# Werkator CI configuration for werkregie (built by https://werkator.javagil.de).
# Reference: https://github.com/mhoennig/werkator/blob/main/docs/configuration.md
werkator:
  version:
    since: "1.0.1"

gitea:
  baseUrl: https://git.javagil.de
  owner: mi
  repo: werkregie
  statusContext: werkator

artifacts:
  retentionPerBranch: 3

watcher:
  newBranchMaxAge: 5d

builds:
  # The gradle wrapper is committed, so the build environment needs a JDK
  # and nothing else; Foojay loads the Temurin 25 of the toolchain (ADR 0001).
  # Gradle itself runs on it too, by dashboard/gradle/gradle-daemon-jvm.properties:
  # the host's Java 17 is too old for werkcrappit's plugin.
  default:
    trigger:
      onPush: true
    cleanCommand: rm -rf dashboard/build
    # pitestPartial mutates the classes the branch changes against origin/main; a few take a minute, all of them 13
    buildCommand: cd dashboard && ./gradlew --console=plain --no-daemon build pitestPartial mutationCrapCheck
    timeout: 20m
    artifactDirs:
      - dashboard/build/reports
    stdoutLog: build.stdout.log
    stderrLog: build.stderr.log

  # The deployment of the server on mih09: what it does is the repository's,
  # when, for which branches, where and with which key is the host's part in .git/werkator/.werkator.yml,
  # pinned, so that no branch deploys itself; without it this definition has no trigger and never runs.
  # The host part: the trigger afterSuccessOf default on main, and the ssh alias werkregie-deploy, see dashboard/README.md.
  deploy:
    # keeps what the green build compiled; the script builds the runtime bundle of the tested commit
    cleanCommand: ""
    buildCommand: dashboard/packaging/werkregie-deploy
    statusContext: werkator/deploy
    # the bundle is 89 MiB and has no reader once it is installed
    artifactDirs: []

  # The known vulnerabilities of the dependencies (doc/risk-analysis.md), for each branch but main:
  # it fails only on those the branch brings against the merge base with main; main is checked each night.
  # It only reads the NVD data, which vulnerability-data loads each night into the Gradle home of the host's user;
  # the host's gradle.properties holds the NVD API key as OWASP_API_KEY.
  dependencies:
    trigger:
      onPush: true
      # named, not left out: Werkator merges a branch's trigger key by key into main's
      branches: ["*", "!main"]
    buildCommand: >-
      cd dashboard && ./gradlew --console=plain --no-daemon
      checkNewVulnerabilities -PvulnerabilityBaseline=origin/main
    statusContext: werkator/dependencies
    # inherits everything but the trigger from default, so artifactDirs keeps the reports of dashboard/build/reports

  # Loads the NVD data once a day, so that no check waits for it; a first download takes far longer than 10 min.
  # Then it checks main in full: a vulnerability found anew in a dependency of main turns it red.
  vulnerability-data:
    trigger:
      atTimes: ["02:00"]
      branches: ["main"]
    buildCommand: cd dashboard && ./gradlew --console=plain --no-daemon dependencyCheckUpdate dependencyCheckAnalyze
    # empty takes the host's executor.buildTimeout instead of the 10 min this build would inherit from default
    timeout: ""
    statusContext: werkator/vulnerability-data

  # Mutates all classes of main and writes the CodeCharta.
  # It shares main's worktree with default, so it deletes only its own reports (Werkator, PR#94).
  mutation:
    trigger:
      atTimes: ["04:00"]
      branches: ["main"]
      activeWithin: 24h
    cleanCommand: rm -rf dashboard/build/reports/pitest dashboard/build/reports/codecharta
    buildCommand: cd dashboard && ./gradlew --console=plain --no-daemon pitestFull mutationCrapCodeCharta mutationCrapCheck
    timeout: ""
    statusContext: werkator/mutation