.cirrus.yml

env:
  CIRRUS_VAULT_URL: https://vault.sonar.build:8200
  CIRRUS_VAULT_AUTH_PATH: jwt-cirrusci
  CIRRUS_VAULT_ROLE: cirrusci-${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}

  ARTIFACTORY_URL: https://repox.jfrog.io/artifactory
  ARTIFACTORY_PRIVATE_USERNAME: vault-${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader
  ARTIFACTORY_PRIVATE_PASSWORD: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader access_token]
  ARTIFACTORY_DEPLOY_USERNAME: vault-${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer
  ARTIFACTORY_DEPLOY_PASSWORD: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer access_token]
  ARTIFACTORY_DEPLOY_REPO: sonarsource-public-qa
  ARTIFACTORY_ACCESS_TOKEN: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader access_token]
  GITHUB_TOKEN: VAULT[development/github/token/licenses-ro token]
  # burgr notification
  BURGR_URL: VAULT[development/kv/data/burgr data.url]
  BURGR_USERNAME: VAULT[development/kv/data/burgr data.cirrus_username]
  BURGR_PASSWORD: VAULT[development/kv/data/burgr data.cirrus_password]

  # Use bash (instead of sh on linux or cmd.exe on windows)
  CIRRUS_SHELL: bash

container_definition: &CONTAINER_DEFINITION
  cluster_name: ${CIRRUS_CLUSTER_NAME}
  builder_role: cirrus-builder
  builder_image: docker-builder-v*
  builder_instance_type: t3.small
  builder_subnet_id: ${CIRRUS_AWS_SUBNET}
  region: eu-central-1
  namespace: default
  use_in_memory_disk: true

maven_cache_definition: &MAVEN_CACHE
  maven_cache:
    folder: ${CIRRUS_WORKING_DIR}/.m2/repository
    fingerprint_script: cat **/pom.xml

nodejs_runtimes_cache_definition: &RUNTIME_CACHE
  runtime_cache:
    folder: tools/fetch-node/downloads/
    fingerprint_script: cat tools/fetch-node/node-distros.mjs

win_vm_definition: &WINDOWS_VM_DEFINITION
  ec2_instance:
    experimental: true # see https://github.com/cirruslabs/cirrus-ci-docs/issues/1051
    image: base-windows-jdk17-v*
    platform: windows
    region: eu-central-1
    type: c6id.4xlarge
    subnet_id: ${CIRRUS_AWS_SUBNET}
    preemptible: false
    use_ssd: true

npmrc_script_definition: &NPMRC_SCRIPT_DEFINITION
  npmrc_script:
    - cp .cirrus/npmrc $CIRRUS_WORKING_DIR/.npmrc

win_ssd_and_clone:
  &WIN_SSD_AND_CLONE # copy&paste from https://github.com/SonarSource/sonar-cpp/blob/a8c6f1e45a12393508682a013ac7ee35eb92bece/.cirrus.yml#L45
  prepare_disk_script:
    - ps: |
        Get-Disk -Number 2 | Initialize-Disk -PassThru | New-Partition -UseMaximumSize -DriveLetter Z
        Format-Volume -DriveLetter Z -FileSystem NTFS -Confirm:$false
    - echo "CIRRUS_WORKING_DIR=Z:/cirrus-ci-build" >> $CIRRUS_ENV
  # we don't clone submodules because they are not needed for the tests
  clone_script: |
    git config --system core.longpaths true
    if [ -z "$CIRRUS_PR" ]; then
      git clone --branch=$CIRRUS_BRANCH https://x-access-token:${CIRRUS_REPO_CLONE_TOKEN}@github.com/${CIRRUS_REPO_FULL_NAME}.git $CIRRUS_WORKING_DIR
      git reset --hard $CIRRUS_CHANGE_IN_REPO
    else
      git clone https://x-access-token:${CIRRUS_REPO_CLONE_TOKEN}@github.com/${CIRRUS_REPO_FULL_NAME}.git $CIRRUS_WORKING_DIR
      git fetch origin pull/$CIRRUS_PR/head:pull/$CIRRUS_PR
      git reset --hard $CIRRUS_CHANGE_IN_REPO
    fi

only_sonarsource_qa: &ONLY_SONARSOURCE_QA
  only_if: $CIRRUS_USER_COLLABORATOR == 'true' && ($CIRRUS_PR != "" || $CIRRUS_BRANCH == "master" || $CIRRUS_BRANCH =~ "branch-.*" || $CIRRUS_BRANCH =~ "dogfood-on-.*")

plugin_qa_body: &PLUGIN_QA_BODY
  depends_on:
    - build
  <<: *ONLY_SONARSOURCE_QA
  eks_container:
    <<: *CONTAINER_DEFINITION
    cpu: 15
    memory: 30G
  env:
    CIRRUS_CLONE_DEPTH: 10
    SONARSOURCE_QA: true
  <<: *MAVEN_CACHE
  qa_script:
    - source cirrus-env QA
    - source set_maven_build_version $BUILD_NUMBER
    - mvn -f its/plugin/pom.xml -Dsonar.runtimeVersion=${SQ_VERSION} ${MVN_TEST} -B -e -V verify surefire-report:report
  cleanup_before_cache_script: cleanup_maven_repository

build_task:
  eks_container:
    <<: *CONTAINER_DEFINITION
    dockerfile: .cirrus/nodejs.Dockerfile
    docker_arguments:
      CIRRUS_AWS_ACCOUNT: ${CIRRUS_AWS_ACCOUNT}
    cpu: 15
    memory: 30G
  env:
    #allow deployment of pull request artifacts to repox
    DEPLOY_PULL_REQUEST: true
    #sign artifacts
    SIGN_KEY: VAULT[development/kv/data/sign data.key]
    PGP_PASSPHRASE: VAULT[development/kv/data/sign data.passphrase]
    SONAR_TOKEN: VAULT[development/kv/data/next data.token]
    SONAR_HOST_URL: https://next.sonarqube.com/sonarqube
    ARTIFACTORY_DEPLOY_ACCESS_TOKEN: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer access_token]
  <<: *MAVEN_CACHE
  <<: *RUNTIME_CACHE
  <<: *NPMRC_SCRIPT_DEFINITION
  build_and_deploy_script:
    - source cirrus-env BUILD
    - npm ci
    - npm run check-format
    - npm run build
    - regular_mvn_build_deploy_analyze -Dmaven.test.skip=true -Dmaven.install.skip=true -Dsonar.skip=true
  cleanup_before_cache_script: cleanup_maven_repository

analyze_task:
  eks_container:
    <<: *CONTAINER_DEFINITION
    dockerfile: .cirrus/nodejs.Dockerfile
    docker_arguments:
      CIRRUS_AWS_ACCOUNT: ${CIRRUS_AWS_ACCOUNT}
    cpu: 15
    memory: 30G
  depends_on:
    - build
  env:
    # analysis on next
    SONAR_TOKEN: VAULT[development/kv/data/next data.token]
    SONAR_HOST_URL: https://next.sonarqube.com/sonarqube
    ARTIFACTORY_DEPLOY_ACCESS_TOKEN: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer access_token]
  <<: *MAVEN_CACHE
  <<: *RUNTIME_CACHE
  <<: *NPMRC_SCRIPT_DEFINITION
  build_and_analyze_script:
    - source cirrus-env QA
    - npm run build
    - PULL_REQUEST_SHA=$GIT_SHA1 regular_mvn_build_deploy_analyze -P-deploy-sonarsource,-release,-sign -Dcommercial -Dmaven.shade.skip=true -Dmaven.install.skip=true -Dmaven.deploy.skip=true -Dsonar.coverage.jacoco.xmlReportPaths=$CIRRUS_WORKING_DIR/report-aggregate/target/site/jacoco-aggregate/jacoco.xml

build_win_task:
  depends_on:
    - build
  <<: *WINDOWS_VM_DEFINITION
  <<: *ONLY_SONARSOURCE_QA
  <<: *MAVEN_CACHE
  <<: *RUNTIME_CACHE
  <<: *NPMRC_SCRIPT_DEFINITION
  build_script:
    - source cirrus-env CI
    - npm run build
  cleanup_before_cache_script: cleanup_maven_repository

ws_scan_task:
  depends_on:
    - build
  eks_container:
    <<: *CONTAINER_DEFINITION
    dockerfile: .cirrus/nodejs.Dockerfile
    docker_arguments:
      CIRRUS_AWS_ACCOUNT: ${CIRRUS_AWS_ACCOUNT}
    cpu: 4
    memory: 8G
  # run only on master and long-term branches
  only_if: $CIRRUS_USER_COLLABORATOR == 'true' && ($CIRRUS_BRANCH == "master" || $CIRRUS_BRANCH =~ "branch-.*")
  env:
    WS_APIKEY: VAULT[development/kv/data/mend data.apikey]
  <<: *MAVEN_CACHE
  <<: *NPMRC_SCRIPT_DEFINITION
  whitesource_script:
    - source cirrus-env QA
    - source set_maven_build_version $BUILD_NUMBER
    - npm ci
    - source ws_scan.sh
  allow_failures: 'true'
  always:
    ws_artifacts:
      path: 'whitesource/**/*'

plugin_qa_with_node_task:
  <<: *PLUGIN_QA_BODY
  eks_container:
    dockerfile: .cirrus/nodejs.Dockerfile
  env:
    SQ_VERSION: LATEST_RELEASE
    MVN_TEST: ''

plugin_qa_no_node_task:
  <<: *PLUGIN_QA_BODY
  eks_container:
    image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest
  env:
    SQ_VERSION: LATEST_RELEASE
    SONARJS_ARTIFACT: multi
    MVN_TEST: '-Dtest=!EslintCustomRulesTest,!SonarJsIntegrationTest --projects !org.sonarsource.javascript:eslint-custom-rules-plugin'

plugin_qa_sq_dev_task:
  <<: *PLUGIN_QA_BODY
  eks_container:
    image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest
  env:
    SQ_VERSION: DEV
    SONARJS_ARTIFACT: multi
    MVN_TEST: '-Dtest=!EslintCustomRulesTest,!SonarJsIntegrationTest --projects !org.sonarsource.javascript:eslint-custom-rules-plugin'

# Plugin QA for Windows is split into 3 parts to make it faster
plugin_qa_win_task:
  depends_on:
    - build
  <<: *WINDOWS_VM_DEFINITION
  <<: *ONLY_SONARSOURCE_QA
  env:
    SONARSOURCE_QA: true
    SQ_VERSION: LATEST_RELEASE
    matrix:
      - TEST: '!CoverageTest,!TypeScriptAnalysisTest,!EslintBasedRulesTest,!PRAnalysisTest,!TypeCheckerConfigTest,!VueAnalysisTest'
      - TEST: 'CoverageTest,TypeScriptAnalysisTest,EslintBasedRulesTest,PRAnalysisTest,TypeCheckerConfigTest,VueAnalysisTest'
  <<: *WIN_SSD_AND_CLONE
  <<: *MAVEN_CACHE
  qa_script:
    - source /c/buildTools-docker/bin/cirrus-env QA
    - source /c/buildTools-docker/bin/set_maven_build_version $BUILD_NUMBER
    # building the custom plugin required for the further tests
    - mvn clean package -f its/plugin/plugins/pom.xml
    - mvn -f its/plugin/tests/pom.xml -Dsonar.runtimeVersion=${SQ_VERSION} "-Dtest=${TEST}" -B -e -V verify surefire-report:report
  cleanup_before_cache_script: cleanup_maven_repository

# Plugin QA for Windows is split into 3 parts to make it faster
plugin_qa_win_sonarlint_task:
  depends_on:
    - build
  <<: *WINDOWS_VM_DEFINITION
  <<: *ONLY_SONARSOURCE_QA
  env:
    SONARSOURCE_QA: true
    SQ_VERSION: LATEST_RELEASE
  <<: *WIN_SSD_AND_CLONE
  <<: *MAVEN_CACHE
  qa_script:
    - source /c/buildTools-docker/bin/cirrus-env QA
    - source /c/buildTools-docker/bin/set_maven_build_version $BUILD_NUMBER
    - mvn -f its/plugin/sonarlint-tests/pom.xml -Dsonar.runtimeVersion=${SQ_VERSION} -B -e -V verify surefire-report:report
  cleanup_before_cache_script: cleanup_maven_repository

js_ts_ruling_task:
  depends_on:
    - build
  <<: *ONLY_SONARSOURCE_QA
  eks_container:
    <<: *CONTAINER_DEFINITION
    dockerfile: .cirrus/nodejs.Dockerfile
    docker_arguments:
      CIRRUS_AWS_ACCOUNT: ${CIRRUS_AWS_ACCOUNT}
      NODE_VERSION: 20
    cpu: 15
    memory: 32G
  env:
    CIRRUS_CLONE_DEPTH: 1
    SONARSOURCE_QA: true
  <<: *MAVEN_CACHE
  <<: *NPMRC_SCRIPT_DEFINITION
  # needed because we need to build the plugin
  <<: *RUNTIME_CACHE
  submodules_script:
    - git submodule update --init
  ruling_script:
    - . ~/.profile
    - source cirrus-env QA
    - source set_maven_build_version $BUILD_NUMBER
    - npm run build:fast
    - npm run update-ruling-data
    - npm run ruling -- --maxWorkers=60%
  cleanup_before_cache_script: cleanup_maven_repository

css_ruling_task:
  depends_on:
    - build
  <<: *ONLY_SONARSOURCE_QA
  eks_container:
    <<: *CONTAINER_DEFINITION
    image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest
    cpu: 15
    memory: 24G
  env:
    CIRRUS_CLONE_DEPTH: 10
    SONARSOURCE_QA: true
  <<: *MAVEN_CACHE
  submodules_script:
    - git submodule update --init
  ruling_script:
    - source cirrus-env QA
    - source set_maven_build_version $BUILD_NUMBER
    - cd its/ruling
    - mvn verify -Dtest=CssRulingTest -Dsonar.runtimeVersion=LATEST_RELEASE -Dmaven.test.redirectTestOutputToFile=false -Djunit.jupiter.execution.parallel.config.dynamic.factor=1 -B -e -V
  cleanup_before_cache_script: cleanup_maven_repository
  on_failure:
    diff_artifacts:
      path: '**/target/actual/**/*'

promote_task:
  depends_on:
    - ws_scan
    - build_win
    - plugin_qa_with_node
    - plugin_qa_no_node
    - plugin_qa_sq_dev
    - plugin_qa_win
    - plugin_qa_win_sonarlint
    - css_ruling
    - js_ts_ruling
    - analyze
  <<: *ONLY_SONARSOURCE_QA
  eks_container:
    <<: *CONTAINER_DEFINITION
    image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest
    cpu: 2
    memory: 4G
  env:
    ARTIFACTORY_PROMOTE_ACCESS_TOKEN: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-promoter access_token]
    GITHUB_TOKEN: VAULT[development/github/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-promotion token]
    #artifacts that will have downloadable links in burgr
    ARTIFACTS: org.sonarsource.javascript:sonar-javascript-plugin:jar
  <<: *MAVEN_CACHE
  script: cirrus_promote_maven
  cleanup_before_cache_script: cleanup_maven_repository