.gitlab-ci.yml

---
# yamllint disable rule:line-length
# ------------------------------------------------------------------

# ------------------------------------------------------------------
# Global settings
#image: "adorsys/ci-build:latest"


image: "gitlab-registry.adorsys.de/adorsys/xs2a/gitlab-ci:latest"

### Authentication for registry docker image for gitlab ci build
before_script:
  - apt-get update && apt-get install -y docker.io
  - docker --version
  - echo "${ADORSYS_REGISTRY_PASSWORD}" | docker login -u "${ADORSYS_REGISTRY_USER}" --password-stdin gitlab-registry.adorsys.de

# ------------------------------------------------------------------
# stages
# ------------------------------------------------------------------

stages:
  #- "Validate"
  - "Lint"
  - "Compile" # build jar and provide as artifact
  - "Test" # run tests and code quality checks
  - "Version Control" # parse pom.xml and change versions on sandbox project
  - "Release" # release
  - "Package" # dockerize jar and push to docker registry
  - "Clone to github"

# ------------------------------------------------------------------
# variables
# ------------------------------------------------------------------

variables:
  GIT_SUBMODULE_STRATEGY: normal
  # Online banking
  DOCKER_IMAGE_NAME_XS2A_ONLINE_BANKING: "xs2a-online-banking"
  DOCKER_IMAGE_NAME_XS2A_ONLINE_BANKING_UI: "xs2a-online-banking-ui"
  DOCKER_IMAGE_NAME_XS2A_TPP_UI: "xs2a-bank-tpp-ui"
  DOCKER_IMAGE_NAME_XS2A_ADMIN_UI: "xs2a-bank-admin-ui"
  DOCKER_IMAGE_NAME_XS2A_DEVPORTAL_UI: "xs2a-bank-devportal"
  DOCKER_IMAGE_NAME_XS2A_TPP_REST_SERVER: "xs2a-tpp-rest-server"
  DOCKER_IMAGE_NAME_XS2A_ADMIN_REST_SERVER: "xs2a-admin-rest-server"

  ###########################
  # Public Dockerhub Images #
  ###########################

  DOCKERHUB_REGISTRY: "gitlab-registry.adorsys.de"

  DOCKERHUB_NAMESPACE: "adorsys/xs2a/psd2-dynamic-sandbox"

  ###########################
  # Build variables         #
  ###########################

  # Defaults for Java 21
  JAVA_TOOL_OPTIONS: "-XX:+UnlockExperimentalVMOptions -XX:MaxRAM=3G -XX:MaxRAMFraction=3"
  MAVEN_OPTS: "-Dmaven.repo.local=.m2/repository"

# ------------------------------------------------------------------
# reusable yaml anchors
# ------------------------------------------------------------------

.build_java: &build_java
  script:
    - sdk use java $BUILD_JAVA_VERSION
    - java -XX:+PrintFlagsFinal -version | grep -Ei "maxheapsize|maxram"
    - make build-java-services
  cache:
    key: "Java_${CI_COMMIT_REF_SLUG}"
    paths:
      - /builds/adorsys/xs2a/psd2-dynamic-sandbox/.m2/repository

.release_java_private: &release_java_private
  script:
    - sdk use java $BUILD_JAVA_VERSION
    - java -XX:+PrintFlagsFinal -version | grep -Ei "maxheapsize|maxram"
    - mvn -ntp --settings scripts/mvn-release-settings.xml -Pgitlab-maven -DskipTests -U deploy
  cache:
    key: "Java_${CI_COMMIT_REF_SLUG}"
    paths:
      - /builds/adorsys/xs2a/psd2-dynamic-sandbox/.m2/repository

# Build docker images and put them to DOCKER HUB repo
.build_and_push_dockerhub_images_private:
  &build_and_push_dockerhub_images_private
  script:
    - docker build -t "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_ONLINE_BANKING}:${DOCKER_TAG}" online-banking/online-banking-app
    - docker build -t "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_ONLINE_BANKING_UI}:${DOCKER_TAG}" oba-ui
    - docker build -t "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_TPP_REST_SERVER}:${DOCKER_TAG}" tpp-app/tpp-rest-server
    - docker build -t "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_ADMIN_REST_SERVER}:${DOCKER_TAG}" admin-app/admin-rest-server
    - docker build -t "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_TPP_UI}:${DOCKER_TAG}" tpp-ui
    - docker build -t "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_ADMIN_UI}:${DOCKER_TAG}" admin-ui
    - docker build -t "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_DEVPORTAL_UI}:${DOCKER_TAG}" developer-portal-ui

    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY

    - docker push "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_ONLINE_BANKING}:${DOCKER_TAG}"
    - docker push "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_ONLINE_BANKING_UI}:${DOCKER_TAG}"
    - docker push "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_TPP_REST_SERVER}:${DOCKER_TAG}"
    - docker push "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_ADMIN_REST_SERVER}:${DOCKER_TAG}"
    - docker push "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_TPP_UI}:${DOCKER_TAG}"
    - docker push "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_ADMIN_UI}:${DOCKER_TAG}"
    - docker push "${DOCKERHUB_REGISTRY}/${DOCKERHUB_NAMESPACE}/${DOCKER_IMAGE_NAME_XS2A_DEVPORTAL_UI}:${DOCKER_TAG}"
    - docker logout $CI_REGISTRY

.sync_changes_github: &sync_changes_github
  image: alpine/git
  script:
    - git config --global user.name "$GITHUB_USERNAME"
    - git config --global user.email "$GITHUB_EMAIL"
    - test -n "$GITHUB_TOKEN"
    - apk add --no-cache curl jq
    - GITHUB_TOKEN_CLEAN=$(printf "%s" "$GITHUB_TOKEN" | tr -d '\r\n')
    - export GIT_TERMINAL_PROMPT=0
    - |
      # --- Safe token diagnostics (no secret values printed) ---
      TOKEN_LEN=${#GITHUB_TOKEN_CLEAN}
      TOKEN_PREFIX=$(printf "%s" "$GITHUB_TOKEN_CLEAN" | cut -c1-4)
      echo "Configured GITHUB_USERNAME: ${GITHUB_USERNAME}"
      echo "Token length: ${TOKEN_LEN}"
      echo "Token prefix (first 4 chars): ${TOKEN_PREFIX}"
      echo "Expected prefixes: ghp_ (classic PAT), github_pat_ (fine-grained PAT), gho_ (OAuth), ghs_ (GitHub App)"

      USER_TOKEN_CODE=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token ${GITHUB_TOKEN_CLEAN}" -H "Accept: application/vnd.github+json" https://api.github.com/user)
      USER_BEARER_CODE=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ${GITHUB_TOKEN_CLEAN}" -H "Accept: application/vnd.github+json" https://api.github.com/user)
      REPO_TOKEN_CODE=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token ${GITHUB_TOKEN_CLEAN}" -H "Accept: application/vnd.github+json" "https://api.github.com/repos/${GITHUB_REPOSITORY}")
      echo "GET /user      (token)  HTTP ${USER_TOKEN_CODE}"
      echo "GET /user      (Bearer) HTTP ${USER_BEARER_CODE}"
      echo "GET /repos/${GITHUB_REPOSITORY} (token) HTTP ${REPO_TOKEN_CODE}"

      if [ "$USER_TOKEN_CODE" != "200" ] && [ "$USER_BEARER_CODE" != "200" ] && [ "$REPO_TOKEN_CODE" != "200" ]; then
        echo ""
        echo "ERROR: All GitHub API auth probes failed (status codes above)."
        echo "Likely causes:"
        echo "  1) GITHUB_TOKEN in GitLab CI/CD variables is invalid, expired, or revoked."
        echo "  2) Token belongs to an account with no access to ${GITHUB_REPOSITORY}."
        echo "  3) Organization SSO authorization is required but not granted for this token."
        echo "  4) Token was pasted with surrounding whitespace/quotes when set as a CI variable."
        echo "Action: Per GitLab docs, regenerate a classic or fine-grained PAT with 'repo' and 'Contents: write' scope"
        echo "        for an account that can push to ${GITHUB_REPOSITORY}, update the GitLab CI/CD variable, and re-run."
        exit 1
      fi
      # ---------------------------------------------------------

      # Per GitLab docs: https://docs.gitlab.com/user/project/repository/mirror/push/
      # Use https://<username>:<token>@github.com/<repo>.git format for HTTPS mirroring
      git remote add github "https://${GITHUB_USERNAME}:${GITHUB_TOKEN_CLEAN}@github.com/${GITHUB_REPOSITORY}.git"

      git ls-remote --exit-code github >/dev/null || {
        echo "GitHub ls-remote failed even though API probes succeeded.";
        echo "Check that the token has push ('Contents: write') permission on ${GITHUB_REPOSITORY}.";
        exit 1;
      }

      for branch in $(git branch -r | grep -E "origin/.*(release-${GITHUB_PROJECT_CLONE_VERSION}.*|support-${GITHUB_PROJECT_CLONE_VERSION}.x).*"); do
        branch=${branch#origin/}
        git checkout "$branch"
        git push github "$branch"
      done

# ------------------------------------------------------------------
# jobs
# ------------------------------------------------------------------

#-------------------------------------------------------------------
# Validation of commit messages and branch names
#-------------------------------------------------------------------

# validate_commits_branche_name:
#   stage: "Validate"
#   image:
#     name: alpine:latest
#     entrypoint: [""]
#   except:
#     - tags
#   before_script:
#     - apk update
#     - apk add --no-cache git bash curl jq
#     - git --version
#   script:
#     - |
#       cat > validate.sh << 'EOF'
#       #!/bin/bash

#       # Function to output error messages
#       print_error() {
#           echo -e "\nERROR: $1" >&2
#           exit 1
#       }

#       # Function to output debug messages (if debug mode is enabled)
#       print_debug() {
#           if [ "$DEBUG" == "true" ]; then
#               echo -e "DEBUG: $1" >&2
#           fi
#       }

#       # Debug flag (can be set externally or internally)
#       DEBUG=false

#       # Get the current branch name
#       BRANCH_NAME=${CI_COMMIT_REF_NAME:?"CI_COMMIT_REF_NAME is not set"}
#       echo "Checking branch: $BRANCH_NAME"

#       # Check branch name format
#       check_branch_name() {
#           local branch_name="$1"
#           print_debug "Checking branch name: '$branch_name'"

#           # Branch name patterns
#           if [[ "$branch_name" =~ ^(master|v2master|develop|v2develop|support-([0-9]+)\.[0-9]+|v2support-([0-9]+)\.[0-9]+|release-([0-9]+(\.[0-9]+){1,2})|v2release-([0-9]+(\.[0-9]+){1,2})|hotfix-([0-9]+\.[0-9]+\.[0-9]+)|v2hotfix-([0-9]+\.[0-9]+\.[0-9]+)|release-([0-9]+\.[0-9]+)-[a-zA-Z0-9_-]+|release-([0-9]+\.[0-9]+\.[0-9]+)-[a-zA-Z0-9_-]+|v2/(feature|setup|bugfix|infra|ci|test|docs|deploy|security|perf|refactor|upgrade)/issue-([0-9]+)-([a-zA-Z0-9_-]+)|v2/PASD/[0-9]+/issue-([0-9]+)-([a-zA-Z0-9_-]+)|(feature|setup|bugfix|infra|ci|test|docs|deploy|security|perf|refactor|upgrade)/issue-([0-9]+)-([a-zA-Z0-9_-]+)|PASD/[0-9]+/issue-([0-9]+)-([a-zA-Z0-9_-]+))$ ]]; then
#               return 0
#           fi

#           print_error "Branch name '$branch_name' format is INCORRECT."
#       }

#       # Check commit message format
#       check_commit_message() {
#           local commit_msg="$1"
#           print_debug "Checking commit message: '$commit_msg'"

#           # Commit message regex
#           if ! [[ $commit_msg =~ ^(feat|fix|docs|doc|style|refactor|perf|test|chore|upgrade|ci|scan|release)(\([a-zA-Z0-9_-]*\))?:\ [a-zA-Z0-9_-]{3}#[0-9]+\ .+ || $commit_msg =~ ^(feat|fix|docs|doc|style|refactor|perf|test|chore|upgrade|ci|scan|release):\ [a-zA-Z0-9_-]{3}#[0-9]+\ .+ ]]; then
#               print_error "Commit message format is INCORRECT. Expected format: <type>(<scope>): <developer gitlab username (3 chars)>#<issue-number> <message> OR <type>: <developer gitlab username (3 chars)>#<issue-number> <message>"
#           fi
#       }

#       # Ensure no direct pushes to blocked branches
#       is_blocked_branch() {
#           local branch="$1"
#           if [[ "$branch" =~ ^(develop|master|master-[0-9]+(\.[0-9]+){1,2}|release-[0-9]+(\.[0-9]+){1,2}|v2/develop|v2/master|v2/master-[0-9]+(\.[0-9]+){1,2}|v2/release-[0-9]+(\.[0-9]+){1,2})$ ]]; then
#               return 0 # Blocked branch
#           else
#               return 1 # Not blocked
#           fi
#       }

#       # Validate branch name
#       check_branch_name "$BRANCH_NAME"

#       # Get the latest commit hash and validate each commit
#       COMMITS=$(git log --format="%H" -n 1)
#       if [ -z "$COMMITS" ]; then
#           print_error "No commits found to validate"
#       fi

#       # Loop through each commit to check its message
#       for commit in $COMMITS; do
#           COMMIT_MSG=$(git log --format=%s -n 1 $commit)
#           check_commit_message "$COMMIT_MSG"
#       done

#       # Ensure no direct pushes to blocked branches
#       if is_blocked_branch "$BRANCH_NAME"; then
#           print_error "Direct push to the '$BRANCH_NAME' branch is not allowed."
#       fi

#       echo "Branch and commit validations passed. Proceeding..."
#       EOF

#     - chmod +x validate.sh
#     - ./validate.sh

#-------------------------------------------------------------------
# Lint
#-------------------------------------------------------------------

Lint (Dockerfiles):
  image: docker
  stage: "Lint"
  services:
    - docker:dind
  tags:
    - aws
  except:
    - schedules
    - support-14.x
    - master-14.x
  variables:
    DOCKER_HOST: tcp://docker:2375
    DOCKER_TLS_CERTDIR: ""
    DOCKER_DRIVER: overlay2
  script:
    - apk add make
    - echo "Run Dockerfiles lint"
    - make lint-dockerfiles

Lint (OBA UI):
  image: node:18.19.1-bookworm-slim
  stage: "Lint"
  except:
    - schedules
    - support-14.x
    - master-14.x
  script:
    - apt-get update && apt-get install jsonlint yamllint libxml2-utils make curl -yq && ln -s /usr/bin/jsonlint-php /usr/bin/jsonlint
    - echo "Run OBA lint"
    - make lint-oba-ui

Lint (TPP UI):
  image: node:18.19.1-bookworm-slim
  stage: "Lint"
  except:
    - schedules
    - support-14.x
    - master-14.x
  script:
    - apt-get update && apt-get install jsonlint yamllint libxml2-utils make curl -yq && ln -s /usr/bin/jsonlint-php /usr/bin/jsonlint
    - echo "Run TPP lint"
    - make lint-tpp-ui

Lint (Admin UI):
  image: node:18.19.1-bookworm-slim
  stage: "Lint"
  except:
    - schedules
    - support-14.x
    - master-14.x
  script:
    - apt-get update && apt-get install jsonlint yamllint libxml2-utils make curl -yq && ln -s /usr/bin/jsonlint-php /usr/bin/jsonlint
    - echo "Run Admin lint"
    - make lint-admin-ui

Lint (DevPortal UI):
  image: node:18.19.1-bookworm-slim
  stage: "Lint"
  except:
    - schedules
    - support-14.x
    - master-14.x
  script:
    - apt-get update && apt-get install jsonlint yamllint libxml2-utils make curl -yq && ln -s /usr/bin/jsonlint-php /usr/bin/jsonlint
    - echo "Run Devportal UI lint"
    - make lint-developer-portal-ui

Lint (OBA Backend):
  image: debian:stable-slim
  stage: "Lint"
  except:
    - schedules
    - support-14.x
    - master-14.x
  script:
    - apt-get update && apt-get install --no-install-recommends jsonlint yamllint libxml2-utils make curl -yq && ln -s /usr/bin/jsonlint-php /usr/bin/jsonlint
    - echo "Run OBA backend lint"
    - make lint-online-banking

Lint (TPP Backend):
  image: debian:stable-slim
  stage: "Lint"
  except:
    - schedules
    - support-14.x
    - master-14.x
  script:
    - apt-get update && apt-get install jsonlint yamllint libxml2-utils make curl -yq && ln -s /usr/bin/jsonlint-php /usr/bin/jsonlint
    - echo "Run TPP backend lint"
    - make lint-tpp-rest-server

Lint (Admin Backend):
  image: debian:stable-slim
  stage: "Lint"
  except:
    - schedules
    - support-14.x
    - master-14.x
  script:
    - apt-get update && apt-get install jsonlint yamllint libxml2-utils make curl -yq && ln -s /usr/bin/jsonlint-php /usr/bin/jsonlint
    - echo "Run Admin backend lint"
    - make lint-admin-rest-server

Lint (Docker Compose):
  image: maven:3.9-eclipse-temurin-21
  stage: "Lint"
  except:
    - schedules
    - support-14.x
    - master-14.x
  script:
    - apt update && apt install -y yamllint docker-compose make python3-pip python3-setuptools
    - echo "Run Docker compose lint"
    - docker-compose -f docker-compose.yml config -q

Lint (PMD CPD):
  image: maven:3.9-eclipse-temurin-21
  stage: "Lint"
  except:
    - schedules
    - support-14.x
    - master-14.x
  script:
    - apt update && apt install make -yq
    - echo "Test java code for PMD and CPD"
    - make lint-pmd-cpd-report
  cache: {}
  artifacts:
    paths:
      - "qa/pmd/pmd-ruleset.xml"
      - "**/**/*/pmd.html"
      - "**/*/pmd.xml"
    name: "${CI_PROJECT_NAME}-${CI_BUILD_REF_NAME#*v}-pmd"
    expire_in: "10 day"

Lint (owasp-dep-check):
  stage: "Lint"
  variables:
    JAVA_TOOL_OPTIONS: "-XX:+UnlockExperimentalVMOptions -Xmx2048m"
  script:
    - mvn -B -ntp --settings scripts/mvn-release-settings.xml -DnvdApiKey=$NVD_API_KEY -DdataDirectory=dependency-check-data org.owasp:dependency-check-maven:aggregate
  timeout: 4h # downloading NVD records for the first time might take a long time
  allow_failure: true
  artifacts:
    when: always
    paths:
      - target/dependency-check-report.html
      - target/dependency-check-report.json
    expire_in: "10 days"
  cache:
    - key: "maven-cache-$CI_COMMIT_REF_SLUG"
      paths:
        - ".m2/repository"
      policy: pull-push
    - key: dependency-check
      paths:
        - dependency-check-data
      policy: pull-push
      when: always

#-------------------------------------------------------------------
# Compile
#-------------------------------------------------------------------

Build (OBA UI):
  image: node:18.19.1-bookworm-slim
  stage: "Compile"
  except:
    - schedules
  script:
    - apt-get update && apt-get install make libxml2-utils jq -yq
    - echo "Update info.json"
    - VERSION=$(xmllint --xpath "//*[local-name()='project']/*[local-name()='version']/text()" pom.xml)
    - jq --arg VERSION "$VERSION"  --arg BUILD_ID "$CI_PIPELINE_ID" '.version = $VERSION | .build_number = $BUILD_ID' oba-ui/info.json >> info.json
    - mv info.json oba-ui/info.json
    - echo "Run OBA UI  Build"
    - make npm-install-oba-ui
  cache: {}
  artifacts:
    paths:
      - "oba-ui/dist"
      - "oba-ui/info.json"
    name: "$CI_PROJECT_NAME-${CI_BUILD_REF_NAME#*v}"
    expire_in: "1 day"

Build (TPP UI):
  image: node:18.19.1-bookworm-slim
  stage: "Compile"
  except:
    - schedules
  script:
    - apt-get update && apt-get install make jq libxml2-utils -yq
    - echo "Update info.json"
    - VERSION=$(xmllint --xpath "//*[local-name()='project']/*[local-name()='version']/text()" pom.xml)
    - jq --arg VERSION "$VERSION"  --arg BUILD_ID "$CI_PIPELINE_ID" '.version = $VERSION | .build_number = $BUILD_ID' tpp-ui/info.json >> info.json
    - mv info.json oba-ui/info.json
    - echo "Run TPP UI  Build"
    - make npm-install-tpp-ui
  cache: {}
  artifacts:
    paths:
      - "tpp-ui/dist"
      - "tpp-ui/info.json"
    name: "$CI_PROJECT_NAME-${CI_BUILD_REF_NAME#*v}"
    expire_in: "1 day"

Build (Admin UI):
  image: node:18.19.1-bookworm-slim
  stage: "Compile"
  except:
    - schedules
  script:
    - apt-get update && apt-get install make jq libxml2-utils -yq
    - echo "Update info.json"
    - VERSION=$(xmllint --xpath "//*[local-name()='project']/*[local-name()='version']/text()" pom.xml)
    - jq --arg VERSION "$VERSION"  --arg BUILD_ID "$CI_PIPELINE_ID" '.version = $VERSION | .build_number = $BUILD_ID' admin-ui/info.json >> info.json
    - mv info.json oba-ui/info.json
    - echo "Run Admin UI Build"
    - make npm-install-admin-ui
  cache: {}
  artifacts:
    paths:
      - "admin-ui/dist"
      - "admin-ui/info.json"
    name: "$CI_PROJECT_NAME-${CI_BUILD_REF_NAME#*v}"
    expire_in: "1 day"

Build (DevPortal UI):
  image: node:18.19.1-bookworm-slim
  stage: "Compile"
  except:
    - schedules
  script:
    - apt-get update && apt-get install zip make jq libxml2-utils -yq
    - echo "Update info.json"
    - VERSION=$(xmllint --xpath "//*[local-name()='project']/*[local-name()='version']/text()" pom.xml)
    - jq --arg VERSION "$VERSION"  --arg BUILD_ID "$CI_PIPELINE_ID" '.version = $VERSION | .build_number = $BUILD_ID' developer-portal-ui/info.json >> info.json
    - mv info.json developer-portal-ui/info.json
    - echo "Update postman test files"
    - scripts/.update-postman-test-files.sh
    - echo "Run Devportal UI Build"
    - make npm-install-developer-portal-ui
  cache: {}
  artifacts:
    paths:
      - "developer-portal-ui/dist"
      - "developer-portal-ui/info.json"
    name: "$CI_PROJECT_NAME-${CI_BUILD_REF_NAME#*v}"
    expire_in: "1 day"

Build (Modelbank):
  <<: *build_java
  stage: "Compile"
  except:
    - schedules
  cache: {}
  variables:
    BUILD_JAVA_VERSION: 21.0.2-open
    JAVA_TOOL_OPTIONS: "-Djavax.net.ssl.trustStorePassword=changeit -XX:MaxRAM=3G"
  artifacts:
    paths:
      - "online-banking/online-banking-app/target/online-banking-app.jar"
      - "certificate-generator/target/certificate-generator.jar"
      - "tpp-app/tpp-rest-server/target/tpp-rest-server.jar"
      - "admin-app/admin-rest-server/target/admin-rest-server.jar"
    name: "$CI_PROJECT_NAME-${CI_BUILD_REF_NAME#*v}"
    expire_in: "1 day"

#-------------------------------------------------------------------
# Test
#-------------------------------------------------------------------

Test (Javadoc):
  stage: "Test"
  except:
    - schedules
  needs: ["Build (Modelbank)"]
  variables:
    JAVA_TOOL_OPTIONS: "-Djavax.net.ssl.trustStorePassword=changeit -XX:MaxRAM=3G"
    JAVA_VERSION: "21.0.2-open"
  script:
    - sdk use java ${JAVA_VERSION}
    - java -XX:+PrintFlagsFinal -version | grep -Ei "maxheapsize|maxram"
    - mvn -ntp --settings scripts/mvn-release-settings.xml -Dmaven.test.skip=true -Pjavadoc verify javadoc:javadoc

Test (Unit Tests):
  image: maven:3.9-eclipse-temurin-21
  stage: "Test"
  except:
    - schedules
  needs: ["Build (Modelbank)"]
  variables:
    JAVA_VERSION: "21.0.2-open"
    JAVA_TOOL_OPTIONS: "-Djavax.net.ssl.trustStorePassword=changeit -XX:MaxRAM=3G"
  script:
    - apt update && apt install make -yq
    - echo "Run unit tests for backend"
    - make unit-tests-backend

Test (DevPortal UI Tests):
  image: node:18.19.1-bookworm-slim
  stage: "Test"
  except:
    - schedules
  needs: ["Build (DevPortal UI)"]
  variables:
    CHROME_BIN: "/usr/bin/chromium"
  script:
    - apt-get update && apt-get install make chromium chromium-l10n -yq
    - echo 'Unit tests Devportal UI'
    - make unit-tests-developer-portal-ui

Test (TPP UI Tests):
  image: node:18.19.1-bookworm-slim
  stage: "Test"
  except:
    - schedules
  needs: ["Build (TPP UI)"]
  variables:
    CHROME_BIN: "/usr/bin/chromium"
  script:
    - apt-get update && apt-get install make chromium chromium-l10n -yq
    - echo 'Unit tests TPP UI'
    - make unit-tests-tpp-ui

Test (Admin UI Tests):
  image: node:18.19.1-bookworm-slim
  stage: "Test"
  except:
    - schedules
  needs: ["Build (Admin UI)"]
  variables:
    CHROME_BIN: "/usr/bin/google-chrome"
  script:
    - apt-get update && apt-get install -y wget gnupg make
    - wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
    - apt-get install -y ./google-chrome-stable_current_amd64.deb
    - echo 'Unit tests Admin UI'
    - make unit-tests-admin-ui


Test (OBA UI Tests):
  image: node:18.19.1-bookworm-slim
  stage: "Test"
  except:
    - schedules
  needs: ["Build (OBA UI)"]
  variables:
    CHROME_BIN: "/usr/bin/chromium"
  script:
    - apt-get update && apt-get install make chromium chromium-l10n -yq
    - echo 'Unit tests OBA UI'
    - make unit-tests-oba-ui

Postman Tests:
  stage: "Test"
  only:
    - schedules
  image:
    name: postman/newman_alpine33
    entrypoint: [""]
  before_script: []
  script:
    - npm config set unsafe-perm true
    - npm install -g newman-reporter-html
    - cd postman
    - newman run postman_collection.json -e postman_environment_dev.json -g postman_global_variable.json --reporters cli,html --reporter-html-template html_report_template.hbs --reporter-html-export postman-tests-report.html --suppress-exit-code
  artifacts:
    when: always
    paths:
      - "postman/postman-tests-report.html"
    expire_in: "10 day"

#-------------------------------------------------------------------
# Package
#-------------------------------------------------------------------

Build and push to private repo (support-14x):
  stage: "Package"
  except:
    - schedules
  only:
    - support-14.x
  services:
    - docker:dind
  tags:
    - aws
  variables:
    DOCKER_HOST: tcp://docker:2375
    DOCKER_TLS_CERTDIR: ""
    DOCKER_DRIVER: overlay2
    DOCKER_TAG: develop
    DOCKERHUB_REGISTRY: gitlab-registry.adorsys.de
    DOCKERHUB_NAMESPACE: "adorsys/xs2a/psd2-dynamic-sandbox"
  <<: *build_and_push_dockerhub_images_private

Build and push to private repo (master):
  stage: "Package"
  only:
    - master
  services:
    - docker:dind
  tags:
    - aws
  variables:
    DOCKER_HOST: tcp://docker:2375
    DOCKER_TLS_CERTDIR: ""
    DOCKER_DRIVER: overlay2
    DOCKER_TAG: support14x
    DOCKERHUB_REGISTRY: gitlab-registry.adorsys.de
    DOCKERHUB_NAMESPACE: "adorsys/xs2a/psd2-dynamic-sandbox"
  <<: *build_and_push_dockerhub_images_private

Build and push to private repo (tags):
  stage: "Package"
  only:
    - tags
  services:
    - docker:dind
  tags:
    - aws
  variables:
    DOCKER_HOST: tcp://docker:2375
    DOCKER_TLS_CERTDIR: ""
    DOCKER_DRIVER: overlay2
    DOCKER_TAG: ${CI_COMMIT_TAG}
    DOCKERHUB_REGISTRY: gitlab-registry.adorsys.de
    DOCKERHUB_NAMESPACE: "adorsys/xs2a/psd2-dynamic-sandbox"
  <<: *build_and_push_dockerhub_images_private

Upload to SonarQube:
  stage: Package
  variables:
    SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"  # Defines the location of the analysis task cache
    GIT_DEPTH: "0"  # Tells git to fetch all the branches of the project, required by the analysis task
  before_script: []
  cache:
    - key: "sonar-cache-$CI_COMMIT_REF_SLUG"
      paths:
        - "${SONAR_USER_HOME}/cache"
      policy: pull-push
    - key: "maven-cache-$CI_COMMIT_REF_SLUG"
      paths:
        - ".m2/repository"
      policy: pull-push
  dependencies:
    - "Build (Modelbank)"
    - "Test (Unit Tests)"
    - "Lint (owasp-dep-check)"
    - "Lint (PMD CPD)"
  script:
    - mvn -B -ntp --settings scripts/mvn-release-settings.xml -Dmaven.repo.local=${CI_PROJECT_DIR}/.m2/repository sonar:sonar -Dsonar.qualitygate.wait=true
  allow_failure: true
  rules:
    - if: $CI_COMMIT_BRANCH == 'support-14.x'
    - if: $CI_COMMIT_BRANCH == 'sonarqube-support'

#-------------------------------------------------------------------
# Release
#-------------------------------------------------------------------

Release snapshot artifacts (support-14x):
  stage: "Release"
  only:
    - support-14.x
  except:
    - schedules
  cache: {}
  variables:
    BUILD_JAVA_VERSION: 21.0.2-open
    JAVA_TOOL_OPTIONS: "-Djavax.net.ssl.trustStorePassword=changeit -XX:MaxRAM=3G"
  <<: *release_java_private

Release snapshot artifacts (tags):
  stage: "Release"
  only:
    - tags
  except:
    - schedules
  cache: {}
  variables:
    BUILD_JAVA_VERSION: 21.0.2-open
    JAVA_TOOL_OPTIONS: "-Djavax.net.ssl.trustStorePassword=changeit -XX:MaxRAM=3G"
  <<: *release_java_private

#-------------------------------------------------------------------
# Version Control
#-------------------------------------------------------------------

Change dependencies versions (support-14.x):
  stage: "Version Control"
  image: alpine
  only:
    refs:
      - support-14.x
    changes:
      - pom.xml
  except:
    - schedules
  before_script:
    - apk add git openssh-client
    - git config --global user.name $GITLAB_USER_NAME
    - git config --global user.email $GITLAB_USER_EMAIL
    - mkdir -p ~/sandbox
    - cd ~/sandbox
    - git clone https://push-token:$PUSH_TOKEN@git.adorsys.de/adorsys/xs2a/sandbox-openshift.git
    - cd sandbox-openshift
    - git branch -a
    - git checkout master
  script:
    - XS2A_VERSION=$(cat $CI_PROJECT_DIR/pom.xml | grep "<xs2a.version>" | awk -F"[<>]" '//{print $3}')
    - CONNECTOR_VERSION=$(cat $CI_PROJECT_DIR/pom.xml | grep "<connector.version>" | awk -F"[<>]" '//{print $3}')
    - LEDGERS_VERSION=$(cat $CI_PROJECT_DIR/pom.xml | grep "<ledgers.version>" | awk -F"[<>]" '//{print $3}')
    - >
      if [[ "$XS2A_VERSION" =~ "\d{1,2}\.\d{1,2}-SNAPSHOT" ]]; then
      XS2A_VERSION=support22x;
      fi
    - >
      if [[ "$CONNECTOR_VERSION" =~ "\d{1,2}\.\d{1,2}-SNAPSHOT" ]]; then
      CONNECTOR_VERSION=support22x;
      fi
    - >
      if [[ "$LEDGERS_VERSION" =~ "\d{1,2}\.\d{1,2}-SNAPSHOT" ]]; then
      LEDGERS_VERSION=support22x;
      fi
    - |
      sed -i "s/tag: .*$/tag: \"$XS2A_VERSION\"/" env/adorsys-modelbank-dev-k8s/certificate-generator/env.yaml
      sed -i "s/tag: .*$/tag: \"$LEDGERS_VERSION\"/" env/adorsys-modelbank-dev-k8s/keycloak/env.yaml
      sed -i "s/tag: .*$/tag: \"$LEDGERS_VERSION\"/" env/adorsys-modelbank-dev-k8s/ledgers/env.yaml
      sed -i "s/tag: .*$/tag: \"$XS2A_VERSION\"/" env/adorsys-modelbank-dev-k8s/xs2a-aspsp-profile/env.yaml
      sed -i "s/tag: .*$/tag: \"$CONNECTOR_VERSION\"/" env/adorsys-modelbank-dev-k8s/xs2a-connector/env.yaml
      sed -i "s/tag: .*$/tag: \"$XS2A_VERSION\"/" env/adorsys-modelbank-dev-k8s/xs2a-consent-management/env.yaml
      sed -i "s/tag: .*$/tag: \"$XS2A_VERSION\"/" env/adorsys-modelbank-dev-k8s/xs2a-embedded/env.yaml

  after_script:
    - cd ~/sandbox/sandbox-openshift
    - git status
    - git add .
    - git commit -m "changed dependencies versions"
    - git push origin master

Change dependencies versions (E2E):
  stage: "Version Control"
  image: alpine
  only:
    refs:
      - schedules
    changes:
      - pom.xml
  before_script:
    - apk add git openssh-client
    - git config --global user.name $GITLAB_USER_NAME
    - git config --global user.email $GITLAB_USER_EMAIL
    - mkdir -p ~/sandbox
    - cd ~/sandbox
    - git clone https://push-token:$PUSH_TOKEN@git.adorsys.de/adorsys/xs2a/sandbox-openshift.git
    - cd sandbox-openshift
    - git branch -a
    - git checkout master
  script:
    - XS2A_VERSION=$(cat $CI_PROJECT_DIR/pom.xml | grep "<xs2a.version>" | awk -F"[<>]" '//{print $3}')
    - CONNECTOR_VERSION=$(cat $CI_PROJECT_DIR/pom.xml | grep "<connector.version>" | awk -F"[<>]" '//{print $3}')
    - LEDGERS_VERSION=$(cat $CI_PROJECT_DIR/pom.xml | grep "<ledgers.version>" | awk -F"[<>]" '//{print $3}')
    - >
      if [[ "$XS2A_VERSION" =~ "\d{1,2}\.\d{1,2}-SNAPSHOT" ]]; then
      XS2A_VERSION=support22x;
      fi
    - >
      if [[ "$CONNECTOR_VERSION" =~ "\d{1,2}\.\d{1,2}-SNAPSHOT" ]]; then
      CONNECTOR_VERSION=support22x;
      fi
    - >
      if [[ "$LEDGERS_VERSION" =~ "\d{1,2}\.\d{1,2}-SNAPSHOT" ]]; then
      LEDGERS_VERSION=7.0;
      fi
    - |
      sed -i "s/tag: .*$/tag: \"$XS2A_VERSION\"/" env/adorsys-modelbank-e2e-k8s/certificate-generator/env.yaml
      sed -i "s/tag: .*$/tag: \"$LEDGERS_VERSION\"/" env/adorsys-modelbank-e2e-k8s/keycloak/env.yaml
      sed -i "s/tag: .*$/tag: \"$LEDGERS_VERSION\"/" env/adorsys-modelbank-e2e-k8s/ledgers/env.yaml
      sed -i "s/tag: .*$/tag: \"$XS2A_VERSION\"/" env/adorsys-modelbank-e2e-k8s/xs2a-aspsp-profile/env.yaml
      sed -i "s/tag: .*$/tag: \"$CONNECTOR_VERSION\"/" env/adorsys-modelbank-e2e-k8s/xs2a-connector/env.yaml
      sed -i "s/tag: .*$/tag: \"$XS2A_VERSION\"/" env/adorsys-modelbank-e2e-k8s/xs2a-consent-management/env.yaml

  after_script:
    - cd ~/sandbox/sandbox-openshift
    - git status
    - git add .
    - git commit -m "changed dependencies versions"
    - git push origin master

Change dependencies versions (INTEG):
  stage: "Version Control"
  image: alpine
  rules:
    - if:
        $CI_COMMIT_TAG =~ /14\..*/
        # changes:
      # - "pom.xml"
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: never
  before_script:
    - apk add git openssh-client
    - git config --global user.name $GITLAB_USER_NAME
    - git config --global user.email $GITLAB_USER_EMAIL
    - mkdir -p ~/sandbox
    - cd ~/sandbox
    - git clone https://push-token:$PUSH_TOKEN@git.adorsys.de/adorsys/xs2a/sandbox-openshift.git
    - cd sandbox-openshift
    - git branch -a
    - git checkout master
  script:
    - XS2A_VERSION=$(cat $CI_PROJECT_DIR/pom.xml | grep "<xs2a.version>" | awk -F"[<>]" '//{print $3}')
    - CONNECTOR_VERSION=$(cat $CI_PROJECT_DIR/pom.xml | grep "<connector.version>" | awk -F"[<>]" '//{print $3}')
    - LEDGERS_VERSION=$(cat $CI_PROJECT_DIR/pom.xml | grep "<ledgers.version>" | awk -F"[<>]" '//{print $3}')
    - |
      sed -i "s/tag: .*$/tag: \"$XS2A_VERSION\"/" env/adorsys-modelbank-integ-k8s/certificate-generator/env.yaml
      sed -i "s/tag: .*$/tag: \"$LEDGERS_VERSION\"/" env/adorsys-modelbank-integ-k8s/keycloak/env.yaml
      sed -i "s/tag: .*$/tag: \"$LEDGERS_VERSION\"/" env/adorsys-modelbank-integ-k8s/ledgers/env.yaml
      sed -i "s/tag: .*$/tag: \"$XS2A_VERSION\"/" env/adorsys-modelbank-integ-k8s/xs2a-aspsp-profile/env.yaml
      sed -i "s/tag: .*$/tag: \"$CONNECTOR_VERSION\"/" env/adorsys-modelbank-integ-k8s/xs2a-connector/env.yaml
      sed -i "s/tag: .*$/tag: \"$XS2A_VERSION\"/" env/adorsys-modelbank-integ-k8s/xs2a-consent-management/env.yaml
      sed -i "s/tag: .*$/tag: \"$CI_COMMIT_TAG\"/" env/adorsys-modelbank-integ-k8s/modelbank-admin/env.yaml
      sed -i "s/tag: .*$/tag: \"$CI_COMMIT_TAG\"/" env/adorsys-modelbank-integ-k8s/modelbank-devportal/env.yaml
      sed -i "s/tag: .*$/tag: \"$CI_COMMIT_TAG\"/" env/adorsys-modelbank-integ-k8s/modelbank-oba/env.yaml
      sed -i "s/tag: .*$/tag: \"$CI_COMMIT_TAG\"/" env/adorsys-modelbank-integ-k8s/modelbank-tpp/env.yaml
  after_script:
    - cd ~/sandbox/sandbox-openshift
    - git status
    - git add .
    - git commit -m "changed dependencies versions"
    - git push origin master

Clone to github:
  stage: "Clone to github"
  <<: *sync_changes_github
  image: alpine/git:latest
  before_script: []
  needs: []
  only:
    - /^.*release-${GITHUB_PROJECT_CLONE_VERSION}.*$/
    - support-${GITHUB_PROJECT_CLONE_VERSION}.x
    - schedules
  variables:
    GITHUB_USERNAME: adorsys
    GITHUB_EMAIL: github@adorsys.de
    GITHUB_REPOSITORY: adorsys/XS2A-Sandbox
    GITHUB_PROJECT_CLONE_VERSION: "14"