include:
  - project: blackduck-inc/black-duck-security-scan
    ref: v2.3.0
    file: templates/security_scan.yml

.coverity scan config:
  stage: coverity
  image: "$CI_REGISTRY_IMAGE/$CI_DESIGNATED_BRANCH_SLUG/builder:latest"
  needs: []
  timeout: 10 hours
  tags:
    - firmware-builder
  variables:
    BRIDGE_COVERITY_CONNECT_URL: https://coverity.prplfoundation.org
    BRIDGE_COVERITY_CONNECT_USER_NAME: prplbot
    BRIDGE_COVERITY_CONNECT_USER_PASSWORD: $COVERITY_PASSPHRASE
    BRIDGE_GITLAB_USER_TOKEN: $GITLAB_API_KEY_EXTERNAL
    BRIDGE_COVERITY_LOCAL: true
    BRIDGE_BREAK: false
    BRIDGE_COVERITY_CLEAN_COMMAND: make clean
    INCLUDE_DIAGNOSTICS: $COVERITY_ENABLE_DIAGNOSTICS
  rules:
    - if: $CI_COMMIT_REF_PROTECTED && $CI_COMMIT_TAG
      variables:
        BRIDGE_COVERITY_CONNECT_POLICY_VIEW: Outstanding Issues
    - if: $CI_PIPELINE_SOURCE == "schedule"
      variables:
        BRIDGE_COVERITY_CONNECT_POLICY_VIEW: Outstanding Issues
    - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_PROTECTED == "true" && $CI_MERGE_REQUEST_LABELS =~ /ci::allow-expensive-jobs/'
  before_script:
    - export BRIDGE_COVERITY_BUILD_COMMAND="make -j $(nproc)"
    - sudo apt-get -qq update && sudo apt-get install -y curl file unzip coccinelle lzop libssl-dev python3-dev
    - touch .build_failed
    - mkdir -p logs
    - set -o pipefail
    - git config --global --add safe.directory '*'

    - |
      crlf_check_failed=$(rgrep -U $'\x0D' profiles | cut -d: -f1 | sort -u || true)
      if test -n "$crlf_check_failed"; then
        echo -e "ERROR: detected CRLF issues in the following YAML profiles:\n"
        for profile in $crlf_check_failed; do
          echo " * $profile"
        done
        echo -e "\nIt might result in hard to debug issues, please fix them."
        exit 1
      fi

    - |
      if [ -z "$CI_COMMIT_TAG" ] && [ "$CI_DESIGNATED_BRANCH" != "$CI_COMMIT_BRANCH" ]; then
        echo "Enabling coredumps and exception tracing in the build."
        export CI_BUILD_ENABLE_COREDUMPS=1
        export CI_BUILD_ENABLE_EXCEPTION_TRACE=1
      else
        echo "Coredumps and exception tracing are disabled in this build."
      fi

    - for script in .gitlab/scripts/build.d/*; do bash "$script"; done

    - >
      if echo "$CI_RUNNER_DESCRIPTION" | grep -v -q "Restricted.*OSP"; then
        sed -i -E 's;git.openwrt.org/(feed|project);github.com/openwrt;' feeds.conf.default
        export CI_BUILD_PROFILE="$(echo $CI_JOB_NAME | sed 's/coverity scan \(.*\)/\1/')"
        scripts/gen_config.py $CI_BUILD_PROFILE 2>&1 | tee logs/build.log
        git checkout -- feeds.conf.default

        for option in $CI_BUILD_CONFIG $CI_BUILD_CONFIG_EXTRA; do
          echo "$option" | sed -E "s/^\+(.*)$/CONFIG_\1=y/;s/^\-(.*)$/CONFIG_\1=n/" >> .config
        done
        echo "CONFIG_REGULATOR_CPR3=n" >> .config
        cat .config
        make defconfig | tee --append logs/build.log

        make -j $(nproc) tools/tar/compile 2>&1 | tee --append logs/build.log
        if [[ "$CI_MERGE_REQUEST_LABELS" == *"skip_integrity_check"* ]]; then
          make -j $(nproc) download 2>&1 | tee --append logs/build.log
        else
          make -j $(nproc) download check FIXUP=1 2>&1 | tee --append logs/build.log
        fi
      else
        grep --color -e "Error updating feeds" -e "ERROR:.*failed to build." logs/build.log && exit 1
      fi

    - >
      git diff-index --exit-code HEAD || {
        ret=$?
        echo "Package integrity issues, please check the output bellow or packages-hash-issues.patch from artifacts"
        git diff | tee packages-hash-issues.patch
        exit $ret
      }

    - >
      topdir=$(pwd);
      for feed in $(find feeds -name .git); do
        pushd $(dirname $feed) > /dev/null; git diff-index --exit-code HEAD || {
          ret=$?
          echo "Feed $(dirname $feed) packages integrity issues, please check the output bellow or feed-packages-hash-issues.patch from artifacts"
          git diff | tee --append $topdir/feed-packages-hash-issues.patch
          exit $ret
        }
        popd > /dev/null
      done

    - >
      trap "
        grep -qz 'package/install[[:space:]]make -r world' logs/build.log && {
          echo '[!] ERROR: package/install seems to fail, enabling verbose output'
          make package/install V=s 2>&1 | tee --append logs/build.log
          grep -C5 'Collected errors:' logs/build.log
        }
        echo '[!] ERROR: build failed'
        exit 1
      " ERR
    - >
      trap "
        grep -qz 'ERROR: target/linux failed to build' logs/build.log && {
          echo '[!] ERROR: target/linux seems to fail, enabling verbose output'
          make target/install -j $(nproc) V=s 2>&1 | tee --append logs/build.log
        }
        echo '[!] ERROR: build failed'
        exit 1
      " ERR
    - make toolchain/compile -j $(nproc) 2>&1 | tee --append logs/build.log

  extends: .run-black-duck-tools
  after_script:
    - mkdir -p bin
    - mkdir -p logs
    - cp .bridge/coverity_connect_scan/*/idir/build-log.txt logs/coverity-build-log.txt 2>/dev/null || true
    - tar -czf bin/coverity-scan-output.tar.gz .bridge/coverity_connect_scan/comparison-report 2>/dev/null || true
  artifacts:
    expire_in: 1 month
    when: always
    paths:
      - logs
      - bin/coverity-scan-output.tar.gz