stages:
  - sync
  - preflight
  - prepare
  - build-images
  - release-environments
  - fixtures
  - lint
  - test-frontend
  - test
  - post-test
  - review
  - qa
  - post-qa
  - pre-merge
  - pages
  - notify
  - benchmark
  - ai-gateway

# always use `gitlab-org` runners, however
# in cases where jobs require Docker-in-Docker, the job
# definition must be extended with `.use-docker-in-docker`
default:
  image: $DEFAULT_CI_IMAGE
  tags:
    - $DEFAULT_JOB_TAG
  # All jobs are interruptible by default
  interruptible: true
  # Default job timeout doesn't work: https://gitlab.com/gitlab-org/gitlab/-/issues/387528
  timeout: 90m

.default-ruby-variables: &default-ruby-variables
  RUBY_VERSION: "${RUBY_VERSION_DEFAULT}"
  OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_3"

.next-ruby-variables: &next-ruby-variables
  RUBY_VERSION: "${RUBY_VERSION_NEXT}"
  OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_3"

.default-branch-pipeline-failure-variables: &default-branch-pipeline-failure-variables
  CREATE_RAILS_FLAKY_TEST_ISSUES: "true"
  CREATE_RAILS_SLOW_TEST_ISSUES: "true"
  CREATE_RAILS_TEST_FAILURE_ISSUES: "true"
  GLCI_PUSH_RAILS_TEST_FAILURE_ISSUES_TO_GCS: "true"

.default-merge-request-variables: &default-merge-request-variables
  ADD_SLOW_TEST_NOTE_TO_MERGE_REQUEST: "true"
  CREATE_RAILS_TEST_FAILURE_ISSUES: "false"
  NO_SOURCEMAPS: "true"
  GLCI_PUSH_RAILS_TEST_FAILURE_ISSUES_TO_GCS: "true"

.if-merge-request-security-canonical-sync: &if-merge-request-security-canonical-sync
  if: '$CI_MERGE_REQUEST_SOURCE_PROJECT_PATH == "gitlab-org/security/gitlab" && $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == $CI_DEFAULT_BRANCH && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'

.if-not-security-canonical-sync: &if-not-security-canonical-sync
  if: '$CI_MERGE_REQUEST_SOURCE_PROJECT_PATH != "gitlab-org/security/gitlab" || $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME != $CI_DEFAULT_BRANCH'

.if-merge-request-labels-run-with-rails-next: &if-merge-request-labels-run-with-rails-next
  if: '($CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_EVENT_TYPE != "merge_train") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-with-rails-next/'

.if-rails-next-schedule: &if-rails-next-schedule
  if: '$CI_COMMIT_BRANCH == "rails-next" && $CI_PIPELINE_SOURCE == "schedule"'

.if-triggered-by-aigw-project: &if-triggered-by-aigw-project
  if: '$CI_PIPELINE_SOURCE == "pipeline" && $TRIGGERED_BY_AI_GATEWAY_PROJECT == "true"'

workflow:
  name: '$PIPELINE_NAME'
  rules:
    # https://gitlab.com/gitlab-org/gitlab/-/issues/514740
    - if: '$GITLAB_USER_LOGIN == "gitlab-crowdin-bot" && $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_APPROVED != "true"'
      when: never
    - if: '$CI_PIPELINE_SOURCE == "pipeline" && $GITALY_TEST'
      variables:
        <<: *default-ruby-variables
        PIPELINE_NAME: 'Gitaly Rails Test Pipeline'
    - <<: *if-triggered-by-aigw-project
      variables:
        <<: *default-ruby-variables
        PIPELINE_NAME: 'AIGW Rails Test Pipeline'
    # If `$FORCE_GITLAB_CI` is set, create a pipeline.
    - if: '$FORCE_GITLAB_CI'
      variables:
        <<: *default-ruby-variables
        PIPELINE_NAME: 'Ruby $RUBY_VERSION forced'
    - if: '$START_AS_IF_FOSS'
      variables:
        <<: *default-ruby-variables
        PIPELINE_NAME: 'Ruby $RUBY_VERSION as-if-foss'
    # As part of the process of creating RCs automatically, we update stable
    # branches with the changes of the most recent production deployment. The
    # merge requests used for this merge a branch release-tools/X into a stable
    # branch. For these merge requests we don't want to run any pipelines, as
    # they serve no purpose and will run anyway when the changes are merged.
    - if: '$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME =~ /^release-tools\/\d+\.\d+\.\d+-rc\d+$/ && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable(-ee)?$/ && $CI_PROJECT_PATH == "gitlab-org/gitlab"'
      when: never
    - if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-in-ruby3_3/ || $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable(-ee)?$/'
      variables:
        <<: [*default-ruby-variables, *default-merge-request-variables]
        PIPELINE_NAME: 'Ruby $RUBY_VERSION MR'
    - if: '$CI_MERGE_REQUEST_LABELS =~ /Community contribution/'
      variables:
        <<: [*next-ruby-variables, *default-merge-request-variables]
        GITLAB_DEPENDENCY_PROXY_ADDRESS: ""
        PIPELINE_NAME: 'Ruby $RUBY_VERSION MR (community contribution)'
    # This work around https://gitlab.com/gitlab-org/gitlab/-/issues/332411 which prevents usage of dependency proxy
    # when pipeline is triggered by a project access token.
    # Example of project bot usernames (the format changed over time):
    # - project_278964_bot2
    # - project_278964_bot_7fb4d1cca8242cb399a0b8f483783120
    #
    # We set the DOCKER_AUTH_CONFIG variable to authenticate to Docker Hub to not be impacted by rate limitations
    # We don't set DOCKER_AUTH_CONFIG as a CI/CD group/project variable, because it would then have higher precedence than .gitlab-ci.yml,
    # and we would always reconfigure the docker deamon for any CI/CD pipeline.
    - if: '$CI_MERGE_REQUEST_IID && $GITLAB_USER_LOGIN =~ /project_\d+_bot/'
      variables:
        <<: [*next-ruby-variables, *default-merge-request-variables]
        GITLAB_DEPENDENCY_PROXY_ADDRESS: ""
        DOCKER_AUTH_CONFIG: "${DOCKER_AUTH_CONFIG_OVERRIDE}"
        PIPELINE_NAME: 'Ruby $RUBY_VERSION MR (triggered by a project token)'
    - <<: *if-merge-request-security-canonical-sync
      variables:
        <<: [*next-ruby-variables, *default-merge-request-variables]
        PIPELINE_NAME: '$CI_DEFAULT_BRANCH security->canonical sync'
        SKIP_MESSAGE: 'MR only contains changes from the security mirror, which have already been reviewed, tested and deployed.'
    - <<: *if-merge-request-labels-run-with-rails-next
      variables:
        <<: [*next-ruby-variables, *default-merge-request-variables]
        BUNDLE_GEMFILE: Gemfile.next
    # This variable can be specified in manual or scheduled pipelines to run CI with the next Rails version.
    # Specifying BUNDLE_GEMFILE: Gemfile.next wouldn't work because QA jobs require
    # BUNDLE_GEMFILE to be Gemfile even with the next Rails version pipelines.
    - <<: *if-rails-next-schedule
      variables:
        <<: *next-ruby-variables
        BUNDLE_GEMFILE: Gemfile.next
        PIPELINE_NAME: 'Rails next version (Gemfile.next)'
    # For (detached) merge request pipelines.
    - if: '$CI_MERGE_REQUEST_IID'
      variables:
        <<: [*next-ruby-variables, *default-merge-request-variables]
        PIPELINE_NAME: 'Ruby $RUBY_VERSION MR'
    # For the scheduled pipelines, we set specific variables.
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule" && $BUILD_WITH_NEXT_RUBY_VERSION == "true"'
      variables:
        <<: *next-ruby-variables
        PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule"'
      variables:
        <<: [*default-ruby-variables, *default-branch-pipeline-failure-variables]
        CRYSTALBALL: "true"
        PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
    - if: '$CI_COMMIT_BRANCH == "ruby-next" && $CI_PIPELINE_SOURCE == "schedule"'
      variables:
        <<: *next-ruby-variables
        PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
    # This work around https://gitlab.com/gitlab-org/gitlab/-/issues/332411 which prevents usage of dependency proxy
    # when pipeline is triggered by a project access token.
    # Example of project bot usernames (the format changed over time):
    # - project_278964_bot2
    # - project_278964_bot_7fb4d1cca8242cb399a0b8f483783120
    #
    # We set the DOCKER_AUTH_CONFIG variable to authenticate to Docker Hub to not be impacted by rate limitations
    # We don't set DOCKER_AUTH_CONFIG as a CI/CD group/project variable, because it would then have higher precedence than .gitlab-ci.yml,
    # and we would always reconfigure the docker deamon for any CI/CD pipeline.
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $GITLAB_USER_LOGIN =~ /project_\d+_bot/'
      variables:
        <<: [*default-ruby-variables, *default-branch-pipeline-failure-variables]
        GITLAB_DEPENDENCY_PROXY_ADDRESS: ""
        DOCKER_AUTH_CONFIG: "${DOCKER_AUTH_CONFIG_OVERRIDE}"
        PIPELINE_NAME: 'Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch (triggered by a project token)'
    # For `$CI_DEFAULT_BRANCH` from wider community contributors, we don't want to run any pipelines on pushes,
    # because normally we want to run merge request pipelines and scheduled pipelines, not for repository synchronization.
    # This can avoid accidentally using up pipeline minutes quota while synchronizing the repository for wider community contributors.
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "push" && $CI_PROJECT_NAMESPACE !~ /^gitlab(-org|-cn)?($|\/)/'
      when: never
    # For `$CI_DEFAULT_BRANCH` branch, create a pipeline (this includes on schedules, pushes, merges, etc.).
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      variables:
        <<: [*default-ruby-variables, *default-branch-pipeline-failure-variables]
        PIPELINE_NAME: 'Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
    # For tags, create a pipeline.
    - if: '$CI_COMMIT_TAG'
      variables:
        <<: *default-ruby-variables
        PIPELINE_NAME: 'Ruby $RUBY_VERSION $CI_COMMIT_TAG tag'
    # If `$GITLAB_INTERNAL` isn't set, don't create a pipeline.
    - if: '$GITLAB_INTERNAL == null'
      when: never
    # For stable, auto-deploy, and security branches, create a pipeline.
    - if: '$CI_COMMIT_BRANCH =~ /^[\d-]+-stable(-ee)?$/'
      variables:
        <<: *default-ruby-variables
        PIPELINE_NAME: 'Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
    - if: '$CI_COMMIT_BRANCH =~ /^\d+-\d+-auto-deploy-\d+$/'
      variables:
        <<: *default-ruby-variables
        PIPELINE_NAME: 'Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
    - if: '$CI_COMMIT_BRANCH =~ /^security\//'
      variables:
        <<: *default-ruby-variables
        PIPELINE_NAME: 'Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
    - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "weekly"'
      variables:
        <<: *default-ruby-variables
        PIPELINE_NAME: 'Weekly scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
        FAST_QUARANTINE: "false"
        CREATE_RAILS_FLAKY_TEST_ISSUES: "false"
        CREATE_RAILS_SLOW_TEST_ISSUES: "false"
        CREATE_RAILS_TEST_FAILURE_ISSUES: "false"
        GLCI_PUSH_RAILS_TEST_FAILURE_ISSUES_TO_GCS: "false"

variables:
  PG_VERSION: "16"
  DEFAULT_CI_IMAGE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/ci/${BUILD_OS}-${OS_VERSION}-slim-ruby-${RUBY_VERSION}-golang-${GO_VERSION}-node-${NODE_VERSION}-python-${PYTHON_VERSION}-postgresql-${PG_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-${GIT_VERSION}-lfs-${LFS_VERSION}-chrome-${CHROME_VERSION}-yarn-${YARN_VERSION}-graphicsmagick-${GRAPHICSMAGICK_VERSION}-poetry-${POETRY_VERSION}"
  DEFAULT_JOB_TAG: "gitlab-org"
  GITLAB_LARGE_RUNNER_OPTIONAL: "gitlab-org"  # overridden just in gitlab-org/gitlab
  GLCI_MEDIUM_RUNNER_REQUIRED: ""  # This should be a tag pointing to a valid "medium" runner. Newer versions of Chrome (133+) require at least medium runners (4 core / 16G RAM), otherwise system test jobs are unpredictably instable due to insufficient resources (postgres DB and Rails application will have random failures). Therefore, the default is an empty string, which will cause system test jobs to never run. See https://issues.chromium.org/issues/447192720
  GLCI_PRODUCTION_ASSETS_RUNNER_OPTIONAL: "gitlab-org-docker"  # this is set to GITLAB_LARGE_RUNNER_OPTIONAL on gitlab-org/gitlab and default to docker runners for dind to work correctly
  DEFAULT_RSPEC_PREDICTIVE_JOB_TAGS: "${DEFAULT_JOB_TAG}"  # Separated by commas, overridden in JiHu
  # We set $GITLAB_DEPENDENCY_PROXY to another variable (since it's set at the group level and has higher precedence than .gitlab-ci.yml)
  # so that we can override $GITLAB_DEPENDENCY_PROXY_ADDRESS in workflow rules.
  GITLAB_DEPENDENCY_PROXY_ADDRESS: "${GITLAB_DEPENDENCY_PROXY}"
  RAILS_ENV: "test"
  NODE_ENV: "test"
  BUNDLE_WITHOUT: "development"
  BUNDLE_INSTALL_FLAGS: "--jobs=$(nproc) --retry=3"
  BUNDLE_FROZEN: "true"
  BUNDLE_GEMFILE: Gemfile
  # we override the max_old_space_size to prevent OOM errors
  NODE_OPTIONS: --max-old-space-size=10240
  GIT_DEPTH: "20"
  # 'GIT_STRATEGY: clone' optimizes the pack-objects cache hit ratio
  GIT_STRATEGY: "clone"
  GIT_SUBMODULE_STRATEGY: "none"
  GET_SOURCES_ATTEMPTS: "3"
  # CI_FETCH_REPO_GIT_STRATEGY: "none" is from artifacts. "clone" is from cloning
  CI_FETCH_REPO_GIT_STRATEGY: "none"
  FORCE_COLOR: 1
  CLICOLOR_FORCE: 1
  GITALY_TESTING_LOG_LEVEL: "debug"

  # File paths used in predictive testing flow
  GLCI_PREDICTIVE_FRONTEND_FIXTURES_MAPPING_PATH: crystalball/frontend_fixtures_mapping.json
  GLCI_PREDICTIVE_MATCHING_JS_FILES_PATH: rspec/js_matching_files.txt
  GLCI_PREDICTIVE_CHANGED_FILES_PATH: rspec/changed_files.txt
  GLCI_PREDICTIVE_RSPEC_MATCHING_TESTS_EE_PATH: rspec/matching_tests-ee.txt
  GLCI_PREDICTIVE_RSPEC_MATCHING_TESTS_FOSS_PATH: rspec/matching_tests-foss.txt
  GLCI_PREDICTIVE_RSPEC_PACKED_TESTS_MAPPING_PATH: crystalball/packed-mapping.json
  GLCI_PREDICTIVE_RSPEC_PACKED_TESTS_MAPPING_ALT_PATH: crystalball/packed-mapping-alt.json
  GLCI_PREDICTIVE_RSPEC_TESTS_MAPPING_PATH: crystalball/mapping.json
  GLCI_PREDICTIVE_RSPEC_TESTS_MAPPING_ALT_PATH: crystalball/mapping-alt.json
  GLCI_PREDICTIVE_RSPEC_PIPELINE_TEMPLATE_YML: .gitlab/ci/rails/rspec-predictive.gitlab-ci.yml.erb
  GLCI_PREDICTIVE_DUO_SYSTEM_TESTS_PATH: rspec/duo_system_test_files.txt

  # Test execution result export to ClickHouse
  GLCI_EXPORT_TEST_METRICS: "true"

  FLAKY_RSPEC_SUITE_REPORT_PATH: rspec/flaky/report-suite.json
  JEST_MATCHING_TEST_FILES_PATH: jest/matching_test_files.txt
  GITLAB_WORKHORSE_FOLDER: "gitlab-workhorse"
  KNAPSACK_RSPEC_SUITE_REPORT_PATH: knapsack/report-master.json
  RSPEC_FAIL_FAST_THRESHOLD: 20
  RSPEC_FAST_QUARANTINE_PATH: rspec/fast_quarantine-gitlab.txt
  RSPEC_TEST_ALREADY_FAILED_ON_DEFAULT_BRANCH_MARKER_PATH: rspec/test_already_failed_on_master.txt
  RSPEC_LAST_RUN_RESULTS_FILE: rspec/rspec_last_run_results.txt
  RSPEC_PROFILING_FOLDER_PATH: rspec/profiling
  RSPEC_AUTO_EXPLAIN_LOG_PATH: auto_explain/auto_explain.ndjson.gz
  RUBYOPT: "--yjit"
  TMP_TEST_FOLDER: ${CI_PROJECT_DIR}/tmp/tests
  GLCI_CACHED_SERVICES_FOLDER: ${CI_PROJECT_DIR}/tmp/services
  GLCI_GITLAB_ASSETS_HASH_FILE: cached-assets-hash.txt

  ES_JAVA_OPTS: "-Xms256m -Xmx256m"
  ELASTIC_URL: "http://elastic:changeme@elasticsearch:9200"
  BUNDLER_CHECKSUM_VERIFICATION_OPT_IN: "1"
  CACHE_CLASSES: "true"
  CHECK_PRECOMPILED_ASSETS: "true"
  RETRY_FAILED_TESTS_IN_NEW_PROCESS: "true"
  # Run with decomposed databases by default
  DECOMPOSED_DB: "true"
  SEC_DECOMPOSED_DB: "true"

  DOCS_GITLAB_REPO_SUFFIX: "ee"

  REGISTRY_HOST: "registry.gitlab.com"
  REGISTRY_GROUP: "gitlab-org"

  # Disable useless network connections when installing some NPM packages.
  # See https://gitlab.com/gitlab-com/gl-security/engineering-and-research/inventory/-/issues/827#note_1203181407
  DISABLE_OPENCOLLECTIVE: "true"

  # This is set at the gitlab-org level, but we set it here for forks
  DANGER_DO_NOT_POST_INVALID_DANGERFILE_ERROR: "1"

  # Workaround for https://gitlab.com/gitlab-org/gitlab/-/issues/390313. This can be dropped whenever
  # https://github.com/ruby/ruby/pull/7663 lands in the Ruby interpreter.
  NOKOGIRI_LIBXML_MEMORY_MANAGEMENT: default

  # CI jobs behavior can be changed by changing the value of these variables in the project's CI/CD variables
  AVERAGE_KNAPSACK_REPORT: "true"
  ENABLE_DEPSCORE: "true"
  REUSE_FRONTEND_FIXTURES_ENABLED: "true"
  SIMPLECOV: "true"

  # Runner features
  FF_NETWORK_PER_BUILD: "true"
  FF_USE_FASTZIP: "true"
  # Feature flag for authenticated CI calls:
  # https://gitlab.com/gitlab-org/gitlab/-/issues/591004
  # https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6444
  FF_USE_GIT_PROACTIVE_AUTH: "true"

include:
  - local: .gitlab/ci/overrides/skip.yml
    rules:
      - <<: *if-merge-request-security-canonical-sync
  - local: .gitlab/ci/version.yml
  - local: .gitlab/ci/*.gitlab-ci.yml
    rules:
      - <<: *if-not-security-canonical-sync
  - remote: 'https://gitlab.com/gitlab-org/frontend/untamper-my-lockfile/-/raw/main/templates/merge_request_pipelines.yml'
    rules:
      - <<: *if-not-security-canonical-sync
  - local: .gitlab/ci/includes/gitlab-com/*.gitlab-ci.yml
    rules:
      - if: '$CI_SERVER_HOST == "gitlab.com"'
      - if: '$CI_SERVER_HOST == "jihulab.com"'
  - local: .gitlab/ci/includes/as-if-jh.gitlab-ci.yml
    rules:
      # Only run as-if-jh triggerred pipelines for gitlab.com/gitlab-org/gitlab MRs that don't target stable branches
      # and that don't have the quarantine or pipeline::expedited labels.
      - if: '$CI_PROJECT_URL != "https://gitlab.com/gitlab-org/gitlab"'
        when: never
      - if: '$CI_MERGE_REQUEST_ID == null'
        when: never
      - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable(-ee|-jh)?$/'
        when: never
      - if: '$CI_MERGE_REQUEST_LABELS =~ /quarantine/ || $CI_MERGE_REQUEST_LABELS =~ /pipeline::expedited/ || $CI_MERGE_REQUEST_LABELS =~ /pipeline:expedite/'
        when: never
      - when: always
  - local: .gitlab/ci/overrides/gem-cache.rails-next.yml
    rules:
      - *if-merge-request-labels-run-with-rails-next
      - *if-rails-next-schedule