.gitlab-ci.yml

# tutti CI: dunn.dev/pipeline catalog @3.0.0.
#
# v2.0.0 contract: every component image resolves to ci-go:$[[
# component.version ]], so pinning the catalog at one tag pins the
# whole tooling matrix. Tag pipelines (release stage) fire on `v*`.
# 2.1.1 carries the .exe handling for windows targets we depend on.

default:
  interruptible: true

# workflow.rules: prevent duplicate pipelines. When a branch has an
# open MR, suppress the redundant push pipeline and let the
# merge_request_event pipeline be the only pipeline for that commit
# (Renovate pushes land on a branch that already has an open MR, which
# otherwise fires BOTH a push and an MR-event pipeline for the same
# commit). Mirrors dunn.dev/othala's fix for the same defect.
workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS && $CI_PIPELINE_SOURCE == "push"
      when: never
    - if: $CI_COMMIT_BRANCH
    - if: $CI_COMMIT_TAG
  auto_cancel:
    on_new_commit: interruptible
    on_job_failure: all

stages:
  - lint
  - test
  - build
  - deploy
  - package
  - release
  - verdict
  - automerge-gate

variables:
  GOFLAGS: -mod=readonly

include:
  # Fail-closed automerge gate (renovate-single-maintainer campaign,
  # GO-2026-5023 remediation follow-up). platformAutomerge is true
  # estate-wide and the canonical preset automerges minor/patch +
  # security-fix MRs; on GitLab the automerge decision rides the
  # aggregate pipeline status, so the whole pipeline (lint + test +
  # build, plus the OSV verdict below) must pass before Renovate
  # native auto-merge proceeds. osv-verdict emits CHECK_OSV via
  # dotenv (newly-introduced findings only on MRs); automerge-gate
  # consumes it over needs: and blocks unless every required check
  # is present and pass. Mirrors dunn.dev/bairn's wiring for the
  # same gate.
  - component: gitlab.com/dunn.dev/pipeline/osv-verdict@4.6.0
  - component: gitlab.com/dunn.dev/pipeline/automerge-gate@4.6.0
    inputs:
      stage: automerge-gate
      required-checks: "osv"

  # Lint: golangci-lint via the catalog's pinned ci-go. Real gate.
  - component: gitlab.com/dunn.dev/pipeline/go-lint@4.6.0

  # Audit: govulncheck on every push. allow_failure by default
  # (vuln-DB shifts shouldn't block a release).
  - component: gitlab.com/dunn.dev/pipeline/go-audit@4.6.0

  # Reference-check: enforcing conformance check against dunn.dev/reference
  # (fail_on_violation: true — the repo verified clean in advisory, so the
  # gate is real). Runs in the lint stage, ahead of build.
  - component: gitlab.com/dunn.dev/pipeline/reference-check@4.6.0
    inputs:
      reference_ref: main
      fail_on_violation: true

  # Branch verification: parallel:matrix cross-compile on every
  # push. ldflags overridden so the binary's version package gets
  # the ref name baked in (catalog default targets main.Version
  # which tutti doesn't expose; we keep the version in
  # internal/version so the manifest writer can read it). Matrix
  # is overridden below to add windows/amd64 to the catalog's
  # default linux+darwin set.
  - component: gitlab.com/dunn.dev/pipeline/go-build@4.6.0
    inputs:
      job_name: go-build
      binary_name: tutti
      package_path: ./cmd/tutti
      ldflags: '-s -w -X gitlab.com/dunn.dev/tutti/internal/version.Tutti=$CI_COMMIT_REF_NAME'

  # Tag-only: parallel:matrix cross-compile + per-binary cosign
  # signature + per-binary .sha256 + upload to package registry.
  # Same ldflags override target as go-build, with $CI_COMMIT_TAG
  # so the released binary stamps the tag itself.
  - component: gitlab.com/dunn.dev/pipeline/go-release-binary@4.6.0
    inputs:
      binary_name: tutti
      package_path: ./cmd/tutti
      package_name: tutti
      ldflags: '-s -w -X gitlab.com/dunn.dev/tutti/internal/version.Tutti=$CI_COMMIT_TAG'

  # Tag-only: CycloneDX SBOM per binary via syft.
  - component: gitlab.com/dunn.dev/pipeline/go-sbom@4.6.0
    inputs:
      package_name: tutti

  # Tag-only: SLSA v1.0 provenance per binary, cosign-signed via
  # GitLab OIDC keyless.
  - component: gitlab.com/dunn.dev/pipeline/slsa-attest@4.6.0

  # Tag-only: GitLab Release with binaries + SBOMs + attestations
  # linked. Idempotent across pipeline reruns.
  - component: gitlab.com/dunn.dev/pipeline/release-create@4.6.0
    inputs:
      package_name: tutti

  # Site: build + deploy the Astro corpus site at web/ to Cloudflare
  # Workers (with Static Assets). Wrangler config lives in web/; the
  # build runs there too so output_dir sits next to wrangler.toml as
  # `dist/`. Build job runs on every push + MR; deploy job runs only
  # on main. WEB_ANALYTICS_TOKEN_TUTTI is a per-project CI variable
  # holding the Cloudflare Web Analytics beacon token; when present,
  # the build step injects the beacon into every .html file under
  # dist/ before deploy.
  - component: gitlab.com/dunn.dev/pipeline/cloudflare-worker@4.6.0
    inputs:
      wrangler_config: web/wrangler.toml
      build_command: npm run build
      output_dir: web/dist
      needs_npm_install: true
      npm_dir: web
      web_analytics_token: $WEB_ANALYTICS_TOKEN_TUTTI
      production_url: https://tutti.dunn.dev

# Job-set parity for the workflow guard above: go-lint (lint) and
# go-audit (audit) ship with NO rules of their own, so they fall back
# to the classic implicit `only: [branches, tags]` default -- which
# does NOT include merge_request_event. That made them push-pipeline
# only; with push suppressed on a branch with an open MR, they'd never
# run at all. Minimal consumer-side override: restate only `rules`,
# every other key (image, script, allow_failure, ...) still comes from
# the catalog component.
lint:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_PIPELINE_SOURCE == "push"'
    - if: '$CI_COMMIT_TAG'

audit:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_PIPELINE_SOURCE == "push"'
    - if: '$CI_COMMIT_TAG'

# Matrix overrides on the catalog jobs. Catalog default is
# linux/amd64 + linux/arm64 + darwin/arm64; we add windows/amd64.
# Catalog 2.1.1 handles the .exe extension for windows targets in
# both go-build and go-release-binary, including the cosign sign
# step.

go-build:
  parallel:
    matrix:
      - GOOS: linux
        GOARCH: amd64
      - GOOS: linux
        GOARCH: arm64
      - GOOS: darwin
        GOARCH: arm64
      - GOOS: windows
        GOARCH: amd64

package:
  parallel:
    matrix:
      - GOOS: linux
        GOARCH: amd64
      - GOOS: linux
        GOARCH: arm64
      - GOOS: darwin
        GOARCH: arm64
      - GOOS: windows
        GOARCH: amd64

# Schema-sync guard. The canonical schema/manifest.v1.json is
# mirrored into internal/schema/ for go:embed; `make sync-schema`
# does the copy locally. CI catches the case where a contributor
# edits one and forgets to mirror.
schema-sync:
  stage: lint
  image: registry.gitlab.com/dunn.dev/pipeline/ci-go:4.6.0@sha256:c37e0eaa5f838105cd9a30f82ec2e798dd36bfde720b9e8a0b42a996ebfd438a
  script:
    - |
      if ! cmp -s schema/manifest.v1.json internal/schema/manifest.v1.json; then
        echo "schema/manifest.v1.json differs from internal/schema/manifest.v1.json"
        echo "Suggested next step: run 'make sync-schema' and commit the result."
        exit 1
      fi
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - when: on_success

# Test: vet + race-detector test suite. Not in the catalog yet
# (catalog ships build/lint/audit/release; tutti adds tests as the
# first Go consumer that has a meaningful test surface). Inline
# until a go-test catalog component lands.
test:
  stage: test
  image: registry.gitlab.com/dunn.dev/pipeline/ci-go:4.6.0@sha256:c37e0eaa5f838105cd9a30f82ec2e798dd36bfde720b9e8a0b42a996ebfd438a
  variables:
    CGO_ENABLED: "1"
    GOMODCACHE: $CI_PROJECT_DIR/.gomodcache
    GOCACHE: $CI_PROJECT_DIR/.gocache
  cache:
    key:
      files: [go.sum]
      prefix: test
    paths:
      - .gomodcache/
      - .gocache/
  script:
    - go vet ./...
    - go test -race ./...
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - when: on_success