.gitlab-ci.yml

default:
  before_script:
    - export GRADLE_USER_HOME=`pwd`/.gradle
    # The project's -Xmx4g is half the container limit, and the Kotlin daemon inherits it as a
    # second JVM, so a build that runs long enough is OOMKilled. Compile in the Gradle daemon
    # instead of forking that second JVM, and cap it to leave room for the test JVMs.
    # GRADLE_USER_HOME properties override the project's, so this stays out of local builds.
    - mkdir -p "$GRADLE_USER_HOME"
    - |
      cat > "$GRADLE_USER_HOME/gradle.properties" <<'PROPS'
      org.gradle.jvmargs=-Xmx3g -XX:MaxMetaspaceSize=1g
      kotlin.compiler.execution.strategy=in-process
      PROPS

variables:
  KUBERNETES_CPU_REQUEST: "4"
  KUBERNETES_CPU_LIMIT: "4"
  KUBERNETES_MEMORY_REQUEST: "8Gi"
  KUBERNETES_MEMORY_LIMIT: "8Gi"
  KUBERNETES_EPHEMERAL_STORAGE_REQUEST: "2Gi"
  KUBERNETES_EPHEMERAL_STORAGE_LIMIT: "5Gi"

workflow:
  rules:
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_BRANCH == "2.x"
    - if: $CI_COMMIT_BRANCH =~ /^patch/

stages:
  - build
  - test
  - publish

.gradle_cache: &gradle_cache
  key: "gradle-$CI_COMMIT_REF_NAME"
  fallback_keys:
    - "gradle-$CI_DEFAULT_BRANCH"
  paths:
    - .gradle/caches
    - .gradle/wrapper

build_libraries:
  stage: build
  image: registry.access.redhat.com/ubi9/openjdk-17
  script:
    - ./gradlew --console=colored classes
  cache:
    <<: *gradle_cache
    policy: pull-push
  artifacts:
    expire_in: 2 days
    paths:
      - "*/build"

test_libraries:
  stage: test
  image: registry.access.redhat.com/ubi9/openjdk-17
  script:
    - ./gradlew --console=colored --continue check koverXmlReport
  cache:
    <<: *gradle_cache
    policy: pull
  artifacts:
    reports:
      junit:
        - "**/build/test-results/test/TEST-*.xml"
      coverage_report:
        coverage_format: cobertura
        path: "build/reports/kover/report.xml"
  needs:
    - job: "build_libraries"

publish_libraries:
  stage: publish
  image: registry.access.redhat.com/ubi9/openjdk-17
  script:
    - ./gradlew --console=colored --no-configuration-cache publishAllPublicationsToArtifactoryRepository
  cache:
    <<: *gradle_cache
    policy: pull
  rules:
    - if: $CI_COMMIT_TAG
  needs:
    - job: "build_libraries"
    - job: "test_libraries"
      artifacts: false

# Maven Central publishing. A clean X.Y.Z tag uploads a deployment that stays staged in the Central
# Portal until released there by hand; an X.Y.Z-rcN tag uploads an overwriting X.Y.Z-SNAPSHOT.
# SONATYPE_GPG_KEY_BASE64 is a file variable holding the base64-encoded armoured private key.
publish_maven_central:
  stage: publish
  image: registry.access.redhat.com/ubi9/openjdk-17
  variables:
    # The key that published every release up to 3.1.0; SONATYPE_GPG_KEY_ID overrides it.
    ORG_GRADLE_PROJECT_signingInMemoryKeyId: "BD2A1230"
    ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: "$SONATYPE_GPG_PASSWORD"
    ORG_GRADLE_PROJECT_mavenCentralUsername: "$SONATYPE_USERNAME"
    ORG_GRADLE_PROJECT_mavenCentralPassword: "$SONATYPE_PASSWORD"
  script:
    - |
      # Decode through a file rather than a variable: command substitution drops NUL bytes, which
      # would hide a binary export by silently repairing it into something Gradle still cannot read.
      KEY=$CI_PROJECT_DIR/.signing-key.asc
      if head -c 5 "$SONATYPE_GPG_KEY_BASE64" | grep -q -- -----; then
        tr -d "\r" < "$SONATYPE_GPG_KEY_BASE64" > "$KEY"
      else
        base64 --decode "$SONATYPE_GPG_KEY_BASE64" | tr -d "\r" > "$KEY"
      fi
      # PowerShell redirection writes UTF-16, which Gradle cannot read. That is unambiguous from
      # the BOM, so convert it rather than failing.
      case "$(head -c 2 "$KEY" | od -An -tx1 | tr -d " \n")" in
        fffe|feff)
          echo "note: the key was stored as UTF-16, converting to UTF-8"
          iconv -f UTF-16 -t UTF-8 < "$KEY" > "$KEY.utf8" && mv "$KEY.utf8" "$KEY"
          ;;
      esac
      SIZE=$(wc -c < "$KEY")
      NULS=$(( SIZE - $(tr -d "\000" < "$KEY" | wc -c) ))
      echo "signing key: $SIZE bytes, $(wc -l < "$KEY") lines, $NULS NUL bytes"
      echo "first line:  $(head -n 1 "$KEY" | tr -c "[:graph:] " . | cut -c1-72)"
      echo "last line:   $(grep -a . "$KEY" | tail -n 1 | tr -c "[:graph:] " . | cut -c1-72)"
      if [ "$NULS" -ne 0 ]; then
        rm -f "$KEY"
        echo "The key is binary, so Gradle cannot read it. Store the armoured form instead:"
        echo "  gpg --armor --export-secret-keys BD2A1230 | base64 -w0"
        exit 1
      fi
      if ! grep -aq "BEGIN PGP PRIVATE KEY BLOCK" "$KEY"; then
        rm -f "$KEY"
        echo "SONATYPE_GPG_KEY_BASE64 holds neither an armoured PGP private key nor its base64."
        exit 1
      fi
      # Armour is line-oriented: a header, a blank line, wrapped payload, a footer.
      if [ "$(wc -l < "$KEY")" -lt 4 ]; then
        rm -f "$KEY"
        echo "The armour has lost its line breaks, so Gradle cannot parse it. Re-store it with:"
        echo "  gpg --armor --export-secret-keys BD2A1230 > key.asc"
        echo "  base64 -w0 key.asc      # the file variable takes this output"
        exit 1
      fi
      export ORG_GRADLE_PROJECT_signingInMemoryKey="$(cat "$KEY")"
      rm -f "$KEY"
      # Select a subkey only when told which one, otherwise sign with whichever key can sign.
      if [ -n "$SONATYPE_GPG_KEY_ID" ]; then
        export ORG_GRADLE_PROJECT_signingInMemoryKeyId="$SONATYPE_GPG_KEY_ID"
      fi
    - ./gradlew --console=colored --no-configuration-cache publishToMavenCentral
  cache:
    <<: *gradle_cache
    policy: pull
  rules:
    - if: $CI_COMMIT_TAG
  needs:
    - job: "build_libraries"
    - job: "test_libraries"
      artifacts: false