.gitlab-ci.yml

stages:
  - maintenance
  - build

variables:
  DOCKER_HOST: "unix:///var/run/docker.sock"

  TEST_TAG: "searxng:test"
  GITLAB_LATEST_TAG: "$CI_REGISTRY_IMAGE:latest"

update-upstream-commit:
  stage: maintenance
  image: alpine:latest
  before_script:
    - apk add --no-cache git
    - git config user.name "gitlab-ci[bot]"
    - git config user.email "gitlab-ci[bot]@users.noreply.gitlab.com"
    - git remote set-url origin "https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git"
    - git fetch origin "$CI_COMMIT_BRANCH"
    - git checkout -B "$CI_COMMIT_BRANCH" "origin/$CI_COMMIT_BRANCH"
  script:
    - |
      UPSTREAM_REPO="$(sed -n 's/.*git clone.* \(https:[^ ]*\).*/\1/p' Dockerfile | head -n1)"
      UPSTREAM_BRANCH="$(sed -n 's/.*--branch \([^ ]*\).*/\1/p' Dockerfile | head -n1)"
      LOCAL_COMMIT="$(grep -m1 "UPSTREAM_COMMIT=" Dockerfile | cut -d'=' -f2)"
      REMOTE_COMMIT="$(git ls-remote "$UPSTREAM_REPO" "${UPSTREAM_BRANCH:-HEAD}" | awk '{print $1}')"

      echo "Upstream repo: $UPSTREAM_REPO"
      echo "Upstream branch: ${UPSTREAM_BRANCH:-HEAD}"
      echo "Remote commit: $REMOTE_COMMIT"
      echo "Local commit:  $LOCAL_COMMIT"

      if [ "$REMOTE_COMMIT" = "$LOCAL_COMMIT" ]; then
        echo "BUILD_REQUIRED=0" > build.env
        echo "Repository is up to date. Skipping."
        exit 0
      fi

      sed -i "/^ENV UPSTREAM_COMMIT=/c\\ENV UPSTREAM_COMMIT=${REMOTE_COMMIT}" Dockerfile

      git add Dockerfile
      git commit -m "upd: latest upstream commit"
      git push origin "HEAD:${CI_COMMIT_BRANCH}"

      echo "BUILD_REQUIRED=1" > build.env
  artifacts:
    reports:
      dotenv: build.env
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
    - if: '$CI_PIPELINE_SOURCE == "web" && $RUN_UPSTREAM_UPDATE == "1"'

build-and-push:
  stage: build
  timeout: 45m
  image: docker:latest
  needs:
    - job: update-upstream-commit
      artifacts: true
      optional: true
  before_script:
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
  script:
    - |
      if [ "${CI_PIPELINE_SOURCE}" = "schedule" ] || [ "${RUN_UPSTREAM_UPDATE:-0}" = "1" ]; then
        if [ "${BUILD_REQUIRED:-0}" != "1" ]; then
          echo "No source update happened. Skipping image build."
          exit 0
        fi

        git fetch origin "$CI_COMMIT_BRANCH"
        git reset --hard "origin/$CI_COMMIT_BRANCH"
      fi

      docker build \
        -f ./Dockerfile \
        -t "$TEST_TAG" \
        -t "$GITLAB_LATEST_TAG" \
        .

      TEST_CONTAINER="searxng-test-${CI_PIPELINE_ID}"

      docker run -d \
        --name "$TEST_CONTAINER" \
        -p 8080:8080 \
        -e AUTHORISED_API=test_api_key \
        "$TEST_TAG"

      curl_host() {
        docker run --rm --network host curlimages/curl:latest "$@"
      }

      dump_logs() {
        echo "==== container logs ===="
        docker logs "$TEST_CONTAINER" || true
      }
      trap dump_logs ERR

      echo "Waiting for container to be ready..."
      for i in $(seq 1 30); do
        if curl_host -fsS http://localhost:8080/healthz 2>/dev/null | grep -q "OK"; then
          echo "Container is ready"
          break
        fi
        if [ "$i" -eq 30 ]; then
          echo "ERROR: container did not become ready within 60 seconds"
          docker logs "$TEST_CONTAINER" || true
          exit 1
        fi
        sleep 2
      done

      curl_host -fsS http://localhost:8080/healthz | grep "OK"

      curl_host -fsS --max-time 60 "http://localhost:8080/search?q=github" | grep "sidebar-end-collapsible"

      unauth_status="$(curl_host -sS -o /dev/null -w '%{http_code}' --max-time 15 \
        "http://localhost:8080/search?q=github&format=json")"
      [ "$unauth_status" = "403" ]

      badauth_status="$(curl_host -sS -o /dev/null -w '%{http_code}' --max-time 15 \
        -u 'user:wrong_key' "http://localhost:8080/search?q=github&format=json")"
      [ "$badauth_status" = "403" ]

      curl_host -fsS --max-time 60 -u 'user:test_api_key' \
        "http://localhost:8080/search?q=github&format=json" | grep '"query"'

      bearer_out="$(curl_host -sS -w 'HTTPSTATUS:%{http_code}' --max-time 15 \
        -H "Authorization: Bearer test_api_key" "http://localhost:8080/search?format=json")"
      echo "$bearer_out" | grep -q '"error"'
      echo "$bearer_out" | grep -q 'HTTPSTATUS:400'

      docker rm -f "$TEST_CONTAINER"

      docker push "$GITLAB_LATEST_TAG"
  after_script:
    - docker rm -f "searxng-test-${CI_PIPELINE_ID}" 2>/dev/null || true
    - docker logout "$CI_REGISTRY" || true
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"'
      changes:
        - src/**/*
        - out/**/*
        - Dockerfile
        - .gitlab-ci.yml
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
    - if: '$CI_PIPELINE_SOURCE == "web"'