.gitlab-ci.yml

---

variables:
  PKGNAME: apparmor.d
  PKGDEST: $CI_PROJECT_DIR/.pkg
  PACKAGER: 'Alexandre Pujol <alexandre@pujol.io>'

stages:
  - lint
  - test
  - build
  - preprocess
  - deploy


# Code Linter
# -----------

bash:
  stage: lint
  image: koalaman/shellcheck-alpine
  script:
    - shellcheck --shell=bash
        PKGBUILD dists/*.sh tests/check.sh
        tests/packer/*.sh tests/packer/src/aa-update
        tests/autopkgtest/autopkgtest.sh debian/apparmor.d.postinst debian/apparmor.d.postrm

golangci-lint:
  stage: lint
  image: golangci/golangci-lint
  script:
    - golangci-lint run

packer:
  stage: lint
  image:
    name: hashicorp/packer:latest
    entrypoint: [""]
  script:
    - packer fmt tests/packer/
    - packer validate --syntax-only tests/packer/


# Code test
# ---------

tests:
  stage: test
  image: golang
  coverage: '/Coverage: \d+.\d+/'
  script:
    - cp tests/journalctl /usr/bin/journalctl
    - chmod 755 /usr/bin/journalctl
    - mkdir -p /var/log/audit/
    - touch /var/log/audit/audit.log /var/log/audit/audit.log.1
    - go test ./cmd/... -v -cover -coverprofile=coverage.out
    - go test $(go list ./pkg/... | grep -v /pkg/paths) -v -cover -coverprofile=coverage.out
    - go tool cover -func=coverage.out

# Disabled as it is long and we reach the limit of GitLab CI minutes
# Enabled in Github Actions CI
.check:
  stage: test
  image: registry.gitlab.com/roddhjav/builders/archlinux
  script:
    - just check

# Package Build
# -------------

archlinux:
  stage: build
  image: registry.gitlab.com/roddhjav/builders/archlinux
  script:
    - sudo pacman -Syu --noconfirm --noprogressbar
    - makepkg -s --noconfirm --noprogressbar
  artifacts:
    expire_in: 1 day
    paths:
      - $PKGDEST/*

debian:
  stage: build
  image: registry.gitlab.com/roddhjav/builders/debian:13
  script:
    - sudo chown -R build:build /builds/
    - git config --global --add safe.directory $CI_PROJECT_DIR
    - mkdir -p "$PKGDEST"
    - sudo apt-get update -q && sudo apt-get install -y config-package-dev golang-go lsb-release libdistro-info-perl
    - just build-dpkg
  artifacts:
    expire_in: 1 day
    paths:
      - $PKGDEST/*.deb

ubuntu:
  stage: build
  image: registry.gitlab.com/roddhjav/builders/ubuntu:26.04
  variables:
    GOFLAGS: "-buildvcs=false"
  script:
    - git config --global --add safe.directory $CI_PROJECT_DIR
    - mkdir -p "$PKGDEST"
    - sudo apt-get update -q && sudo apt-get install -y config-package-dev golang-go lsb-release libdistro-info-perl
    - just build-dpkg
  artifacts:
    expire_in: 1 day
    paths:
      - $PKGDEST/*.deb

opensuse:
  stage: build
  image: registry.gitlab.com/roddhjav/builders/opensuse
  script:
    - mkdir -p "$PKGDEST"
    - sudo zypper install -y distribution-release golang-packaging apparmor-profiles
    - just build-rpm
  artifacts:
    expire_in: 1 day
    paths:
      - $PKGDEST/*.rpm


# Profile Preprocessing
# ---------------------

preprocess-archlinux:
  stage: preprocess
  image: archlinux
  dependencies:
    - archlinux
  script:
    - pacman -Syu --noconfirm --noprogressbar apparmor
    - pacman -U --noconfirm --noprogressbar $PKGDEST/${PKGNAME}-*
    - apparmor_parser --preprocess /etc/apparmor.d 1> /dev/null

preprocess-debian:
  stage: preprocess
  image: debian:13
  dependencies:
    - debian
  script:
    - apt-get update -q
    - apt-get install -y apparmor apparmor-profiles
    - dpkg --install $PKGDEST/${PKGNAME}*.deb
    - apparmor_parser --preprocess /etc/apparmor.d 1> /dev/null

preprocess-ubuntu:
  stage: preprocess
  image: ubuntu:26.04
  dependencies:
    - ubuntu
  script:
    - apt-get update -q
    - apt-get install -y apparmor apparmor-profiles
    - dpkg --install $PKGDEST/${PKGNAME}*.deb
    - apparmor_parser --preprocess /etc/apparmor.d 1> /dev/null

preprocess-opensuse:
  stage: preprocess
  image: opensuse/tumbleweed
  dependencies:
    - opensuse
  script:
    - zypper install -y apparmor-profiles
    - rpm -i $PKGDEST/*
    - rm -f /etc/apparmor.d/hostname
    - apparmor_parser --preprocess /etc/apparmor.d 1> /dev/null


# Deploy the documentation
# ------------------------

pages:
  stage: deploy
  image: python
  variables:
    MKDOCS_OFFLINE: "false"
    GIT_STRATEGY: clone
    GIT_DEPTH: 0
  script:
    - pip install -r requirements.txt
    - bash dists/docstring.sh
    - zensical build --strict
    - mv site public
  artifacts:
    paths:
      - public
  rules:
    - if: $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH