specter-desktop/.gitlab-ci.yml

# this image contains python, bitcoind and docker
# check docker/python-bitcoind on how it's built
image: registry.gitlab.com/cryptoadvance/specter-desktop/python-bitcoind:v22.0

variables:
  # Cache documentation: https://docs.gitlab.com/ee/ci/caching/
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"

cache:
  # enable per-job and per-branch caching
  - key:
      files:
        - ./requirements.txt
      prefix: "$CI_JOB_NAME"
    paths:
      - .cache/pip
      - .env

stages:
  - testing
  - releasing
  - post_releasing

before_script:
  - docker info || echo "no docker-command found" # Print out docker version for debugging
  - echo CI_PROJECT_NAMESPACE = $CI_PROJECT_NAMESPACE
  - echo CI_PROJECT_ROOT_NAMESPACE = $CI_PROJECT_ROOT_NAMESPACE
  - python -V # Print out python version for debugging
  - apt update
  - apt install -y libusb-1.0-0-dev libudev-dev # usb-support in hidapi
  # https://github.com/python-babel/babel/issues/990#issuecomment-1760326334
  - rm -f /etc/localtime
  - ln -s /usr/share/zoneinfo/Etc/UTC /etc/localtime
  # This doesn't get cached in gitlab but we don't need it anyway for now:
  #  - ./tests/install_noded.sh --debug --elements compile
  - pip3 install --upgrade virtualenv
  - virtualenv --python=python3 .env
  - source .env/bin/activate

check:
  stage: testing
  # We simply check here whether all the tests on github are completed and green
  script:
    - ./utils/release.sh wait_on_master || exit 1 # that command will have a non-0 exit-value if not everything is green

# jobs with a preceding . like .test are hidden jobs and are not executed. I leave them in here as
# we might want to reactivate them in the case that github explodes or something.
# So effectively, gitlab is currently only used for releasing.

.test:
  stage: testing
  # We assume here that people who want to get code into the master-branch are
  # relying on PRs and people who are working on gitlab-forks are working
  # on CI which probably want fast feedback on the releasing-jobs
  # and therefore skip the test-job
  # tem deactivated as it did not work as expected
  #only:
  #   - $CI_PROJECT_ROOT_NAMESPACE =~ "cryptoadvance"
  script:
    - pip3 install -r requirements.txt
    - pip3 install -e .
    - pip3 install -e ".[test]"
    - python3 setup.py install # compiles babel stuff as well (might make pip install obsolete)
    - py.test --cov-report term --cov cryptoadvance

.test-cypress:
  image: registry.gitlab.com/cryptoadvance/specter-desktop/cypress-python-jammy:v9.7.0
  stage: testing
  script:
    # start the server in the background
    - pip3 install -e .
    - pip3 install -e ".[test]"
    - python3 setup.py install # compiles babel stuff as well (might make pip install obsolete)
    - npm i
    - ./utils/test-cypress.sh --docker --debug run
    - docker ps || echo "probably no docker available anyway"
  artifacts:
    when: always
    paths:
      - cypress/videos/**/*.mp4
      - cypress/screenshots/**/*.png
    expire_in: 1 day

release_pip:
  stage: releasing
  only:
    - tags
  script:
    - pip3 install -e .
    - pip3 install -e ".[test]"
    - pip3 install .
    - pip3 install build==0.10.0 twine
    - python3 -m build
    - ls -l dist
    # twine reads the password from the env-var TWINE_PASSWORD
    # Either testing it or doing the real thing depending on which gitlab-project we're running:
    - if ! [[ ${CI_PROJECT_ROOT_NAMESPACE} = "cryptoadvance" ]]; then  python3 -m twine upload --verbose --user __token__ dist/* --repository-url https://test.pypi.org/legacy/ ; fi
    - if [[ ${CI_PROJECT_ROOT_NAMESPACE} = "cryptoadvance" ]]; then  python3 -m twine upload --verbose --user __token__ dist/* ; fi
    - cd dist
    - sha256sum cryptoadvance.specter-*.tar.gz > SHA256SUMS-pip
    - ../utils/artifact_signer.sh sign --artifact ./SHA256SUMS-pip
    - cd ..
    - cat ./dist/SHA256SUMS-pip
    #- python ./utils/github.py upload ./dist/SHA256SUMS-pip
    #- python ./utils/github.py upload ./dist/SHA256SUMS-pip.asc
    - python ./utils/github.py upload ./dist/cryptoadvance.specter-*.tar.gz
  artifacts:
    when: always
    paths:
      - dist/*
    expire_in: 1 day

release_binary_windows:
  stage: releasing
  only:
    - tags
  variables:
    GIT_DEPTH: 0 # Disable shallow clone to get all Git history
  tags:
    - windows
  before_script:
    - whoami
    - python -V
    - pip3 --version
    - pip install virtualenv
    - virtualenv --python=python3 .env
    - .\.env\Scripts\activate
    - pip3 install -e ".[test]"

  script:
    # This script won't execute if the script before that fails
    # No need to check the version-scheme again

    - echo "Releasing for ${CI_PROJECT_ROOT_NAMESPACE}"
    - .\pyinstaller\build-win-ci.bat $CI_COMMIT_TAG
    - python ./utils/github.py upload ./pyinstaller/release/specterd-$CI_COMMIT_TAG-win64.zip
    - cd ./pyinstaller/release
    - python ..\..\utils\release_helper.py sha256sums specterd-$CI_COMMIT_TAG-win64.zip > SHA256SUMS-windows
    - type SHA256SUMS-windows
    - echo $GPG_PASSPHRASE | c:\Program` Files` `(x86`)\GnuPg\bin\gpg --detach-sign --armor --no-tty --batch --yes --passphrase-fd 0  --pinentry-mode loopback SHA256SUMS-windows
  artifacts:
    when: always
    paths:
      - pyinstaller/release/*
    expire_in: 1 day
  cache:
    key:
      files:
        - ./pyinstaller/electron/package-lock.json
      prefix: $CI_JOB_NAME
    paths:
      - ./pyinstaller/electron/node_modules

release_electron_linux_windows:
  image: registry.gitlab.com/cryptoadvance/specter-desktop/electron-builder:latest
  stage: releasing
  only:
    - tags
  needs:
    - release_binary_windows
  before_script:
    - python3 -V # Print out python version for debugging
    - apt update
    - apt install -y unzip libusb-1.0-0-dev libudev-dev # usb-support in hidapi
    - pip3 install virtualenv
    # Only difference to default befor_script: (ToDo fix this)
    - python3 -m virtualenv --python=python3 .env
    - source .env/bin/activate
    # https://github.com/python-babel/babel/issues/990#issuecomment-1760326334
    - rm -f /etc/localtime
    - ln -s /usr/share/zoneinfo/Etc/UTC /etc/localtime
    - pip3 install -e ".[test]" # TZ=UTC because https://github.com/nektos/act/issues/1853
  script:
    - echo "Releasing for ${CI_PROJECT_ROOT_NAMESPACE}"
    - export CI_PROJECT_ROOT_NAMESPACE # needed in the build-script to download the right windows-binary
    - ./utils/build-unix.sh --version $CI_COMMIT_TAG make-hash specterd electron-linux electron-win
    - ls -l release
    - cd release
    - sha256sum specterd-${CI_COMMIT_TAG}-x86_64-linux-gnu.zip specter_desktop-${CI_COMMIT_TAG}-x86_64-linux-gnu.tar.gz > ./SHA256SUMS-linux
    - cat ./SHA256SUMS-linux
    - sha256sum  Specter-Setup-${CI_COMMIT_TAG}.exe > ./SHA256SUMS-win
    - cat ./SHA256SUMS-win
    - cd ..
    - ./utils/artifact_signer.sh sign --artifact ./release/SHA256SUMS-win
    - ./utils/artifact_signer.sh sign --artifact ./release/SHA256SUMS-linux
    - python3 ./utils/github.py upload ./release/Specter-Setup-${CI_COMMIT_TAG}.exe
    - python3 ./utils/github.py upload ./release/specterd-${CI_COMMIT_TAG}-x86_64-linux-gnu.zip
    - python3 ./utils/github.py upload ./release/specter_desktop-${CI_COMMIT_TAG}-x86_64-linux-gnu.tar.gz
    #- python3 ../utils/github.py upload ./release/SHA256SUMS-linux
    #- python3 ../utils/github.py upload ./release/SHA256SUMS-linux.asc
    #- python3 ../utils/github.py upload ./release/SHA256SUMS-win
    #- python3 ../utils/github.py upload ./release/SHA256SUMS-win.asc
  cache:
    key:
      files:
        - ./pyinstaller/electron/package-lock.json
      prefix: $CI_JOB_NAME
    paths:
      - ./pyinstaller/electron/node_modules

  artifacts:
    when: always
    paths:
      - release/Specter-Setup-${CI_COMMIT_TAG}.exe
      - release/specterd-${CI_COMMIT_TAG}-x86_64-linux-gnu.zip
      - release/specter_desktop-${CI_COMMIT_TAG}-x86_64-linux-gnu.tar.gz
      - release/SHA256SUMS-linux
      - release/SHA256SUMS-linux.asc
      - release/SHA256SUMS-win
      - release/SHA256SUMS-win.asc
    expire_in: 1 day

release_signatures:
  stage: post_releasing
  only:
    - tags
  before_script:
    - python -V # Print out python version for debugging
    - pip3 install --upgrade virtualenv
    - virtualenv --python=python3 .env
    - source .env/bin/activate
    - pip3 install -e ".[test]"
    - ./utils/artifact_signer.sh init # prepare .gnupg
  script:
    - python3 -m utils.release_helper download # downloads the job-artifacts from gitlab
    - python3 -m utils.release_helper downloadgithub # downloads additional artifacts from github (if not there and is they have SHA256SUMS-something)
    - python3 -m utils.release_helper checksigs # checks the signatures of all SHA256SUMM*.asc files
    - python3 -m utils.release_helper checkhashes # checks all SHA256SUM* files (might modify files on the fly due to windows line endings)
    - python3 -m utils.release_helper create # creates a SHA256SUM
    - ./utils/artifact_signer.sh sign --artifact ./signing_dir/SHA256SUMS # Signs the SHA256SUM
    - python3 -m utils.release_helper upload_shasums # uploads SHA256SUMS to github
    - python3 -m utils.release_helper upload_shasumssig # uploads SHA256SUMS.asc to github

release_docker:
  stage: post_releasing
  only:
    - tags
  before_script:
    - echo "Triggering Docker Release"
  script:
    - ./utils/trigger_docker_build.sh

# Tagging the current master-branch of https://github.com/cryptoadvance/specterext-dummy
# with the same CI_COMMIT_TAG
tag_specterext_dummy_repo:
  stage: post_releasing
  only:
    - tags
  before_script:
    # write access to git@github.com:cryptoadvance/specterext-dummy.git
    - source ./utils/prepare_for_git_write.sh "$SSH_SPECTEREXT_DEPLOY_KEY"
  script:
    - echo "Now tagging ... git@github.com:${CI_PROJECT_ROOT_NAMESPACE}/specterext-dummy.git"
    - ./utils/tag_specterext_dummy.sh

update_github:
  stage: post_releasing
  only:
    - tags
  needs:
    - release_signatures
  before_script:
    # write access to git@github.com:swan-bitcoin/specter-static.git
    - source ./utils/prepare_for_git_write.sh "$SSH_SPECTERSTATIC_DEPLOY_KEY"
  script:
    - echo "Now updating https://github.com:${CI_PROJECT_ROOT_NAMESPACE}/specter-desktop/releases/tag/${CI_COMMIT_TAG:-v2.0.4-pre8}"
    - ./utils/generate_downloadpage.sh --org_name ${CI_PROJECT_ROOT_NAMESPACE:-k9ert} --debug --version ${CI_COMMIT_TAG:-v2.0.4-pre8} generate github # default-value for testing

update_webpage:
  stage: post_releasing
  only:
    - tags
  needs:
    - release_signatures
  before_script:
    # write access to git@github.com:swan-bitcoin/specter-static.git
    - source ./utils/prepare_for_git_write.sh "$SSH_SPECTERSTATIC_DEPLOY_KEY"
  script:
    - echo "Now updating https://github.com:${CI_PROJECT_ROOT_NAMESPACE}/specter-static.git"
    - ./utils/generate_downloadpage.sh --org_name ${CI_PROJECT_ROOT_NAMESPACE:-k9ert} --debug --version ${CI_COMMIT_TAG:-v2.0.4-pre8} generate webpage # default-value for testing