.gitlab-ci.yml

# .gitlab-ci.yml
#
# ink
#
# pipelines can be triggered manually in the web

default:
  retry:
    max: 2
    when:
      - runner_system_failure
      - unknown_failure
      - api_failure

stages:
  - lint
  - check
  - workspace
  - examples
  - ink-waterfall
  - fuzz
  - publish

variables:
  GIT_STRATEGY:                    fetch
  GIT_DEPTH:                       100
  CARGO_INCREMENTAL:               0
  CARGO_TARGET_DIR:                "/ci-cache/${CI_PROJECT_NAME}/targets/${CI_COMMIT_REF_NAME}/${CI_JOB_NAME}"
  CI_IMAGE:                        "paritytech/ink-ci-linux:production"
  PURELY_STD_CRATES:               "lang/codegen metadata engine"
  ALSO_WASM_CRATES:                "env storage storage/derive allocator prelude primitives lang lang/macro lang/ir"
  # this var is changed to "-:staging" when the CI image gets rebuilt
  # read more https://github.com/paritytech/scripts/pull/244
  ALL_CRATES:                      "${PURELY_STD_CRATES} ${ALSO_WASM_CRATES}"
  DELEGATOR_SUBCONTRACTS:          "accumulator adder subber"
  VAULT_SERVER_URL:                "https://vault.parity-mgmt-vault.parity.io"
  VAULT_AUTH_PATH:                 "gitlab-parity-io-jwt"
  VAULT_AUTH_ROLE:                 "cicd_gitlab_parity_${CI_PROJECT_NAME}"

workflow:
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH

.collect-artifacts:                &collect-artifacts
  artifacts:
    name:                          "${CI_JOB_NAME}_${CI_COMMIT_REF_NAME}"
    when:                          on_success
    expire_in:                     7 days
    paths:
      - artifacts/

.rust-info-script:                 &rust-info-script
  - rustup show
  - cargo --version
  - rustup +nightly show
  - cargo +nightly --version
  - cargo spellcheck --version
  - bash --version
  - sccache -s

.test-refs:                        &test-refs
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
    - if: $CI_PIPELINE_SOURCE == "schedule"
    - if: $CI_COMMIT_REF_NAME == "master"
    - if: $CI_COMMIT_REF_NAME == "tags"
    - if: $CI_COMMIT_REF_NAME =~ /^[0-9]+$/                         # PRs
    - if: $CI_COMMIT_REF_NAME =~ /^v[0-9]+\.[0-9]+.*$/              # i.e. v1.0, v2.1rc1

.docker-env:                       &docker-env
  image:                           "${CI_IMAGE}"
  before_script:
    - *rust-info-script
    - ./scripts/.ci/pre_cache.sh
    - sccache -s
  interruptible:                   true
  tags:
    - linux-docker

.kubernetes-env:                   &kubernetes-env
  interruptible:                   true
  tags:
    - kubernetes-parity-build

#### Vault secrets
.vault-secrets:                    &vault-secrets
  secrets:
    CODECOV_P_TOKEN:
      vault:                       cicd/gitlab/$CI_PROJECT_PATH/CODECOV_P_TOKEN@kv
      file:                        false
    CODECOV_TOKEN:
      vault:                       cicd/gitlab/$CI_PROJECT_PATH/CODECOV_TOKEN@kv
      file:                        false
    GITHUB_EMAIL:
      vault:                       cicd/gitlab/$CI_PROJECT_PATH/GITHUB_EMAIL@kv
      file:                        false
    GITHUB_USER:
      vault:                       cicd/gitlab/$CI_PROJECT_PATH/GITHUB_USER@kv
      file:                        false
    GITHUB_TOKEN:
      vault:                       cicd/gitlab/$CI_PROJECT_PATH/GITHUB_TOKEN@kv
      file:                        false
    PIPELINE_TOKEN:
      vault:                       cicd/gitlab/$CI_PROJECT_PATH/PIPELINE_TOKEN@kv
      file:                        false
    GITHUB_SSH_PRIV_KEY:
      vault:                       cicd/gitlab/$CI_PROJECT_PATH/GITHUB_SSH_PRIV_KEY@kv
      file:                        false

#### stage:                        lint
#
# Note: For all of these lints we `allow_failure` so that the rest of the build can
# continue running despite them not passing. Merging is still disallowed since (most) of
# the lint steps are marked as "Required" in GitHub.
spellcheck:
  stage:                           lint
  <<:                              *docker-env
  <<:                              *test-refs
  script:
    - cargo spellcheck check -vvvv --cfg=.config/cargo_spellcheck.toml --checkers hunspell --code 1 -- recursive .
    - cargo spellcheck check -vvvv --cfg=.config/cargo_spellcheck.toml --checkers hunspell --code 1 -- recursive examples/
  allow_failure:                   true

fmt:
  stage:                           lint
  <<:                              *docker-env
  <<:                              *test-refs
  script:
    - cargo fmt --verbose --all -- --check
    # For the UI tests we need to disable the license check
    - cargo fmt --verbose --all -- --check --config=license_template_path="" crates/lang/tests/ui/contract/{pass,fail}/*.rs
    - cargo fmt --verbose --all -- --check --config=license_template_path="" crates/lang/tests/ui/trait_def/{pass,fail}/*.rs
  allow_failure:                   true

examples-fmt:
  stage:                           lint
  <<:                              *docker-env
  <<:                              *test-refs
  script:
    # Note that we disable the license header check for the examples, since they are unlicensed.
    - for example in examples/*/; do
        cargo fmt --verbose --manifest-path ${example}/Cargo.toml -- --check --config=license_template_path="";
      done
    - for contract in ${DELEGATOR_SUBCONTRACTS}; do
        cargo fmt --verbose --manifest-path examples/delegator/${contract}/Cargo.toml -- --check --config=license_template_path="";
      done
  allow_failure:                   true

clippy-std:
  stage:                           lint
  <<:                              *docker-env
  <<:                              *test-refs
  script:
    - for crate in ${ALL_CRATES}; do
        cargo clippy --verbose --all-targets --all-features --manifest-path crates/${crate}/Cargo.toml -- -D warnings;
      done

clippy-wasm:
  stage:                           lint
  <<:                              *docker-env
  <<:                              *test-refs
  script:
    - for crate in ${ALSO_WASM_CRATES}; do
        cargo clippy --verbose --no-default-features --manifest-path crates/${crate}/Cargo.toml --target wasm32-unknown-unknown -- -D warnings;
      done
  allow_failure:                   true

examples-clippy-std:
  stage:                           lint
  <<:                              *docker-env
  <<:                              *test-refs
  script:
    - for example in examples/*/; do
        cargo clippy --verbose --all-targets --manifest-path ${example}/Cargo.toml -- -D warnings;
      done
    - for contract in ${DELEGATOR_SUBCONTRACTS}; do
        cargo clippy --verbose --all-targets --manifest-path examples/delegator/${contract}/Cargo.toml -- -D warnings;
      done
  allow_failure:                   true

examples-clippy-wasm:
  stage:                           lint
  <<:                              *docker-env
  <<:                              *test-refs
  script:
    - for example in examples/*/; do
        cargo clippy --verbose --manifest-path ${example}/Cargo.toml --no-default-features --target wasm32-unknown-unknown -- -D warnings;
      done
    - for contract in ${DELEGATOR_SUBCONTRACTS}; do
        cargo clippy --verbose --manifest-path examples/delegator/${contract}/Cargo.toml --no-default-features --target wasm32-unknown-unknown -- -D warnings;
      done
  allow_failure:                   true


#### stage:                        check

check-std:
  stage:                           check
  <<:                              *docker-env
  <<:                              *test-refs
  script:
    - for crate in ${ALL_CRATES}; do
        cargo check --verbose --all-features --manifest-path crates/${crate}/Cargo.toml;
      done

check-wasm:
  stage:                           check
  <<:                              *docker-env
  <<:                              *test-refs
  script:
    - for crate in ${ALSO_WASM_CRATES}; do
        cargo check --verbose --no-default-features --target wasm32-unknown-unknown --manifest-path crates/${crate}/Cargo.toml;
      done


#### stage:                        workspace

build-std:
  stage:                           workspace
  <<:                              *docker-env
  <<:                              *test-refs
  needs:
    - job:                         check-std
      artifacts:                   false
  script:
    - for crate in ${ALL_CRATES}; do
        cargo build --verbose --all-features --release --manifest-path crates/${crate}/Cargo.toml;
      done

build-wasm:
  stage:                           workspace
  <<:                              *docker-env
  <<:                              *test-refs
  needs:
    - job:                         check-wasm
      artifacts:                   false
  script:
    - for crate in ${ALSO_WASM_CRATES}; do
        cargo build --verbose --no-default-features --release --target wasm32-unknown-unknown --manifest-path crates/${crate}/Cargo.toml;
      done

test:
  stage:                           workspace
  <<:                              *docker-env
  <<:                              *test-refs
  needs:
    - job:                         check-std
      artifacts:                   false
  variables:
      # Since we run the tests with `--all-features` this implies the feature
      # `ink-fuzz-tests` as well -- i.e. the fuzz tests are run.
      # There's no way to disable a single feature while enabling all features
      # at the same time, hence we use this workaround.
      QUICKCHECK_TESTS:            0
  script:
    - cargo test --verbose --all-features --no-fail-fast --workspace
    - cargo test --verbose --all-features --no-fail-fast --workspace --doc

      # Just needed as long as we have the `ink-experimental-engine` feature.
      # We do not invoke `--all-features` here -- this would imply the feature
      # `ink-experimental-engine`. So in order to still run the tests without the
      # experimental engine feature we need this command.
    - cargo test --verbose --features std --no-fail-fast --workspace

docs:
  stage:                           workspace
  <<:                              *docker-env
  <<:                              *test-refs
  variables:
    RUSTDOCFLAGS: -Dwarnings
  artifacts:
    name: "${CI_JOB_NAME}_${CI_COMMIT_REF_NAME}-doc"
    when: on_success
    expire_in: 7 days
    paths:
      - ./crate-docs/
  script:
    - cargo doc --no-deps --all-features
        -p scale-info -p ink_metadata
        -p ink_env -p ink_storage -p ink_storage_derive
        -p ink_primitives -p ink_prelude
        -p ink_lang -p ink_lang_macro -p ink_lang_ir -p ink_lang_codegen
    - mv ${CARGO_TARGET_DIR}/doc ./crate-docs
    # FIXME: remove me after CI image gets nonroot
    - chown -R nonroot:nonroot ./crate-docs


codecov:
  stage:                           workspace
  <<:                              *docker-env
  <<:                              *test-refs
  <<:                              *vault-secrets
  needs:
    - job:                         check-std
      artifacts:                   false
  variables:
    # For codecov it's sufficient to run the fuzz tests only once.
    QUICKCHECK_TESTS:              1
    INK_COVERAGE_REPORTING:        "true"
    CARGO_INCREMENTAL:             0
    # Variables partly came from https://github.com/mozilla/grcov/blob/master/README.md
    RUSTFLAGS:                     "-Zprofile -Zmir-opt-level=0 -Ccodegen-units=1
                                    -Clink-dead-code -Copt-level=0 -Coverflow-checks=off"
    # The `cargo-taurpalin` coverage reporting tool seems to have better code instrumentation and thus
    # produces better results for Rust codebases in general. However, unlike `grcov` it requires
    # running docker with `--security-opt seccomp=unconfined` which is why we use `grcov` instead.
  before_script:
    - *rust-info-script
    # RUSTFLAGS are the cause target cache can't be used here
    # FIXME: cust-covfix doesn't support the external target dir
    # https://github.com/Kogia-sima/rust-covfix/issues/7
    - unset "CARGO_TARGET_DIR"
    - cargo clean
    # make sure there's no stale coverage artifacts
    - find . -name "*.profraw" -type f -delete
    - find . -name "*.gcda" -type f -delete
  script:
    # RUSTFLAGS are the cause target cache can't be used here
    - cargo build --verbose --all-features --workspace
    - cargo test --verbose --all-features --no-fail-fast --workspace
    # Just needed as long as we have the `ink-experimental-engine` feature.
    # We must additionally run the coverage without `--all-features` here -- this
    # would imply the feature `ink-experimental-engine`. So in order to still run
    # the tests without the experimental engine feature we need this command.
    - cargo test --verbose --features std --no-fail-fast --workspace
    # coverage with branches
    - grcov . --binary-path ./target/debug/ --source-dir . --output-type lcov --llvm --branch
        --ignore-not-existing --ignore "/*" --ignore "tests/*" --output-path lcov-w-branch.info
    - rust-covfix lcov-w-branch.info --output lcov-w-branch-fixed.info
    - codecov --token "$CODECOV_P_TOKEN" --file lcov-w-branch-fixed.info --nonZero
    # lines coverage
    - grcov . --binary-path ./target/debug/ --source-dir . --output-type lcov --llvm
        --ignore-not-existing --ignore "/*" --ignore "tests/*" --output-path lcov-lines.info
    - rust-covfix lcov-lines.info --output lcov-lines-fixed.info
    - codecov --token "$CODECOV_TOKEN" --file lcov-lines-fixed.info --nonZero


#### stage:                        examples

examples-test:
  stage:                           examples
  <<:                              *docker-env
  <<:                              *test-refs
  needs:
    - job:                         clippy-std
      artifacts:                   false
  script:
    - for example in examples/*/; do
        cargo test --verbose --manifest-path ${example}/Cargo.toml;
      done
    - for contract in ${DELEGATOR_SUBCONTRACTS}; do
        cargo test --verbose --manifest-path examples/delegator/${contract}/Cargo.toml;
      done

examples-test-experimental-engine:
  stage:                           examples
  <<:                              *docker-env
  <<:                              *test-refs
  needs:
    - job:                         clippy-std
      artifacts:                   false
  script:
    # We test only the examples for which the tests have already been migrated to
    # use the experimental engine.
    - cargo test --no-default-features --features std, ink-experimental-engine --verbose --manifest-path examples/erc20/Cargo.toml
    - cargo test --no-default-features --features std, ink-experimental-engine --verbose --manifest-path examples/erc1155/Cargo.toml
    - cargo test --no-default-features --features std, ink-experimental-engine --verbose --manifest-path examples/contract-terminate/Cargo.toml
    - cargo test --no-default-features --features std, ink-experimental-engine --verbose --manifest-path examples/contract-transfer/Cargo.toml


examples-contract-build:
  stage:                           examples
  <<:                              *docker-env
  <<:                              *test-refs
  script:
    - cargo contract -V
    - for example in examples/*/; do
        pushd $example &&
        cargo contract build &&
        popd;
      done
    - cd examples/delegator/ && ./build-all.sh

examples-docs:
  stage:                           examples
  <<:                              *docker-env
  <<:                              *test-refs
  variables:
    RUSTDOCFLAGS: -Dwarnings
  script:
    # `--document-private-items` needs to be in here because currently our contract macro
    # puts the contract functions in a private module.
    # Once https://github.com/paritytech/ink/issues/336 has been implemented we can get rid
    # of this flag.
    - for example in examples/*/; do
        cargo doc --manifest-path ${example}/Cargo.toml --document-private-items --verbose --no-deps;
      done
    - for contract in ${DELEGATOR_SUBCONTRACTS}; do
        cargo doc --manifest-path examples/delegator/${contract}/Cargo.toml --document-private-items --verbose --no-deps;
      done


#### stage:                        ink-waterfall

ink-waterfall:
  stage:                           ink-waterfall
  image:                           paritytech/tools:latest
  <<:                              *kubernetes-env
  <<:                              *test-refs
  <<:                              *vault-secrets
  variables:
    TRGR_PROJECT:                  ${CI_PROJECT_NAME}
    TRGR_REF:                      ${CI_COMMIT_REF_NAME}
    # The `ink-waterfall` project id in GitLab
    DWNSTRM_ID:                    409
  script:
    - ./scripts/.ci/trigger_pipeline.sh
  allow_failure:                   true


#### stage:                        publish

publish-docs:
  stage:                           publish
  <<:                              *kubernetes-env
  image:                           paritytech/tools:latest
  <<:                              *vault-secrets
  needs:
    - job:                         docs
      artifacts:                   true
  variables:
    GIT_DEPTH:                     100
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
    - if: $CI_PIPELINE_SOURCE == "schedule"
    - if: $CI_COMMIT_REF_NAME == "master"
    - if: $CI_COMMIT_REF_NAME == "tags"
  before_script:
    - unset CARGO_TARGET_DIR
  script:
    # Setup ssh
    - eval $(ssh-agent)
    - ssh-add - <<< ${GITHUB_SSH_PRIV_KEY}
    - mkdir ~/.ssh && touch ~/.ssh/known_hosts
    - ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
    # Set git config
    - git config user.email "devops-team@parity.io"
    - git config user.name "${GITHUB_USER}"
    - git config remote.origin.url "git@github.com:/paritytech/${CI_PROJECT_NAME}.git"
    - git config remote.origin.fetch "+refs/heads/*:refs/remotes/origin/*"
    - git fetch origin gh-pages
    # saving README and docs
    - cp -r ./crate-docs/ /tmp/doc/
    - cp README.md /tmp/doc/
    - cp -r .images/ /tmp/doc/
    - git checkout gh-pages
    - mv _config.yml /tmp/doc/
    # remove everything and restore generated docs, README and Jekyll config
    - rm -rf ./*
    - rm -rf ./.images
    - mv /tmp/doc/* .
    - mv /tmp/doc/.images .
    # Upload files
    - git add --all --force
    - git status
    # `git commit` has an exit code of > 0 if there is nothing to commit.
    # This unfortunately causes GitLab to exit immediately and mark this
    # job as failed subsequently.
    # We don't want to mark the entire job as failed if there's nothing to
    # publish though, hence the `|| true`.
    - git commit -m "Updated docs for ${CI_COMMIT_REF_NAME} and pushed to gh-pages" || true
    - git push origin gh-pages --force
  after_script:
    - rm -rf .git/ ./*

#### stage:                        fuzz

fuzz-tests:
  stage:                           fuzz
  <<:                              *docker-env
  <<:                              *vault-secrets
  variables:
    # The QUICKCHECK_TESTS default is 100
    QUICKCHECK_TESTS:              5000
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
    - if: $CI_COMMIT_REF_NAME == "master"
  script:
    # We fuzz-test only crates which possess the `ink-fuzz-tests` feature
    - all_tests_passed=0
    - for crate in ${ALL_CRATES}; do
        if grep "ink-fuzz-tests =" crates/${crate}/Cargo.toml;
        then
          cargo test --verbose --features ink-fuzz-tests --manifest-path crates/${crate}/Cargo.toml --no-fail-fast -- fuzz_ || exit_code=$?;
          all_tests_passed=$(( all_tests_passed | exit_code ));
        fi
      done
    - if [ $all_tests_passed -eq 0 ]; then exit 0; fi
    - |
      curl -X "POST" "https://api.github.com/repos/paritytech/ink/issues" \
        -H "Cookie: logged_in=no" \
        -H "Authorization: token ${GITHUB_TOKEN}" \
        -H "Content-Type: application/json; charset=utf-8" \
        -d $'{
            "title": "[ci] Failing fuzz tests on master ('"$( date +"%d %b %Y" )"')",
            "body": "The CI job ['"${CI_JOB_ID}"']('"${CI_JOB_URL}"') just failed.\n\nThe offending commit is ['"${CI_COMMIT_TITLE}"'](https://github.com/paritytech/ink/commit/'"${CI_COMMIT_SHA}"').",
            "assignees": [],
            "labels": [
                "P-high"
            ]
        }'
    - exit ${all_tests_passed}