.gitlab-ci.yml

.build_setup_steps: &build_setup_steps
  before_script:
    - mkdir -p /opt/IronFox
    - echo "$SB_GAPI_KEY" > "$SB_GAPI_KEY_FILE"
    - |
      curl \
        --request GET \
        --header "JOB-TOKEN: $CI_JOB_TOKEN" \
        "${CI_API_V4_URL}/projects/$CI_PROJECT_ID/secure_files/$KEYSTORE_SECFILEID/download" \
        --output "$KEYSTORE"

variables: &build_variables
  PRODUCTION_BRANCH: main
  VERSION_NAME: "135.0.0"
  SB_GAPI_KEY_FILE: /opt/IronFox/sb-gapi.data
  KEYSTORE: /opt/IronFox/signing-key.jks
  BUNDLETOOL: 1.18.0

stages:
  - build_fdroid
  - build_docker
  - build_ironfox
  - release

update-fdroid-repo:
  image: fedora:41
  stage: build_fdroid
  rules:
    - if: $CI_COMMIT_TAG
  variables:
    TARGET_REPO_PATH: ironfox-oss/fdroid
    TARGET_REPO_BRANCH: dev
    META_FILE: "./fdroid/metadata/org.ironfoxoss.ironfox.yml"
    REPO_DIR: "./fdroid/repo"
    <<: *build_variables
  before_script:
    - sudo dnf install -y bash curl git jq make python3 python3-pip
    - pip install androguard
    - git config --global user.email "ci@ironfoxoss.org"
    - git config --global user.name "IronFox CI"
  script:
    - bash -x scripts/ci-update-fdroid.sh

build-docker:
  image: docker:cli
  stage: build_docker
  services:
    - docker:dind
  variables:
    DOCKER_IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
  before_script:
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
  script:
    - docker build --pull -t "$DOCKER_IMAGE_NAME" .
    - docker push "$DOCKER_IMAGE_NAME"
    - |
      if [[ "$CI_COMMIT_BRANCH" == "$CI_DEFAULT_BRANCH" ]]; then
        docker tag "$DOCKER_IMAGE_NAME" "$CI_REGISTRY_IMAGE:latest"
        docker push "$CI_REGISTRY_IMAGE:latest"
      fi
  rules:
    - if: $CI_COMMIT_BRANCH
      exists:
        - Dockerfile
      changes:
        - Dockerfile
    - if: $CI_COMMIT_BRANCH == $PRODUCTION_BRANCH

build-apk:
  image: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
  stage: build_ironfox
  timeout: 2h
  needs:
    - job: "build-docker"
      optional: true
  tags:
    - saas-linux-xlarge-amd64
  parallel:
    matrix:
      - VERSION_CODE: ["31350000", "31350010", "31350020"]
  variables:
    <<: *build_variables
  <<: *build_setup_steps
  script:
    - bash -x scripts/ci-build.sh
  artifacts:
    untracked: false
    when: on_success
    access: all
    expire_in: "30 days"
    paths:
      - $CI_PROJECT_DIR/artifacts/apk/**/*
      - $CI_PROJECT_DIR/artifacts/aar/**/*
  except:
      changes:
      - "*.md"
      - assets/*
      - .gitignore
      - LICENSE

build-apk-set:
  image: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
  stage: build_ironfox
  timeout: 2h
  needs:
    - job: "build-docker"
      optional: true
    - job: "build-apk"
      artifacts: true
      optional: false
  tags:
    - saas-linux-xlarge-amd64
  variables:
    VERSION_CODE: "31350030"
    <<: *build_variables
  <<: *build_setup_steps
  script:
    - bash -x scripts/ci-build.sh
  artifacts:
    untracked: false
    when: on_success
    access: all
    expire_in: "30 days"
    paths:
      - $CI_PROJECT_DIR/artifacts/apks/**/*
  except:
      changes:
      - "*.md"
      - assets/*
      - .gitignore
      - LICENSE

prepare-release:
  image: alpine:latest
  stage: release
  interruptible: true
  needs:
    - job: "build-docker"
      optional: true
    - job: "build-apk"
      artifacts: true
      optional: true
    - job: "build-apk-set"
      artifacts: true
      optional: true
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: $CI_COMMIT_BRANCH == $PRODUCTION_BRANCH
  variables:
    <<: *build_variables
  before_script:
    - apk add --update --no-cache bash curl jq
  script:
    - bash -x scripts/ci-publish-packages.sh
  artifacts:
    untracked: false
    when: on_success
    access: all
    expire_in: "30 days"
    paths:
      - build/release.yml

publish-release:
  image: registry.gitlab.com/gitlab-org/release-cli:latest
  stage: release
  interruptible: true
  needs:
    - job: "prepare-release"
      artifacts: true
      optional: false
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: $CI_COMMIT_BRANCH == $PRODUCTION_BRANCH
  variables:
    <<: *build_variables
  script:
    - |
      release-cli \
        --server-url "$CI_SERVER_URL" \
        --project-id "$CI_PROJECT_ID" \
        --private-token "$GITLAB_CI_API_TOKEN" \
        create-from-file \
        --file build/release.yml