---

steps:

  test:
    image: python:3.11-bookworm
    group: test
    commands:
      - pip3 install -e .[test]
      - python3 -m coverage run --rcfile=setup.cfg -m unittest discover easywks

  codestyle:
    image: python:3.11-bookworm
    group: test
    commands:
      - pip3 install -e .[test]
      - pycodestyle easywks

  easywksserver_gpgwksclient:
    image: python:3.11-bookworm
    group: integration
    commands:
      - echo "openpgpkey" > /etc/hostname
      - echo "127.0.0.1 openpgpkey.example.org openpgpkey example.org" > /etc/hosts
      - pip3 install -e .[test]
      - apt update; apt install --yes gnupg2 socat ca-certificates
      - openssl req -x509 -newkey rsa:4096 -keyout /etc/ssl/key.pem -out /etc/ssl/cert.pem -sha256 -days 365 -nodes -subj '/CN=openpgpkey.example.org'
      - cp /etc/ssl/cert.pem /usr/local/share/ca-certificates/local.crt
      - update-ca-certificates
      - mkdir -p /tmp/easywks
      - |
        cat > /tmp/easywks.yml <<EOF
        directory: /tmp/easywks
        httpd:
          host: 127.0.0.1
          port: 8080
        mailing_method: stdout
        domains:
          example.org:
            submission_address: webkey@example.org
            policy_flags:
              me.s3lph.easywks_permit-unsigned-response: true  # required for gpg-wks-client compat
        EOF
      - easywks --config /tmp/easywks.yml init
      - easywks --config /tmp/easywks.yml webserver &
      - socat OPENSSL-LISTEN:443,fork,reuseaddr,verify=0,cert=/etc/ssl/cert.pem,key=/etc/ssl/key.pem TCP:127.0.0.1:8080 &
      - sleep 3
      - install -m 0700 -d /tmp/gpg /tmp/cleangpg
      - export GNUPGHOME=/tmp/gpg
      - test/genkey.sh alice@example.org
      - >-
        export FINGERPRINT="$(gpg --with-colons --fingerprint alice@example.org | grep -A1 ^pub | grep ^fpr | cut -d: -f10)"
      - /usr/lib/gnupg/gpg-wks-client --supported alice@example.org
      - /usr/lib/gnupg/gpg-wks-client --check webkey@example.org
      - PUBREQ="$(/usr/lib/gnupg/gpg-wks-client --create "$${FINGERPRINT}" alice@example.org)"
      - CONFREQ="$(echo "$${PUBREQ}" | easywks --config /tmp/easywks.yml process)"
      - CONFRESP="$(echo "$${CONFREQ}" | /usr/lib/gnupg/gpg-wks-client --receive --verbose)"
      - PUBRESP="$(echo "$${CONFRESP}" | easywks --config /tmp/easywks.yml process)"
      - echo "$${PUBRESP}" | gpg --batch --decrypt
      - /usr/lib/gnupg/gpg-wks-client --check alice@example.org
      - export GNUPGHOME=/tmp/gpg
      - gpg --auto-key-locate=clear,wkd,nodefault --locate-keys alice@example.org
      - kill %2 || true
      - kill %1 || true

  coverage:
    image: python:3.11-bookworm
    group: integration
    commands:
      - pip3 install -e .[test]
      - python3 -m coverage combine
      - python3 -m coverage report --rcfile=setup.cfg

  build_wheel:
    image: python:3.11-bookworm
    group: package
    when:
      - event: tag
    secrets:
      - GITEA_API_REPOSITORY_PYPI
      - GITEA_API_USERNAME
      - GITEA_API_PASSWORD
    commands:
      - pip3 install -e .[test]
      - python3 setup.py egg_info bdist_wheel
      - |
        cat > ~/.pypirc <<EOF
        [distutils]
        index-servers = gitea

        [gitea]
        repository = $${GITEA_API_REPOSITORY_PYPI}
        username = $${GITEA_API_USERNAME}
        password = $${GITEA_API_PASSWORD}
        EOF
      - python3 -m twine upload --repository gitea dist/*.whl

  build_debian:
    image: python:3.11-bookworm
    group: package
    when:
      - event: tag
    secrets:
      - GITEA_API_REPOSITORY_DEB
      - GITEA_API_USERNAME
      - GITEA_API_PASSWORD
    commands:
      - apt update; apt install -y lintian rsync sudo curl
      - export EASYWKS_VERSION=$(python -c 'import easywks; print(easywks.__version__)')
      - |
        (for version in "$(cat CHANGELOG.md | grep '<!-- BEGIN CHANGES' | cut -d ' ' -f 4)"; do
          echo "easywks ($${version}-1) stable; urgency=medium\n"
          cat CHANGELOG.md | grep -A 1000 "<"'!'"-- BEGIN CHANGES $${version} -->" | grep -B 1000 "<"'!'"-- END CHANGES $${version} -->" | tail -n +2 | head -n -1 | sed -re 's/^-/  */g'
          echo "\n -- s3lph@kabelsalat.ch  $(date -R)\n"
        done) > package/debian/easywks/usr/share/doc/easywks/changelog
      - gzip -9n package/debian/easywks/usr/share/doc/easywks/changelog
      - python3 setup.py egg_info install --root=package/debian/easywks/ --prefix=/usr --optimize=1
      - cd package/debian
      - sed -re "s/__EASYWKS_VERSION__/$${EASYWKS_VERSION}/g" -i easywks/DEBIAN/control
      - mkdir -p easywks/usr/lib/python3/dist-packages/
      - rsync -a easywks/usr/lib/python3.11/site-packages/ easywks/usr/lib/python3/dist-packages/
      - rm -rf easywks/usr/lib/python3.11/site-packages
      - find easywks/usr/lib/python3/dist-packages -name __pycache__ -exec rm -r {} \; 2>/dev/null || true
      - find easywks/usr/lib/python3/dist-packages -name '*.pyc' -exec rm {} \;
      - find easywks/usr/lib/python3/dist-packages -name '*.pyo' -exec rm {} \;
      - sed -re 's$#!/usr/local/bin/python3$#!/usr/bin/python3$' -i easywks/usr/bin/easywks
      - find easywks -type f -exec chmod 0644 {} \;
      - find easywks -type d -exec chmod 755 {} \;
      - chmod +x easywks/usr/bin/easywks easywks/DEBIAN/postinst easywks/DEBIAN/prerm easywks/DEBIAN/postrm
      - dpkg-deb --build easywks
      - mv easywks.deb "easywks_$${EASYWKS_VERSION}-1_all.deb"
      - sudo -u nobody lintian "easywks_$${EASYWKS_VERSION}-1_all.deb" || true
      - >-
        curl
        --user "$${GITEA_API_USERNAME}:$${GITEA_API_PASSWORD}"
        --upload-file "easywks_$${EXPORTER_VERSION}-1_all.deb"
        $${GITEA_API_REPOSITORY_DEB}