.gitlab-ci.yml

include:
  - local: ".gitlab-ci/arch.yml"
  - component: "gitlab.gnome.org/GNOME/citemplates/release-service@master"
    inputs:
      job-stage: "deploy"
      dist-job-name: "make-git-archive"
      tarball-artifact-path: "${CI_PROJECT_NAME}-${CI_COMMIT_TAG}.tar.xz"

variables:
  GET_SOURCES_ATTEMPTS: 3
  BST_NO_PUSH: "bst --config $CI_PROJECT_DIR/.gitlab-ci/buildstream-nopush.conf --log-file $CI_PROJECT_DIR/logs/build.log --colors"
  BST: "bst --config $CI_PROJECT_DIR/.gitlab-ci/buildstream.conf --log-file $CI_PROJECT_DIR/logs/build.log --colors"
  # This mirrors the project.conf
  # OCI_BRANCH is like branch and the tag that we use in the images
  # FLATPAK_BRANCH is branch+qualifier (ex. 46beta)
  OCI_BRANCH: master
  FLATPAK_BRANCH: master
  OPENQA_HOST: https://openqa.gnome.org
  OPENQA_TESTS_GIT: https://gitlab.gnome.org/gnome/openqa-tests
  OPENQA_TESTS_BRANCH: master
  OPENQA_NEEDLES_GIT: https://gitlab.gnome.org/gnome/openqa-needles
  OPENQA_NEEDLES_BRANCH: master

  # Docker Images
  DOCKER_REGISTRY: "registry.gitlab.com/freedesktop-sdk/infrastructure/freedesktop-sdk-docker-images"
  DOCKER_IMAGE_ID: "edcad4f0b35deca34fbf20ad38c078b463f627f4"

  # RUN_THIS_STAGE_ONLY: "track-refs"

stages:
- track-refs
- build
- deploy
- test
- reports

.stage-only-rules:
  rules:
    # Allow forcing a specific stage to run, useful for scheduled pipelines to save up runners.
    # Set this to the stage you want to trigger in a scheduled pipeline
    # Example: RUN_THIS_STAGE_ONLY="track-refs"
    - if: $RUN_THIS_STAGE_ONLY != null && $RUN_THIS_STAGE_ONLY != $CI_JOB_STAGE
      when: never
    - if: $RUN_THIS_STAGE_ONLY != null && $RUN_THIS_STAGE_ONLY == $CI_JOB_STAGE

workflow:
  # https://docs.gitlab.com/ee/ci/yaml/index.html#switch-between-branch-pipelines-and-merge-request-pipelines
  rules:
  - if: '$CI_PIPELINE_SOURCE == "schedules" || $CI_PIPELINE_SOURCE == "web"'
  - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS && $CI_PIPELINE_SOURCE == "push"
    when: never
  - if: '$CI_COMMIT_BRANCH && $CI_COMMIT_REF_PROTECTED == "true"'
  - if: '$CI_COMMIT_TAG'

default:
  image: "${DOCKER_REGISTRY}/bst2:${DOCKER_IMAGE_ID}"
  before_script:
  # Ensure the log directory exists
  - mkdir -p logs

  # Setup certificate for pushing to the cache
  - echo "$CASD_CLIENT_CERT" > client.crt
  - echo "$CASD_CLIENT_KEY" > client.key

  # Setup certificates and image version for sysupdate
  - |
    if [ "${CI_COMMIT_REF_PROTECTED-}" = true ]; then
      make -C files/boot-keys generate-keys IMPORT_MODE=import
    else
      make -C files/boot-keys generate-keys IMPORT_MODE=snakeoil
    fi

  - |
    build_num="${CI_PIPELINE_ID}"
    if [ "${CI_COMMIT_BRANCH-}" = master ]; then
      IMAGE_VERSION="nightly.$build_num"
    else
      # Assume this will always be a stable branch string like "gnome-44"
      IMAGE_VERSION=$(echo "${CI_COMMIT_REF_SLUG:-unknown}.$build_num" | sed "s/-/_/g")
    fi

    echo "image-version: ${IMAGE_VERSION}" > include/image-version.yml
    export IMAGE_VERSION
    cat include/image-version.yml


  retry:
    max: 2
    when:
    - 'runner_system_failure'
    - 'stuck_or_timeout_failure'
    - 'scheduler_failure'
    - 'api_failure'

#
# Templates shared by multiple jobs
#

.build-template:
  stage: build
  interruptible: true
  rules:
  - !reference [".stage-only-rules", "rules"]
  # We want still execute by default even if neither of the stage rules match.
  # If we add a when: always/on_success rule it has the chance of triggering when we don't
  # expect it due to how gitlab behaves, so use a variable that will always exist
  # as a fake: always kind of rule
  - if: "$CI_COMMIT_REF_NAME"
  script:
  - $CI_PROJECT_DIR/.gitlab-ci/build_elements.sh
  # Store artifacts so we can inspect build failures
  artifacts:
    when: always
    paths:
    - logs
    expire_in: '1 week'

.manual-image-template:
  stage: deploy
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: "$CI_COMMIT_REF_NAME"
    when: manual
    allow_failure: true
  script:
  - ${BST_NO_PUSH} --max-jobs $(( $(nproc) / 4 )) ${ARCH_OPT} build "${IMAGE}"
  - ${BST} ${ARCH_OPT} artifact checkout --hardlinks "${IMAGE}" --directory image
  artifacts:
    when: always
    paths:
    - image
    expire_in: '2 days'

.deploy-rules:
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: $CI_COMMIT_REF_NAME == "master"
  - if: $CI_COMMIT_REF_NAME =~ /^gnome-\d\d$/ && $CI_PIPELINE_SOURCE != "schedule"

.test-phone-image-template:
  extends:
  - .aarch64
  stage: test
  needs:
    artifacts: true
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: "$CI_COMMIT_REF_NAME"
    when: manual
    allow_failure: true
  before_script:
  - dd if=/dev/zero of=flash1.img bs=1M count=64
  - dd if=/dev/zero of=flash0.img bs=1M count=64
  - dd if=/usr/share/qemu/edk2-aarch64-code.fd of=flash0.img conv=notrunc

  - mv $(pwd)/image/disk.img.xz ./disk.img.xz
  - unxz -T$(nproc) disk.img.xz

.test-openqa-template:
  stage: test
  image:
    name: registry.opensuse.org/devel/openqa/containers15.6/openqa_worker:latest
    entrypoint: ["/bin/bash", "-c"]
  variables:
    # CI needs to be set so OPENQA_TEST_TIMEOUT_SCALE_CI has an effect.
    CI: 1
    OPENQA_TEST_TIMEOUT_SCALE_CI: 4
  needs:
  - job: 's3-image'
    artifacts: false
  script:
  - |
    git clone "$OPENQA_TESTS_GIT" --branch "$OPENQA_TESTS_BRANCH" ./openqa
    echo "Checked out $OPENQA_TESTS_GIT commit $(git -C ./openqa rev-parse HEAD)"
  - |
    rm /etc/openqa/*
    cat >/etc/openqa/client.conf <<EOF
    [openqa.gnome.org]
    key = $OPENQA_API_KEY
    secret = $OPENQA_API_SECRET
    EOF
  - |
    # Kludge so we can use `/tests/config/smbios.txt` to locate the smbios file.
    ln -s $(pwd)/openqa /tests
  - |
    worker_class=qemu_x86_64-${CI_JOB_ID}
    openqa/utils/setup_worker.sh ${worker_class}
    /run_openqa_worker.sh &> worker.log &
  - |
    echo "Starting jobs: "
    echo
    version="master"
    casedir="$(pwd)/openqa"
    for testsuite in $TESTSUITES; do
      openqa/utils/start_job.sh "${worker_class}" "${version}" "${casedir}" "${testsuite}" > /tmp/job_id
      echo " * ${testsuite}: $OPENQA_HOST/tests/$(cat /tmp/job_id)"
      cat /tmp/job_id >> /tmp/all_job_ids
    done
  - openqa/utils/wait_for_job.sh $(cat /tmp/all_job_ids) > /tmp/exit_code
  - exit $(cat /tmp/exit_code)
  after_script:
  - |
    if [ ! -e /tmp/exit_code ]; then
        echo "Job creation failed, log below."
        cat openqa.log
    fi
  - |
    openqa/utils/openqa_junit_report.py $(cat /tmp/all_job_ids) > ./junit.xml
  artifacts:
    when: always
    paths:
    - junit.xml
    - openqa.log
    - worker.log
    reports:
      junit: junit.xml
    expire_in: '1 week'

#
# "Real" CI jobs
#

build-x86_64:
  extends:
  - .build-template
  - .x86_64

build-x86_64_v3:
  extends:
  - .build-template
  - .x86_64_v3

build-i386:
  extends:
  - .build-template
  - .i686

build-aarch64:
  extends:
  - .build-template
  - .aarch64

deploy-flatpak:
  extends: .arch-indep
  stage: deploy
  needs:
  - job: 'build-x86_64'
    artifacts: false
  - job: 'build-i386'
    artifacts: false
  - job: 'build-aarch64'
    artifacts: false
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: $CI_COMMIT_REF_NAME == "master"
    variables:
      FLAT_MANAGER_SERVER: https://flat-manager.gnome.org/
      ENVIRONMENT_NAME: flatpak-nightly
      FLAT_MANAGER_REPO: nightly
      SUPPORTED_ARCHES: "x86_64 i686 aarch64"
  - if: $CI_PIPELINE_SOURCE == "schedule"
    when: never
  - if: $CI_COMMIT_REF_NAME =~ /^gnome-\d\d$/ && $FLATPAK_BRANCH =~ /beta$/
    variables:
      FLAT_MANAGER_SERVER: https://hub.flathub.org/
      ENVIRONMENT_NAME: flathub/$FLATPAK_BRANCH
      FLAT_MANAGER_REPO: beta
      SUPPORTED_ARCHES: "x86_64 i686 aarch64"
  - if: $CI_COMMIT_REF_NAME =~ /^gnome-\d\d$/
    variables:
      FLAT_MANAGER_SERVER: https://hub.flathub.org/
      ENVIRONMENT_NAME: flathub/$FLATPAK_BRANCH
      FLAT_MANAGER_REPO: stable
      SUPPORTED_ARCHES: "x86_64 i686 aarch64"
  variables:
    RUNNER_AFTER_SCRIPT_TIMEOUT: 20m
    TARGETS: flatpak-runtimes.bst
    TARGETS_nightly: 'flatpak-platform-extensions.bst flatpak-platform-extensions-extra.bst'
  script:
  - TARGETS_REPO=TARGETS_${FLAT_MANAGER_REPO}
  - TARGETS="$TARGETS ${!TARGETS_REPO}"
  - echo $TARGETS

  # Sanity chck where we going to push
  - python3 $CI_PROJECT_DIR/utils/publish-flatpak-gate.py

  - ostree init --repo repo/ --mode archive
  - |
    for ARCH in $SUPPORTED_ARCHES; do
      for target in $TARGETS; do
        $BST -o arch $ARCH artifact checkout $target --directory checkout-repo/
        ostree pull-local --repo repo/ checkout-repo/
        rm -rf checkout-repo/
      done
    done
  - ostree fsck --repo repo/ --all
  - flatpak build-update-repo --generate-static-deltas repo/

  - flat-manager-client create $FLAT_MANAGER_SERVER $FLAT_MANAGER_REPO > build.txt
  - flat-manager-client push $(cat build.txt) repo/
  - flat-manager-client commit --wait $(cat build.txt)
  - flat-manager-client publish --wait $(cat build.txt)
  after_script:
  - flat-manager-client purge $(cat build.txt)
  environment:
    name: $ENVIRONMENT_NAME

deploy-oci:
  stage: deploy
  extends:
  - .x86_64_v3
  rules:
    - !reference [.deploy-rules, rules]
  needs:
  - job: 'build-x86_64_v3'
    artifacts: false
  # Sometimes podman push will timeout
  retry: 2
  script:
  - ${BST} ${ARCH_OPT} artifact pull oci/platform.bst oci/sdk.bst oci/core.bst
  - ${BST} ${ARCH_OPT} artifact checkout --tar - oci/platform.bst | podman load
  - ${BST} ${ARCH_OPT} artifact checkout --tar - oci/sdk.bst | podman load
  - ${BST} ${ARCH_OPT} artifact checkout --tar - oci/core.bst | podman load
  - |
    if [ -n "$OCI_REGISTRY_PASSWORD" ] && [ "${CI_COMMIT_REF_PROTECTED-}" = true ]; then
        ./utils/publish-oci-quay.sh
    fi

sysupdate-image-x86_64:
  extends:
  - .x86_64_v3
  - .sysupdate-image
  needs:
  - job: 'build-x86_64_v3'
    artifacts: false

sysupdate-image-aarch64:
  extends:
  - .aarch64
  - .sysupdate-image
  needs:
  - job: 'build-aarch64'
    artifacts: false

.sysupdate-image:
  rules:
  - !reference [.deploy-rules, rules]
  # Also allow to manually trigger it for normal branches
  - if: '$CI_COMMIT_REF_NAME'
    when: manual
    allow_failure: true
  stage: deploy
  script:
  - ${BST_NO_PUSH} ${ARCH_OPT} --max-jobs $(( $(nproc) / 4 ))  build gnomeos/update-images.bst

  - ${BST} ${ARCH_OPT} artifact checkout --hardlinks gnomeos/update-images.bst --directory update-images/

  - |
    if [ -n "$AWS_ACCESS_KEY_ID" ] && [ -n "$SECURE_BOOT_DISTRIBUTION_KEY" ] && [ "${CI_COMMIT_REF_PROTECTED-}" = true ]; then
        ./utils/publish-sysupdate-to-s3.sh
    fi

pinephone-image:
  extends:
  - .manual-image-template
  - .aarch64
  needs:
  - job: "build-aarch64"
    artifacts: false
  variables:
    IMAGE: boards/pinephone/image.bst

pinephone-pro-image:
  extends:
  - .manual-image-template
  - .aarch64
  needs:
  - job: "build-aarch64"
    artifacts: false
  variables:
    IMAGE: boards/pinephone-pro/image.bst

iso-installer-x86_64:
  extends:
  - .manual-image-template
  - .x86_64_v3
  variables:
    IMAGE: iso/image.bst
  needs:
  - job: 'build-x86_64_v3'
    artifacts: false

s3-image:
  extends: .x86_64_v3
  stage: deploy
  needs:
  - job: 'build-x86_64_v3'
    artifacts: false
  script:
  - ${BST_NO_PUSH} --max-jobs $(( $(nproc) / 4 )) ${ARCH_OPT} build gnomeos/image.bst iso/image.bst
  - ${BST} ${ARCH_OPT} artifact checkout --hardlinks gnomeos/image.bst --directory secure-image
  - ${BST} ${ARCH_OPT} artifact checkout --hardlinks iso/image.bst --directory iso

  - |
    if [ -n "$CI_COMMIT_TAG" ]; then
        aws $AWS_ENDPOINT_URL s3 cp --acl public-read secure-image/disk.img.xz \
            "s3://gnome-build-meta/tag/${CI_COMMIT_TAG}/disk_${CI_COMMIT_TAG}-${ARCH}.img.xz"
        aws $AWS_ENDPOINT_URL s3 cp --acl public-read iso/installer.iso \
            s3://gnome-build-meta/tag/$CI_COMMIT_TAG/gnome_os_installer_$CI_COMMIT_TAG.iso
    else
        aws $AWS_ENDPOINT_URL s3 cp --acl public-read secure-image/disk.img.xz \
            "s3://gnome-build-meta/nightly/${CI_PIPELINE_ID}/disk_${CI_PIPELINE_ID}-${ARCH}.img.xz"
        aws $AWS_ENDPOINT_URL s3 cp --acl public-read iso/installer.iso \
            s3://gnome-build-meta/nightly/$CI_PIPELINE_ID/gnome_os_installer_$CI_PIPELINE_ID.iso
    fi

  - aws $AWS_ENDPOINT_URL s3 ls --recursive --human-readable s3://gnome-build-meta/

  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: $CI_COMMIT_REF_NAME == "master"
  - if: $CI_COMMIT_TAG

s3-image-aarch64:
  extends: .aarch64
  stage: deploy
  needs:
  - job: 'build-aarch64'
    artifacts: false
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: $CI_COMMIT_REF_NAME == "master"
  - if: $CI_COMMIT_TAG
  script:
  - ${BST_NO_PUSH} --max-jobs $(( $(nproc) / 4 )) ${ARCH_OPT} build gnomeos/image.bst
  - ${BST} ${ARCH_OPT} artifact checkout --hardlinks gnomeos/image.bst --directory secure-image

  - |
    if [ -n "$CI_COMMIT_TAG" ]; then
        aws --$AWS_ENDPOINT_URL s3 cp --acl public-read secure-image/disk.img.xz \
            "s3://gnome-build-meta/tag/${CI_COMMIT_TAG}/disk_${CI_COMMIT_TAG}-${ARCH}.img.xz"
    else
        aws $AWS_ENDPOINT_URL s3 cp --acl public-read secure-image/disk.img.xz \
            "s3://gnome-build-meta/nightly/${CI_PIPELINE_ID}/disk_${CI_PIPELINE_ID}-${ARCH}.img.xz"
    fi

  - aws $AWS_ENDPOINT_URL s3 ls --recursive --human-readable s3://gnome-build-meta/

openh264-x86_64:
  extends:
  - .x86_64
  stage: deploy
  needs: []
  allow_failure: true
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: $CI_COMMIT_REF_NAME == "master"
    when: manual
  script:
  - git clone https://gitlab.com/freedesktop-sdk/openh264-extension.git
  - cd openh264-extension
  - ${BST} build flatpak-repo.bst
  - ${BST} artifact checkout flatpak-repo.bst --directory flatpak-repo.bst
  - test -e repo || ostree init --repo=repo --mode=archive
  - flatpak build-commit-from --src-repo=flatpak-repo.bst --subject $(git rev-parse HEAD) repo
  - flatpak build-update-repo --generate-static-deltas repo/
  - rm -rf flatpak-repo.bst
  - BUILD_ID=$(flat-manager-client create https://nightly.gnome.org/ nightly)
  - flat-manager-client push --commit --publish --wait $BUILD_ID repo/ || result=$?
  - flat-manager-client purge $BUILD_ID
  - exit $result


s3-image-static:
  extends: .arch-indep
  stage: reports
  needs:
  - job: s3-image
    artifacts: false
  - job: sysupdate-image-x86_64
    artifacts: false
  - job: s3-image-aarch64
    artifacts: false
  - job: sysupdate-image-aarch64
    artifacts: false
  - job: test-openqa-installer
    artifacts: false
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: $CI_PIPELINE_SOURCE == "web" && $CI_COMMIT_REF_NAME == "master"
    when: manual
    needs:
    - job: s3-image
      artifacts: false
    - job: sysupdate-image-x86_64
      artifacts: false
  - if: $CI_COMMIT_REF_NAME == "master"
    when: on_success
  script:
  - |
    echo nightly/$CI_PIPELINE_ID/gnome_os_installer_$CI_PIPELINE_ID.iso > latest-iso

    echo nightly/$CI_PIPELINE_ID/disk_$CI_PIPELINE_ID-x86_64.img.xz > latest-x86_64-disk
    echo nightly/$CI_PIPELINE_ID/disk_$CI_PIPELINE_ID-aarch64.img.xz > latest-aarch64-disk
  - |
    aws $AWS_ENDPOINT_URL s3 cp --acl public-read latest-iso s3://gnome-build-meta/latest-iso

    aws $AWS_ENDPOINT_URL s3 cp --acl public-read latest-x86_64-disk s3://gnome-build-meta/latest-x86_64-disk
    aws $AWS_ENDPOINT_URL s3 cp --acl public-read latest-aarch64-disk s3://gnome-build-meta/latest-aarch64-disk

  - aws $AWS_ENDPOINT_URL s3 ls --recursive --human-readable s3://gnome-build-meta/


s3-image-static-stable:
  extends: .arch-indep
  stage: reports
  needs:
  - job: s3-image
    artifacts: false
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: $CI_COMMIT_TAG
  script:
  - |
    # For 47.x tag use 47 branch
    branch=$(echo $CI_COMMIT_TAG | cut -d . -f 1)

    echo tag/$CI_COMMIT_TAG/gnome_os_installer_$CI_COMMIT_TAG.iso > stable-$branch-iso
  - |
    aws $AWS_ENDPOINT_URL s3 cp --acl public-read stable-$branch-x86_64-disk s3://gnome-build-meta/stable-$branch-x86_64-disk
    aws $AWS_ENDPOINT_URL s3 cp --acl public-read stable-$branch-iso s3://gnome-build-meta/stable-$branch-iso

  - aws $AWS_ENDPOINT_URL s3 ls --recursive --human-readable s3://gnome-build-meta/


cve_report:
  extends: .aarch64
  variables:
    CVE_MOUNTS: "--mount cve /buildstream-build --mount cve-reports /cve-reports --mount manifests /manifests"
    GEN_CVE_REPORT: "${BST} ${ARCH_OPT} shell freedesktop-sdk.bst:utils/generate-cve-report.bst --mount cve /buildstream-build"
  stage: 'deploy'
  needs:
  - job: 'build-aarch64'
    artifacts: false
  script:
  - ${BST} ${ARCH_OPT} artifact pull gnomeos/manifest-devel.bst
  - ${BST} artifact pull flatpak/platform-manifest.bst flatpak/sdk-manifest.bst
  - ${BST} build freedesktop-sdk.bst:utils/generate-cve-report.bst

  - mkdir -p cve manifests/ cve-reports/
  - ${BST} artifact checkout flatpak/platform-manifest.bst --directory manifests/platform
  - ${BST} artifact checkout flatpak/sdk-manifest.bst --directory manifests/sdk
  - ${BST} ${ARCH_OPT} artifact checkout gnomeos/manifest-devel.bst --directory manifests/gnomeos

  - ${GEN_CVE_REPORT} -- update_local_cve_database
  - ${GEN_CVE_REPORT} ${CVE_MOUNTS} -- generate_cve_report /manifests/platform/usr/manifest.json /cve-reports/platform.html
  - ${GEN_CVE_REPORT} ${CVE_MOUNTS} -- generate_cve_report /manifests/sdk/usr/manifest.json /cve-reports/sdk.html
  - ${GEN_CVE_REPORT} ${CVE_MOUNTS} -- generate_cve_report /manifests/gnomeos/usr/manifest.json /cve-reports/gnomeos.html
  cache:
    key: cve
    paths:
    - cve
  artifacts:
    paths:
    - cve-reports
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: $CI_COMMIT_REF_NAME == "master" || $CI_COMMIT_REF_NAME =~ /^gnome-\d\d$/
  - if: $CI_COMMIT_REF_NAME != "master"
    when: "manual"
    allow_failure: true

test-openqa-installer:
  extends:
  - .test-openqa-template
  - .x86_64
  variables:
    TESTSUITES: "gnome_install"
  before_script:
  - |
    echo "Preparing test media for installer test"
    if [ -n "$CI_COMMIT_TAG" ]; then
        S3_ISO_IMAGE_URL=https://os.gnome.org/download/${CI_COMMIT_TAG}/gnome_os_installer_${CI_COMMIT_TAG}.iso
    else
        S3_ISO_IMAGE_URL=https://os.gnome.org/download/${CI_PIPELINE_ID}/gnome_os_installer_${CI_PIPELINE_ID}.iso
    fi
    mkdir -p /data/factory/iso
    curl --fail --get --location $S3_ISO_IMAGE_URL --output /data/factory/iso/installer.iso
    sha256sum /data/factory/iso/installer.iso
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: $CI_COMMIT_REF_NAME == "master"
  - if: $CI_COMMIT_TAG

test-openqa-desktop:
  extends:
  - .test-openqa-template
  - .x86_64
  variables:
    TESTSUITES: "gnome_apps gnome_accessibility gnome_mobile gnome_locales"
  before_script:
  - |
    echo "Preparing test media for desktop test"
    if [ -n "$CI_COMMIT_TAG" ]; then
        S3_DISK_IMAGE_URL=https://os.gnome.org/download/${CI_COMMIT_TAG}/disk_${CI_COMMIT_TAG}-x86_64.img.xz
    else
        S3_DISK_IMAGE_URL=https://os.gnome.org/download/${CI_PIPELINE_ID}/disk_${CI_PIPELINE_ID}-x86_64.img.xz
    fi
    mkdir -p /data/factory/hdd
    curl --fail --get --location $S3_DISK_IMAGE_URL --output /data/factory/hdd/disk.img.xz
    unxz /data/factory/hdd/disk.img.xz
    sha256sum /data/factory/hdd/disk.img
    disk_size_gb=15
    dd if=/dev/zero of=/data/factory/hdd/disk.img seek=$disk_size_gb obs=1GB count=0
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: $CI_COMMIT_REF_NAME == "master"
  - if: $CI_COMMIT_TAG
  allow_failure: true

test-pinephone-aarch64:
  extends:
  - .test-phone-image-template
  script:
  - python3 utils/test_phone_image.py test-pinephone-aarch64
  needs:
  - job: "pinephone-image"

test-pinephone-pro-aarch64:
  extends:
  - .test-phone-image-template
  script:
  - python3 utils/test_phone_image.py test-pinephone-pro-aarch64
  needs:
  - job: "pinephone-pro-image"

update_refs:
  stage: "track-refs"
  tags:
  - x86_64
  - gnome-build-meta
  variables:
    SSH_SERVER_HOSTKEYS: "ssh.gitlab.gnome.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHG6b3deoYMPwKEu9Sj+y6MBHYYUKQiAnta/go3aNv7R"
  timeout: '90m'
  rules:
    - !reference [".stage-only-rules", "rules"]
  script:
  - bash "$CI_PROJECT_DIR/.gitlab-ci/ci-bot-track-refs.sh"
  # Fetch the sources and push them into the source cache
  - ${BST} source push
  after_script:
  - rm -rf ~/.ssh

pages:
  stage: 'reports'
  needs:
  - job: 'cve_report'
    artifacts: true
  script:
  - mkdir -p public/master/
  - mv cve-reports/ public/master/
  - python3 utils/download_cve_reports.py
  - python3 utils/generate_release_contents.py
  artifacts:
    paths:
    - 'public'
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: $CI_COMMIT_REF_NAME == "master"

make-git-archive:
  stage: "deploy"
  needs:
  - job: 'build-x86_64_v3'
    artifacts: false
  - job: 'build-x86_64'
    artifacts: false
  - job: 'build-i386'
    artifacts: false
  - job: 'build-aarch64'
    artifacts: false
  before_script: []
  script:
  - version=${CI_COMMIT_TAG:-$CI_COMMIT_SHORT_SHA}
  - git archive --prefix gnome-$version/ -o ${CI_PROJECT_NAME}-$version.tar $version
  - xz ${CI_PROJECT_NAME}-$version.tar
  rules:
  - !reference [".stage-only-rules", "rules"]
  - if: $CI_COMMIT_TAG
  - if: $CI_COMMIT_SHORT_SHA
    when: "manual"
    allow_failure: true
  artifacts:
    expire_in: "2 days"
    paths:
    - "*.tar.xz"