new handlers
      NEW_HANDLERS=$(echo "$DIFF" | grep -cE '^\+func [A-Z][a-zA-Z]*(Handler|Handle|Endpoint)\(' || true)
      NEW_SWAGGER=$(echo "$DIFF" | grep -cE '^\+.*@Summary' || true)
      if [ "$NEW_HANDLERS" -gt 0 ] && [ "$NEW_SWAGGER" -eq 0 ]; then
        WARNINGS+=("Swagger: $NEW_HANDLERS new handler(s) with no @Summary annotation")
      fi

      # Rule 5: Migration edits (append-only)
      if echo "$DIFF" | grep -qE '^--- .*migrations\.go'; then
        EDITED=$(echo "$DIFF" | grep -cE '^\-.*migration|^\-.*CREATE TABLE|^\-.*ALTER TABLE' || true)
        if [ "$EDITED" -gt 0 ]; then
          VIOLATIONS+=("Database: existing migration modified — migrations are append-only")
        fi
      fi

      # Rule 6: Pi-hole deprecated CLI
      if echo "$DIFF" | grep -qE '^\+.*(pihole -a|pihole --|pihole reloaddns|docker exec.*pihole.*--config)'; then
        VIOLATIONS+=("Pi-hole: deprecated CLI — use v6 REST API at port 6001")
      fi

      # Rule 7: YouTrack issue ID
      if ! echo "$CI_COMMIT_MESSAGE" | grep -qE '\[CUBEOS-[0-9]+\]'; then
        if ! echo "$CI_COMMIT_MESSAGE" | grep -qE '^chore: bump version'; then
          WARNINGS+=("Traceability: commit has no [CUBEOS-XX] reference")
        fi
      fi

      echo ""
      echo "=== Consistency Check: $REPO_NAME ==="
      if [ ${#VIOLATIONS[@]} -gt 0 ]; then
        echo "VIOLATIONS (pipeline blocked):"
        for v in "${VIOLATIONS[@]}"; do echo "  [BLOCK] $v"; done
      fi
      if [ ${#WARNINGS[@]} -gt 0 ]; then
        echo "WARNINGS (review recommended):"
        for w in "${WARNINGS[@]}"; do echo "  [WARN]  $w"; done
      fi
      if [ ${#VIOLATIONS[@]} -eq 0 ] && [ ${#WARNINGS[@]} -eq 0 ]; then
        echo "  All checks passed."
      fi
      echo ""
      if [ ${#VIOLATIONS[@]} -gt 0 ]; then
        echo "FAILED: ${#VIOLATIONS[@]} violation(s). Fix before merging."
        exit 1
      fi
      echo "PASSED"
      CONSISTENCY_CHECK
  rules:
    - when: always
  allow_failure: false

# -----------------------------------------------------------------------------
# BUILD — Generate OpenAPI docs + Compile Go binary
# -----------------------------------------------------------------------------
build:
  stage: build
  tags: [multiarch]
  image: ${BUILDER_IMAGE}
  script:
    - cd ${CI_PROJECT_DIR}
    - go mod download

    # Generate OpenAPI docs from swaggo annotations
    - echo "Installing swag CLI..."
    - go install github.com/swaggo/swag/cmd/swag@latest
    - export PATH=$PATH:$(go env GOPATH)/bin

    - echo "Generating OpenAPI spec from annotations..."
    - |
      swag init \
        -g cmd/cubeos-hal/main.go \
        --output ./docs \
        --parseDependency \
        --parseInternal \
        --parseDepth 2 \
        || echo "Swag init had warnings (may be OK)"

    - |
      if [ -f docs/swagger.yaml ]; then
        cp docs/swagger.yaml internal/handlers/openapi.yaml
        echo "OpenAPI spec generated ($(wc -l < docs/swagger.yaml) lines)"
      elif [ -f docs/swagger.json ]; then
        echo "Converting swagger.json to yaml..."
        python3 -c "import json,yaml; yaml.dump(json.load(open('docs/swagger.json')), open('internal/handlers/openapi.yaml','w'), default_flow_style=False)" 2>/dev/null \
          || cp docs/swagger.json internal/handlers/openapi.yaml
        echo "OpenAPI spec generated from JSON"
      else
        echo "No swagger spec generated, using existing openapi.yaml"
      fi

    # Build binaries for both architectures
    - echo "Building ARM64 binary..."
    - GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -ldflags="-s -w" -o cubeos-hal-arm64 ./cmd/cubeos-hal/

    - echo "Building AMD64 binary..."
    - GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w" -o cubeos-hal-amd64 ./cmd/cubeos-hal/

    - ls -lh cubeos-hal-arm64 cubeos-hal-amd64 internal/handlers/openapi.yaml
  artifacts:
    paths:
      - cubeos-hal-arm64
      - cubeos-hal-amd64
      - internal/handlers/openapi.yaml
    expire_in: 1 week
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# -----------------------------------------------------------------------------
# PACKAGE — Build multi-arch Docker image and push to GHCR
# -----------------------------------------------------------------------------
package:
  stage: package
  tags: [multiarch]
  image: docker:28
  needs:
    - job: build
      artifacts: true
  before_script:
    - echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USER" --password-stdin
    - echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USER" --password-stdin
    - docker buildx create --name halbuilder --driver docker-container --use
    - docker buildx inspect --bootstrap
  script:
    - |
      echo "OpenAPI spec in build context:"
      wc -l internal/handlers/openapi.yaml

      docker buildx build --no-cache \
        --platform linux/amd64,linux/arm64 \
        --push \
        -t ${HAL_IMAGE}:${CI_COMMIT_SHORT_SHA} \
        -t ${HAL_IMAGE}:latest \
        .
      echo "Pushed multi-arch ${HAL_IMAGE}:${CI_COMMIT_SHORT_SHA}"
  after_script:
    - docker buildx rm halbuilder || true
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# -----------------------------------------------------------------------------
# DEPLOY — Pull latest image on Pi and restart HAL container (via SSH)
# -----------------------------------------------------------------------------
deploy:
  stage: deploy
  tags: [multiarch]
  image: alpine:latest
  needs:
    - package
  before_script:
    - apk add --no-cache openssh-client curl
    - eval $(ssh-agent -s)
    - echo "$CI_DEPLOY_SSH_KEY" | tr -d '\r' | ssh-add -
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    # Resolve deploy target — try primary, fall back to alt interface
    - |
      _RESOLVED=""
      for ADDR in ${PI_DEPLOY_ADDR} ${PI_DEPLOY_ADDR_ALT}; do
        [ -z "$ADDR" ] && continue
        ssh-keyscan -H "$ADDR" >> ~/.ssh/known_hosts 2>/dev/null || true
        if ssh -o ConnectTimeout=5 -o BatchMode=yes "cubeos@${ADDR}" true 2>/dev/null; then
          _RESOLVED="$ADDR"
          break
        fi
      done
      if [ -z "$_RESOLVED" ]; then
        echo "ERROR: Pi unreachable at ${PI_DEPLOY_ADDR} / ${PI_DEPLOY_ADDR_ALT}"
        exit 1
      fi
      export PI_DEPLOY_ADDR="$_RESOLVED"
      export PI_DEPLOY_HOST="cubeos@${_RESOLVED}"
      echo "Deploy target: ${PI_DEPLOY_HOST}"
  script:
    - scp scripts/ci-deploy.sh ${PI_DEPLOY_HOST}:/tmp/ci-deploy-hal.sh
    # Run deploy detached via nohup — HAL container recreate can disrupt WiFi
    # which kills the SSH session. The deploy script has a WiFi recovery watchdog.
    - |
      ssh ${PI_DEPLOY_HOST} \
        "GHCR_TOKEN='${GHCR_TOKEN}' GHCR_USER='${GHCR_USER}' CI_COMMIT_SHORT_SHA='${CI_COMMIT_SHORT_SHA}' \
         nohup bash /tmp/ci-deploy-hal.sh > /tmp/hal-deploy.log 2>&1 & echo \$!"
    # Wait for deploy + WiFi recovery (container recreate + health check + watchdog)
    - sleep 70
    # Reconnect to verify deploy — try both interfaces (WiFi may have changed)
    - |
      VERIFY_CMD="echo '--- Deploy log ---'; cat /tmp/hal-deploy.log 2>/dev/null; \
        echo '--- WiFi recovery log ---'; cat /tmp/hal-wifi-recovery.log 2>/dev/null; \
        echo '--- Health check ---'; curl -sf http://127.0.0.1:6005/health && echo 'HAL OK'"
      CLEANUP_CMD="rm -f /tmp/ci-deploy-hal.sh /tmp/hal-deploy.log /tmp/hal-wifi-recovery.log"
      for i in 1 2 3 4 5; do
        for ADDR in ${PI_DEPLOY_ADDR} ${PI_DEPLOY_ADDR_ALT}; do
          [ -z "$ADDR" ] && continue
          ssh-keyscan -H "$ADDR" >> ~/.ssh/known_hosts 2>/dev/null || true
          if ssh -o ConnectTimeout=10 -o BatchMode=yes "cubeos@${ADDR}" "$VERIFY_CMD" 2>/dev/null; then
            echo "HAL deploy verified via ${ADDR}"
            ssh -o ConnectTimeout=5 "cubeos@${ADDR}" "$CLEANUP_CMD" 2>/dev/null || true
            exit 0
          fi
        done
        echo "Attempt $i: Pi not yet reachable, waiting 15s..."
        sleep 15
      done
      echo "ERROR: Pi not reachable after HAL deploy"
      exit 1
  after_script:
    - kill $SSH_AGENT_PID 2>/dev/null || true
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  environment:
    name: production