Gitlab Ci Validator

# Tools directory (created by install_tools.sh)
.tools/

# Node modules (if gitlab-ci-local installed locally)
node_modules/
package-lock.json

stages:
  - .pre
  - build
  - test
  - security
  - deploy
  - .post
variables:
  CACHE_VERSION: v1
  NODE_VERSION: '18'
validate_config:
  stage: .pre
  image:
    name: alpine:latest
  script:
    - echo "Validating configuration"
    - test -f package.json || exit 1
    - test -f Dockerfile || exit 1
  tags:
    - docker
build_frontend:
  stage: build
  image:
    name: node:${NODE_VERSION}-alpine
  script:
    - echo "Building frontend"
    - cd frontend
    - npm ci
    - npm run build
  artifacts:
    paths:
      - frontend/dist/
    expire_in: 1 day
  cache:
    - key: ${CACHE_VERSION}-frontend-${CI_COMMIT_REF_SLUG}
      paths:
        - frontend/node_modules/
        - frontend/.npm/
      policy: pull-push
      when: on_success
  tags:
    - docker
build_backend:
  stage: build
  image:
    name: golang:1.21-alpine
  script:
    - echo "Building backend"
    - cd backend
    - go mod download
    - go build -o bin/server ./cmd/server
  artifacts:
    paths:
      - backend/bin/
    expire_in: 1 day
  cache:
    - key: ${CACHE_VERSION}-backend-${CI_COMMIT_REF_SLUG}
      paths:
        - /go/pkg/mod/
      policy: pull-push
      when: on_success
  tags:
    - docker
build_docs:
  stage: build
  image:
    name: python:3.11-alpine
  script:
    - echo "Building documentation"
    - pip install mkdocs mkdocs-material
    - mkdocs build
  artifacts:
    paths:
      - site/
    expire_in: 1 week
  tags:
    - docker
test_frontend_unit:
  stage: test
  image:
    name: node:${NODE_VERSION}-alpine
  needs:
    - job: build_frontend
      artifacts: true
      optional: false
  script:
    - echo "Running frontend unit tests"
    - cd frontend
    - npm ci
    - npm run test:unit
  artifacts:
    reports:
      junit: frontend/junit.xml
      coverage_report:
        coverage_format: cobertura
        path: frontend/coverage/cobertura.xml
  coverage: /Lines\s*:\s*(\d+\.\d+)%/
  tags:
    - docker
test_frontend_e2e:
  stage: test
  image:
    name: cypress/included:13.6.0
  needs:
    - job: build_frontend
      artifacts: true
      optional: false
  services:
    - name: nginx:alpine
      alias: web
  script:
    - echo "Running E2E tests"
    - cd frontend
    - npm ci
    - npm run test:e2e
  artifacts:
    when: always
    paths:
      - frontend/cypress/screenshots/
      - frontend/cypress/videos/
    expire_in: 1 week
  allow_failure: true
  tags:
    - docker
test_backend_unit:
  stage: test
  image:
    name: golang:1.21-alpine
  needs:
    - job: build_backend
      artifacts: true
      optional: false
  script:
    - echo "Running backend unit tests"
    - cd backend
    - go test -v -coverprofile=coverage.out ./...
    - go tool cover -func=coverage.out
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: backend/coverage.xml
  coverage: /total:.*?(\d+\.\d+)%/
  tags:
    - docker
test_backend_integration:
  stage: test
  image:
    name: golang:1.21-alpine
  needs:
    - job: build_backend
      artifacts: true
      optional: false
  services:
    - name: postgres:15-alpine
      alias: postgres
    - name: redis:7-alpine
      alias: redis
  variables:
    POSTGRES_DB: testdb
    POSTGRES_USER: test
    POSTGRES_PASSWORD: test
    DATABASE_URL: postgres://test:test@postgres:5432/testdb?sslmode=disable
    REDIS_URL: redis://redis:6379
  script:
    - echo "Running backend integration tests"
    - cd backend
    - go test -v -tags=integration ./...
  tags:
    - docker
lint_frontend:
  stage: test
  image:
    name: node:${NODE_VERSION}-alpine
  needs:
    - job: build_frontend
      artifacts: false
      optional: false
  script:
    - echo "Linting frontend code"
    - cd frontend
    - npm ci
    - npm run lint
  allow_failure: true
  tags:
    - docker
lint_backend:
  stage: test
  image:
    name: golangci/golangci-lint:v1.55-alpine
  needs:
    - job: build_backend
      artifacts: false
      optional: false
  script:
    - echo "Linting backend code"
    - cd backend
    - golangci-lint run
  allow_failure: true
  tags:
    - docker
sast_scan:
  stage: security
  image:
    name: returntocorp/semgrep:latest
  needs: []
  script:
    - semgrep --config=auto --json --output=sast-report.json .
  artifacts:
    reports:
      sast: sast-report.json
  allow_failure: true
  tags:
    - docker
dependency_scan:
  stage: security
  image:
    name: aquasec/trivy:latest
  needs: []
  script:
    - trivy fs --format json --output dependency-report.json .
  artifacts:
    paths:
      - dependency-report.json
    expire_in: 1 week
  allow_failure: true
  tags:
    - docker
secret_scan:
  stage: security
  image:
    name: trufflesecurity/trufflehog:latest
  needs: []
  script:
    - trufflehog filesystem --directory=. --json > secrets-report.json
  artifacts:
    paths:
      - secrets-report.json
    expire_in: 1 week
  allow_failure: true
  tags:
    - docker
deploy_staging:
  stage: deploy
  image:
    name: alpine:latest
  needs:
    - job: test_frontend_unit
      artifacts: true
      optional: false
    - job: test_backend_unit
      artifacts: true
      optional: false
    - job: test_backend_integration
      artifacts: true
      optional: false
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Deploying to staging"
    - curl -X POST "$STAGING_DEPLOY_WEBHOOK"
  environment:
    name: staging
    url: https://staging.example.com
    on_stop: stop_staging
    auto_stop_in: 7 days
  rules:
    - if: $CI_COMMIT_BRANCH == "develop"
  tags:
    - docker
stop_staging:
  stage: deploy
  image:
    name: alpine:latest
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Stopping staging environment"
    - curl -X DELETE "$STAGING_DEPLOY_WEBHOOK"
  environment:
    name: staging
    action: stop
  when: manual
  rules:
    - if: $CI_COMMIT_BRANCH == "develop"
  tags:
    - docker
deploy_review:
  stage: deploy
  image:
    name: alpine:latest
  needs:
    - job: test_frontend_unit
      artifacts: true
      optional: false
    - job: test_backend_unit
      artifacts: true
      optional: false
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Deploying review app"
    - echo "URL https://$CI_ENVIRONMENT_SLUG.review.example.com"
    - curl -X POST "$REVIEW_DEPLOY_WEBHOOK"
  environment:
    name: review/main
    url: https://review-ci-commit-ref-sl.review.example.com
    on_stop: stop_review
    auto_stop_in: 3 days
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  tags:
    - docker
stop_review:
  stage: deploy
  image:
    name: alpine:latest
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Stopping review app"
    - curl -X DELETE "$REVIEW_DEPLOY_WEBHOOK"
  environment:
    name: review/main
    action: stop
  when: manual
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  tags:
    - docker
deploy_production:
  stage: deploy
  image:
    name: alpine:latest
  needs:
    - job: test_frontend_unit
      artifacts: true
      optional: false
    - job: test_backend_unit
      artifacts: true
      optional: false
    - job: test_backend_integration
      artifacts: true
      optional: false
    - job: sast_scan
      artifacts: true
      optional: false
    - job: dependency_scan
      artifacts: true
      optional: false
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Deploying to production"
    - curl -X POST "$PRODUCTION_DEPLOY_WEBHOOK"
  environment:
    name: production
    url: https://example.com
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual
  allow_failure: false
  tags:
    - docker
notify_deployment:
  stage: .post
  image:
    name: alpine:latest
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Sending deployment notification"
    - |
      curl -X POST "$SLACK_WEBHOOK" \
        -H 'Content-Type: application/json' \
        -d "{\"text\":\"Pipeline completed: $CI_PIPELINE_URL\"}"
  when: always
  rules:
    - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "develop"
  tags:
    - docker
default: {}

# To contribute improvements to CI/CD templates, please follow the Development guide at:
# https://docs.gitlab.com/development/cicd/templates/
# This specific template is located at:
# https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Jobs/Dependency-Scanning.gitlab-ci.yml

# Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/
#
# Configure dependency scanning with CI/CD variables (https://docs.gitlab.com/ee/ci/variables/).
# List of available variables: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#available-cicd-variables

variables:
  # Setting this variable affects all Security templates
  # (SAST, Dependency Scanning, ...)
  SECURE_ANALYZERS_PREFIX: "$CI_TEMPLATE_REGISTRY_HOST/security-products"
  #
  DS_EXCLUDED_ANALYZERS: ""
  DS_EXCLUDED_PATHS: "spec, test, tests, tmp, node_modules"
  DS_MAJOR_VERSION: 6
  DS_SCHEMA_MODEL: 15

dependency_scanning:
  stage: test
  script:
    - echo "$CI_JOB_NAME is used for configuration only, and its script should not be executed"
    - exit 1
  artifacts:
    access: 'developer'
    reports:
      dependency_scanning: gl-dependency-scanning-report.json
  dependencies: []
  rules:
    - when: never

.ds-analyzer:
  extends: dependency_scanning
  allow_failure: true
  variables:
    # DS_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
    # override the analyzer image with a custom value. This may be subject to change or
    # breakage across GitLab releases.
    DS_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/$DS_ANALYZER_NAME:$DS_MAJOR_VERSION"
    # DS_ANALYZER_NAME is an undocumented variable used in job definitions
    # to inject the analyzer name in the image name.
    DS_ANALYZER_NAME: ""
  image:
    name: "$DS_ANALYZER_IMAGE$DS_IMAGE_SUFFIX"
  # `rules` must be overridden explicitly by each child job
  # see https://gitlab.com/gitlab-org/gitlab/-/issues/218444
  script:
    - /analyzer run

.cyclonedx-reports:
  artifacts:
    access: 'developer'
    paths:
      - "**/gl-sbom-*.cdx.json"
    reports:
      cyclonedx: "**/gl-sbom-*.cdx.json"

.gemnasium-shared-rule:
  exists:
    - '**/{Gemfile.lock,composer.lock,gems.locked,go.sum,npm-shrinkwrap.json,package-lock.json,yarn.lock,pnpm-lock.yaml,packages.lock.json,conan.lock}'

gemnasium-dependency_scanning:
  extends:
    - .ds-analyzer
    - .cyclonedx-reports
  variables:
    DS_ANALYZER_NAME: "gemnasium"
    GEMNASIUM_LIBRARY_SCAN_ENABLED: "true"
  rules:
    - if: $DEPENDENCY_SCANNING_DISABLED == 'true' || $DEPENDENCY_SCANNING_DISABLED == '1'
      when: never
    - if: $DS_EXCLUDED_ANALYZERS =~ /gemnasium([^-]|$)/
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR pipeline* if MR pipelines for AST are enabled and there's an open merge request.
    ## When FIPS mode is enabled, use the FIPS compatible image
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $CI_GITLAB_FIPS_MODE == "true"
      exists: !reference [.gemnasium-shared-rule, exists]
      variables:
        DS_IMAGE_SUFFIX: "-fips"
        DS_REMEDIATE: "false"
    ## When FIPS mode is not enabled, use the regular image
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists: !reference [.gemnasium-shared-rule, exists]

    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never

    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    ## When FIPS mode is enabled, use the FIPS compatible image
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $CI_GITLAB_FIPS_MODE == "true"
      exists: !reference [.gemnasium-shared-rule, exists]
      variables:
        DS_IMAGE_SUFFIX: "-fips"
        DS_REMEDIATE: "false"
    ## When FIPS mode is not enabled, use the regular image
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists: !reference [.gemnasium-shared-rule, exists]

.gemnasium-maven-shared-rule:
  exists:
    - '**/{build.gradle,build.gradle.kts,build.sbt,pom.xml}'

gemnasium-maven-dependency_scanning:
  extends:
    - .ds-analyzer
    - .cyclonedx-reports
  variables:
    DS_ANALYZER_NAME: "gemnasium-maven"
  rules:
    - if: $DEPENDENCY_SCANNING_DISABLED == 'true' || $DEPENDENCY_SCANNING_DISABLED == '1'
      when: never
    - if: $DS_EXCLUDED_ANALYZERS =~ /gemnasium-maven/
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR pipeline* if MR pipelines for AST are enabled and there's an open merge request.
    ## When FIPS mode is enabled, use the FIPS compatible image
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $CI_GITLAB_FIPS_MODE == "true"
      exists: !reference [.gemnasium-maven-shared-rule, exists]
      variables:
        DS_IMAGE_SUFFIX: "-fips"
        DS_REMEDIATE: "false"
    ## When FIPS mode is not enabled, use the regular image
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists: !reference [.gemnasium-maven-shared-rule, exists]

    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never

    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    ## When FIPS mode is enabled, use the FIPS compatible image
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $CI_GITLAB_FIPS_MODE == "true"
      exists: !reference [.gemnasium-maven-shared-rule, exists]
      variables:
        DS_IMAGE_SUFFIX: "-fips"
    ## When FIPS mode is not enabled, use the regular image
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists: !reference [.gemnasium-maven-shared-rule, exists]

.gemnasium-python-shared-rule:
  exists:
    - '**/{requirements.txt,requirements.pip,Pipfile,Pipfile.lock,requires.txt,setup.py,poetry.lock,uv.lock}'

gemnasium-python-dependency_scanning:
  extends:
    - .ds-analyzer
    - .cyclonedx-reports
  variables:
    DS_ANALYZER_NAME: "gemnasium-python"
  rules:
    - if: $DEPENDENCY_SCANNING_DISABLED == 'true' || $DEPENDENCY_SCANNING_DISABLED == '1'
      when: never
    - if: $DS_EXCLUDED_ANALYZERS =~ /gemnasium-python/
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR pipeline* if MR pipelines for AST are enabled and there's an open merge request.
    ## When FIPS mode is enabled, use the FIPS compatible image
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $CI_GITLAB_FIPS_MODE == "true"
      exists: !reference [.gemnasium-python-shared-rule, exists]
      variables:
        DS_IMAGE_SUFFIX: "-fips"
    ## When FIPS mode is not enabled, use the regular image
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists: !reference [.gemnasium-python-shared-rule, exists]
    # Support passing of $PIP_REQUIREMENTS_FILE
    #   See https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#configuring-specific-analyzers-used-by-dependency-scanning
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $PIP_REQUIREMENTS_FILE &&
          $CI_GITLAB_FIPS_MODE == "true"
      variables:
        DS_IMAGE_SUFFIX: "-fips"
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $PIP_REQUIREMENTS_FILE

    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never

    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    ## When FIPS mode is enabled, use the FIPS compatible image
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $CI_GITLAB_FIPS_MODE == "true"
      exists: !reference [.gemnasium-python-shared-rule, exists]
      variables:
        DS_IMAGE_SUFFIX: "-fips"
    ## When FIPS mode is not enabled, use the regular image
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists: !reference [.gemnasium-python-shared-rule, exists]
    # Support passing of $PIP_REQUIREMENTS_FILE
    # See https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#configuring-specific-analyzers-used-by-dependency-scanning
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $PIP_REQUIREMENTS_FILE &&
          $CI_GITLAB_FIPS_MODE == "true"
      variables:
        DS_IMAGE_SUFFIX: "-fips"
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $PIP_REQUIREMENTS_FILE

# Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/sast/
#
# Configure SAST with CI/CD variables (https://docs.gitlab.com/ee/ci/variables/).
# List of available variables: https://docs.gitlab.com/ee/user/application_security/sast/#available-cicd-variables

variables:
  # Setting this variable affects all Security templates
  # (SAST, Dependency Scanning, ...)
  SECURE_ANALYZERS_PREFIX: "$CI_TEMPLATE_REGISTRY_HOST/security-products"
  #
  SAST_IMAGE_SUFFIX: ""
  SAST_EXCLUDED_ANALYZERS: ""
  DEFAULT_SAST_EXCLUDED_PATHS: "spec, test, tests, tmp"
  SAST_EXCLUDED_PATHS: "$DEFAULT_SAST_EXCLUDED_PATHS"
  SCAN_KUBERNETES_MANIFESTS: "false"

sast:
  stage: test
  artifacts:
    access: 'developer'
    reports:
      sast: gl-sast-report.json
    paths: [gl-sast-report.json]
  rules:
    - when: never
  variables:
    SEARCH_MAX_DEPTH: 4
  script:
    - echo "$CI_JOB_NAME is used for configuration only, and its script should not be executed"
    - exit 1

.sast-analyzer:
  extends: sast
  allow_failure: true
  # `rules` must be overridden explicitly by each child job
  # see https://gitlab.com/gitlab-org/gitlab/-/issues/218444
  script:
    - /analyzer run

.deprecated-16.8:
  extends: .sast-analyzer
  script:
    - echo "This job was deprecated in GitLab 16.8 and removed in GitLab 17.0"
    - echo "For more information see https://docs.gitlab.com/update/deprecations/#sast-analyzer-coverage-changing-in-gitlab-170"
    - exit 1
  rules:
    - when: never

# list of extensions that are supported by gitlab-advanced-sast. Some of these are also supported by semgrep-sast
# NOTE: When adding a new extension here, make sure to remove any matching extensions from `.semgrep-with-advanced-sast-exist-rules`
.gitlab-advanced-sast-exist-rules:
  exists:
    - '**/{*.py,*.go,*.java,*.jsp,*.js,*.jsx,*.ts,*.tsx,*.cjs,*.mjs,*.cs,*.rb,*.php}'

gitlab-advanced-sast:
  extends: .sast-analyzer
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
    SEARCH_MAX_DEPTH: 20
    SAST_ANALYZER_IMAGE_TAG: '2'
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/gitlab-advanced-sast:$SAST_ANALYZER_IMAGE_TAG$SAST_IMAGE_SUFFIX"
  cache:
    key: "scan-metrics-$CI_COMMIT_REF_SLUG"
    fallback_keys:
      - "scan-metrics-$CI_DEFAULT_BRANCH"
    paths:
      - "scan_metrics.csv"
  rules:
    - if: $SAST_DISABLED == 'true' || $SAST_DISABLED == '1'
      when: never
    - if: $SAST_EXCLUDED_ANALYZERS =~ /(^|[,[:space:]])gitlab-advanced-sast([,[:space:]]|$)/
      when: never
    - if: $GITLAB_ADVANCED_SAST_ENABLED != 'true' && $GITLAB_ADVANCED_SAST_ENABLED != '1'
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR* pipeline if MR pipelines for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bsast_advanced\b/
      exists: !reference [.gitlab-advanced-sast-exist-rules, exists]
    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never
    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bsast_advanced\b/
      exists: !reference [.gitlab-advanced-sast-exist-rules, exists]

bandit-sast:
  extends: .sast-analyzer
  script:
    - echo "This job was deprecated in GitLab 14.8 and removed in GitLab 15.4"
    - echo "For more information see https://gitlab.com/gitlab-org/gitlab/-/issues/352554"
    - exit 1
  rules:
    - when: never

brakeman-sast:
  extends: .deprecated-16.8

eslint-sast:
  extends: .sast-analyzer
  script:
    - echo "This job was deprecated in GitLab 14.8 and removed in GitLab 15.4"
    - echo "For more information see https://gitlab.com/gitlab-org/gitlab/-/issues/352554"
    - exit 1
  rules:
    - when: never

flawfinder-sast:
  extends: .deprecated-16.8

kubesec-sast:
  extends: .sast-analyzer
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
    SAST_ANALYZER_IMAGE_TAG: 6
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/kubesec:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED == 'true' || $SAST_DISABLED == '1'
      when: never
    - if: $SAST_EXCLUDED_ANALYZERS =~ /kubesec/
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR* pipeline if MR pipelines for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $SCAN_KUBERNETES_MANIFESTS == 'true'
    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never
    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    - if: $CI_COMMIT_BRANCH &&
          $SCAN_KUBERNETES_MANIFESTS == 'true'

gosec-sast:
  extends: .sast-analyzer
  script:
    - echo "This job was deprecated in GitLab 14.8 and removed in GitLab 15.4"
    - echo "For more information see https://gitlab.com/gitlab-org/gitlab/-/issues/352554"
    - exit 1
  rules:
    - when: never

mobsf-android-sast:
  extends: .deprecated-16.8

mobsf-ios-sast:
  extends: .deprecated-16.8

nodejs-scan-sast:
  extends: .deprecated-16.8

phpcs-security-audit-sast:
  extends: .deprecated-16.8

.pmd-apex-exist-rules:
  exists:
    - '**/*.cls'

pmd-apex-sast:
  extends: .sast-analyzer
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
    SAST_ANALYZER_IMAGE_TAG: 6
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/pmd-apex:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED == 'true' || $SAST_DISABLED == '1'
      when: never
    - if: $SAST_EXCLUDED_ANALYZERS =~ /pmd-apex/
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR* pipeline if MR pipelines for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event"
      exists: !reference [.pmd-apex-exist-rules, exists]
    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never
    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    - if: $CI_COMMIT_BRANCH
      exists: !reference [.pmd-apex-exist-rules, exists]

# list of extensions that are supported by semgrep-sast. Some of these are also supported by gitlab-advanced-sast
.semgrep-exist-rules:
  exists:
    - '**/{*.py,*.js,*.jsx,*.ts,*.tsx,*.cjs,*.mjs,*.c,*.cc,*.cpp,*.c++,*.cp,*.cxx,*.h,*.hpp,*.go,*.java,*.cs,*.scala,*.sc,*.php,*.swift,*.m,*.rb,*.kt,*.properties,application*.yml,bootstrap*.yml,application*.yaml,bootstrap*.yaml}'

# list of extensions that are only supported by semgrep, and not gitlab-advanced-sast
# NOTE: this list MUST NOT contain any extensions that are present in `.gitlab-advanced-sast-exist-rules`
.semgrep-with-advanced-sast-exist-rules:
  exists:
    - '**/{*.c,*.cc,*.cpp,*.c++,*.cp,*.cxx,*.h,*.hpp,*.scala,*.sc,*.swift,*.m,*.kt,*.properties,application*.yml,bootstrap*.yml,application*.yaml,bootstrap*.yaml}'

security-code-scan-sast:
  extends: .sast-analyzer
  script:
    - echo "This job was deprecated in GitLab 15.9 and removed in GitLab 16.0"
    - echo "For more information see https://gitlab.com/gitlab-org/gitlab/-/issues/390416"
    - exit 1
  rules:
    - when: never

semgrep-sast:
  extends: .sast-analyzer
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
    SEARCH_MAX_DEPTH: 20
    SAST_ANALYZER_IMAGE_TAG: 6
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/semgrep:$SAST_ANALYZER_IMAGE_TAG$SAST_IMAGE_SUFFIX"
  rules:
    - if: $SAST_DISABLED == 'true' || $SAST_DISABLED == '1'
      when: never
    - if: $SAST_EXCLUDED_ANALYZERS =~ /semgrep/
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR* pipeline if MR pipelines for AST are enabled and there's an open merge request.
    ## In case gitlab-advanced-sast also runs, exclude files already scanned by gitlab-advanced-sast
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bsast_advanced\b/ &&
          $SAST_EXCLUDED_ANALYZERS !~ /(^|[,[:space:]])gitlab-advanced-sast([,[:space:]]|$)/ &&
          ($GITLAB_ADVANCED_SAST_ENABLED == 'true' || $GITLAB_ADVANCED_SAST_ENABLED == '1')
      variables:
        # Customization of SAST_EXCLUDED_PATHS to be removed in 19.0, more details https://gitlab.com/gitlab-org/gitlab/-/issues/562940
        SAST_EXCLUDED_PATHS: "$DEFAULT_SAST_EXCLUDED_PATHS, **/*.py, **/*.go, **/*.java, **/*.js, **/*.jsx, **/*.ts, **/*.tsx, **/*.cjs, **/*.mjs, **/*.cs, **/*.rb, **/*.php"
        SAST_SEMGREP_EXCLUDED_PATHS: "**/*.py, **/*.go, **/*.java, **/*.js, **/*.jsx, **/*.ts, **/*.tsx, **/*.cjs, **/*.mjs, **/*.cs, **/*.rb, **/*.php"
      exists: !reference [.semgrep-with-advanced-sast-exist-rules, exists]
    ## In case gitlab-advanced-sast already covers all the files that semgrep-sast would have scanned (i.e the previous rule did not match) skip this job
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bsast_advanced\b/ &&
          $SAST_EXCLUDED_ANALYZERS !~ /(^|[,[:space:]])gitlab-advanced-sast([,[:space:]]|$)/ &&
          ($GITLAB_ADVANCED_SAST_ENABLED == 'true' || $GITLAB_ADVANCED_SAST_ENABLED == '1')
      when: never
    ## In case gitlab-advanced-sast doesn't run, scan all files supported by semgrep
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event"
      exists: !reference [.semgrep-exist-rules, exists]

    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never

    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    ## In case gitlab-advanced-sast also runs, exclude files already scanned by gitlab-advanced-sast
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bsast_advanced\b/ &&
          $SAST_EXCLUDED_ANALYZERS !~ /(^|[,[:space:]])gitlab-advanced-sast([,[:space:]]|$)/ &&
          ($GITLAB_ADVANCED_SAST_ENABLED == 'true' || $GITLAB_ADVANCED_SAST_ENABLED == '1')
      variables:
        # Customization of SAST_EXCLUDED_PATHS to be removed in 19.0, more details https://gitlab.com/gitlab-org/gitlab/-/issues/562940
        SAST_EXCLUDED_PATHS: "$DEFAULT_SAST_EXCLUDED_PATHS, **/*.py, **/*.go, **/*.java, **/*.js, **/*.jsx, **/*.ts, **/*.tsx, **/*.cjs, **/*.mjs, **/*.cs, **/*.rb, **/*.php"
        SAST_SEMGREP_EXCLUDED_PATHS: "**/*.py, **/*.go, **/*.java, **/*.js, **/*.jsx, **/*.ts, **/*.tsx, **/*.cjs, **/*.mjs, **/*.cs, **/*.rb, **/*.php"
      exists: !reference [.semgrep-with-advanced-sast-exist-rules, exists]
    ## In case gitlab-advanced-sast already covers all the files that semgrep-sast would have scanned
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bsast_advanced\b/ &&
          $SAST_EXCLUDED_ANALYZERS !~ /(^|[,[:space:]])gitlab-advanced-sast([,[:space:]]|$)/ &&
          ($GITLAB_ADVANCED_SAST_ENABLED == 'true' || $GITLAB_ADVANCED_SAST_ENABLED == '1')
      when: never
    ## In case gitlab-advanced-sast doesn't run, scan all files supported by semgrep
    - if: $CI_COMMIT_BRANCH
      exists: !reference [.semgrep-exist-rules, exists]

.sobelow-exist-rules:
  exists:
    - '**/mix.exs'

sobelow-sast:
  extends: .sast-analyzer
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
    SAST_ANALYZER_IMAGE_TAG: 6
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/sobelow:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED == 'true' || $SAST_DISABLED == '1'
      when: never
    - if: $SAST_EXCLUDED_ANALYZERS =~ /sobelow/
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR* pipeline if MR pipelines for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event"
      exists: !reference [.sobelow-exist-rules, exists]
    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never
    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    - if: $CI_COMMIT_BRANCH
      exists: !reference [.sobelow-exist-rules, exists]

.spotbugs-exist-rules:
  exists:
    - '**/*.groovy'

spotbugs-sast:
  extends: .sast-analyzer
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
    SAST_ANALYZER_IMAGE_TAG: 5
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/spotbugs:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_EXCLUDED_ANALYZERS =~ /spotbugs/
      when: never
    - if: $SAST_DISABLED == 'true' || $SAST_DISABLED == '1'
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR* pipeline if MR pipelines for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event"
      exists: !reference [.spotbugs-exist-rules, exists]
    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never
    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    - if: $CI_COMMIT_BRANCH
      exists: !reference [.spotbugs-exist-rules, exists]

.gitlab-advanced-sast-cpp-exist-rules:
  exists:
    - '**/{*.c,*.cc,*.cpp,*.c++,*.cp,*.cxx,*.h,*.hpp}'

gitlab-advanced-sast-cpp:
  extends: .sast-analyzer
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
    SAST_ANALYZER_IMAGE_TAG: 1
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/clangsa:$SAST_ANALYZER_IMAGE_TAG$SAST_IMAGE_SUFFIX"
  rules:
    - if: $SAST_DISABLED == 'true' || $SAST_DISABLED == '1'
      when: never
    - if: $SAST_EXCLUDED_ANALYZERS =~ /gitlab-advanced-sast-cpp/
      when: never
    - if: $GITLAB_ADVANCED_SAST_CPP_ENABLED != 'true' && $GITLAB_ADVANCED_SAST_CPP_ENABLED != '1'
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR* pipeline if MR pipelines for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
        $CI_PIPELINE_SOURCE == "merge_request_event" &&
        $GITLAB_FEATURES =~ /\bsast_advanced\b/
      exists: !reference [.gitlab-advanced-sast-cpp-exist-rules, exists]
    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
        $CI_OPEN_MERGE_REQUESTS
      when: never
    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    - if: $CI_COMMIT_BRANCH &&
        $GITLAB_FEATURES =~ /\bsast_advanced\b/
      exists: !reference [.gitlab-advanced-sast-cpp-exist-rules, exists]

# Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/secret_detection
#
# Configure the scanning tool through the environment variables.
# List of the variables: https://docs.gitlab.com/ee/user/application_security/secret_detection/#available-variables
# How to set: https://docs.gitlab.com/ee/ci/yaml/#variables

variables:
  # Setting this variable affects all Security templates
  # (SAST, Dependency Scanning, ...)
  SECURE_ANALYZERS_PREFIX: "$CI_TEMPLATE_REGISTRY_HOST/security-products"
  #
  SECRET_DETECTION_IMAGE_SUFFIX: ""
  SECRETS_ANALYZER_VERSION: "7"
  SECRET_DETECTION_EXCLUDED_PATHS: ""

.secret-analyzer:
  stage: test
  image: "$SECURE_ANALYZERS_PREFIX/secrets:$SECRETS_ANALYZER_VERSION$SECRET_DETECTION_IMAGE_SUFFIX"
  services: []
  allow_failure: true
  variables:
    GIT_DEPTH: "50"
  # `rules` must be overridden explicitly by each child job
  # see https://gitlab.com/gitlab-org/gitlab/-/issues/218444
  artifacts:
    access: 'developer'
    reports:
      secret_detection: gl-secret-detection-report.json
    paths: [gl-secret-detection-report.json]

secret_detection:
  extends: .secret-analyzer
  rules:
    - if: $SECRET_DETECTION_DISABLED == 'true' || $SECRET_DETECTION_DISABLED == '1'
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR* pipeline if MR pipelines for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event"
    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never
    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    - if: $CI_COMMIT_BRANCH
  script:
    - /analyzer run

# Basic GitLab CI/CD Pipeline Example
# This example demonstrates a simple three-stage pipeline with best practices

stages:
  - build
  - test
  - deploy

variables:
  APP_NAME: "my-application"
  APP_VERSION: "1.0.0"

# Default settings for all jobs
default:
  retry:
    max: 2
    when:
      - runner_system_failure
      - stuck_or_timeout_failure
  interruptible: true
  tags:
    - docker

# Build job
build_app:
  stage: build
  image: node:18-alpine
  timeout: 15m
  script:
    - echo "Building $APP_NAME version $APP_VERSION"
    - npm ci
    - npm run build
  artifacts:
    paths:
      - dist/
      - node_modules/
    expire_in: 1 hour
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - .npm/

# Unit tests
unit_tests:
  stage: test
  image: node:18-alpine
  timeout: 10m
  needs:
    - build_app
  dependencies:
    - build_app
  script:
    - echo "Running unit tests"
    - npm run test:unit
  artifacts:
    when: always
    expire_in: 1 week
    reports:
      junit: junit.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura.xml
  coverage: '/Lines\s*:\s*(\d+\.\d+)%/'

# Linting job
lint_code:
  stage: test
  image: node:18-alpine
  timeout: 5m
  needs:
    - build_app
  dependencies:
    - build_app
  script:
    - echo "Linting code"
    - npm run lint
  allow_failure: true

# Deploy to staging
deploy_staging:
  stage: deploy
  image: alpine:3.19
  timeout: 10m
  interruptible: false
  needs:
    - unit_tests
    - lint_code
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Deploying to staging environment"
    - echo "Version $APP_VERSION"
    - curl -X POST $STAGING_WEBHOOK_URL
  environment:
    name: staging
    url: https://staging.example.com
  resource_group: staging
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop"'

# Deploy to production
deploy_production:
  stage: deploy
  image: alpine:3.19
  timeout: 10m
  interruptible: false
  needs:
    - unit_tests
    - lint_code
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Deploying to production environment"
    - echo "Version $APP_VERSION"
    - curl -X POST $PRODUCTION_WEBHOOK_URL
  environment:
    name: production
    url: https://example.com
  resource_group: production
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: manual
      allow_failure: false

# Complex Workflow Example
# Demonstrates advanced GitLab CI/CD features including:
# - Multiple includes and templates
# - Matrix builds
# - Conditional workflows
# - Release automation
# - Performance testing
# - Infrastructure as Code

include:
  # Use Jobs templates instead of deprecated Security templates
  - template: Jobs/SAST.gitlab-ci.yml
  - template: Jobs/Secret-Detection.gitlab-ci.yml
  - template: Jobs/Dependency-Scanning.gitlab-ci.yml

stages:
  - .pre
  - validate
  - build
  - test
  - performance
  - security
  - package
  - deploy
  - verify
  - .post

variables:
  CACHE_VERSION: "v2"
  DOCKER_BUILDKIT: 1
  FF_USE_FASTZIP: "true"
  ARTIFACT_COMPRESSION_LEVEL: "fast"
  CACHE_COMPRESSION_LEVEL: "fast"

# Workflow rules to control when pipelines run
workflow:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
    - when: never

# Default settings for all jobs
default:
  retry:
    max: 2
    when:
      - runner_system_failure
      - stuck_or_timeout_failure
  interruptible: true
  tags:
    - docker

# Hidden job templates
.base_node_job:
  image: node:18-alpine
  cache:
    key: ${CACHE_VERSION}-node-${CI_COMMIT_REF_SLUG}
    paths:
      - node_modules/
      - .npm/
  before_script:
    - npm ci --cache .npm --prefer-offline

.base_go_job:
  image: golang:1.21-alpine
  cache:
    key: ${CACHE_VERSION}-go-${CI_COMMIT_REF_SLUG}
    paths:
      - /go/pkg/mod/
  before_script:
    - go mod download

.deploy_template:
  image: google/cloud-sdk:486.0.0-alpine
  before_script:
    - echo $GCP_SERVICE_KEY | base64 -d > ${HOME}/gcp-key.json
    - gcloud auth activate-service-account --key-file ${HOME}/gcp-key.json
    - gcloud config set project $GCP_PROJECT_ID

# Validation stage
validate_yaml:
  stage: .pre
  image: alpine:3.19
  before_script:
    - apk add --no-cache yamllint
  script:
    - yamllint -c .yamllint.yml .
  rules:
    - changes:
        - "**/*.yml"
        - "**/*.yaml"

validate_terraform:
  stage: validate
  image: hashicorp/terraform:1.9
  script:
    - cd infrastructure/
    - terraform fmt -check -recursive
    - terraform init -backend=false
    - terraform validate
  rules:
    - changes:
        - "infrastructure/**/*.tf"

# Build stage with matrix
build_frontend:
  extends: .base_node_job
  stage: build
  parallel:
    matrix:
      - NODE_VERSION: ["16", "18", "20"]
  image: node:${NODE_VERSION}-alpine
  script:
    - echo "Building with Node ${NODE_VERSION}"
    - npm run build
    - npm run build:storybook
  artifacts:
    paths:
      - dist/
      - storybook-static/
    expire_in: 1 day
    name: "frontend-node${NODE_VERSION}-${CI_COMMIT_SHORT_SHA}"

build_backend:
  extends: .base_go_job
  stage: build
  script:
    - CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-w -s" -o bin/server-linux-amd64 ./cmd/server
    - CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -ldflags="-w -s" -o bin/server-darwin-arm64 ./cmd/server
  artifacts:
    paths:
      - bin/
    expire_in: 1 day

build_docker_images:
  stage: build
  image: docker:24-cli
  services:
    - docker:24-dind
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - |
      docker build \
        --cache-from $CI_REGISTRY_IMAGE:buildcache \
        --build-arg BUILDKIT_INLINE_CACHE=1 \
        --build-arg VERSION=$CI_COMMIT_TAG \
        --build-arg COMMIT=$CI_COMMIT_SHORT_SHA \
        --tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA \
        --tag $CI_REGISTRY_IMAGE:latest \
        .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    - if [ -n "$CI_COMMIT_TAG" ]; then docker push $CI_REGISTRY_IMAGE:latest; fi
  needs:
    - build_backend

# Test stage
test_unit:
  extends: .base_node_job
  stage: test
  script:
    - npm run test:unit -- --coverage
  artifacts:
    when: always
    reports:
      junit: junit.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura.xml
  coverage: '/Lines\s*:\s*(\d+\.\d+)%/'

test_integration:
  extends: .base_go_job
  stage: test
  services:
    - name: postgres:15-alpine
      alias: db
    - name: redis:7-alpine
      alias: cache
    - name: elasticsearch:8.11.0
      alias: search
      variables:
        discovery.type: single-node
        xpack.security.enabled: "false"
  variables:
    DATABASE_URL: $TEST_DATABASE_URL  # Set in CI/CD variables
    REDIS_URL: $TEST_REDIS_URL
    ELASTICSEARCH_URL: $TEST_ELASTICSEARCH_URL
  script:
    - go test -v -tags=integration -coverprofile=coverage.out ./...
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml

test_e2e:
  image: mcr.microsoft.com/playwright:v1.40.0-jammy
  stage: test
  needs:
    - build_frontend
  services:
    - name: postgres:15-alpine
      alias: db
  variables:
    DATABASE_URL: $TEST_DATABASE_URL  # Set in CI/CD variables
  script:
    - npm ci
    - npm run test:e2e
  artifacts:
    when: always
    paths:
      - playwright-report/
      - test-results/
    expire_in: 7 days
  allow_failure: true

test_accessibility:
  extends: .base_node_job
  stage: test
  needs:
    - build_frontend
  script:
    - npm run test:a11y
  artifacts:
    when: always
    paths:
      - a11y-report/
    expire_in: 7 days
  allow_failure: true

# Performance testing
performance_lighthouse:
  image: cypress/browsers:node18.12.0-chrome106-ff106
  stage: performance
  needs:
    - build_frontend
  script:
    - npm install -g @lhci/cli
    - lhci autorun --collect.url=http://localhost:3000
  artifacts:
    paths:
      - .lighthouseci/
    expire_in: 7 days
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  allow_failure: true

performance_k6:
  image: grafana/k6:0.52.0
  stage: performance
  needs:
    - deploy_staging
  script:
    - k6 run --out json=k6-results.json tests/k6/load-test.js
  artifacts:
    paths:
      - k6-results.json
    expire_in: 7 days
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
  allow_failure: true

# Security stage (in addition to included templates)
security_container_scan:
  image: aquasec/trivy:0.55.0
  stage: security
  needs:
    - build_docker_images
  script:
    - trivy image --format json --output container-scan.json $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    - trivy image --severity HIGH,CRITICAL --exit-code 1 $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
  artifacts:
    paths:
      - container-scan.json
    expire_in: 7 days
  allow_failure: false

security_license_scan:
  extends: .base_node_job
  stage: security
  script:
    - npm install -g license-checker
    - license-checker --json --out licenses.json
    - license-checker --failOn 'GPL;AGPL'
  artifacts:
    paths:
      - licenses.json
    expire_in: 30 days
  allow_failure: true

# Package stage
package_helm_chart:
  image: alpine/helm:3.15.3
  stage: package
  needs:
    - build_docker_images
  script:
    - helm package helm/app --version $CI_COMMIT_TAG --app-version $CI_COMMIT_TAG
    - helm push app-$CI_COMMIT_TAG.tgz oci://$CI_REGISTRY/$CI_PROJECT_PATH/charts
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'

create_release:
  image: registry.gitlab.com/gitlab-org/release-cli:v0.17.0
  stage: package
  needs:
    - build_backend
    - build_frontend
  script:
    - echo "Creating release for $CI_COMMIT_TAG"
  release:
    tag_name: '$CI_COMMIT_TAG'
    name: 'Release $CI_COMMIT_TAG'
    description: './CHANGELOG.md'
    assets:
      links:
        - name: 'Linux Binary'
          url: '${CI_PROJECT_URL}/-/jobs/${CI_JOB_ID}/artifacts/file/bin/server-linux-amd64'
        - name: 'macOS Binary'
          url: '${CI_PROJECT_URL}/-/jobs/${CI_JOB_ID}/artifacts/file/bin/server-darwin-arm64'
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'

# Deploy stage
deploy_staging:
  extends: .deploy_template
  stage: deploy
  needs:
    - test_unit
    - test_integration
    - security_container_scan
  script:
    - gcloud run deploy $SERVICE_NAME-staging
        --image $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
        --platform managed
        --region $GCP_REGION
        --allow-unauthenticated
  environment:
    name: staging
    url: https://staging.example.com
    on_stop: stop_staging
    auto_stop_in: 7 days
    deployment_tier: staging
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop"'

stop_staging:
  extends: .deploy_template
  stage: deploy
  script:
    - gcloud run services delete $SERVICE_NAME-staging
        --platform managed
        --region $GCP_REGION
        --quiet
  environment:
    name: staging
    action: stop
  when: manual
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop"'

deploy_production:
  extends: .deploy_template
  stage: deploy
  needs:
    - test_unit
    - test_integration
    - test_e2e
    - security_container_scan
  script:
    - gcloud run deploy $SERVICE_NAME
        --image $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
        --platform managed
        --region $GCP_REGION
        --allow-unauthenticated
  environment:
    name: production
    url: https://example.com
    deployment_tier: production
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'
      when: manual
      allow_failure: false
  interruptible: false
  resource_group: production

deploy_canary:
  extends: .deploy_template
  stage: deploy
  needs:
    - deploy_production
  script:
    - echo "Deploying canary with 10% traffic"
    - gcloud run services update-traffic $SERVICE_NAME
        --to-revisions=$CI_COMMIT_SHORT_SHA=10,LATEST=90
        --platform managed
        --region $GCP_REGION
  environment:
    name: production/canary
    deployment_tier: production
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'
      when: manual
  interruptible: false

# Verify stage
verify_deployment:
  image: curlimages/curl:8.9.0
  stage: verify
  needs:
    - deploy_production
  script:
    - |
      response=$(curl -s -o /dev/null -w "%{http_code}" https://example.com/health)
      if [ $response -eq 200 ]; then
        echo "Health check passed"
      else
        echo "Health check failed with status $response"
        exit 1
      fi
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'

smoke_tests:
  extends: .base_node_job
  stage: verify
  needs:
    - deploy_production
  script:
    - npm run test:smoke
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'

# Post-deployment actions
notify_success:
  image: alpine:3.19
  stage: .post
  before_script:
    - apk add --no-cache curl
  script:
    - |
      curl -X POST $SLACK_WEBHOOK \
        -H 'Content-Type: application/json' \
        -d "{
          \"text\": \"✅ Pipeline successful!\",
          \"attachments\": [{
            \"color\": \"good\",
            \"fields\": [
              {\"title\": \"Project\", \"value\": \"$CI_PROJECT_NAME\", \"short\": true},
              {\"title\": \"Branch\", \"value\": \"$CI_COMMIT_BRANCH\", \"short\": true},
              {\"title\": \"Commit\", \"value\": \"$CI_COMMIT_SHORT_SHA\", \"short\": true},
              {\"title\": \"Author\", \"value\": \"$GITLAB_USER_NAME\", \"short\": true}
            ],
            \"actions\": [{
              \"type\": \"button\",
              \"text\": \"View Pipeline\",
              \"url\": \"$CI_PIPELINE_URL\"
            }]
          }]
        }"
  when: on_success
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'

notify_failure:
  image: alpine:3.19
  stage: .post
  before_script:
    - apk add --no-cache curl
  script:
    - |
      curl -X POST $SLACK_WEBHOOK \
        -H 'Content-Type: application/json' \
        -d "{
          \"text\": \"❌ Pipeline failed!\",
          \"attachments\": [{
            \"color\": \"danger\",
            \"fields\": [
              {\"title\": \"Project\", \"value\": \"$CI_PROJECT_NAME\", \"short\": true},
              {\"title\": \"Branch\", \"value\": \"$CI_COMMIT_BRANCH\", \"short\": true},
              {\"title\": \"Failed Job\", \"value\": \"$CI_JOB_NAME\", \"short\": true}
            ],
            \"actions\": [{
              \"type\": \"button\",
              \"text\": \"View Pipeline\",
              \"url\": \"$CI_PIPELINE_URL\"
            }]
          }]
        }"
  when: on_failure
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'

# GitLab CI/CD Pipeline Example with Components (GitLab 17.0+)
#
# This example demonstrates the use of CI/CD components from the GitLab Catalog.
# Components are reusable pipeline configuration units introduced in GitLab 16.x
# and made GA in GitLab 17.0 (May 2024).
#
# Learn more: https://docs.gitlab.com/ci/components/

# Include components from the CI/CD Catalog
include:
  # Example 1: Docker build and push component
  - component: $CI_SERVER_FQDN/components/docker/build-and-push@1.2.0
    inputs:
      stage: build
      dockerfile: Dockerfile
      context: .
      docker_image: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
      registry_user: $CI_REGISTRY_USER
      registry_password: $CI_REGISTRY_PASSWORD

  # Example 2: Node.js test component with specific version
  - component: gitlab.com/components/nodejs/test@2.1.0
    inputs:
      stage: test
      node_version: "20"
      test_command: "npm test"

  # Example 3: Security scanning component from official GitLab components
  - component: $CI_SERVER_FQDN/components/security/sast@3.0.1
    inputs:
      stage: security
      sast_excluded_paths: "tests/,docs/"

  # Example 4: Component with conditional rules
  - component: $CI_SERVER_FQDN/components/deploy/kubernetes@1.5.2
    inputs:
      stage: deploy
      k8s_namespace: $CI_ENVIRONMENT_NAME
      k8s_cluster: $K8S_CLUSTER_NAME
      manifest_path: ./k8s/deployment.yaml
    rules:
      - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

  # Example 5: Using ~latest for development (not recommended for production)
  # Warning: This will use the absolute latest version which may include breaking changes
  - component: $CI_SERVER_FQDN/components/quality/code-coverage@~latest
    inputs:
      stage: report
      coverage_format: cobertura
    rules:
      - if: $CI_PIPELINE_SOURCE == "merge_request_event"

  # Example 6: Project include (traditional method) with pinned ref for comparison
  - project: 'shared-ci/templates'
    ref: 'v2.3.0'  # Pinned version for security and reproducibility
    file: '/templates/notification.gitlab-ci.yml'

  # Example 7: Local include for custom jobs
  - local: '.gitlab/ci/custom-jobs.yml'

# Define pipeline stages
stages:
  - build
  - test
  - security
  - report
  - deploy
  - .post  # Special stage that runs after all other stages

# Global variables
variables:
  # Docker configuration
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: "/certs"

  # Component configuration
  CI_DEBUG_COMPONENTS: "false"

# Additional custom job that works alongside components
validate:
  stage: test
  image: alpine:latest
  script:
    - echo "Running additional validation..."
    - echo "This job runs alongside component-based jobs"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

# Override or extend component behavior
# Components can be customized using the inputs parameter
# or by defining jobs that extend component-generated jobs

# Example: Production deployment with manual trigger
deploy_production:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - echo "Deploying to production environment"
    - kubectl apply -f k8s/production/
  environment:
    name: production
    url: https://app.example.com
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  when: manual
  needs:
    - validate

# Example: Notification job
notify_success:
  stage: .post
  image: curlimages/curl:latest
  script:
    - echo "Pipeline completed successfully"
    - |
      curl -X POST $SLACK_WEBHOOK_URL \
        -H 'Content-Type: application/json' \
        -d "{\"text\": \"Pipeline $CI_PIPELINE_ID completed for $CI_PROJECT_NAME\"}"
  rules:
    - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: on_success
  allow_failure: true

# Best Practices for Components:
#
# 1. Version Pinning:
#    - Always pin to specific versions (@1.2.3) in production
#    - Use ~latest only in development/testing
#    - Partial versions (~1.2) match latest patch version
#
# 2. Inputs:
#    - Use CI/CD variables for sensitive data (not hardcoded)
#    - Validate required inputs are provided
#    - Use descriptive input names
#
# 3. Security:
#    - Verify component sources (prefer $CI_SERVER_FQDN)
#    - Review component code before using in production
#    - Monitor for component updates and security advisories
#
# 4. Testing:
#    - Test component integration in non-production branches first
#    - Use rules to control when components run
#    - Monitor pipeline execution times
#
# 5. Documentation:
#    - Document why specific components were chosen
#    - Keep track of component versions used
#    - Document any custom configurations or inputs

# Docker Build and Push Pipeline Example
# Demonstrates building and pushing Docker images to registry

stages:
  - test
  - build
  - scan
  - deploy

variables:
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: "/certs"
  IMAGE_NAME: $CI_REGISTRY_IMAGE
  IMAGE_TAG: $CI_COMMIT_SHORT_SHA

# Use Docker-in-Docker service
default:
  image: docker:24-cli
  services:
    - docker:24-dind
  before_script:
    - docker info

# Run tests before building
test_application:
  image: node:18-alpine
  stage: test
  script:
    - npm ci
    - npm run test
  artifacts:
    reports:
      junit: junit.xml
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - node_modules/
      - .npm/

# Build Docker image
build_image:
  stage: build
  script:
    - echo "Building Docker image"
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build
        --build-arg VERSION=$IMAGE_TAG
        --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
        --tag $IMAGE_NAME:$IMAGE_TAG
        --tag $IMAGE_NAME:latest
        .
    - docker push $IMAGE_NAME:$IMAGE_TAG
    - docker push $IMAGE_NAME:latest
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
    - if: '$CI_COMMIT_TAG'
  tags:
    - docker

# Build image for feature branches (no push to latest)
build_feature_image:
  stage: build
  script:
    - echo "Building feature branch image"
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build
        --tag $IMAGE_NAME:$CI_COMMIT_REF_SLUG
        .
    - docker push $IMAGE_NAME:$CI_COMMIT_REF_SLUG
  rules:
    - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH && $CI_COMMIT_TAG == null'
  tags:
    - docker

# Scan image for vulnerabilities
scan_image:
  image: aquasec/trivy:latest
  stage: scan
  script:
    - echo "Scanning image for vulnerabilities"
    - trivy image --exit-code 0 --severity LOW,MEDIUM $IMAGE_NAME:$IMAGE_TAG
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $IMAGE_NAME:$IMAGE_TAG
  needs:
    - build_image
  allow_failure: true
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
    - if: '$CI_COMMIT_TAG'
  tags:
    - docker

# Deploy to Kubernetes
deploy_to_k8s:
  image: bitnami/kubectl:latest
  stage: deploy
  script:
    - echo "Deploying to Kubernetes"
    - kubectl config use-context $KUBE_CONTEXT
    - kubectl set image deployment/$APP_NAME $APP_NAME=$IMAGE_NAME:$IMAGE_TAG -n $NAMESPACE
    - kubectl rollout status deployment/$APP_NAME -n $NAMESPACE
  environment:
    name: production
    url: https://app.example.com
    kubernetes:
      namespace: $NAMESPACE
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: manual
  needs:
    - build_image
    - scan_image
  tags:
    - kubernetes

# Multi-stage build example with BuildKit
build_optimized:
  stage: build
  variables:
    DOCKER_BUILDKIT: 1
  script:
    - echo "Building with BuildKit"
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build
        --cache-from $IMAGE_NAME:buildcache
        --build-arg BUILDKIT_INLINE_CACHE=1
        --tag $IMAGE_NAME:$IMAGE_TAG-optimized
        --file Dockerfile.optimized
        .
    - docker push $IMAGE_NAME:$IMAGE_TAG-optimized
  rules:
    - if: '$CI_COMMIT_TAG'
  tags:
    - docker

# Docker Compose testing
test_with_compose:
  stage: test
  image: docker/compose:latest
  services:
    - docker:24-dind
  script:
    - docker compose up -d
    - docker compose ps
    - docker compose run --rm test npm run test:integration
    - docker compose down
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  tags:
    - docker

# Multi-Stage Pipeline with DAG (Directed Acyclic Graph)
# Demonstrates advanced pipeline structure with parallel execution

stages:
  - .pre
  - build
  - test
  - security
  - deploy
  - .post

variables:
  CACHE_VERSION: "v1"
  NODE_VERSION: "18"

# Pre-flight checks
validate_config:
  stage: .pre
  image: alpine:latest
  script:
    - echo "Validating configuration"
    - test -f package.json || exit 1
    - test -f Dockerfile || exit 1
  tags:
    - docker

# Build frontend
build_frontend:
  stage: build
  image: node:${NODE_VERSION}-alpine
  script:
    - echo "Building frontend"
    - cd frontend
    - npm ci
    - npm run build
  artifacts:
    paths:
      - frontend/dist/
    expire_in: 1 day
  cache:
    key: ${CACHE_VERSION}-frontend-${CI_COMMIT_REF_SLUG}
    paths:
      - frontend/node_modules/
      - frontend/.npm/
  tags:
    - docker

# Build backend
build_backend:
  stage: build
  image: golang:1.21-alpine
  script:
    - echo "Building backend"
    - cd backend
    - go mod download
    - go build -o bin/server ./cmd/server
  artifacts:
    paths:
      - backend/bin/
    expire_in: 1 day
  cache:
    key: ${CACHE_VERSION}-backend-${CI_COMMIT_REF_SLUG}
    paths:
      - /go/pkg/mod/
  tags:
    - docker

# Build documentation
build_docs:
  stage: build
  image: python:3.11-alpine
  script:
    - echo "Building documentation"
    - pip install mkdocs mkdocs-material
    - mkdocs build
  artifacts:
    paths:
      - site/
    expire_in: 1 week
  tags:
    - docker

# Frontend unit tests - runs immediately after build_frontend
test_frontend_unit:
  stage: test
  image: node:${NODE_VERSION}-alpine
  needs:
    - job: build_frontend
      artifacts: true
  script:
    - echo "Running frontend unit tests"
    - cd frontend
    - npm ci
    - npm run test:unit
  artifacts:
    reports:
      junit: frontend/junit.xml
      coverage_report:
        coverage_format: cobertura
        path: frontend/coverage/cobertura.xml
  coverage: '/Lines\s*:\s*(\d+\.\d+)%/'
  tags:
    - docker

# Frontend E2E tests
test_frontend_e2e:
  stage: test
  image: cypress/included:13.6.0
  needs:
    - job: build_frontend
      artifacts: true
  services:
    - name: nginx:alpine
      alias: web
  script:
    - echo "Running E2E tests"
    - cd frontend
    - npm ci
    - npm run test:e2e
  artifacts:
    when: always
    paths:
      - frontend/cypress/screenshots/
      - frontend/cypress/videos/
    expire_in: 1 week
  allow_failure: true
  tags:
    - docker

# Backend unit tests
test_backend_unit:
  stage: test
  image: golang:1.21-alpine
  needs:
    - job: build_backend
      artifacts: true
  script:
    - echo "Running backend unit tests"
    - cd backend
    - go test -v -coverprofile=coverage.out ./...
    - go tool cover -func=coverage.out
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: backend/coverage.xml
  coverage: '/total:.*?(\d+\.\d+)%/'
  tags:
    - docker

# Backend integration tests
test_backend_integration:
  stage: test
  image: golang:1.21-alpine
  needs:
    - job: build_backend
      artifacts: true
  services:
    - name: postgres:15-alpine
      alias: postgres
    - name: redis:7-alpine
      alias: redis
  variables:
    POSTGRES_DB: testdb
    POSTGRES_USER: test
    POSTGRES_PASSWORD: test
    DATABASE_URL: "postgres://test:test@postgres:5432/testdb?sslmode=disable"
    REDIS_URL: "redis://redis:6379"
  script:
    - echo "Running backend integration tests"
    - cd backend
    - go test -v -tags=integration ./...
  tags:
    - docker

# Lint frontend code
lint_frontend:
  stage: test
  image: node:${NODE_VERSION}-alpine
  needs:
    - job: build_frontend
      artifacts: false
  script:
    - echo "Linting frontend code"
    - cd frontend
    - npm ci
    - npm run lint
  allow_failure: true
  tags:
    - docker

# Lint backend code
lint_backend:
  stage: test
  image: golangci/golangci-lint:v1.55-alpine
  needs:
    - job: build_backend
      artifacts: false
  script:
    - echo "Linting backend code"
    - cd backend
    - golangci-lint run
  allow_failure: true
  tags:
    - docker

# SAST scanning
sast_scan:
  stage: security
  image: returntocorp/semgrep:latest
  needs: []
  script:
    - semgrep --config=auto --json --output=sast-report.json .
  artifacts:
    reports:
      sast: sast-report.json
  allow_failure: true
  tags:
    - docker

# Dependency scanning
dependency_scan:
  stage: security
  image: aquasec/trivy:latest
  needs: []
  script:
    - trivy fs --format json --output dependency-report.json .
  artifacts:
    paths:
      - dependency-report.json
    expire_in: 1 week
  allow_failure: true
  tags:
    - docker

# Secret scanning
secret_scan:
  stage: security
  image: trufflesecurity/trufflehog:latest
  needs: []
  script:
    - trufflehog filesystem --directory=. --json > secrets-report.json
  artifacts:
    paths:
      - secrets-report.json
    expire_in: 1 week
  allow_failure: true
  tags:
    - docker

# Deploy to staging
deploy_staging:
  stage: deploy
  image: alpine:latest
  needs:
    - test_frontend_unit
    - test_backend_unit
    - test_backend_integration
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Deploying to staging"
    - curl -X POST "$STAGING_DEPLOY_WEBHOOK"
  environment:
    name: staging
    url: https://staging.example.com
    on_stop: stop_staging
    auto_stop_in: 7 days
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop"'
  tags:
    - docker

# Stop staging environment
stop_staging:
  stage: deploy
  image: alpine:latest
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Stopping staging environment"
    - curl -X DELETE "$STAGING_DEPLOY_WEBHOOK"
  environment:
    name: staging
    action: stop
  when: manual
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop"'
  tags:
    - docker

# Deploy review app
deploy_review:
  stage: deploy
  image: alpine:latest
  needs:
    - test_frontend_unit
    - test_backend_unit
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Deploying review app"
    - echo "URL https://$CI_ENVIRONMENT_SLUG.review.example.com"
    - curl -X POST "$REVIEW_DEPLOY_WEBHOOK"
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    url: https://$CI_ENVIRONMENT_SLUG.review.example.com
    on_stop: stop_review
    auto_stop_in: 3 days
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  tags:
    - docker

# Stop review app
stop_review:
  stage: deploy
  image: alpine:latest
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Stopping review app"
    - curl -X DELETE "$REVIEW_DEPLOY_WEBHOOK"
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    action: stop
  when: manual
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  tags:
    - docker

# Deploy to production
deploy_production:
  stage: deploy
  image: alpine:latest
  needs:
    - test_frontend_unit
    - test_backend_unit
    - test_backend_integration
    - sast_scan
    - dependency_scan
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Deploying to production"
    - curl -X POST "$PRODUCTION_DEPLOY_WEBHOOK"
  environment:
    name: production
    url: https://example.com
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: manual
  allow_failure: false
  tags:
    - docker

# Post-deployment notifications
notify_deployment:
  stage: .post
  image: alpine:latest
  before_script:
    - apk add --no-cache curl
  script:
    - echo "Sending deployment notification"
    - |
      curl -X POST "$SLACK_WEBHOOK" \
        -H 'Content-Type: application/json' \
        -d "{\"text\":\"Pipeline completed: $CI_PIPELINE_URL\"}"
  when: always
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "develop"'
  tags:
    - docker