.gitlab-ci-release.yml

make release branch:
  before_script:
    - git fetch origin development
    - if [[ -f /load-env.sh ]]; then source /load-env.sh; fi
  stage: deploy
  when: manual
  tags:
    - shared-small
  only:
    - development
    - /^hotfix/
  except:
    - schedules
  needs: []
  script:
    - |
      if [ -z "$RELEASE_NOTES" ]; then
          echo "Variable: RELEASE_NOTES manual var is required to continue"
          exit 1;
      else
          echo "Updated env for $RELEASE_NOTES"
      fi
    - git config user.email "$GIT_CI_EMAIL"
    - git config user.name "$GIT_CI_USERNAME"
    # Compute version code and name
    - export VERSION_NAME=$(./gradlew -q getVersionName | tail -n 1)
    - export VERSION_CODE=$(./gradlew -q getVersionCode | tail -n 1)
    # Make new release branch and add guestholes
    - ./gradlew :app:prepareGuestHoleServers
    - mv app/src/main/assets/GuestHoleServers.json app/config/
    - git checkout -b release/${VERSION_NAME}
    - git add app/config/GuestHoleServers.json
    - git commit -m "Update guesthole servers"
    # Add f-droid metadata
    - echo -e "What's new\n${RELEASE_NOTES}" > metadata/en-US/changelogs/${VERSION_CODE}.txt
    - echo -e "versionName=${VERSION_NAME}\nversionCode=${VERSION_CODE}" > metadata/version_fdroid.txt
    - git add -- ./metadata
    - git commit -m "Add fdroid metadata"
    # Add remote with oauth and push new branch
    - git remote add self_origin "$OAUTH_SELF_URL"
    - git tag -a ${VERSION_NAME} -m "${VERSION_NAME} release"
    - git push self_origin ${VERSION_NAME}
    - git push self_origin release/${VERSION_NAME}

sign-bundle:
  stage: deploy
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: never
    - if: $CI_COMMIT_BRANCH == "development"
      when: always
    - if: $CI_COMMIT_BRANCH =~ /^hotfix/
      when: always
    - if: $CI_COMMIT_BRANCH =~ /^release/
      when: always
  needs: ["build google play bundle", "build google debug"]
  tags:
    - signing
  variables:
    ARTIFACT_SIGNATURE_KIND: android-app-bundle
    ARTIFACT_SIGNATURE_PROFILE: android-vpn
    ARTIFACT_SIGNATURE_REF_TYPE: protected-branch
    ARTIFACT_SIGNATURE_FILES: app/build/outputs/bundle/productionGooglePlayStoreRelease/${ARCHIVES_BASE_NAME}-production-google-playStore-release.aab
    ARTIFACT_SIGNATURE_DEST: signedBundle/
  id_tokens:
    SIGNING_ID_TOKEN:
      aud: https://gitlab.protontech.ch
  script:
    - "true"

sync-app:
  cache: {}
  stage: mirror
  only:
    - /^release/
  except:
    - schedules
  script:
    - apt update && apt-get install -y connect-proxy
    - git remote add public $PUBLIC_REPO_URL
    - git checkout $CI_COMMIT_REF_NAME
    # Push current branch to github
    - git push public $CI_COMMIT_REF_NAME
    # Push the latest tag we can find
    - git push public "$(git describe --abbrev=0)"
    # Point github master to latest release branch
    - git checkout -b master
    - git push public master -f

publish-apk-internal:
  stage: publish
  tags:
    - xlarge-k8s
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: never
    - if: $CI_COMMIT_BRANCH == "development"
      when: always
  needs:
    - job: sign-bundle
    # Make sure tests pass before publishing. The dependency is on coverage report to avoid listing
    # all test jobs here.
    - job: coverage report
      artifacts: false
  script:
    - ./gradlew generateReleaseNotesForPublishing
    - ./gradlew publishProductionGooglePlayStoreBundle --artifact-dir signedBundle/
    - ./gradlew notifyPublishOnSlack

publish-github:
  stage: publish
  only:
    - /^release/
  except:
    - schedules
  interruptible: false
  before_script:
    - |
      # if not a tag pipeline and job is running on top of a release branch release/<version> we extract <version>
      if [ -z "$CI_COMMIT_TAG" ] && [ "${CI_COMMIT_REF_NAME#release/}" != "$CI_COMMIT_REF_NAME" ]; then
        export CI_COMMIT_TAG="$(echo "$CI_COMMIT_REF_NAME" | cut -d '/' -f 2)"
        echo "extract tag from release branch ($CI_COMMIT_REF_NAME) -> $CI_COMMIT_TAG"
      fi
      echo "version: $CI_COMMIT_TAG"
  variables:
    RELEASE_APP: android-vpn
    RELEASE_GITHUB_REPOSITORY: $PUBLIC_REPO_URL
  extends: .release-make-release

publish downloads:
  extends: .publish-download-base
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: never
    - if: $CI_COMMIT_BRANCH =~ /^release/
      when: always
  interruptible: false
  variables:
    ORIGIN_OAUTH_URL: "${OAUTH_DOWNLOADS_REPO_URL}"
    ARTIFACT_PATH: "app/build/outputs/apk/productionVanillaDirect/release/${ARCHIVES_BASE_NAME}-production-vanilla-direct-release.apk"
    ARTIFACT_OUTPUT_NAME: "ProtonVPN.apk"
    SLACK_HOOK: "${SLACK_HOOK_DEPLOY_CHANNEL}"
    SLACK_MESSAGE: '{"text":"Updated ProtonVPN.apk. Can someone deploy downloads? Thanks :)"}'

publish nexus:
  stage: publish
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: never
    - if: $CI_COMMIT_BRANCH =~ /^release/
      when: always
    - when: manual
  tags:
    - shared-medium
  image: $CI_REGISTRY/tpe/test-scripts
  allow_failure: true
  dependencies:
    - build google play dev (monitoring release)
  before_script: []
  script:
    # Delete old assets
    - /usr/local/bin/nexus/delete_asset_on_nexus.py
      --repository $NEXUS_REPO
      --group $NEXUS_GROUP
    # Upload release build
    - /usr/local/bin/nexus/upload_to_nexus.py
      --path "app/build/outputs/apk/productionGoogleDev/release/ProtonVPN-*-production-google-dev-release.apk"
      --repository $NEXUS_REPO
      --group $NEXUS_GROUP
      --filename "vpn-latest-stable-release.apk"
    # Upload release test build
    - /usr/local/bin/nexus/upload_to_nexus.py
      --path "release_tests/build/outputs/apk/release/release_tests-release.apk"
      --repository $NEXUS_REPO
      --group $NEXUS_GROUP
      --filename "vpn-latest-stable-release-test.apk"