stages:
  - pruefen
  - testen
  - bauen
  - scannen
  - ausrollen

variables:
  IMAGE: "$CI_REGISTRY_IMAGE"
  TAG: "$CI_COMMIT_SHORT_SHA"

default:
  interruptible: true          # alter Lauf wird bei neuem Push abgebrochen

# ---------------------------------------------------------------
lint:
  stage: pruefen
  image: python:3.12-slim
  script:
    - pip install --quiet ruff
    - ruff check src/ tests/
    - ruff format --check src/ tests/

geheimnisse-suchen:
  stage: pruefen
  image: zricethezav/gitleaks:latest
  script:
    - gitleaks detect --source . --verbose --no-git

# ---------------------------------------------------------------
unit-tests:
  stage: testen
  image: python:3.12-slim
  script:
    - pip install --quiet -r requirements.txt
    - pytest --junitxml=report.xml --cov=src --cov-report=xml
  artifacts:
    when: always
    reports:
      junit: report.xml

integration-tests:
  stage: testen
  image: python:3.12-slim
  services:
    - name: postgres:16
      alias: db
  variables:
    POSTGRES_PASSWORD: test
    DB_HOST: db
  script:
    - pip install --quiet -r requirements.txt
    - pytest tests/integration/ -v

# ---------------------------------------------------------------
container-bauen:
  stage: bauen
  image: quay.io/podman/stable
  script:
    - podman login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
    - |
      podman build \
        --label "org.opencontainers.image.revision=$CI_COMMIT_SHA" \
        --label "org.opencontainers.image.source=$CI_PROJECT_URL" \
        -t "$IMAGE:$TAG" .
    - podman push "$IMAGE:$TAG"
    - podman inspect "$IMAGE:$TAG" --format '{{.Digest}}' > digest.txt
  artifacts:
    paths: [digest.txt]
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# ---------------------------------------------------------------
schwachstellen:
  stage: scannen
  image: aquasec/trivy:latest
  script:
    - trivy image --exit-code 0 --severity LOW,MEDIUM "$IMAGE:$TAG"
    - trivy image --exit-code 1 --severity HIGH,CRITICAL "$IMAGE:$TAG"
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# ---------------------------------------------------------------
ausrollen-test:
  stage: ausrollen
  environment:
    name: test
  script:
    - ./scripts/deploy.sh test "$IMAGE@$(cat digest.txt)"
    - ./scripts/smoketest.sh https://kfz-test.intern
  rules:
    - if: $CI_COMMIT_BRANCH == "main"