.gitlab-ci.yml

include:
  - remote: https://gitlab-templates.ddbuild.io/libdatadog/include/ci_authenticated_job.yml
  - remote: https://gitlab-templates.ddbuild.io/apm/packaging.yml
  - local: ".gitlab/benchmarks.yml"
  - local: ".gitlab/exploration-tests.yml"
  - local: ".gitlab/ci-visibility-tests.yml"
  - local: ".gitlab/single-step-instrumentation-tests.yml"

stages:
  - build
  - package
  - deploy
  - benchmarks
  - exploration-tests
  - ci-visibility-tests
  - single-step-instrumentation-tests
  - generate-signing-key

variables:
  REGISTRY: 486234852809.dkr.ecr.us-east-1.amazonaws.com
  SONATYPE_USERNAME: robot-sonatype-apm-java
  DOWNSTREAM_BRANCH:
    value: "master"
    description: "Run a specific datadog-reliability-env branch downstream"
  FORCE_TRIGGER:
    value: "false"
    description: "Set to true to override rules in the reliability-env pipeline (e.g. override 'only deploy master')"

.common: &common
  tags: [ "runner:main", "size:large" ]

.docker: &docker
  tags: [ "arch:amd64", "size:large" ]
  image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/docker:20.10.13
  cache:
    key: no-cache
    policy: pull

cache: &default_cache
  key: '$CI_SERVER_VERSION' # Reset the cache every time gitlab is upgraded.  ~Every couple months
  paths:
    - .gradle/wrapper
    - .gradle/caches
  policy: pull

.gradle_build: &gradle_build
  <<: *common
  image: ghcr.io/datadog/dd-trace-java-docker-build:v23.10-base
  before_script:
    - export GRADLE_USER_HOME=`pwd`/.gradle
    # for weird reasons, gradle will always "chmod 700" the .gradle folder
    # with Gitlab caching, .gradle is always owned by root and thus gradle's chmod invocation fails
    # This dance is a hack to have .gradle owned by the Gitlab runner user
    - mkdir -p .gradle
    - cp -r .gradle .gradle-copy
    - rm -rf .gradle
    - mv .gradle-copy .gradle
    - ls -la

build: &build
  <<: *gradle_build
  stage: build
  rules:
    - if: '$POPULATE_CACHE'
      when: never
    - when: on_success
  script:
    - GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xmx1900M -Xms512M' -Ddatadog.forkedMaxHeapSize=512M -Ddatadog.forkedMinHeapSize=128M" ./gradlew clean :dd-java-agent:shadowJar :dd-trace-api:jar :dd-trace-ot:shadowJar --build-cache --parallel --stacktrace --no-daemon --max-workers=8
    - echo UPSTREAM_TRACER_VERSION=$(java -jar workspace/dd-java-agent/build/libs/*.jar) >> upstream.env
    - echo "BUILD_JOB_NAME=$CI_JOB_NAME" >> build.env
    - echo "BUILD_JOB_ID=$CI_JOB_ID" >> build.env
  artifacts:
    paths:
      - 'workspace/dd-java-agent/build/libs/*.jar'
      - 'workspace/dd-trace-api/build/libs/*.jar'
      - 'workspace/dd-trace-ot/build/libs/*.jar'
      - 'upstream.env'
    reports:
      dotenv: build.env

build_with_cache:
  <<: *build
  rules:
    - if: '$POPULATE_CACHE'
      when: on_success
    - when: manual
      allow_failure: true
  cache:
    <<: *default_cache
    policy: push

package:
  extends: .package
  when: on_success # this can't use 'needs: [build]', since build is not available in the scheduled pipeline
  script:
    - ../.gitlab/build_java_package.sh
    - find . -iregex '.*\.\(deb\|rpm\)' -printf '%f\0' | xargs -0 dd-pkg lint

package-arm:
  extends: .package-arm
  when: on_success # this can't use 'needs: [build]', since build is not available in the scheduled pipeline
  script:
    - ../.gitlab/build_java_package.sh
    - find . -iregex '.*\.\(deb\|rpm\)' -printf '%f\0' | xargs -0 dd-pkg lint

package-oci:
  stage: package
  extends: .package-oci
  when: on_success # this can't use 'needs: [build]', since build is not available in the scheduled pipeline
  script:
    - ../.gitlab/build_java_package_oci.sh

.release-package:
  stage: deploy
  variables:
    PRODUCT_NAME: auto_inject-java

deploy_to_reliability_env:
  stage: deploy
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: on_success
    - when: manual
      allow_failure: true
  trigger:
    project: DataDog/apm-reliability/datadog-reliability-env
    branch: $DOWNSTREAM_BRANCH
  variables:
    UPSTREAM_PACKAGE_JOB: $BUILD_JOB_NAME
    UPSTREAM_PROJECT_ID: $CI_PROJECT_ID
    UPSTREAM_PROJECT_NAME: $CI_PROJECT_NAME
    UPSTREAM_PIPELINE_ID: $CI_PIPELINE_ID
    UPSTREAM_BRANCH: $CI_COMMIT_REF_NAME
    UPSTREAM_COMMIT_SHA: $CI_COMMIT_SHA
    FORCE_TRIGGER: $FORCE_TRIGGER

deploy_to_profiling_backend:
  stage: deploy
  rules:
    - if: '$POPULATE_CACHE'
      when: never
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: on_success
    - if: '$CI_COMMIT_TAG =~ /^v.*/'
      when: on_success
    - when: manual
      allow_failure: true
  trigger:
    project: DataDog/profiling-backend
    branch: dogfooding
  variables:
    UPSTREAM_PACKAGE_JOB: $BUILD_JOB_NAME
    UPSTREAM_PACKAGE_JOB_ID: $BUILD_JOB_ID
    UPSTREAM_PROJECT_ID: $CI_PROJECT_ID
    UPSTREAM_PROJECT_NAME: $CI_PROJECT_NAME
    UPSTREAM_PIPELINE_ID: $CI_PIPELINE_ID
    UPSTREAM_BRANCH: $CI_COMMIT_BRANCH
    UPSTREAM_TAG: $CI_COMMIT_TAG
    FORCE_TRIGGER: $FORCE_TRIGGER

deploy_to_di_backend:manual:
  stage: deploy
  rules:
    - if: '$POPULATE_CACHE'
      when: never
    - when: manual
      allow_failure: true
  trigger:
    project: DataDog/debugger-demos
    branch: main
  variables:
    UPSTREAM_PACKAGE_JOB: build
    UPSTREAM_PROJECT_ID: $CI_PROJECT_ID
    UPSTREAM_PROJECT_NAME: $CI_PROJECT_NAME
    UPSTREAM_PIPELINE_ID: $CI_PIPELINE_ID
    UPSTREAM_BRANCH: $CI_COMMIT_BRANCH
    UPSTREAM_TAG: $CI_COMMIT_TAG
    UPSTREAM_COMMIT_AUTHOR: $CI_COMMIT_AUTHOR
    UPSTREAM_COMMIT_SHORT_SHA: $CI_COMMIT_SHORT_SHA

deploy_to_sonatype:
  <<: *gradle_build
  stage: deploy
  rules:
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: on_success
    - if: '$CI_COMMIT_TAG =~ /^v.*/'
      when: on_success
    - when: manual
      allow_failure: true
  script:
    - export SONATYPE_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.sonatype_password --with-decryption --query "Parameter.Value" --out text)
    - export GPG_PRIVATE_KEY=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.signing.gpg_private_key --with-decryption --query "Parameter.Value" --out text)
    - export GPG_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.signing.gpg_passphrase --with-decryption --query "Parameter.Value" --out text)
    - ./gradlew -PbuildInfo.build.number=$CI_JOB_ID publishToSonatype closeSonatypeStagingRepository --max-workers=1 --build-cache --stacktrace --no-daemon

deploy_artifacts_to_github:
  stage: deploy
  image: registry.ddbuild.io/github-cli:v27480869-eafb11d-2.43.0
  tags: [ "arch:amd64" ]
  rules:
    - if: '$POPULATE_CACHE'
      when: never
    - if: '$CI_COMMIT_TAG =~ /^v.*/'
      when: on_success
    - when: manual
      allow_failure: true
  script:
    - aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.gh_release_token --with-decryption --query "Parameter.Value" --out text > github-token.txt
    - gh auth login --with-token < github-token.txt
    - gh auth status  # Maybe helpful to have this output in logs?
    - cp workspace/dd-java-agent/build/libs/dd-java-agent-*.jar workspace/dd-java-agent/build/libs/dd-java-agent.jar # we upload two filenames
    - gh release upload --clobber --repo DataDog/dd-trace-java $CI_COMMIT_TAG workspace/dd-java-agent/build/libs/*.jar
    - gh release upload --clobber --repo DataDog/dd-trace-java $CI_COMMIT_TAG workspace/dd-trace-api/build/libs/*.jar
    - gh release upload --clobber --repo DataDog/dd-trace-java $CI_COMMIT_TAG workspace/dd-trace-ot/build/libs/*.jar
    
deploy_to_docker_registries:
  stage: deploy
  rules:
    - if: '$CI_COMMIT_TAG =~ /.*-[Rr][Cc].*/'
      when: manual
      allow_failure: true
    - if: '$POPULATE_CACHE'
      when: never
    - if: '$CI_COMMIT_TAG =~ /^v.*/'
      when: on_success
    - when: manual
      allow_failure: true
  trigger:
    project: DataDog/public-images
    branch: main
    strategy: depend
  variables:
    IMG_SOURCES: ghcr.io/datadog/dd-trace-java/dd-lib-java-init:$CI_COMMIT_SHA
    IMG_DESTINATIONS: dd-lib-java-init:$CI_COMMIT_TAG
    IMG_SIGNING: "false"

deploy_latest_tag_to_docker_registries:
  stage: deploy
  rules:
    - if: '$CI_COMMIT_TAG =~ /.*-[Rr][Cc].*/'
      when: manual
      allow_failure: true
    - if: '$POPULATE_CACHE'
      when: never
    - if: '$CI_COMMIT_TAG =~ /^v1\..*/'
      when: on_success
    - when: manual
      allow_failure: true
  trigger:
    project: DataDog/public-images
    branch: main
    strategy: depend
  variables:
    IMG_SOURCES: ghcr.io/datadog/dd-trace-java/dd-lib-java-init:$CI_COMMIT_SHA
    IMG_DESTINATIONS: dd-lib-java-init:latest
    IMG_SIGNING: "false"

create_key:
  stage: generate-signing-key
  when: manual
  needs: [ ]
  tags: [ "arch:amd64", "size:large" ]
  variables:
    PROJECT_NAME: "dd-trace-java"
    EXPORT_TO_KEYSERVER: "true"
  image: $REGISTRY/ci/agent-key-management-tools/gpg:1
  script:
    - /create.sh
  artifacts:
    expire_in: 13 mos
    paths:
      - pubkeys

tracer-base-image-release:
  extends: .ci_authenticated_job
  stage: deploy
  rules:
    - if: '$POPULATE_CACHE'
      when: never
    - if: '$CI_COMMIT_TAG =~ /^v1\..*/'
      when: on_success
  dependencies:
    - build
  script:
    - echo $GH_TOKEN|docker login ghcr.io/datadog -u uploader --password-stdin
    - mkdir -p ./tooling/ci/binaries/ && cp workspace/dd-java-agent/build/libs/*.jar ./tooling/ci/binaries/dd-java-agent.jar
    - docker buildx build -t ghcr.io/datadog/dd-trace-java/dd-trace-java:latest -f ./tooling/ci/Dockerfile .
    - docker push ghcr.io/datadog/dd-trace-java/dd-trace-java:latest

tracer-base-image-snapshot:
  extends: .ci_authenticated_job
  stage: deploy
  rules:
    - if: '$POPULATE_CACHE'
      when: never
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: on_success
  dependencies:
    - build
  script:
    - echo $GH_TOKEN|docker login ghcr.io/datadog -u uploader --password-stdin
    - mkdir -p ./tooling/ci/binaries/ && cp workspace/dd-java-agent/build/libs/*.jar ./tooling/ci/binaries/dd-java-agent.jar
    - docker buildx build -t ghcr.io/datadog/dd-trace-java/dd-trace-java:latest_snapshot -f ./tooling/ci/Dockerfile .
    - docker push ghcr.io/datadog/dd-trace-java/dd-trace-java:latest_snapshot