.gitlab-ci.yml

# Note: This GitLab CI configuration is used for internal testing, users can ignore it.
include:
    - project: '${CI_PROJECT_NAMESPACE}/ci-libs-for-client-libraries'
      file:
          - '/${CI_PROJECT_NAME}/.gitlab-ci.yml'
    - project: 'deepl-org/deepl/devex/gitlab-ci-lib'
      file:
          - '/templates/.secret-detection.yml'
    - template: Security/SAST.gitlab-ci.yml

# Global --------------------------

# Use Active LTS (22)
image: node:22-alpine

workflow:
    rules:
        # The tag pipeline must run: that is where the registry publish job fires.
        - if: $CI_COMMIT_TAG
        # The release commit carries only the version and the changelog, both
        # derived from commits that were already checked on the way in.
        - if: $CI_COMMIT_MESSAGE =~ /^chore\(release\):/
          when: never
        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
        - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

cache:
    key:
        files:
            - package.json
            - package-lock.lock
    paths:
        - node_modules/

stages:
    - check
    - build
    - test
    - publish

before_script:
    - npm install

variables:
    GITLAB_ADVANCED_SAST_ENABLED: 'true'

# stage: check ----------------------

.eslint_base:
    stage: check
    script:
        - npm run lint

eslint_scheduled:
    extends: .eslint_base
    rules:
        - if: $CI_PIPELINE_SOURCE == "schedule"
    retry: 2

eslint_manual:
    extends: .eslint_base
    rules:
        - if: $CI_PIPELINE_SOURCE != "schedule"

.audit_base:
    stage: check
    script:
        - npm audit --production
        # Suppressing NPM audit failures on dev dependencies due to CVE-2022-25883
        #   in semver <7.5.2, used by test dependencies.
        # See: https://github.com/npm/node-semver/pull/564
        # Currently npm audit fix cannot resolve this issue.
        - npm audit || echo "Suppressing npm audit failures for dev dependencies"

audit_scheduled:
    extends: .audit_base
    rules:
        - if: $CI_PIPELINE_SOURCE == "schedule"
    retry: 2

audit_manual:
    extends: .audit_base
    rules:
        - if: $CI_PIPELINE_SOURCE != "schedule"

.format_base:
    stage: check
    script:
        - npm run format

format_scheduled:
    extends: .format_base
    rules:
        - if: $CI_PIPELINE_SOURCE == "schedule"
    retry: 2

format_manual:
    extends: .format_base
    rules:
        - if: $CI_PIPELINE_SOURCE != "schedule"

secret_detection:
    extends: .secret-detection
    stage: check
    image: !reference [.secret-detection, image]
    before_script:
        - echo "overriding default before_script..."
    rules:
        - if: $CI_MERGE_REQUEST_ID

gitlab-advanced-sast:
    stage: check
    rules:
        - when: always
    before_script:
        - ''
    variables:
        SAST_EXCLUDED_PATHS: '$DEFAULT_SAST_EXCLUDED_PATHS'
        GIT_STRATEGY: clone

semgrep-sast:
    stage: check
    rules:
        - when: always
    before_script:
        - ''
    variables:
        SAST_EXCLUDED_PATHS: '$DEFAULT_SAST_EXCLUDED_PATHS'
        GIT_STRATEGY: clone

# stage: build ----------------------

build:
    stage: build
    script:
        - npm run clean
        - npm run build
    artifacts:
        paths:
            - dist

# stage: test ----------------------

.test_offline_base:
    stage: test
    variables:
        KUBERNETES_MEMORY_LIMIT: 8Gi
    parallel:
        matrix:
            - DOCKER_IMAGE: 'node:16-alpine'
            - DOCKER_IMAGE: 'node:17-alpine'
            - DOCKER_IMAGE: 'node:18-alpine'
            - DOCKER_IMAGE: 'node:20-alpine'
            - DOCKER_IMAGE: 'node:22-alpine'
            - DOCKER_IMAGE: 'node:24-alpine'
    image: ${DOCKER_IMAGE}
    script:
        - npm run test:offline -- --coverage --reporters="default" --reporters="jest-junit" --maxWorkers=5
    artifacts:
        reports:
            coverage_report:
                coverage_format: cobertura
                path: coverage/clover.xml
            junit:
                - junit.xml
        when: always

test_offline_scheduled:
    extends: .test_offline_base
    rules:
        - if: $CI_PIPELINE_SOURCE == "schedule"
    retry: 2

test_offline_manual:
    extends: .test_offline_base
    rules:
        - if: $CI_PIPELINE_SOURCE != "schedule"

# Every endpoint once against the real API; no retry, as a retry repeats every request.
.test_real_api_base:
    stage: test
    extends: .test
    variables:
        KUBERNETES_MEMORY_LIMIT: 8Gi
    image: node:24-alpine
    script:
        - npm run test:real-api -- --coverage --reporters="default" --reporters="jest-junit"
    artifacts:
        reports:
            coverage_report:
                coverage_format: cobertura
                path: coverage/clover.xml
            junit:
                - junit.xml
        when: always

test_real_api_scheduled:
    extends: .test_real_api_base
    rules:
        - if: $CI_PIPELINE_SOURCE == "schedule"

test_real_api_manual:
    extends: .test_real_api_base
    rules:
        - if: $CI_PIPELINE_SOURCE != "schedule"

.examples_base:
    stage: test
    extends: .test
    image: node:24-alpine
    before_script: # Note: replaces global before_script
        - npm install --production
    script:
        - cd $CI_PROJECT_DIR/examples/commonjs
        - npm install
        - node index.js
        - cd $CI_PROJECT_DIR/examples/esmodule
        - npm install
        - node index.js
        - cd $CI_PROJECT_DIR/examples/typescript
        - npm install
        - npm run build
        - node index.js

examples_scheduled:
    extends: .examples_base
    rules:
        - if: $CI_PIPELINE_SOURCE == "schedule"
    retry: 2

examples_manual:
    extends: .examples_base
    rules:
        - if: $CI_PIPELINE_SOURCE != "schedule"

# stage: publish ----------------------

publish to NPM:
    stage: publish
    extends: .publish
    dependencies:
        - build
    rules:
        - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'
    script:
        - npm config set //registry.npmjs.org/:_authToken ${NPM_PUBLISH_TOKEN}
        - npm publish