include:
- template: Jobs/Dependency-Scanning.latest.gitlab-ci.yml
- template: Jobs/SAST.latest.gitlab-ci.yml
- template: Security/Coverage-Fuzzing.latest.gitlab-ci.yml

variables:
  GITLAB_ADVANCED_SAST_ENABLED: 'true'

# Overriding security scanning jobs from templates, because
# we need to replace the rules with our own, the same
# as in `.merge_request_pipelines` template.
gemnasium-dependency_scanning:
  rules: !reference [".rules:merge_request_pipelines:no_docs", rules]

gitlab-advanced-sast:
  rules: !reference [".rules:merge_request_pipelines:no_docs", rules]

.linux test:
  extends:
  - .rules:merge_request_pipelines:no_docs
  - .docker
  - .go-cache
  stage: test
  artifacts:
    paths:
    - .splitic/
    when: always
    expire_in: 7d
    reports:
      junit: .splitic/junit_*.xml

compile tests:
  extends:
    - .linux test
  needs:
    - "clone test repo"
    - "prepare done"
  script:
    - make splitic
    - make test-compile

unit test:
  extends:
  - .linux test
  needs:
  - 'clone test repo'
  - 'prepare done'
  script:
  - make splitic
  - >
    splitic test \
      -junit-report .splitic/junit_${CI_NODE_INDEX}.xml \
      -cover-report .splitic/cover_${CI_NODE_INDEX}.profile -cover -coverpkg gitlab.com/gitlab-org/gitlab-runner/... \
      -env-passthrough ./scripts/envs/allowlist_common.env -env-passthrough ./scripts/envs/allowlist_unix.env \
      ./... \
      -- -ldflags "$(make print_test_ldflags)"
  parallel: 2

unit test with race:
  extends:
  - unit test
  - .go-cache
  variables:
    CGO_ENABLED: "1"
  script:
  - make splitic
  - >
    splitic test \
      -race \
      -junit-report .splitic/junit_${CI_NODE_INDEX}.xml \
      -cover-report .splitic/cover_${CI_NODE_INDEX}.profile -cover -coverpkg gitlab.com/gitlab-org/gitlab-runner/... \
      -env-passthrough ./scripts/envs/allowlist_common.env -env-passthrough ./scripts/envs/allowlist_unix.env \
      ./... \
      -- -ldflags "$(make print_test_ldflags)" -timeout=90m

.with outer token:
  variables:
    OUTER_CI_JOB_TOKEN: ${CI_JOB_TOKEN}

integration test:
  extends:
  - .linux test
  - .with outer token
  needs:
  - 'clone test repo'
  - 'prebuilt helper images'
  - 'prepare done'
  script:
  - make splitic
  - go install gitlab.com/gitlab-org/fleeting/fleeting-plugin-static/cmd/fleeting-plugin-static@latest
  - make splitic
  - >
    splitic test \
      -junit-report .splitic/junit_${CI_NODE_INDEX}.xml \
      -cover-report .splitic/cover_${CI_NODE_INDEX}.profile -cover -coverpkg gitlab.com/gitlab-org/gitlab-runner/... \
      -env-passthrough ./scripts/envs/allowlist_common.env -env-passthrough ./scripts/envs/allowlist_unix.env \
      -tags integration \
      ./... \
      -- -ldflags "$(make print_test_ldflags)" -timeout 15m
  parallel: 4

integration test with race:
  extends:
  - integration test
  - .go-cache
  variables:
    CGO_ENABLED: "1"
  script:
  - make splitic
  - >
    splitic test \
      -race \
      -junit-report .splitic/junit_${CI_NODE_INDEX}.xml \
      -cover-report .splitic/cover_${CI_NODE_INDEX}.profile -cover -coverpkg gitlab.com/gitlab-org/gitlab-runner/... \
      -env-passthrough ./scripts/envs/allowlist_common.env -env-passthrough ./scripts/envs/allowlist_unix.env \
      -tags integration \
      ./... \
      -- -ldflags "$(make print_test_ldflags)" -timeout 30m

fuzz variable mask:
  extends:
  - .fuzz_base
  - .no_dependencies
  - .rules:merge_request_pipelines:no_docs
  image: golang:$GO_VERSION
  stage: test
  variables:
    COVFUZZ_SEED_CORPUS: './common/buildlogger/internal/testdata/corpus'
  script:
  - apt update && apt install -y clang
  - go install github.com/dvyukov/go-fuzz/go-fuzz@latest && go install github.com/dvyukov/go-fuzz/go-fuzz-build@latest && go get github.com/dvyukov/go-fuzz/go-fuzz-dep@latest
  - go-fuzz-build -libfuzzer -o fuzz_variable_mask.a -preserve crypto/internal/bigmod ./common/buildlogger/internal
  - clang -fsanitize=fuzzer fuzz_variable_mask.a -o fuzz_variable_mask
  - ./gitlab-cov-fuzz run -- ./fuzz_variable_mask -only_ascii=1 -max_len=128 -max_total_time=300
  allow_failure: false

.windows test:
  extends:
  - .rules:merge_request_pipelines:no_docs
  - .go-cache-windows
  stage: test
  parallel: 6
  before_script:
  - !reference [.go-cache-windows, before_script]
  - start-service docker
  - Set-MpPreference -DisableRealtimeMonitoring $true
  - git config --system core.longpaths true
  - New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" `
    -Name "LongPathsEnabled" -Value 1 -PropertyType DWORD -Force
  - $ProgressPreference = 'SilentlyContinue'
  - (Measure-Command { curl -o golang-windows-amd64.zip $env:RUNNER_IMAGES_WINDOWS_GO_URL }).TotalSeconds
  - if (Test-Path "C:\Program Files\Go") { Remove-Item -Path "C:\Program Files\Go" -Recurse -Force }
  - New-Item -Path "C:\Program Files\Go" -ItemType Directory > $null
  - (Measure-Command { 7z x .\golang-windows-amd64.zip -o"C:\Program Files\Go" }).TotalSeconds
  - rm golang-windows-amd64.zip
  - $env:Path = "C:\Program Files\Go\bin;$env:Path"
  - go version
  - echo $env:GOCACHE
  - go env GOCACHE
  - go install gitlab.com/ajwalker/splitic@latest
  - $env:Path += ";$(go env GOPATH)/bin"
  artifacts:
    paths:
    - .splitic/
    when: always
    expire_in: 7d
    reports:
      junit: .splitic/junit_*.xml
  allow_failure:
    exit_codes: 99

.windows unit test:
  extends:
  - .windows test
  parallel: 2
  needs:
  - 'clone test repo'
  #- 'prepare done'
  script:
  - splitic test -junit-report .splitic/junit_${WINDOWS_VERSION}_${CI_NODE_INDEX}.xml -quarantined ci/.test-failures.${WINDOWS_VERSION}.txt -cover-report .splitic/cover_windows_${CI_NODE_INDEX}.profile -cover -coverpkg gitlab.com/gitlab-org/gitlab-runner/... -env-passthrough ./scripts/envs/allowlist_common.env -env-passthrough ./scripts/envs/allowlist_windows.env -fail-exit-code 99 ./... -- -timeout 20m

.windows integration test:
  extends:
  - .windows test
  - .with outer token
  parallel: 4
  needs:
  - 'clone test repo'
  - 'prepare done'
  script:
  # pre-pull windows images before starting tests
  - docker pull registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:x86_64-v17.7.1-${WINDOWS_VERSION}
  - docker tag registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:x86_64-v17.7.1-${WINDOWS_VERSION} registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:x86_64-latest-${WINDOWS_VERSION}
  - docker pull registry.gitlab.com/gitlab-org/ci-cd/tests/liveness:0.1.0
  - docker network create -d "nat" test-network
  - docker network rm test-network
  - go install gitlab.com/gitlab-org/fleeting/fleeting-plugin-static/cmd/fleeting-plugin-static@latest
  - splitic test -junit-report .splitic/junit_${WINDOWS_VERSION}_${CI_NODE_INDEX}.xml -quarantined ci/.test-failures.${WINDOWS_VERSION}.txt -cover-report .splitic/cover_windows_${CI_NODE_INDEX}.profile -cover -coverpkg gitlab.com/gitlab-org/gitlab-runner/... -env-passthrough ./scripts/envs/allowlist_common.env -env-passthrough ./scripts/envs/allowlist_windows.env -fail-exit-code 99 -tags integration ./... -- -timeout 45m

windows 1809 compile tests:
  extends:
  - .windows unit test
  - .windows1809
  - .rules:merge_request_pipelines:no_docs:no-community-mr
  parallel: null
  script:
    - go test -count=1 --tags=integration,kubernetes -run=nope ./...
    - go test -count=1 --tags=integration,steps -run=nope ./...
    - go test -count=1 --tags=integration -run=nope ./...
    - go test -count=1 -run=nope ./...

windows 21H2 compile tests:
  extends:
  - .windows unit test
  - .windows21H2
  - .rules:merge_request_pipelines:no_docs:no-community-mr
  parallel: null
  script:
    - go test -count=1 --tags=integration,kubernetes -run=nope ./...
    - go test -count=1 --tags=integration,steps -run=nope ./...
    - go test -count=1 --tags=integration -run=nope ./...
    - go test -count=1 -run=nope ./...

# Only test the oldest supported version in merge requests,
# but test all versions in the default branch.
windows 1809 unit tests:
  extends:
  - .windows unit test
  - .windows1809
  - .rules:merge_request_pipelines:no_docs:no-community-mr

windows 21H2 unit tests:
  extends:
  - .windows unit test
  - .windows21H2
  - .rules:merge_request_pipelines:no_docs:no-community-mr

windows 1809 integration tests:
  extends:
  - .windows integration test
  - .windows1809
  - .rules:merge_request_pipelines:no_docs:no-community-mr
  needs:
  - 'clone test repo'
  - 'prepare done'
  - job: 'development servercore1809 helper docker images'
    optional: true
  - job: 'bleeding edge servercore1809 helper docker images'
    optional: true
  - job: 'stable servercore1809 helper docker images'
    optional: true

windows 21H2 integration tests:
  extends:
  - .windows integration test
  - .windows21H2
  - .rules:merge_request_pipelines:no_docs:no-community-mr
  needs:
  - 'clone test repo'
  - 'prepare done'
  - job: 'development servercore21H2 helper docker images'
    optional: true
  - job: 'bleeding edge servercore21H2 helper docker images'
    optional: true
  - job: 'stable servercore21H2 helper docker images'
    optional: true
