.gitlab-ci.yml

image: "alpine"

stages:
  - lint
  - audit
  - test
  - build
  - e2e
  - package

.retry:
  retry: 2

.when:
  extends: .retry
  only:
    refs:
      - main

.frontend:
  extends: .when
  before_script:
    - cd frontend

.frontend-pnpm:
  extends: .frontend
  image: "node:22-alpine"
  before_script:
    - cd frontend
    - npm install -g pnpm@10
  cache:
    key: pnpm-store-frontend
    paths:
      - /root/.local/share/pnpm/**/*

.backend:
  extends: .when
  before_script:
    - cd backend

.backend-npm:
  extends: .backend
  image: "node:22-alpine"
  cache:
    key: node-modules-backend
    paths:
      - /root/.npm/**/*

.chatpopup:
  extends: .when
  before_script:
    - cd plugins/chat-popup

.chatpopup-pnpm:
  extends: .chatpopup
  image: "node:22-alpine"
  before_script:
    - cd plugins/chat-popup
    - npm install -g pnpm@10
  cache:
    key: pnpm-store-chatpopup
    paths:
      - /root/.local/share/pnpm/**/*

.frontend-playwright:
  extends: .frontend
  image: "mcr.microsoft.com/playwright:v1.55.0-jammy"
  before_script:
    - cd frontend
    - npm install -g pnpm@10
  cache:
    key: pnpm-store-frontend
    paths:
      - /root/.local/share/pnpm/**/*

.backend-e2e-base:
  extends: .retry
  services:
    - name: "mongo:4.2.8"
      alias: mongo
  variables:
    MONGO_HOST: "mongo"
    MONGO_PORT: "27017"
    MONGO_DB: "delta5_${CI_JOB_ID}"
    MONGO_URI: "mongodb://mongo:27017/delta5_${CI_JOB_ID}"
    E2E_MONGO_URI: "mongodb://mongo:27017/delta5_${CI_JOB_ID}"
    JWT_SECRET: "test-jwt-secret-change-in-production"
    API_ROOT: "/api/v2"
    BACKEND_PORT: "3002"

lint-docker-frontend:
  extends: .frontend
  stage: lint
  image: "hadolint/hadolint:latest-debian"
  script:
    - /bin/hadolint Dockerfile
  only:
    refs:
      - main
    changes:
      - frontend/Dockerfile

lint-docker-backend:
  extends: .backend
  stage: lint
  image: "hadolint/hadolint:latest-debian"
  script:
    - /bin/hadolint Dockerfile
  only:
    refs:
      - main
    changes:
      - backend/Dockerfile

lint-docker-backend-v2:
  extends: .when
  stage: lint
  image: "hadolint/hadolint:latest-debian"
  before_script:
    - cd backend-v2
  script:
    - /bin/hadolint Dockerfile
  only:
    refs:
      - main
    changes:
      - backend-v2/Dockerfile

lint-frontend:
  extends: .frontend-pnpm
  stage: lint
  script:
    - if grep "material-ui/[^/]*'$" src -Rl ; then echo 'Do not import material ui through root' ; false ; fi
    - pnpm install --frozen-lockfile
    - pnpm run genversion
    - pnpm run lint
  only:
    refs:
      - main
    changes:
      - frontend/**/*

lint-backend:
  extends: .backend-npm
  stage: lint
  script:
    - npm ci
    - npm run lint
  only:
    refs:
      - main
    changes:
      - backend/**/*

lint-backend-v2:
  extends: .when
  stage: lint
  image: "golangci/golangci-lint:v1.62-alpine"
  before_script:
    - cd backend-v2
  script:
    - golangci-lint run --timeout=5m
  only:
    refs:
      - main
    changes:
      - backend-v2/**/*

test-backend:
  extends: .backend-npm
  stage: test
  services:
    - name: "mongo:4.2.8"
      alias: mongo
  variables:
    MONGO_HOST: "mongo"
    MONGO_PORT: "27017"
  script:
    - npm ci
    - DEBUG="infinity:*" npm run test
  artifacts:
    reports:
      junit: ./backend/junit.xml
  coverage: /All\sfiles.*?\s+(\d+.\d+)/
  needs: []
  only:
    refs:
      - main
    changes:
      - backend/**/*

test-backend-v2:
  extends: .when
  stage: test
  image: "golang:1.25-alpine"
  before_script:
    - cd backend-v2
  script:
    - apk add --no-cache git
    - go mod download
    - go test -v -coverprofile=coverage.out ./...
    - go tool cover -func=coverage.out
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: backend-v2/coverage.out
  needs: []
  only:
    refs:
      - main
    changes:
      - backend-v2/**/*

build-frontend:
  extends: .frontend-pnpm
  stage: build
  script:
    - |
      if [[ "${CI_COMMIT_REF_NAME}" != "${CI_COMMIT_REF_NAME/deploy/}" ]] ; then
        VERSION="${CI_COMMIT_SHORT_SHA}"
      else
        VERSION=${CI_COMMIT_TAG:-${CI_COMMIT_SHORT_SHA}}
      fi
    - 'sed "s/\"gitVersion\":[^,]*/\"gitVersion\": \"${VERSION}\"/" -i package.json'
    - pnpm install --frozen-lockfile
    - GENERATE_SOURCEMAP=false npm run build
    - ls dist/index.html
  artifacts:
    paths:
      - frontend/dist
    expire_in: 1 day
  needs: []

build-backend:
  extends: .backend-npm
  stage: build
  script:
    - |
      if [[ "${CI_COMMIT_REF_NAME}" != "${CI_COMMIT_REF_NAME/deploy/}" ]] ; then
        VERSION=0.0.0-${CI_COMMIT_SHORT_SHA}+$(date '+%Y%m%d%H%M')
      else
        VERSION=${CI_COMMIT_TAG:-0.0.0-${CI_COMMIT_SHORT_SHA}+$(date '+%Y%m%d%H%M')}
      fi
    - 'sed "s/\"version\":[^,]*/\"version\": \"${VERSION}\"/" -i package.json'
    - npm ci
    - npm run build
  artifacts:
    paths:
      - backend/build
    expire_in: 1 day
  needs: []

build-backend-v2:
  extends: .when
  stage: build
  image: "golang:1.25-alpine"
  before_script:
    - cd backend-v2
  script:
    - apk add --no-cache git
    - go mod download
    - go mod tidy
    - go build -ldflags="-s -w" -o backend-v2 .
    - chmod +x backend-v2
    - go build -o seed-users ./cmd/seed-users
  artifacts:
    paths:
      - backend-v2/backend-v2
      - backend-v2/seed-users
    expire_in: 1 day
  needs: []

build-chatpopup:
  extends: .chatpopup-pnpm
  stage: build
  script:
    - |
      if [[ "${CI_COMMIT_REF_NAME}" != "${CI_COMMIT_REF_NAME/deploy/}" ]] ; then
        VERSION="0.0.0-${CI_COMMIT_SHORT_SHA}+$(date '+%Y%m%d%H%M')"
      else
        VERSION=${CI_COMMIT_TAG:-0.0.0-${CI_COMMIT_SHORT_SHA}+$(date '+%Y%m%d%H%M')}
      fi
    - 'sed "s/\"version\":[^,]*/\"version\": \"${VERSION}\"/" -i package.json'
    - pnpm install --frozen-lockfile
    - GENERATE_SOURCEMAP=false pnpm run build
    - ls dist/index.html
  artifacts:
    paths:
      - plugins/chat-popup/dist
    expire_in: 1 day
  needs: []

e2e-backend:
  extends: .backend-e2e-base
  stage: e2e
  image: "node:22-alpine"
  cache:
    key: node-modules-backend-v2-e2e
    paths:
      - /root/.npm/**/*
  script:
    - apk add --no-cache bash curl git
    - cd backend-v2
    - chmod +x backend-v2 seed-users
    - cd e2e
    - npm ci
    - cd ..
    - DROP_DB=true bash e2e-db-init.sh
    - MONGO_URI="${MONGO_URI}" JWT_SECRET="${JWT_SECRET}" PORT="${BACKEND_PORT}" API_ROOT="${API_ROOT}" MOCK_EXTERNAL_SERVICES=true nohup ./backend-v2 > backend-e2e.log 2>&1 & echo $! > backend-e2e.pid
    - sleep 5
    - if ! kill -0 $(cat backend-e2e.pid); then echo "Backend failed to start"; cat backend-e2e.log; exit 1; fi
    - curl -f http://localhost:${BACKEND_PORT}${API_ROOT}/health || (cat backend-e2e.log; exit 1)
    - cd e2e
    - E2E_SERVER_URL=http://localhost:${BACKEND_PORT} E2E_API_BASE_PATH=${API_ROOT} E2E_MONGO_URI="${E2E_MONGO_URI}" npm test || (kill $(cat ../backend-e2e.pid); exit 1)
    - kill $(cat ../backend-e2e.pid)
  after_script:
    - cd backend-v2 && bash e2e-db-drop.sh 2>/dev/null || true
  artifacts:
    reports:
      junit: ./backend-v2/e2e/junit.xml
    paths:
      - backend-v2/backend-e2e.log
    when: always
  needs:
    - build-backend-v2
  only:
    refs:
      - main
    changes:
      - backend-v2/**/*

e2e-frontend:
  extends: .backend-e2e-base
  stage: e2e
  timeout: 4h
  image: "mcr.microsoft.com/playwright:v1.55.0-jammy"
  before_script:
    - apt-get update && apt-get install -y curl bubblewrap
  script:
    # Parity with GitHub CI: the command executor sandboxes agent processes with bubblewrap,
    # which needs unprivileged user namespaces. Best-effort enable (requires a permissive runner).
    - sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 2>/dev/null || true
    - 'bwrap --ro-bind /usr /usr --ro-bind /lib /lib --ro-bind /lib64 /lib64 --ro-bind /bin /bin --ro-bind /etc /etc --proc /proc --dev /dev --tmpfs /tmp --unshare-user --unshare-pid -- node -e "process.exit(0)" && echo "bwrap sandbox OK" || echo "WARN bubblewrap sandbox unavailable on this runner; ACP-local sandbox specs need unprivileged user namespaces on the GitLab runner"'
    # Parity with GitHub CI: build and start the Node.js (v1) backend that backend-v2 proxies
    # command execution to. Without it, every MCP/RPC command-execution spec fails at execute time.
    - cd backend
    - npm ci
    - npm run build
    - MOCK_EXTERNAL_SERVICES=true PORT="3004" MONGO_URI="mongodb://mongo:27017/delta5_${CI_JOB_ID}" JWT_SECRET="test-jwt-secret-change-in-production" D5_ALLOW_UNSANDBOXED_SPAWN=true nohup node build/index.js > backend-e2e.log 2>&1 & echo $! > backend-e2e.pid
    - sleep 5
    - if ! kill -0 $(cat backend-e2e.pid); then echo "Node.js backend failed to start"; cat backend-e2e.log; exit 1; fi
    - cd ../backend-v2
    - chmod +x backend-v2 seed-users
    - DROP_DB=true bash e2e-db-init.sh
    - MONGO_DATABASE="delta5_${CI_JOB_ID}" MONGO_URI="mongodb://mongo:27017/delta5_${CI_JOB_ID}" JWT_SECRET="test-jwt-secret-change-in-production" PORT="3002" API_ROOT="/api/v2" MOCK_EXTERNAL_SERVICES=true NODEJS_BACKEND_URL="http://localhost:3004" nohup ./backend-v2 > backend-e2e.log 2>&1 & echo $! > backend-e2e.pid
    - sleep 5
    - if ! kill -0 $(cat backend-e2e.pid); then echo "Backend failed to start"; cat backend-e2e.log; exit 1; fi
    - curl -f http://localhost:${BACKEND_PORT}${API_ROOT}/health || (cat backend-e2e.log; exit 1)
    - cd ../frontend
    - npm install -g pnpm@10
    - pnpm install --frozen-lockfile
    - pnpm run genversion
    - nohup pnpm dev > vite-e2e.log 2>&1 & echo $! > vite-e2e.pid
    - sleep 10
    - curl -f http://localhost:5173 || (cat vite-e2e.log; kill $(cat ../backend-v2/backend-e2e.pid); exit 1)
    - E2E_BASE_URL=http://localhost:5173 E2E_ADMIN_USER=admin E2E_ADMIN_PASS='P@ssw0rd!' E2E_OPEN_API_KEY='mock-openai-key' E2E_DEEPSEEK_API_KEY='mock-deepseek-key' E2E_QWEN_API_KEY='mock-qwen-key' E2E_CLAUDE_API_KEY='mock-claude-key' E2E_PERPLEXITY_API_KEY='mock-perplexity-key' E2E_YANDEX_API_KEY='mock-yandex-key' E2E_YANDEX_FOLDER_ID='mock-folder-id' E2E_CUSTOM_LLM_URL='http://localhost:8080' CI=true pnpm run test:e2e:ci || TEST_EXIT=$?
    - kill $(cat vite-e2e.pid) || true
    - kill $(cat ../backend-v2/backend-e2e.pid) || true
    - kill $(cat ../backend/backend-e2e.pid) || true
    - exit ${TEST_EXIT:-0}
  after_script:
    - cd backend-v2 && bash e2e-db-drop.sh 2>/dev/null || true
  artifacts:
    reports:
      junit: ./frontend/junit.xml
    paths:
      - frontend/playwright-report
      - frontend/test-results
      - frontend/vite-e2e.log
      - backend-v2/backend-e2e.log
      - backend-v2/backend-e2e.log
    when: always
  needs:
    - build-backend-v2
  only:
    refs:
      - main
    changes:
      - frontend/**/*
      - backend-v2/**/*

package-frontend:
  extends: .frontend
  stage: package
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  script:
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}"
      > /kaniko/.docker/config.json
    - source $CI_PROJECT_DIR/scripts/ci-helpers.sh
    - TAG=$(generate_docker_tag)
    - NAME=$(generate_docker_name "frontend")
    - /kaniko/executor
      --context "$CI_PROJECT_DIR/frontend"
      --dockerfile Dockerfile
      --destination "$CI_REGISTRY_IMAGE:$NAME-$TAG"

package-backend:
  extends: .backend
  stage: package
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  script:
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}"
      > /kaniko/.docker/config.json
    - source $CI_PROJECT_DIR/scripts/ci-helpers.sh
    - TAG=$(generate_docker_tag)
    - NAME=$(generate_docker_name "backend")
    - /kaniko/executor
      --context "$CI_PROJECT_DIR/backend"
      --dockerfile Dockerfile
      --destination "$CI_REGISTRY_IMAGE:$NAME-$TAG"

package-chatpopup:
  extends: .chatpopup
  stage: package
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  script:
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}"
      > /kaniko/.docker/config.json
    - source $CI_PROJECT_DIR/scripts/ci-helpers.sh
    - TAG=$(generate_docker_tag)
    - NAME=$(generate_docker_name "chatpopup")
    - /kaniko/executor
      --context "$CI_PROJECT_DIR/plugins/chat-popup"
      --dockerfile Dockerfile
      --destination "$CI_REGISTRY_IMAGE:$NAME-$TAG"

package-backend-v2:
  extends: .when
  stage: package
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  dependencies:
    - build-backend-v2
  before_script:
    - cd backend-v2
  script:
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}"
      > /kaniko/.docker/config.json
    - source $CI_PROJECT_DIR/scripts/ci-helpers.sh
    - TAG=$(generate_docker_tag)
    - NAME=$(generate_docker_name "backend-v2")
    - /kaniko/executor
      --context "$CI_PROJECT_DIR/backend-v2"
      --dockerfile Dockerfile
      --destination "$CI_REGISTRY_IMAGE:$NAME-$TAG"