image: node:22

# We use stages for clarity of intent, and "needs" for dependencies and sequencing.
# "needs" should work in parallel where acceptable, and get any artifacts directly from the source step.
stages:
  - download (untrusted)
  - prepare
  - deploy

# Install dependencies.
install:
  stage: download (untrusted)

  # NOTE: We ignore lifecycle scripts as they are a common attack vector.
  script:
    - npm ci --ignore-scripts

  # Carry over the installed dependencies as artifacts in the pipeline.
  artifacts:
    paths:
      - node_modules/

# Verify that installed dependencies are free from known security issues.
audit:
  stage: download (untrusted)

  needs:
    - install

  script:
    # Check for moderate, high and critical issues but ignore low impact issues.
    - npm audit --audit-level=moderate
    # Check for supply chain tampering with downloaded packages.
    - npm audit signatures

build:
  stage: prepare

  needs:
    - install
    - audit

  script:
    - npm run build

  # Carry over the build application in the pipeline.
  artifacts:
    paths:
      - packages/docs/dist/
      - packages/json-payment-protocol-v2/dist/
      - packages/primitives/dist/
      - packages/stack/dist/

# NOTE: Some tests depend on the build output, so we run tests after build.
test:
  stage: prepare

  needs:
    - install
    - audit
    - build

  script:
    # Run tests
    - npm run test
    # Ensure no circular dependencies
    - npm run madge

publish:development:
  stage: deploy

  needs:
    - build
    - test

  only:
    - development

  # Configure what tag to use for this publication.
  variables:
    NPM_TAG: 'development'
    GITLAB_USER_EMAIL: 'ci@stack.xo.cash'
    GITLAB_USER_NAME: 'GitLab CI'

  script:
    # Setup git config
    - git config --global user.email "${GITLAB_USER_EMAIL}"
    - git config --global user.name "${GITLAB_USER_NAME}"

    # Configure git to push with CI token
    - git remote set-url origin "https://gitlab-ci-token:$GL_TOKEN@$CI_SERVER_HOST/$CI_PROJECT_PATH.git"

    # Ensure full Git history so Lerna can detect changes
    - git fetch --unshallow
    - git fetch origin development

    # Check the current HEAD and the associated branch
    - 'echo "CI_COMMIT_SHA: ${CI_COMMIT_SHA}"'
    - git log -1

    # Setup npm config for npmjs.com
    - npm config set registry https://registry.npmjs.org/
    - npm config set //registry.npmjs.org/:_authToken ${NPM_AUTH_TOKEN}

    # Version and publish
    - npm run publish

# TODO: Document the Lerna Recursive problem when we run lerna version on our main branch.
# NOTE: The "lerna version" command will create a new commit and push it to our main branch.
#       This can create a problem where our CI on the "main" branch is recursively triggered.
#       To prevent this, we add [ci skip] to our Lerna Version commit message.
#       This is supported OOTB by GitLab (and GitHub).
#       See: https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline

# Publish the documentation to GitLab Pages (for now).
publish:docs:
  stage: deploy

  # After this job successfully completes, GitLab will initiates a Pages deployment, publishing the contents in the specified artifacts directory.
  pages: true

  needs:
    - build
    - test

  only:
    - development

  script:
    - mv packages/docs/dist public

  artifacts:
    paths:
      - public