# Ce pipeline a 1 stage et 1 job
stages:
  - hello

dire-bonjour:
  stage: hello
  script:
    - echo "Bonjour depuis GitLab CI !"
    - echo "Je tourne sur un runner"

stages:
  - install
  - test
  - build

default:
  image: node:20-alpine      # image Docker utilisée par tous les jobs
  cache:
    key: "$CI_COMMIT_REF_SLUG"
    paths: [node_modules/]   # mise en cache pour accélérer

installer-deps:
  stage: install
  script:
    - npm ci                   # install propre depuis package-lock.json

lancer-tests:
  stage: test
  script:
    - npm test
  artifacts:
    paths: [coverage/]        # conserve le rapport de couverture
    expire_in: 1 week

compiler-app:
  stage: build
  script:
    - npm run build
  artifacts:
    paths: [dist/]            # fichiers compilés disponibles pour téléchargement

# ── 1. ORDRE DES STAGES ───────────────────────────────────────
stages:
  - build        # les jobs de ce stage tournent avant "test"
  - test
  - deploy

# ── 2. VARIABLES GLOBALES ────────────────────────────────────
variables:
  APP_NAME: "my-app"
  DOCKER_IMAGE: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"

# ── 3. DEFAULTS (appliqués à tous les jobs) ──────────────────
default:
  image: node:20-alpine
  before_script:
    - npm ci --cache .npm
  retry: 2              # retry automatique en cas d'échec runner
  timeout: 10 minutes

# ── 4. WORKFLOW — contrôle quand un pipeline est créé ────────
workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_TAG
    - when: never

# ── 5. UN JOB ────────────────────────────────────────────────
build-app:
  stage: build        # dans quel stage s'exécute ce job
  image: node:20      # surcharge l'image default
  script:             # commandes exécutées dans le conteneur
    - npm run build
  artifacts:          # fichiers à conserver
    paths: [dist/]

unit-tests:
  stage: test
  image: node:20-alpine       # surcharge l'image default
  tags:                        # cibler un runner spécifique
    - docker
    - linux
  allow_failure: false         # true = job rouge mais pipeline continue
  timeout: 10 minutes
  retry:
    max: 2
    when:
      - runner_system_failure
      - stuck_or_timeout_failure
  before_script:
    - npm ci
  script:                      # ← OBLIGATOIRE
    - npm test -- --coverage
  after_script:               # toujours exécuté, même si script échoue
    - echo "Tests terminés"
  coverage: '/Lines\s*:\s*(\d+\.?\d*)%/'  # regex extraction % coverage

# Job déclenché manuellement
deploy-prod:
  stage: deploy
  script:
    - ./deploy.sh
  when: manual           # on_success | on_failure | always | manual | delayed
  start_in: "1 hour"    # uniquement pour when: delayed

# Variables globales (tous les jobs)
variables:
  ENV: "production"
  PORT: "3000"                 # toujours une string en YAML
  URL: "https://$CI_PROJECT_NAME.example.com"  # interpolation OK

# Variable locale à un job (surcharge la globale)
my-job:
  variables:
    ENV: "staging"
    GIT_STRATEGY: none      # fetch | clone | none — "none" = pas de checkout
    GIT_DEPTH: "10"          # shallow clone, accélère le checkout
  script:
    - echo $ENV              # → staging
    - echo ${ENV:-default}   # valeur par défaut bash si vide
    - echo ${APP_NAME:?Variable obligatoire}  # erreur si non définie

# Secrets — définis dans GitLab UI (Settings › CI/CD › Variables)
# ⚠ Ne jamais mettre de mot de passe dans le YAML !
deploy:
  script:
    - echo $DB_PASSWORD      # variable masquée définie dans l'UI → *** dans les logs
    - curl -H "Token: $API_KEY" https://api.example.com

deploy-staging:
  script: ./deploy.sh staging
  rules:
    # Si branche develop → exécute automatiquement
    - if: '$CI_COMMIT_BRANCH == "develop"'
      when: on_success
    # Si MR vers main → exécute manuellement
    - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main"'
      when: manual
    # Si un fichier spécifique a été modifié
    - changes:
        - src/**/*
        - package.json
    # Fallback : ne jamais exécuter autrement
    - when: never

release:
  script: ./release.sh
  rules:
    # Uniquement sur les tags semver (ex: v1.2.3)
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'

# Injecter des variables différentes selon la règle
build:
  script: npm run build
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      variables:
        BUILD_ENV: production
        MINIFY: "true"
    - if: '$CI_COMMIT_BRANCH'
      variables:
        BUILD_ENV: staging
        MINIFY: "false"

# Combiner if ET changes (les deux doivent être vrais)
test-api:
  script: npm run test:api
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      changes:
        - api/**/*
        - tests/api/**/*

stages:
  - build
  - test
  - deploy

build-frontend:
  stage: build
  script: npm run build:frontend

build-backend:
  stage: build
  script: npm run build:backend

# Ne attend que build-frontend, pas build-backend
test-frontend:
  stage: test
  needs:
    - job: build-frontend
      artifacts: true       # télécharge les artifacts du job parent
  script: npm run test:frontend

test-backend:
  stage: test
  needs: [build-backend]   # syntaxe courte
  script: npm run test:backend

# Attend les deux tests
deploy-staging:
  stage: deploy
  needs: [test-frontend, test-backend]
  script: ./deploy.sh

# needs: [] = démarre immédiatement (ignore les stages précédents)
notify-start:
  stage: test
  needs: []
  script: curl -X POST $SLACK_WEBHOOK -d '{"text":"Pipeline démarré"}'

build:
  script: npm run build
  artifacts:
    paths:
      - dist/
      - coverage/
    exclude:
      - dist/**/*.map              # exclure les sourcemaps
    reports:
      junit: test-results.xml     # rapport visible dans l'UI MR
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura.xml
    expire_in: 1 week            # 30 mins | 1 day | 1 week | never
    when: always                  # conserver même si le job échoue
    untracked: false             # inclure les fichiers non-git

install:
  script: npm ci
  cache:
    key:
      files:                       # clé basée sur le hash du fichier lock
        - package-lock.json
    paths:
      - node_modules/
      - .npm/
    policy: pull-push             # pull | push | pull-push (défaut)

# Job qui ne fait que lire le cache (pas d'écriture)
test:
  cache:
    key: "$CI_COMMIT_REF_SLUG-node"
    paths: [node_modules/]
    policy: pull                  # plus rapide : ne re-pousse pas

# Cache Python pip
test-python:
  image: python:3.12
  cache:
    key:
      files: [requirements.txt]
    paths: [.pip-cache/]
  variables:
    PIP_CACHE_DIR: "$CI_PROJECT_DIR/.pip-cache"
  script:
    - pip install -r requirements.txt
    - pytest

# ── Installation sur Ubuntu/Debian ────────────────────────────
curl -L https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh | sudo bash
sudo apt install gitlab-runner

# ── Enregistrement interactif (pose des questions) ────────────
sudo gitlab-runner register

# ── Enregistrement non-interactif (scripts CI) ────────────────
sudo gitlab-runner register \
  --non-interactive \
  --url "https://gitlab.com/" \
  --registration-token "$RUNNER_TOKEN" \
  --executor "docker" \
  --docker-image "alpine:latest" \
  --description "mon-runner-docker" \
  --tag-list "docker,linux" \
  --docker-privileged    # nécessaire pour Docker-in-Docker

# ── Vérifier que le runner tourne ────────────────────────────
sudo gitlab-runner status
sudo gitlab-runner list

# Job sur runner avec tag "docker"
build-docker:
  tags:
    - docker
    - linux

# Job sur runner K8s
deploy-k8s:
  tags:
    - kubernetes

# Job sur runner Windows
build-windows:
  tags:
    - windows
  script:
    - msbuild solution.sln

# ⚠ Si aucun runner ne correspond aux tags → job bloqué "stuck"

tests-integration:
  image: node:20-alpine
  services:
    - name: postgres:16-alpine
      alias: db                  # accès via hostname "db"
    - name: redis:7-alpine
      alias: redis
    - name: elasticsearch:8.11.0
      alias: elastic
      variables:
        discovery.type: single-node
  variables:
    POSTGRES_DB: testdb
    POSTGRES_USER: ci
    POSTGRES_PASSWORD: ci
    DATABASE_URL: "postgresql://ci:ci@db:5432/testdb"
    REDIS_URL: "redis://redis:6379"
  before_script:
    - npm ci
    - npx wait-on tcp:db:5432  # attendre que postgres soit prêt
  script:
    - npm run db:migrate
    - npm run test:integration

# Docker-in-Docker : exécuter Docker depuis un job Docker
build-image:
  image: docker:26
  services:
    - docker:26-dind              # Docker daemon dans un conteneur
  variables:
    DOCKER_TLS_CERTDIR: "/certs"  # TLS activé (recommandé)
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    # Taguer aussi "latest" sur main
    - |
      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
        docker tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA $CI_REGISTRY_IMAGE:latest
        docker push $CI_REGISTRY_IMAGE:latest
      fi

deploy-staging:
  stage: deploy
  script:
    - ./deploy.sh $CI_ENVIRONMENT_URL
  environment:
    name: staging
    url: https://staging.example.com
    on_stop: stop-staging         # job à appeler pour supprimer l'env
    deployment_tier: staging

stop-staging:
  stage: deploy
  script:
    - ./teardown.sh staging
  environment:
    name: staging
    action: stop               # stop | start | prepare | verify | access
  when: manual

# ── Review Apps : environnement dynamique par MR ─────────────
deploy-review:
  stage: deploy
  script:
    - ./deploy-review.sh $CI_COMMIT_REF_SLUG
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    url: https://$CI_COMMIT_REF_SLUG.review.example.com
    on_stop: stop-review
    auto_stop_in: 1 week        # suppression automatique
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

stop-review:
  stage: deploy
  script: ./teardown.sh $CI_COMMIT_REF_SLUG
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    action: stop
  when: manual
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: manual

# ── Production : déclenchement sur tag uniquement ─────────────
deploy-prod:
  stage: deploy
  script:
    - ./deploy.sh production
  environment:
    name: production
    url: https://example.com
    deployment_tier: production
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v\d+/'
      when: manual

# Job de base — préfixe . = caché (non exécuté directement)
.base-node:
  image: node:20-alpine
  before_script:
    - npm ci --cache .npm
  cache:
    key: "$CI_COMMIT_REF_SLUG"
    paths: [.npm/]

# .rules-mr-only — conditions réutilisables
.rules-mr-only:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

build:
  extends: .base-node        # hérite image, before_script, cache
  stage: build
  script: npm run build      # seule différence

test:
  extends: .base-node
  stage: test
  script: npm test

# extends multiple (héritage de plusieurs sources)
lint:
  extends:
    - .base-node
    - .rules-mr-only           # applique aussi les rules
  script: npm run lint

# Définir un ancre &
.before_npm: &before_npm
  - npm ci
  - echo "Dépendances prêtes"

# Réutiliser avec *
build:
  before_script: *before_npm
  script: npm run build

# Merge de maps avec <<:
.common: &common
  image: node:20
  tags: [docker]
  retry: 2

my-job:
  <<: *common               # fusionne les clés de .common
  script: echo "hello"

include:
  # Fichier local dans ce repo
  - local: ".gitlab/ci/build.yml"
  - local: ".gitlab/ci/deploy.yml"

  # Template officiel GitLab (hébergé sur gitlab.com)
  - template: Jobs/SAST.gitlab-ci.yml
  - template: Workflows/MergeRequest-Pipelines.gitlab-ci.yml

  # Depuis un autre projet GitLab (templates d'équipe)
  - project: my-group/ci-templates
    ref: main
    file:
      - templates/docker.yml
      - templates/notify.yml

  # URL externe (HTTPS)
  - remote: https://example.com/ci/shared-template.yml

# Surcharger un job venant d'un template inclus
SAST:
  variables:
    SAST_EXCLUDED_PATHS: "spec,test,tests,tmp,node_modules"
  rules:
    - if: $CI_PIPELINE_SOURCE != "schedule"

# N copies identiques d'un job (utile pour fragmenter une suite de tests)
rspec:
  script: bundle exec rspec
  parallel: 5                   # 5 jobs identiques → $CI_NODE_INDEX (1..5)

# Matrix — combinatoire de variables
test-matrix:
  image: "$RUNTIME:$VERSION"
  script: npm test
  parallel:
    matrix:
      - RUNTIME: node
        VERSION: ["18", "20", "22"]
      - RUNTIME: bun
        VERSION: ["1.0", "1.1"]
  # → 5 jobs : node:18, node:20, node:22, bun:1.0, bun:1.1

# Matrix pour déploiement multi-régions × multi-envs
deploy:
  script:
    - ./deploy.sh --region $REGION --env $ENV
  environment:
    name: "$ENV/$REGION"
  parallel:
    matrix:
      - REGION: [eu-west-1, us-east-1, ap-southeast-1]
        ENV: [staging, production]
  # → 6 jobs (3 régions × 2 envs)

# .gitlab-ci.yml (pipeline parent)
stages:
  - triggers

trigger-frontend:
  stage: triggers
  trigger:
    include: frontend/.gitlab-ci.yml  # pipeline enfant local
    strategy: depend                  # parent attend la fin de l'enfant
  rules:
    - changes: [frontend/**/*]        # déclenché seulement si frontend modifié

trigger-api:
  trigger:
    project: my-group/api-service   # pipeline dans un AUTRE repo
    branch: main
  rules:
    - changes: [api/**/*]

# Job qui génère un fichier YAML dynamiquement (Python, bash, etc.)
generate-pipeline:
  script:
    - python3 scripts/gen_pipeline.py > generated-pipeline.yml
  artifacts:
    paths: [generated-pipeline.yml]

run-generated:
  trigger:
    include:
      - artifact: generated-pipeline.yml
        job: generate-pipeline
    strategy: depend
  needs: [generate-pipeline]

# Inclure les scanners souhaités
include:
  - template: Jobs/SAST.gitlab-ci.yml
  - template: Jobs/Secret-Detection.gitlab-ci.yml
  - template: Jobs/Dependency-Scanning.gitlab-ci.yml
  - template: Jobs/Container-Scanning.gitlab-ci.yml

# Personnaliser SAST (exclure des dossiers)
semgrep-sast:
  variables:
    SAST_EXCLUDED_PATHS: "spec,test,tests,tmp,node_modules"
    SAST_EXCLUDED_ANALYZERS: "bandit,flawfinder"

# DAST — scanner l'appli déployée (nécessite un env accessible)
include:
  - template: DAST.gitlab-ci.yml

dast:
  variables:
    DAST_WEBSITE: https://staging.example.com
    DAST_FULL_SCAN_ENABLED: "true"
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

# Container scanning — analyser une image Docker
container_scanning:
  variables:
    CS_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == "schedule"
    - when: never                  # tous les autres cas ignorés

# Optimisations de performance
.slim-defaults:
  image: alpine:3.19           # préférer :alpine ou :slim
  variables:
    GIT_DEPTH: "1"             # shallow clone
    FF_USE_FASTZIP: "true"     # compression artifacts plus rapide
    TRANSFER_METER_FREQUENCY: "5s"

✅ À FAIRE
// Utiliser rules: plutôt que only:/except: (déprécié)
// Versionner les images Docker (node:20.11 > node:latest)
// Séparer build / test / deploy en stages distincts
// Utiliser needs: pour paralléliser et accélérer le pipeline
// Stocker les secrets dans CI/CD Variables (masked + protected)
// Factoriser avec .hidden-jobs + extends:
// Activer Secret Detection au minimum (gratuit)
// Fixer expire_in sur les artifacts non essentiels
// Utiliser GIT_DEPTH: "1" si historique git non nécessaire
// Valider le YAML avec CI Lint avant de pusher
// Utiliser workflow: rules pour éviter les pipelines en double

❌ À ÉVITER
// Stocker des secrets en clair dans le YAML ou le code
// image: latest (non reproductible, peut casser)
// allow_failure: true sur des jobs critiques (sécurité, tests)
// Scripts inline trop longs — extraire dans des fichiers .sh
// Un seul job monolithique qui fait tout (illisible, lent)
// Cache avec policy: pull-push dans des jobs parallèles (conflits)
// Ignorer les rapports Security dans les MR
// Laisser des tokens/credentials dans les variables non-masked

# ═══════════════════════════════════════════════════════════════
# Pipeline complet : install → quality → build → docker → deploy
# Adapté pour : Node.js 20, Docker, déploiement SSH/Kubernetes
# ═══════════════════════════════════════════════════════════════

# Évite les pipelines en double (push + MR)
workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_TAG
    - when: never

stages:
  - install
  - quality
  - build
  - docker
  - deploy-staging
  - deploy-prod

variables:
  NODE_VERSION: "20"
  IMAGE_TAG: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
  IMAGE_LATEST: "$CI_REGISTRY_IMAGE:latest"

# ── Template de base partagé ──────────────────────────────────
.node-base:
  image: node:$NODE_VERSION-alpine
  cache:
    key:
      files: [package-lock.json]
    paths: [node_modules/, .npm/]
    policy: pull

# ── STAGE : install ───────────────────────────────────────────
install-dependencies:
  extends: .node-base
  stage: install
  cache:
    key:
      files: [package-lock.json]
    paths: [node_modules/, .npm/]
    policy: pull-push            # ce job écrit le cache
  script:
    - npm ci --cache .npm --prefer-offline

# ── STAGE : quality (parallèle) ───────────────────────────────
lint:
  extends: .node-base
  stage: quality
  needs: [install-dependencies]
  script:
    - npm run lint
  allow_failure: false

unit-tests:
  extends: .node-base
  stage: quality
  needs: [install-dependencies]
  script:
    - npm test -- --coverage --ci
  coverage: '/Statements\s*:\s*(\d+\.?\d*)%/'
  artifacts:
    when: always
    reports:
      junit: junit.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura.xml
    paths: [coverage/]
    expire_in: 30 days

security-audit:
  extends: .node-base
  stage: quality
  needs: [install-dependencies]
  script:
    - npm audit --audit-level=high
  allow_failure: true            # ne bloque pas si vulnerabilité modérée

# ── STAGE : build ─────────────────────────────────────────────
build-app:
  extends: .node-base
  stage: build
  needs: [lint, unit-tests]
  script:
    - npm run build
  artifacts:
    paths: [dist/]
    expire_in: 1 week

# ── STAGE : docker ────────────────────────────────────────────
build-image:
  stage: docker
  image: docker:26
  services:
    - docker:26-dind
  variables:
    DOCKER_TLS_CERTDIR: "/certs"
  needs:
    - job: build-app
      artifacts: true
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker build --build-arg NODE_ENV=production -t $IMAGE_TAG .
    - docker push $IMAGE_TAG
    - |
      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
        docker tag $IMAGE_TAG $IMAGE_LATEST
        docker push $IMAGE_LATEST
      fi
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_TAG

# ── STAGE : deploy-staging ────────────────────────────────────
deploy-to-staging:
  stage: deploy-staging
  image: alpine:3.19
  needs: [build-image]
  before_script:
    - apk add --no-cache openssh-client
    - eval $(ssh-agent -s)
    - echo "$SSH_PRIVATE_KEY" | ssh-add -      # clé SSH définie dans CI/CD Variables
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    - ssh-keyscan $STAGING_HOST >> ~/.ssh/known_hosts
  script:
    - ssh deploy@$STAGING_HOST "docker pull $IMAGE_TAG && docker-compose up -d"
  environment:
    name: staging
    url: https://staging.example.com
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

# ── STAGE : deploy-prod (manuel, sur tag uniquement) ──────────
deploy-to-production:
  stage: deploy-prod
  image: alpine:3.19
  needs: [deploy-to-staging]
  before_script:
    - apk add --no-cache openssh-client
    - eval $(ssh-agent -s)
    - echo "$SSH_PRIVATE_KEY" | ssh-add -
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    - ssh-keyscan $PROD_HOST >> ~/.ssh/known_hosts
  script:
    - ssh deploy@$PROD_HOST "docker pull $IMAGE_TAG && docker-compose up -d"
  environment:
    name: production
    url: https://example.com
    deployment_tier: production
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'
      when: manual

# Étape 1 : build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY dist/ ./dist/

# Étape 2 : image finale (légère)
FROM node:20-alpine
WORKDIR /app
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
COPY --from=builder /app .
USER appuser
EXPOSE 3000
CMD ["node", "dist/index.js"]

# Activer le mode debug (affiche toutes les commandes + variables)
# ⚠️ Expose les secrets masqués dans les logs !
my-job:
  variables:
    CI_DEBUG_TRACE: "true"      # ou: CI_DEBUG_SERVICES pour les services
  script:
    - set -x                   # trace bash (moins intrusif)
    - env | sort               # affiche toutes les variables d'env
    - whoami && pwd            # vérifier l'utilisateur et le répertoire

# Valider le YAML localement (installer gitlab-ci-local)
npm install -g gitlab-ci-local
gitlab-ci-local --job mon-job  # exécute un job en local

# Valider via l'API GitLab (sans push)
curl --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
     --form "content=@.gitlab-ci.yml" \
     https://gitlab.com/api/v4/ci/lint