add gitlab ci

2026-09-16 14:47:10 +02:00
parent 906d48702c
commit cd4f0179fc
32 changed files with 1462 additions and 40 deletions
@@ -0,0 +1,190 @@
+# Pipeline GitLab pour VaultDrop — CI + Release.
+#
+# Prérequis runner :
+#   - Un runner avec executor Docker pour les jobs d'images (postgres service,
+#     docker:dind). Les jobs Android utilisent $ANDROID_IMAGE (défaut
+#     cimg/android) ; remplacez par l'image installée sur vos workers.
+#
+# Variables CI/CD à définir (Settings > CI/CD > Variables) :
+#   - RELEASE_KEYSTORE_B64   base64 du keystore release Android (jamais en clair)
+#   - SIGNING_STORE_PASSWORD SIGNING_KEY_ALIAS SIGNING_KEY_PASSWORD
+#   - GITLAB_API_TOKEN       token (scope api, write_repository) pour créer la GitLab Release
+#   - DOCKERHUB_USER         DOCKERHUB_TOKEN  PAT Docker Hub (push public)
+#   - DOCKERHUB_NAMESPACE    namespace Docker Hub (placeholder)
+#
+# Publication : à chaque tag vX.Y.Z → GitLab Release (APK attaché, latest +
+# historique) + image $CI_REGISTRY + image Docker Hub.
+
+stages:
+  - lint
+  - test
+  - build
+  - docker
+  - release
+
+variables:
+  GO_IMAGE: "golang:1.26-alpine"
+  POSTGRES_IMAGE: "postgres:17-alpine"
+  ANDROID_IMAGE: "cimg/android:2024.01"
+  GRADLE_USER_HOME: "$CI_PROJECT_DIR/.gradle-home"
+  CGO_ENABLED: "0"
+
+default:
+  interruptible: true
+  retry:
+    max: 1
+
+# ---------------------------------------------------------------- lint ----
+lint-backend:
+  stage: lint
+  image: $GO_IMAGE
+  script:
+    - go mod download
+    - go vet ./...
+    - go install honnef.co/go/tools/cmd/staticcheck@latest && staticcheck ./...
+
+lint-mobile:
+  stage: lint
+  image: $ANDROID_IMAGE
+  cache:
+    key: gradle-cache
+    paths:
+      - .gradle-home/caches
+      - .gradle-home/wrapper
+  script:
+    - cd mobile-kotlin && ./gradlew :app:lint -q
+
+# ---------------------------------------------------------------- test ----
+test-backend:
+  stage: test
+  image: $GO_IMAGE
+  services:
+    - name: $POSTGRES_IMAGE
+      alias: postgres
+  variables:
+    POSTGRES_DB: vaultdrop_test
+    POSTGRES_USER: vaultdrop
+    POSTGRES_PASSWORD: vaultdrop
+    TEST_DATABASE_URL: postgres://vaultdrop:vaultdrop@postgres:5432/vaultdrop_test?sslmode=disable
+  script:
+    - mkdir -p .go-cache && export GOPATH="$CI_PROJECT_DIR/.go-cache"
+    - go mod download
+    - go test ./...
+  cache:
+    key: go-cache
+    paths:
+      - .go-cache
+
+test-mobile:
+  stage: test
+  image: $ANDROID_IMAGE
+  cache:
+    key: gradle-cache
+    paths:
+      - .gradle-home/caches
+      - .gradle-home/wrapper
+  script:
+    - cd mobile-kotlin && ./gradlew :app:testDebugUnitTest -q
+
+# ---------------------------------------------------------------- build ----
+build-backend:
+  stage: build
+  image: $GO_IMAGE
+  script:
+    - export VERSION=$(cat VERSION)
+    - mkdir -p backend/bin
+    - cd backend && CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-s -w -X main.version=$VERSION" -o bin/vaultdrop-server cmd/server/main.go
+    - ./bin/vaultdrop-server --version
+  artifacts:
+    paths:
+      - backend/bin/vaultdrop-server
+    expire_in: 1 week
+
+# --------------------------------------------------------------- docker ----
+docker:
+  stage: docker
+  image: docker:27
+  services:
+    - name: docker:27-dind
+      alias: docker
+  variables:
+    DOCKER_HOST: tcp://docker:2375
+    DOCKER_TLS_CERTDIR: ""
+    IMAGE_TAG: "$CI_COMMIT_TAG"
+  script:
+    - export IMAGE_TAG="${IMAGE_TAG:-$CI_COMMIT_REF_SLUG}"
+    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
+    - docker build
+      --build-arg VERSION="$(cat VERSION)"
+      --build-arg BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+      -t "$CI_REGISTRY_IMAGE:$IMAGE_TAG"
+      ./backend
+    - docker push "$CI_REGISTRY_IMAGE:$IMAGE_TAG"
+    - docker run --rm "$CI_REGISTRY_IMAGE:$IMAGE_TAG" --version
+  needs: ["build-backend"]
+  rules:
+    - if: $CI_COMMIT_TAG
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+
+# -------------------------------------------------------------- release ----
+release-apk:
+  stage: release
+  image: $ANDROID_IMAGE
+  cache:
+    key: gradle-cache
+    paths:
+      - .gradle-home/caches
+      - .gradle-home/wrapper
+  script:
+    - export VERSION=$(cat VERSION)
+    - cd mobile-kotlin
+    - |
+      if [ -n "${RELEASE_KEYSTORE_B64:-}" ]; then
+        echo "$RELEASE_KEYSTORE_B64" | base64 -d > app/release.keystore
+        cat > app/signing.properties <<EOF
+      storeFile=release.keystore
+      storePassword=${SIGNING_STORE_PASSWORD:?}
+      keyAlias=${SIGNING_KEY_ALIAS:?}
+      keyPassword=${SIGNING_KEY_PASSWORD:?}
+      EOF
+      else
+        echo "RELEASE_KEYSTORE_B64 manquant — release non signée." >&2
+        exit 1
+      fi
+    - ./gradlew :app:assembleRelease -q
+    - cd "$CI_PROJECT_DIR"
+    - export GITLAB_TOKEN="$GITLAB_API_TOKEN"
+    - glab release create "v$VERSION"
+      --name "VaultDrop v$VERSION"
+      --notes-file CHANGELOG.md
+      "mobile-kotlin/app/build/outputs/apk/release/app-release.apk"
+  needs: ["docker"]
+  rules:
+    - if: $CI_COMMIT_TAG
+
+release-docker:
+  stage: release
+  image: docker:27
+  services:
+    - name: docker:27-dind
+      alias: docker
+  variables:
+    DOCKER_HOST: tcp://docker:2375
+    DOCKER_TLS_CERTDIR: ""
+  script:
+    - export VERSION=$(cat VERSION)
+    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
+    - docker pull "$CI_REGISTRY_IMAGE:$CI_COMMIT_TAG"
+    - |
+      : "${DOCKERHUB_USER:?DOCKERHUB_USER manquant}"
+      : "${DOCKERHUB_TOKEN:?DOCKERHUB_TOKEN manquant}"
+      : "${DOCKERHUB_NAMESPACE:?DOCKERHUB_NAMESPACE manquant}"
+      echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USER" --password-stdin docker.io
+      IMAGE="$DOCKERHUB_NAMESPACE/vaultdrop"
+      docker tag "$CI_REGISTRY_IMAGE:$CI_COMMIT_TAG" "$IMAGE:$CI_COMMIT_TAG"
+      docker tag "$CI_REGISTRY_IMAGE:$CI_COMMIT_TAG" "$IMAGE:latest"
+      docker push "$IMAGE:$CI_COMMIT_TAG"
+      docker push "$IMAGE:latest"
+  needs: ["docker"]
+  rules:
+    - if: $CI_COMMIT_TAG