mirror of
https://github.com/ProtonMail/proton-bridge.git
synced 2025-12-10 04:36:43 +00:00
308 lines
8.2 KiB
YAML
308 lines
8.2 KiB
YAML
# Copyright (c) 2022 Proton Technologies AG
|
|
#
|
|
# This file is part of ProtonMail Bridge.
|
|
#
|
|
# ProtonMail Bridge is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# ProtonMail Bridge is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with ProtonMail Bridge. If not, see <https://www.gnu.org/licenses/>.
|
|
|
|
---
|
|
image: gitlab.protontech.ch:4567/go/bridge-internal:go18
|
|
|
|
before_script:
|
|
- eval $(ssh-agent -s)
|
|
- echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add - > /dev/null
|
|
- mkdir -p .cache/bin
|
|
- export PATH=$(pwd)/.cache/bin:$PATH
|
|
- export GOPATH="$CI_PROJECT_DIR/.cache"
|
|
- make install-dev-dependencies
|
|
- git checkout .
|
|
|
|
cache:
|
|
key: go18-mod
|
|
paths:
|
|
- .cache
|
|
policy: pull
|
|
|
|
stages:
|
|
- cache
|
|
- test
|
|
- build
|
|
- check
|
|
- mirror
|
|
|
|
|
|
.rules-branch-and-MR-always:
|
|
rules:
|
|
- if: $CI_COMMIT_BRANCH || $CI_PIPELINE_SOURCE == "merge_request_event"
|
|
when: always
|
|
allow_failure: false
|
|
- when: never
|
|
|
|
.rules-branch-and-MR-manual:
|
|
rules:
|
|
- if: $CI_COMMIT_BRANCH || $CI_PIPELINE_SOURCE == "merge_request_event"
|
|
when: manual
|
|
allow_failure: true
|
|
- when: never
|
|
|
|
.rules-branch-manual-MR-always:
|
|
rules:
|
|
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
|
when: always
|
|
allow_failure: false
|
|
- if: $CI_COMMIT_BRANCH
|
|
when: manual
|
|
allow_failure: true
|
|
- when: never
|
|
|
|
# Stage: CACHE
|
|
|
|
# This will ensure latest dependency versions and updates the cache for
|
|
# all other following jobs which only pull the cache.
|
|
cache-push:
|
|
stage: cache
|
|
extends:
|
|
- .rules-branch-and-MR-always
|
|
script:
|
|
- echo ""
|
|
cache:
|
|
key: go18-mod
|
|
paths:
|
|
- .cache
|
|
|
|
# Stage: TEST
|
|
|
|
lint:
|
|
stage: test
|
|
extends:
|
|
- .rules-branch-and-MR-always
|
|
before_script:
|
|
- mkdir -p .cache/bin
|
|
- export PATH=$(pwd)/.cache/bin:$PATH
|
|
- export GOPATH="$CI_PROJECT_DIR/.cache"
|
|
script:
|
|
- env GOMAXPROCS=$(( ${CI_TAG_CPU} / 2 )) make lint
|
|
tags:
|
|
- medium
|
|
|
|
test-linux:
|
|
stage: test
|
|
extends:
|
|
- .rules-branch-manual-MR-always
|
|
script:
|
|
- apt-get -y install pass gnupg rng-tools
|
|
# First have enough of entropy (cat /proc/sys/kernel/random/entropy_avail).
|
|
- rngd -r /dev/urandom
|
|
# Generate GPG key without password for the password manager.
|
|
- gpg --batch --yes --passphrase '' --quick-generate-key 'tester@example.com'
|
|
# Use the last created GPG ID for the password manager.
|
|
- pass init `gpg --list-keys | grep "^ " | tail -1 | tr -d '[:space:]'`
|
|
# Then finally run the tests
|
|
- make test
|
|
tags:
|
|
- medium
|
|
|
|
test-windows:
|
|
extends:
|
|
- .build-windows-base
|
|
- .rules-branch-and-MR-always
|
|
stage: test
|
|
needs: []
|
|
script:
|
|
- make test
|
|
|
|
test-integration:
|
|
stage: test
|
|
extends:
|
|
- .rules-branch-manual-MR-always
|
|
script:
|
|
- VERBOSITY=debug make -C test test
|
|
tags:
|
|
- large
|
|
|
|
dependency-updates:
|
|
stage: test
|
|
script:
|
|
- make updates
|
|
|
|
# Stage: BUILD
|
|
|
|
.build-base:
|
|
stage: build
|
|
needs: ["lint"]
|
|
rules:
|
|
# GODT-1833: use `=~ /qa/` after mac and windows runners are fixed
|
|
- if: $CI_JOB_NAME =~ /build-linux-qa/ && $CI_PIPELINE_SOURCE == "merge_request_event"
|
|
when: always
|
|
allow_failure: false
|
|
- if: $CI_COMMIT_BRANCH || $CI_PIPELINE_SOURCE == "merge_request_event"
|
|
when: manual
|
|
allow_failure: true
|
|
- when: never
|
|
before_script:
|
|
- mkdir -p .cache/bin
|
|
- export PATH=$(pwd)/.cache/bin:$PATH
|
|
- export GOPATH="$CI_PROJECT_DIR/.cache"
|
|
script:
|
|
- make build
|
|
- git diff && git diff-index --quiet HEAD
|
|
artifacts:
|
|
# Note: The latest artifacts for refs are locked against deletion, and kept
|
|
# regardless of the expiry time. Introduced in GitLab 13.0 behind a
|
|
# disabled feature flag, and made the default behavior in GitLab 13.4.
|
|
expire_in: 1 day
|
|
when: always
|
|
paths:
|
|
- bridge_*.tgz
|
|
tags:
|
|
- large
|
|
|
|
build-linux:
|
|
extends: .build-base
|
|
image: gitlab.protontech.ch:4567/go/bridge-internal:qt6
|
|
variables:
|
|
VCPKG_DEFAULT_BINARY_CACHE: ${CI_PROJECT_DIR}/.cache
|
|
cache:
|
|
key: linux-vcpkg
|
|
paths:
|
|
- .cache
|
|
when: 'always'
|
|
artifacts:
|
|
name: "bridge-linux-$CI_COMMIT_SHORT_SHA"
|
|
|
|
build-linux-qa:
|
|
extends: build-linux
|
|
variables:
|
|
BUILD_TAGS: "build_qa"
|
|
artifacts:
|
|
name: "bridge-linux-qa-$CI_COMMIT_SHORT_SHA"
|
|
|
|
|
|
.build-darwin-base:
|
|
extends: .build-base
|
|
before_script:
|
|
- export PATH=/usr/local/bin:$PATH
|
|
- export PATH=/usr/local/opt/git/bin:$PATH
|
|
- export PATH=/usr/local/opt/make/libexec/gnubin:$PATH
|
|
- export PATH=/usr/local/opt/go@1.13/bin:$PATH
|
|
- export PATH=/usr/local/opt/gnu-sed/libexec/gnubin:$PATH
|
|
- export GOPATH=~/go
|
|
- export PATH=$GOPATH/bin:$PATH
|
|
- export CGO_CPPFLAGS='-Wno-error -Wno-nullability-completeness -Wno-expansion-to-defined -Wno-builtin-requires-header'
|
|
script:
|
|
- go version
|
|
- make build
|
|
- git diff && git diff-index --quiet HEAD
|
|
cache: {}
|
|
tags:
|
|
- macOS
|
|
|
|
build-darwin:
|
|
extends: .build-darwin-base
|
|
artifacts:
|
|
name: "bridge-darwin-$CI_COMMIT_SHORT_SHA"
|
|
|
|
build-darwin-qa:
|
|
extends: .build-darwin-base
|
|
variables:
|
|
BUILD_TAGS: "build_qa"
|
|
artifacts:
|
|
name: "bridge-darwin-qa-$CI_COMMIT_SHORT_SHA"
|
|
|
|
|
|
.build-windows-base:
|
|
extends: .build-base
|
|
before_script:
|
|
- export GOROOT=/c/Go1.18/
|
|
- export PATH=$GOROOT/bin:$PATH
|
|
- export GOARCH=amd64
|
|
- export GOPATH=~/go18
|
|
- export GO111MODULE=on
|
|
- export PATH="${GOPATH}/bin:${PATH}"
|
|
- export MSYSTEM=
|
|
- export QT6DIR=/c/grrrQt/6.3.1/msvc2019_64
|
|
- export PATH=$PATH:${QT6DIR}/bin
|
|
- export PATH="/c/Program Files/Microsoft Visual Studio/2022/Community/Common7/IDE/CommonExtensions/Microsoft/CMake/CMake/bin:$PATH"
|
|
script:
|
|
- make build
|
|
- git diff && git diff-index --quiet HEAD
|
|
tags:
|
|
- windows-bridge
|
|
|
|
build-windows:
|
|
extends: .build-windows-base
|
|
artifacts:
|
|
name: "bridge-windows-$CI_COMMIT_SHORT_SHA"
|
|
|
|
build-windows-qa:
|
|
extends: .build-windows-base
|
|
variables:
|
|
BUILD_TAGS: "build_qa"
|
|
artifacts:
|
|
name: "bridge-windows-qa-$CI_COMMIT_SHORT_SHA"
|
|
|
|
# Stage: CHECK
|
|
|
|
check-gobinsec:
|
|
stage: check
|
|
needs: ["build-linux-qa"]
|
|
extends:
|
|
- .rules-branch-and-MR-manual
|
|
cache:
|
|
key: gobinsec-cache-v3
|
|
paths:
|
|
- ./gobinsec-cache-valid.yml
|
|
policy: pull-push
|
|
before_script:
|
|
- mkdir build
|
|
- tar -xzf bridge_linux_*.tgz -C build
|
|
- "[ ! -f ./gobinsec-cache-valid.yml ] && wget bridgeteam.protontech.ch/bridgeteam/gobinsec-cache-valid.yml"
|
|
- cp ./gobinsec-cache-valid.yml ./gobinsec-cache.yml
|
|
script:
|
|
- cat ./gobinsec-cache.yml
|
|
- gobinsec -wait -cache -config utils/gobinsec_conf.yml build/bridge
|
|
- cp ./gobinsec-cache.yml ./gobinsec-cache-valid.yml # Only update cache file if gobinsec succeeds
|
|
|
|
|
|
|
|
# Stage: MIRROR
|
|
|
|
mirror-repo:
|
|
stage: mirror
|
|
only:
|
|
refs:
|
|
- master
|
|
script:
|
|
- |
|
|
cat <<EOF > ~/.ssh/config
|
|
Host github.com
|
|
Hostname ssh.github.com
|
|
User git
|
|
Port 443
|
|
ProxyCommand connect-proxy -H $http_proxy %h %p
|
|
EOF
|
|
- ssh-keyscan -t rsa ${CI_SERVER_HOST} > ~/.ssh/known_hosts
|
|
- |
|
|
cat <<EOF >> ~/.ssh/known_hosts
|
|
# ssh.github.com:443 SSH-2.0-babeld-2e9d163d
|
|
[ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
|
|
EOF
|
|
- echo "$mirror_key" | tr -d '\r' | ssh-add - > /dev/null
|
|
- ssh-add -l
|
|
- git clone "$CI_REPOSITORY_URL" --branch master _REPO_CLONE;
|
|
- cd _REPO_CLONE
|
|
- git remote add public $mirror_url
|
|
- git push public master
|
|
# Pushing the latest tag from master history
|
|
- git push public "$(git describe --tags --abbrev=0 || echo master)"
|