Kazier/.gitlab-ci.yml

# Pipeline GitLab pour VaultDrop — CI + Release.
#
# Prérequis runner :
#   - Un runner avec executor Docker pour les jobs d'images (postgres service,
#     docker:dind). Les jobs Android utilisent $ANDROID_IMAGE (défaut
#     cimg/android) ; remplacez par l'image installée sur vos workers.
#
# Variables CI/CD à définir (Settings > CI/CD > Variables) :
#   - RELEASE_KEYSTORE_B64   base64 du keystore release Android (jamais en clair)
#   - SIGNING_STORE_PASSWORD SIGNING_KEY_ALIAS SIGNING_KEY_PASSWORD
#   - GITLAB_API_TOKEN       token (scope api, write_repository) pour créer la GitLab Release
#   - DOCKERHUB_USER         DOCKERHUB_TOKEN  PAT Docker Hub (push public)
#   - DOCKERHUB_NAMESPACE    namespace Docker Hub (placeholder)
#
# Publication : à chaque tag vX.Y.Z → GitLab Release (APK attaché, latest +
# historique) + image $CI_REGISTRY + image Docker Hub.

stages:
  - lint
  - test
  - build
  - docker
  - release

variables:
  GO_IMAGE: "golang:1.26-alpine"
  POSTGRES_IMAGE: "postgres:17-alpine"
  ANDROID_IMAGE: "cimg/android:2024.01"
  GRADLE_USER_HOME: "$CI_PROJECT_DIR/.gradle-home"
  CGO_ENABLED: "0"

default:
  interruptible: true
  retry:
    max: 1

# ---------------------------------------------------------------- lint ----
lint-backend:
  stage: lint
  image: $GO_IMAGE
  script:
    - go mod download
    - go vet ./...
    - go install honnef.co/go/tools/cmd/staticcheck@latest && staticcheck ./...

lint-mobile:
  stage: lint
  image: $ANDROID_IMAGE
  cache:
    key: gradle-cache
    paths:
      - .gradle-home/caches
      - .gradle-home/wrapper
  script:
    - cd mobile-kotlin && ./gradlew :app:lint -q

# ---------------------------------------------------------------- test ----
test-backend:
  stage: test
  image: $GO_IMAGE
  services:
    - name: $POSTGRES_IMAGE
      alias: postgres
  variables:
    POSTGRES_DB: vaultdrop_test
    POSTGRES_USER: vaultdrop
    POSTGRES_PASSWORD: vaultdrop
    TEST_DATABASE_URL: postgres://vaultdrop:vaultdrop@postgres:5432/vaultdrop_test?sslmode=disable
  script:
    - mkdir -p .go-cache && export GOPATH="$CI_PROJECT_DIR/.go-cache"
    - go mod download
    - go test ./...
  cache:
    key: go-cache
    paths:
      - .go-cache

test-mobile:
  stage: test
  image: $ANDROID_IMAGE
  cache:
    key: gradle-cache
    paths:
      - .gradle-home/caches
      - .gradle-home/wrapper
  script:
    - cd mobile-kotlin && ./gradlew :app:testDebugUnitTest -q

# ---------------------------------------------------------------- build ----
build-backend:
  stage: build
  image: $GO_IMAGE
  script:
    - export VERSION=$(cat VERSION)
    - mkdir -p backend/bin
    - cd backend && CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-s -w -X main.version=$VERSION" -o bin/vaultdrop-server cmd/server/main.go
    - ./bin/vaultdrop-server --version
  artifacts:
    paths:
      - backend/bin/vaultdrop-server
    expire_in: 1 week

# --------------------------------------------------------------- docker ----
docker:
  stage: docker
  image: docker:27
  services:
    - name: docker:27-dind
      alias: docker
  variables:
    DOCKER_HOST: tcp://docker:2375
    DOCKER_TLS_CERTDIR: ""
    IMAGE_TAG: "$CI_COMMIT_TAG"
  script:
    - export IMAGE_TAG="${IMAGE_TAG:-$CI_COMMIT_REF_SLUG}"
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
    - docker build
      --build-arg VERSION="$(cat VERSION)"
      --build-arg BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
      -t "$CI_REGISTRY_IMAGE:$IMAGE_TAG"
      ./backend
    - docker push "$CI_REGISTRY_IMAGE:$IMAGE_TAG"
    - docker run --rm "$CI_REGISTRY_IMAGE:$IMAGE_TAG" --version
  needs: ["build-backend"]
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

# -------------------------------------------------------------- release ----
release-apk:
  stage: release
  image: $ANDROID_IMAGE
  cache:
    key: gradle-cache
    paths:
      - .gradle-home/caches
      - .gradle-home/wrapper
  script:
    - export VERSION=$(cat VERSION)
    - cd mobile-kotlin
    - |
      if [ -n "${RELEASE_KEYSTORE_B64:-}" ]; then
        echo "$RELEASE_KEYSTORE_B64" | base64 -d > app/release.keystore
        cat > app/signing.properties <<EOF
      storeFile=release.keystore
      storePassword=${SIGNING_STORE_PASSWORD:?}
      keyAlias=${SIGNING_KEY_ALIAS:?}
      keyPassword=${SIGNING_KEY_PASSWORD:?}
      EOF
      else
        echo "RELEASE_KEYSTORE_B64 manquant — release non signée." >&2
        exit 1
      fi
    - ./gradlew :app:assembleRelease -q
    - cd "$CI_PROJECT_DIR"
    - export GITLAB_TOKEN="$GITLAB_API_TOKEN"
    - glab release create "v$VERSION"
      --name "VaultDrop v$VERSION"
      --notes-file CHANGELOG.md
      "mobile-kotlin/app/build/outputs/apk/release/app-release.apk"
  needs: ["docker"]
  rules:
    - if: $CI_COMMIT_TAG

release-docker:
  stage: release
  image: docker:27
  services:
    - name: docker:27-dind
      alias: docker
  variables:
    DOCKER_HOST: tcp://docker:2375
    DOCKER_TLS_CERTDIR: ""
  script:
    - export VERSION=$(cat VERSION)
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
    - docker pull "$CI_REGISTRY_IMAGE:$CI_COMMIT_TAG"
    - |
      : "${DOCKERHUB_USER:?DOCKERHUB_USER manquant}"
      : "${DOCKERHUB_TOKEN:?DOCKERHUB_TOKEN manquant}"
      : "${DOCKERHUB_NAMESPACE:?DOCKERHUB_NAMESPACE manquant}"
      echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USER" --password-stdin docker.io
      IMAGE="$DOCKERHUB_NAMESPACE/vaultdrop"
      docker tag "$CI_REGISTRY_IMAGE:$CI_COMMIT_TAG" "$IMAGE:$CI_COMMIT_TAG"
      docker tag "$CI_REGISTRY_IMAGE:$CI_COMMIT_TAG" "$IMAGE:latest"
      docker push "$IMAGE:$CI_COMMIT_TAG"
      docker push "$IMAGE:latest"
  needs: ["docker"]
  rules:
    - if: $CI_COMMIT_TAG