.gitlab-ci.yml

image: $DOCKER_URL/node:20

stages:
  - update
  - commands
  - schema
  - atg-shared-checks
  - test
  - build
  - deploy
  - integration test
  - teardown
  - post build
  - docs

variables:
  BIGIP_IMAGE:
    description: The name of the BIG-IP image to use for integration testing. Names are specific to the deploy environment.
  DO_DOWNLOAD_DIR: do_rpm
  DOCS_BUILD_DIR: "docs/_build/html"
  F5_PERF_TRACING_ENABLED:
    description: Send performance traces to Jaeger
    value: "false"
    options:
      - "true"
      - "false"
  FORCE_INTEGRATION_TEST:
    description: Force a run of integration testing. Otherwise, decision is based on pipeline type.
    value: "false"
    options:
      - "true"
      - "false"
  GIT_DEPTH: "10"
  IMAGE_NAME: f5-as3-container
  RPM_PACKAGE_URL:
    description: URL from which to download the RPM to test. By default use the RPM from the build_rpm job.
  TEST_CODE_VERSION:
    description: AS3 branch/tag from which to get integration tests.
    value: "$CI_COMMIT_REF_NAME"
  TEST_MANUAL_PATH:
    description: Path to manual test file relative to test dir, only used when REGRESSION_SCHEDULE is set to manual.
    value: "test/integration/bigip/REPLACE_WITH_YOUR_TEST_FILE.js"
  REGRESSION_SCHEDULE:
    description: Type of schedule to run for integration tests.
    value: nightly
    options:
      - nightly
      - performance
      - remote
      - smoke
      - manual
  PARALLEL:
    description: Run integration tests in parallel. Deploy 3 BIGIP instances.
    value: "false"
    options:
      - "true"
      - "false"
  TF_DIRECTORY: test/common/env/terraform
  TF_HTTP_LOCK_METHOD: POST
  TF_HTTP_UNLOCK_METHOD: DELETE
  TF_HTTP_USERNAME: ${CI_REGISTRY_USER}
  TF_HTTP_PASSWORD: ${CI_JOB_TOKEN}
  TF_CLI_ARGS_apply: "-auto-approve"
  TF_CLI_ARGS_destroy: "-auto-approve"
  TF_STATE_URL: "$CI_API_V4_URL/projects/$CI_PROJECT_ID/terraform/state"
  # terraform will try to update state 5(4+1) times every 3 minutes.
  TF_HTTP_RETRY_MAX: 4
  TF_HTTP_RETRY_WAIT_MIN: 3
  TEST_REPORTER_OPTIONS: "--reporter mocha-multi-reporters --reporter-options configFile=test/mochaReporterConfig.json"
  CURL_CONTENT: "Content-Type: application/json"
  SECRETS_ANALYZER_VERSION: '5.1.16'

# This inherits all the jobs defined in the parent template
# Override variables in this project as needed
include:
# adds atg-shared-checks stage and jobs
# adds atg_shared_checks_result job to test stage
  - project: automation-toolchain/atg-shared-templates
    file:
      - compliance/base.gitlab-ci.yml
      - security/base.gitlab-ci.yml

# Override compliance template job
check_copyrights:
  allow_failure: false

# Override compliance template job
lint:
  needs:
    - schema
  allow_failure: false

.vault_id_token: &vault_id_token
  VAULT_ID_TOKEN:
    aud: $VAULT_SERVER_URL

update_autotool_deps:
  stage: update
  rules:
    - if: '$UPDATE_DEPS =~ /true/i'
  needs: []
  id_tokens: *vault_id_token
  secrets:
    AS3_ACCESS_TOKEN_PATH:
      vault: pipeline/secrets/AS3_ACCESS_TOKEN@kv
  variables:
    UPDATE_BRANCH_NAME: update_autotool_deps
  script:
    - export AS3_ACCESS_TOKEN=$(cat "$AS3_ACCESS_TOKEN_PATH")
    - . ./scripts/dev/update-as3-deps.sh
    - >
      if [ "$AUTOTOOL_DIFF" = "true" ]; then
        git push -f origin ${UPDATE_BRANCH_NAME}
        node ./scripts/dev/createMR.js
      fi
  tags: [cm-official-docker-executor]

schema:
  image: $DOCKER_URL/node:14
  stage: schema
  needs: []
  tags:
    - cm-official-docker-executor
  script:
    - npm ci --no-optional
    - npm run build-schema
  artifacts:
    name: f5-appsvcs-extension-$CI_COMMIT_SHA
    paths:
      - src/schema/latest/adc-schema.json
      - src/schema/latest/as3-schema.json
      - src/schema/latest/per-app-schema.json

coverage:
  image: $DOCKER_URL/node:16
  stage: test
  needs:
    - schema
  tags:
    - cm-official-docker-executor
  script:
    - npm ci
    - npm run coverage
  artifacts:
    paths:
      - coverage
  coverage: /All files[^|]*\|[^|]*\s+([\d\.]+)/

node:8:
  image: $DOCKER_URL/node:8
  stage: test
  needs:
    - schema
  tags:
    - cm-official-docker-executor
  script:
    - npm ci
    - npm install mocha@7
    - npm run test-no-build -- $TEST_REPORTER_OPTIONS
  artifacts:
    when: always
    reports:
      junit: test_report.xml

build_rpm:
  image: $DOCKER_URL/node:14
  stage: build
  needs:
    - schema
  script:
    # setup node environment
    - sed -i 's|http://deb.debian.org/debian|http://archive.debian.org/debian|g' /etc/apt/sources.list
    - sed -i 's|http://security.debian.org/debian-security|http://archive.debian.org/debian-security|g' /etc/apt/sources.list
    - apt-get update -o Acquire::Check-Valid-Until=false
    - apt-get update && apt-get install -y rpm --no-install-recommends
    - npm ci --no-optional
    # build installation package
    - scripts/build/buildRpm.sh "cloud"
  tags:
    - cm-official-docker-executor
  artifacts:
    name: f5-appsvcs-extension-$CI_COMMIT_SHA
    paths:
      - dist
      - src/schema/latest/adc-schema.json
      - src/schema/latest/as3-schema.json
      - src/schema/latest/per-app-schema.json

create_source:
  stage: post build
  needs:
    - build_rpm
  script:
    - scripts/build/source-package.sh
  tags:
    - cm-official-docker-executor
  artifacts:
    name: f5-appsvcs-source
    paths:
      - dist/*-source.tar.gz
      - dist/*-examples.tar.gz

build_api_docs:
  stage: build
  needs: []
  script:
    # install packages
    # package-lock ends up with OS specific info during npm install, so
    # make sure it is right for the platform we're on
    - rm package-lock.json
    - npm install
    # generate docs
    - npm run make-api-docs
    - mkdir apidocs && mv redoc-static.html apidocs/index.html
  tags:
    - cm-official-docker-executor
  artifacts:
    name: docs
    paths:
      - apidocs

.deploy_common: &deploy_common
  image: $INTEGRATION_DEPLOY_IMAGE
  tags:
    - classy-crows-as3-docker-runner
  stage: deploy
  timeout: 2 hours
  script:
    - export QRT_PASSPHRASE=$(cat "$QRT_PASSPHRASE_PATH")
    - export REGKEY=$(cat "$REGKEY_PATH")
    - apk update
    - |
      if [[ "${TEST_IN_AZURE,,}" != "true" ]]; then
        echo "Using QRT-based deployment"
        apk add npm gettext bash jq build-base python3 cmake
        # Set machine count based on test type
        # Note we use TF_VAR_bigip_count to unify Azure and OpenStack deployments
        if [[ "$PARALLEL" = "true" ]]; then
          export TF_VAR_bigip_count=3
        elif [ "$REGRESSION_SCHEDULE" = "remote" ]; then
          export TF_VAR_bigip_count=2
        else
          export TF_VAR_bigip_count=1
        fi
        # Save previous unified password if harness file exists (for retry scenarios)
        if [[ -f "qrt_harness_file.json" ]]; then
          export PREVIOUS_UNIFIED_PASSWORD=$(jq -r '.machines[0].password // empty' qrt_harness_file.json 2>/dev/null)
          if [[ -n "$PREVIOUS_UNIFIED_PASSWORD" ]]; then
            echo "Saved previous unified password from existing harness file for retry"
          fi
        fi
        # Reserve machines using QRT
        source scripts/dev/reserve_machines.sh
        # Extract unified password from first machine for password synchronization
        export UNIFIED_SSH_PASSWORD=$(echo "$QRT_MACHINES_JSON" | jq -r '.[0].password')
        echo "Using unified password from first machine for all machines"
        # Prepare machines (remove unwanted config, apply base settings, unify passwords)
        # prepare_machines.sh reads directly from QRT_MACHINES_JSON environment variable
        source scripts/dev/prepare_machines.sh
        # Extract credentials and IPs from QRT_MACHINES_JSON
        BIGIPS_ADDRESSES=($(echo "$QRT_MACHINES_JSON" | jq -r '.[].ip'))
        AS3_USERNAME=$(echo "$QRT_MACHINES_JSON" | jq -r '.[0].username')
        AS3_PASSWORD=$(echo "$QRT_MACHINES_JSON" | jq -r '.[0].password')
        # Create harness file for teardown stage
        bash scripts/dev/create_qrt_harness.sh "$QRT_RESERVATION_IDS" "$TF_VAR_bigip_count" "$QRT_MACHINES_JSON"
      else
        echo "Using Terraform-based deployment"
        apk add npm gettext
        cd "$TF_ROOT"
        terraform init
        if [[ "$SKIP_DEPLOYMENT" != "true" ]]; then
          # $SKIP_DEPLOYMENT may be undefined so we check for true
          terraform destroy
          terraform apply
        fi
        if [[ "$PARALLEL" = "true" ]]; then
          BIGIPS_ADDRESSES=($(terraform output --json admin_ip | jq -rc .[]))
        else
          # Single NIC deployment uses port 8443 for management IP
          AS3_HOST=$(terraform output --json admin_ip | jq -rc .[0]):8443
          if [ "$REGRESSION_SCHEDULE" = "remote" ]; then
            TARGET_HOST=$(terraform output --json admin_ip | jq -rc .[1]):8443
          fi
        fi
        AS3_USERNAME=$(terraform output --json admin_username | jq -rc .)
        AS3_PASSWORD=$(terraform output --json admin_password | jq -rc .)
        cd -
      fi
    - |
      if [[ -n "$RPM_PACKAGE_URL" ]]; then
        echo using RPM "$RPM_PACKAGE_URL" from RPM_PACKAGE_URL env var
        export RPM_PACKAGE=$(basename "$RPM_PACKAGE_URL")
        curl -o "$RPM_PACKAGE" "$RPM_PACKAGE_URL"
      elif [[ $CI_PIPELINE_SOURCE == "pipeline" ]]; then
        echo using RPM from cross-project pipeline
        RPM_PACKAGE=$(ls ${UPSTREAM_RPM_PATH}/*.rpm)
      else
        echo using RPM from our pipeline
        RPM_PACKAGE=$(ls ${CI_PROJECT_DIR}/dist/*.rpm)
      fi
    - |
      if [[ "$SKIP_DEPLOYMENT" != "true" ]]; then
        mkdir -p "$DO_DOWNLOAD_DIR"
        DO_RPM_FILE=$(scripts/dev/download-latest-do.sh "$DO_DOWNLOAD_DIR" "${DO_INTEGRATION_VERSION}")
        npm install --no-optional
        if [[ "$PARALLEL" = "true" ]]; then
          for IP in "${BIGIPS_ADDRESSES[@]}"; do
            echo "Configuring $IP"
            source scripts/dev/instance-config.sh "$IP" "$AS3_USERNAME:$AS3_PASSWORD" "$DO_RPM_FILE" "$TF_ROOT/onboard.json" "$RPM_PACKAGE" &
          done
          for job in $(jobs -p); do
            echo "Jobs $(jobs -p)"
            echo "Job we're waiting $job"
            wait $job
            RC=$?
            if [[ $RC != 0 ]]; then
              exit $RC
            fi
          done
          SERVER_SET_JSON=$(source scripts/dev/build-server-set.sh)
          echo "Posting server set to reservation server $RESERVATION_SERVER_HOST:$RESERVATION_SERVER_PORT"
          CURL_RESPONSE=$(curl -s --retry 5 --retry-max-time 300 -H "$CURL_CONTENT" -d "$SERVER_SET_JSON" -X POST http://$RESERVATION_SERVER_HOST:$RESERVATION_SERVER_PORT/reservations/api/server-sets)
          if ! echo "$CURL_RESPONSE" | jq empty 2>/dev/null; then
            echo "ERROR: Invalid JSON response from reservation server:"
            echo "$CURL_RESPONSE"
            exit 1
          fi
          SERVER_SET=$(echo "$CURL_RESPONSE" | jq -r .id)
          echo "Server set id is $SERVER_SET"
          echo "SERVER_SET=$SERVER_SET" >> deploy.env
        else
          # For non-parallel, construct AS3_HOST if not already set (QRT case)
          if [[ -z "$AS3_HOST" ]]; then
            AS3_HOST="${BIGIPS_ADDRESSES[0]}"
          fi
          echo "Configuring host $AS3_HOST"
          echo "AS3_HOST=$AS3_HOST" >> deploy.env
          echo "AS3_USERNAME=$AS3_USERNAME" >> deploy.env
          echo "AS3_PASSWORD=$AS3_PASSWORD" >> deploy.env
          source scripts/dev/instance-config.sh "$AS3_HOST" "$AS3_USERNAME:$AS3_PASSWORD" "$DO_RPM_FILE" "$TF_ROOT/onboard.json" "$RPM_PACKAGE" &
          if [ "$REGRESSION_SCHEDULE" = "remote" ]; then
            # For remote, construct TARGET_HOST if not already set (QRT case)
            if [[ -z "$TARGET_HOST" ]]; then
              TARGET_HOST="${BIGIPS_ADDRESSES[1]}"
            fi
            echo "Configuring target host $TARGET_HOST"
            echo "TARGET_HOST=$TARGET_HOST" >> deploy.env
            source scripts/dev/instance-config.sh "$TARGET_HOST" "$AS3_USERNAME:$AS3_PASSWORD" "$DO_RPM_FILE" "$TF_ROOT/onboard.json" "$RPM_PACKAGE" &
          fi
          wait
        fi
      else
        echo "skipping DO install due to SKIP_DEPLOYMENT"
      fi
  artifacts:
    when: always
    reports:
      dotenv: deploy.env
    paths:
      - qrt_harness_file.json
    expire_in: 1 day
  retry:
    max: 2
    when: always

deploy_to_azure:
  rules:
    - if: '$TEST_IN_AZURE =~ /true/i'
  needs:
    - job: build_rpm
      artifacts: true
    - job: schema
      artifacts: true
  id_tokens: *vault_id_token
  secrets:
    QRT_PASSPHRASE_PATH:
      vault: pipeline/secrets/QRT_PASSPHRASE@kv
    REGKEY_PATH:
      vault: pipeline/secrets/BIGIP_LICENSE_AZURE@kv
  variables:
    F5_DISABLE_CERT_VERIFY: 'true'
    TF_VAR_f5_cidr_blocks: "${F5_CIDR_BLOCKS}"
    TF_ROOT: "$TF_DIRECTORY/plans/azure"
  before_script:
    - export TF_VAR_bigip_version="${BIGIP_IMAGE}"
    # terraform doesn't support '.' in backend address.
    - export TRIM_VERSION="$(echo ${BIGIP_IMAGE} | cut -d '-' -f 2 | tr '.' -)"
    - |
      if [[ "$PARALLEL" = "true" ]]; then
        export TF_VAR_bigip_count=3
        export TF_HTTP_ADDRESS="$TF_STATE_URL/parallel-azure-$TRIM_VERSION"
      else
        export TF_HTTP_ADDRESS="$TF_STATE_URL/azure-$TRIM_VERSION"
      fi
    - export TF_HTTP_LOCK_ADDRESS="$TF_HTTP_ADDRESS/lock"
    - export TF_HTTP_UNLOCK_ADDRESS=$TF_HTTP_LOCK_ADDRESS
  <<: *deploy_common

deploy_for_this_project:
  rules:
    - if: '$TEST_IN_AZURE =~ /true/i'
      when: never
    - if: '$TRIGGER_INTEGRATION_TEST =~ /true/i'
      when: never
    - if: '$UPDATE_DEPS =~ /true/i'
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
    - if: '$FORCE_INTEGRATION_TEST =~ /true/i'
  needs:
    - job: build_rpm
      artifacts: true
    - job: schema
      artifacts: true
  id_tokens: *vault_id_token
  secrets:
    QRT_PASSPHRASE_PATH:
      vault: pipeline/secrets/QRT_PASSPHRASE@kv
    REGKEY_PATH:
      vault: pipeline/secrets/BIGIP_LICENSE@kv
  variables:
    TF_ROOT: "$TF_DIRECTORY/plans/openstack"
    TF_LOG: "DEBUG"  # Add this for detailed Terraform logs
    TF_LOG_PATH: "/tmp/terraform.log"  # Optional: save logs to file
  before_script:
    - export TF_VAR_bigip_version="${BIGIP_IMAGE}"
    # terraform doesn't support '.' in backend address.
    - export TRIM_VERSION="$(echo ${BIGIP_IMAGE} | cut -d '-' -f 2 | tr '.' -)"
    - |
      if [[ "$PARALLEL" = "true" ]]; then
        export TF_VAR_bigip_count=3
        export TF_HTTP_ADDRESS="$TF_STATE_URL/parallel-openstack-$TRIM_VERSION"
      elif [ "$REGRESSION_SCHEDULE" = "remote" ]; then
        export TF_VAR_bigip_count=2
        export TF_HTTP_ADDRESS="$TF_STATE_URL/remote-openstack-$TRIM_VERSION"
      elif [ "$REGRESSION_SCHEDULE" = "performance" ]; then
        export TF_VAR_performance_test=true
        export TF_HTTP_ADDRESS="$TF_STATE_URL/performance-openstack-$TRIM_VERSION"
      else
        export TF_HTTP_ADDRESS="$TF_STATE_URL/openstack-$TRIM_VERSION"
      fi
    - export TF_HTTP_LOCK_ADDRESS="$TF_HTTP_ADDRESS/lock"
    - export TF_HTTP_UNLOCK_ADDRESS=$TF_HTTP_LOCK_ADDRESS
  <<: *deploy_common

deploy_for_other_project:
  rules:
    - if: '$TRIGGER_INTEGRATION_TEST =~ /true/i'
  needs:
    - project: "$UPSTREAM_PROJECT_PATH"
      job: "$UPSTREAM_JOB"
      ref: "$UPSTREAM_REF"
      artifacts: true
  id_tokens: *vault_id_token
  secrets:
    QRT_PASSPHRASE_PATH:
      vault: pipeline/secrets/QRT_PASSPHRASE@kv
    REGKEY_PATH:
      vault: pipeline/secrets/BIGIP_LICENSE@kv
  variables:
    TF_ROOT: "$TF_DIRECTORY/plans/openstack"
  before_script:
    - |
      if [ -n "$UPSTREAM_RPM_PATH" ]; then
        export RPM_PACKAGE=$(ls ${UPSTREAM_RPM_PATH}/*.rpm)
      fi
    - export BIGIP_IMAGE="${BIGIP_IMAGE_DEFAULT}"
    - export TF_VAR_bigip_version="${BIGIP_IMAGE}"
    # terraform doesn't support '.' in backend address.
    - export TRIM_VERSION="$(echo ${BIGIP_IMAGE} | cut -d '-' -f 2 | tr '.' -)"
    - export TF_HTTP_ADDRESS="$TF_STATE_URL/atg-build-openstack-$TRIM_VERSION"
    - export TF_HTTP_LOCK_ADDRESS="$TF_HTTP_ADDRESS/lock"
    - export TF_HTTP_UNLOCK_ADDRESS=$TF_HTTP_LOCK_ADDRESS
  <<: *deploy_common

.test_rpms_common: &test_rpms_common
  image: $DOCKER_URL/node:20
  stage: integration test
  tags:
    - classy-crows-as3-docker-runner
  id_tokens: *vault_id_token
  secrets:
    ARM_CLIENT_ID_PATH:
      vault: pipeline/secrets/ARM_CLIENT_ID@kv
    ARM_CLIENT_SECRET_PATH:
      vault: pipeline/secrets/ARM_CLIENT_SECRET@kv
    ARM_SUBSCRIPTION_ID_PATH:
      vault: pipeline/secrets/ARM_SUBSCRIPTION_ID@kv
    ARM_TENANT_ID_PATH:
      vault: pipeline/secrets/ARM_TENANT_ID@kv
    DISCOVERY_AWS_ID_PATH:
      vault: pipeline/secrets/DISCOVERY_AWS_ID@kv
    DISCOVERY_AWS_SECRET_PATH:
      vault: pipeline/secrets/DISCOVERY_AWS_SECRET@kv
    DISCOVERY_GCE_SECRET_PATH:
      vault: pipeline/secrets/DISCOVERY_GCE_SECRET@kv
  script:
    - export ARM_CLIENT_ID=$(cat "$ARM_CLIENT_ID_PATH")
    - export ARM_TENANT_ID=$(cat "$ARM_TENANT_ID_PATH")
    - export ARM_CLIENT_SECRET=$(cat "$ARM_CLIENT_SECRET_PATH")
    - export ARM_SUBSCRIPTION_ID=$(cat "$ARM_SUBSCRIPTION_ID_PATH")
    - export DISCOVERY_AWS_ID=$(cat "$DISCOVERY_AWS_ID_PATH")
    - export DISCOVERY_AWS_SECRET=$(cat "$DISCOVERY_AWS_SECRET_PATH")
    - export DISCOVERY_GCE_SECRET=$(cat "$DISCOVERY_GCE_SECRET_PATH")
    - apt-get update && apt-get install -y jq --no-install-recommends
    - npm ci --no-optional
    - npm install --no-optional
    - REPO=f5-appsvcs-extension
    - if [[ "$TEST_CODE_VERSION" != $"CI_COMMIT_REF_NAME" ]]; then
    -   echo running test code from "$TEST_CODE_VERSION"
    -   if [[ "$TEST_CODE_VERSION" =~ ^v ]]; then
    -     if [[ "$TEST_CODE_VERSION" < v3.42.0 ]]; then
    -       REPO=f5-appsvcs
    -     fi
    -   fi
    -   TOP_DIR=$(pwd)
    -   TEST_CODE_DIR=test_code_repo/f5-appsvcs-extension
    -   git clone --branch "$TEST_CODE_VERSION" --single-branch https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}/automation-toolchain/${REPO}.git "$TEST_CODE_DIR"
    -   cd "$TEST_CODE_DIR"
    -   node scripts/build/schema-build.js
    -   cd "$TOP_DIR"
    - else
    -   echo running test code from current branch
    -   TEST_CODE_DIR=.
    - fi
    - MOCHA_OPTS=$TEST_REPORTER_OPTIONS
    - if [[ -f ${TEST_CODE_DIR}/test/integration/bigip/property/mochaHooks.js ]]; then
    -   MOCHA_OPTS="${MOCHA_OPTS} --require ${TEST_CODE_DIR}/test/integration/bigip/property/mochaHooks.js"
    - fi
    - if [[ "$PARALLEL" = "true" ]]; then
    -   MOCHA_OPTS="${MOCHA_OPTS} --parallel"
    - fi
    - echo "TESTING WITH IMAGE ${BIGIP_IMAGE}"
    - if [ "$SMOKE_TEST" = "true" ]; then
    -   export REGRESSION_SCHEDULE="smoke"
    - fi
    - export FILE_VERBOSITY=verbose
    - if [ "$REGRESSION_SCHEDULE" = "nightly" ]; then
    -   npx mocha ${TEST_CODE_DIR}/test/integration/bigip/property ${TEST_CODE_DIR}/test/integration/bigip/misc $MOCHA_OPTS --exit
    - elif [ "$REGRESSION_SCHEDULE" = "remote" ]; then
    -   npm run property -- $MOCHA_OPTS --exit
    - elif [ "$REGRESSION_SCHEDULE" = "smoke" ]; then
    -   npm run smoke -- $MOCHA_OPTS
    - elif [ "$REGRESSION_SCHEDULE" = "performance" ]; then
    -   ./scripts/dev/enable-perf-tracing.sh "$AS3_HOST" ${AS3_USERNAME}:${AS3_PASSWORD} "$JAEGER_ENDPOINT"
    -   npx mocha ${TEST_CODE_DIR}/test/integration/bigip/property $MOCHA_OPTS --exit
    - elif [ "$REGRESSION_SCHEDULE" = "manual" ]; then
    -   npx mocha ${TEST_CODE_DIR}/${TEST_MANUAL_PATH} $MOCHA_OPTS --exit
    - else
    -   npm run misc -- $MOCHA_OPTS --exit
    - fi

test_rpms_in_azure:
  image: $DOCKER_URL/node:12-buster
  timeout: 12 hours
  rules:
    - if: '$SKIP_TEST_IN_AZURE =~ /true/i'
      when: never
    - if: '$TEST_IN_AZURE =~ /true/i'
  variables:
    TEST_RESOURCES_URL: "$TEST_RESOURCES_URL_AZURE"
  <<: *test_rpms_common
  artifacts:
    name: f5-appsvcs-extension-$CI_COMMIT_SHA
    when: always
    paths:
      - test/logs
    reports:
      junit: test_report.xml
  needs:
    - job: schema
      artifacts: true
    - job: build_rpm
      artifacts: true
    - job: deploy_to_azure
      artifacts: true

test_rpms_for_this_project:
  image: $DOCKER_URL/node:12-buster
  timeout: 12 hours
  rules:
    - if: '$TEST_IN_AZURE =~ /true/i'
      when: never
    - if: '$UPDATE_DEPS =~ /true/i'
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
    - if: '$FORCE_INTEGRATION_TEST =~ /true/i'
  <<: *test_rpms_common
  artifacts:
    name: f5-appsvcs-extension-$CI_COMMIT_SHA
    when: always
    paths:
      - test/logs
    reports:
      junit: test_report.xml
  needs:
    - job: schema
      artifacts: true
    - job: deploy_for_this_project
      artifacts: true
    - job: build_rpm
      artifacts: true

test_rpms_for_other_project:
  image: $DOCKER_URL/node:12-buster
  timeout: 12 hours
  rules:
    - if: '$TEST_IN_AZURE =~ /true/i'
      when: never
    - if: '$TRIGGER_INTEGRATION_TEST =~ /true/i'
  <<: *test_rpms_common
  artifacts:
    name: f5-appsvcs-extension-$CI_COMMIT_SHA
    when: always
    paths:
      - test/logs
    reports:
      junit: test_report.xml
  needs:
    - job: schema
      artifacts: true
    - job: deploy_for_other_project
      artifacts: true
    - project: "$UPSTREAM_PROJECT_PATH"
      job: "$UPSTREAM_JOB"
      ref: "$UPSTREAM_REF"
      artifacts: true

.teardown_common: &teardown_common
  image: $INTEGRATION_DEPLOY_IMAGE
  tags:
      - classy-crows-as3-docker-runner
  stage: teardown
  id_tokens: *vault_id_token
  secrets:
    QRT_PASSPHRASE_PATH:
      vault: pipeline/secrets/QRT_PASSPHRASE@kv
  script:
      - export QRT_PASSPHRASE=$(cat "$QRT_PASSPHRASE_PATH")
      - |
        if [[ "${TEST_IN_AZURE,,}" != "true" ]]; then
          echo "Using QRT-based teardown"
          bash scripts/dev/release_machines.sh
        else
          echo "Using Terraform-based teardown"
          cd "$TF_ROOT"
          terraform init
          terraform destroy --var bigip_version="${BIGIP_IMAGE}"
          cd -
        fi
      - |
        if [[ "$PARALLEL" = "true" ]]; then
          echo "Delete server-set $SERVER_SET from $RESERVATION_SERVER_HOST:$RESERVATION_SERVER_PORT"
          curl -s --retry 5 --retry-max-time 300 -X DELETE http://$RESERVATION_SERVER_HOST:$RESERVATION_SERVER_PORT/reservations/api/server-sets/id/$SERVER_SET
        fi
  retry:
    max: 1
    when: script_failure

teardown_azure:
  rules:
    - if: '$SKIP_TEARDOWN =~ /true/i'
      when: never
    - if: '$TEST_IN_AZURE =~ /true/i'
      when: always
  variables:
    F5_DISABLE_CERT_VERIFY: 'true'
    TF_VAR_f5_cidr_blocks: "${F5_CIDR_BLOCKS}"
    TF_ROOT: "$TF_DIRECTORY/plans/azure"
  before_script:
    # terraform doesn't support '.' in backend address.
    - export TRIM_VERSION="$(echo ${BIGIP_IMAGE} | cut -d '-' -f 2 | tr '.' -)"
    - |
      if [[ "$PARALLEL" = "true" ]]; then
        export TF_HTTP_ADDRESS="$TF_STATE_URL/parallel-azure-$TRIM_VERSION"
      else
        export TF_HTTP_ADDRESS="$TF_STATE_URL/azure-$TRIM_VERSION"
      fi
  <<: *teardown_common

teardown_openstack:
  rules:
    - if: '$SKIP_TEARDOWN =~ /true/i'
      when: never
    - if: '$TEST_IN_AZURE =~ /true/i'
      when: never
    - if: '$UPDATE_DEPS =~ /true/i'
      when: never
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: always
    - if: '$TRIGGER_INTEGRATION_TEST =~ /true/i'
      when: always
    - if: '$FORCE_INTEGRATION_TEST =~ /true/i'
      when: always
  when: always
  variables:
    TF_ROOT: "$TF_DIRECTORY/plans/openstack"
  before_script:
    # terraform doesn't support '.' in backend address.
    - export TRIM_VERSION="$(echo ${BIGIP_IMAGE} | cut -d '-' -f 2 | tr '.' -)"
    - |
      if [[ "$PARALLEL" = "true" ]]; then
        export TF_HTTP_ADDRESS="$TF_STATE_URL/parallel-openstack-$TRIM_VERSION"
      elif [ "$REGRESSION_SCHEDULE" = "remote" ]; then
        export TF_VAR_bigip_count=2
        export TF_HTTP_ADDRESS="$TF_STATE_URL/remote-openstack-$TRIM_VERSION"
      elif [ "$REGRESSION_SCHEDULE" = "performance" ]; then
        export TF_VAR_performance_test=true
        export TF_HTTP_ADDRESS="$TF_STATE_URL/performance-openstack-$TRIM_VERSION"
      elif [ "$TRIGGER_INTEGRATION_TEST" = "true" ]; then
        export BIGIP_IMAGE="${BIGIP_IMAGE_DEFAULT}"
        export TRIM_VERSION="$(echo ${BIGIP_IMAGE} | cut -d '-' -f 2 | tr '.' -)"
        export TF_HTTP_ADDRESS="$TF_STATE_URL/atg-build-openstack-$TRIM_VERSION"
      else
        export TF_HTTP_ADDRESS="$TF_STATE_URL/openstack-$TRIM_VERSION"
      fi
  <<: *teardown_common

# DOCS
create_docs:
  image: ${CONTAINTHEDOCS_IMAGE}
  stage: post build
  allow_failure: true
  needs:
    - build_api_docs
  script:
    - npm ci --no-optional
    - npm run build-schema
    - node scripts/build/schema-to-rst.js
    - node scripts/build/create-examples-collection.js
    - if [ "$CI_COMMIT_REF_NAME" = "docs-staging" ] || [ "$CI_COMMIT_REF_NAME" = "docs-0.0" ] || [ "$CI_COMMIT_REF_NAME" = "docs-latest" ] || [ "$CI_COMMIT_REF_NAME" = "docs-3.13.1" ] || [ "$CI_COMMIT_REF_NAME" = "docs-3.5.1" ]; then
    -    rm -rf docs/_templates
    - fi
    - npm install mocha@10.2
    - make html
    - API_DOCS_INDEX=${DOCS_BUILD_DIR}/refguide/apidocs.html
    - cp apidocs/index.html ${API_DOCS_INDEX}

    - echo "Checking grammar and style"
    # Runs the grammar check on everything except the /docs/drafts directory
    - vale --glob='*.rst' .

    # build developer documentation (optional)
    - |
      if [ "$CI_COMMIT_REF_NAME" = "main" ]; then
        npm install --registry $NPM_REGISTRY_URL -g jsdoc
        jsdoc src/nodejs/* -d contributing
      fi

    - echo "Checking links"
    # Final link check, that we will error on if there are broken links
    - make linkcheck
  tags:
    - cm-official-docker-executor
  artifacts:
    expire_in: 1 week
    name: sphinx-docs_$CI_COMMIT_SHA
    paths:
      - docs/_build/html
      - contributing
      - examples/as3.examples.collection.json

# Deploy docs to Pages for review
pages:
  stage: docs
  allow_failure: true
  environment:
    name: staging
    url: https://${CI_PROJECT_NAMESPACE}.${PAGES_DOMAIN}/${CI_PROJECT_NAME}/
  tags:
    - cm-official-docker-executor
  needs:
    - create_docs
    - coverage
  script:
    - PUBLIC_DIR='./public'
    - PUBLIC_DOCS=${PUBLIC_DIR}/public-docs
    - COVERAGE_DOCS=${PUBLIC_DIR}/coverage-docs
    - mkdir -p ${PUBLIC_DIR}
    - mkdir -p ${PUBLIC_DOCS}
    - mkdir -p ${COVERAGE_DOCS}
    - cp docs/index.html ${PUBLIC_DIR}/index.html
    - cp -R docs/_build/html/* ${PUBLIC_DOCS}
    - cp -R coverage/* ${COVERAGE_DOCS}
  artifacts:
    paths:
      - public
  only:
    - develop
    - doc-release-branch
    - joes-as3-wip
    - /^atgs-.*$/i

# Publish docs to clouddocs.f5.com
docs_to_production:
  image: ${CONTAINTHEDOCS_IMAGE}
  stage: docs
  environment:
    name: production
    url: https://clouddocs.f5.com/products/extensions/f5-appsvcs-extension/latest
  only:
  # Currently will only deploy to clouddocs.f5.com on commits to docs-latest
  # fill in desired release branch name and uncomment to add deployment from a branch
    - docs-latest
  tags:
    - cm-official-docker-executor
  needs:
    - create_docs
  script:
  # Uncomment and set to create desired version format
    - aws s3 sync docs/_build/html s3://clouddocs.f5.com/products/extensions/f5-appsvcs-extension/latest
    - aws s3 cp versions.json s3://clouddocs.f5.com/products/extensions/f5-appsvcs-extension/versions.json
    # create invalidation to clear cloudfront cache
    # - aws cloudfront create-invalidation --distribution-id $AWS_DIST --paths /products/extensions/f5-appsvcs-extension/latest