stages:
  - test
  - build
  - deploy
  - pypi-twine

test:
  stage: test
  tags: ["build"]
  except:
    - tags
  script: make test

build:
  stage: build
  tags: ["build"]
  except:
    - tags
  script:
    - make clean
    - make install-source-prod
    # Copy static assets to env/static and create a tarball of the static files.
    - cp -pr make_post_sell/static env/static
    - cp -pr env/static static
    - tar -zcf static.tar.gz static
    # Clean up the directory outside of the gitlab-runner filesystem.
    # rm -rf can race with background processes on build runners — verify removal.
    - rm -rf /opt/make_post_sell/env; for i in 1 2 3; do [ ! -d /opt/make_post_sell/env ] && break; sleep 2; rm -rf /opt/make_post_sell/env; done; [ ! -d /opt/make_post_sell/env ]
    # Ensure bin/python symlink exists (Python 3.12 venv may only create python3).
    - test -f env/bin/python || ln -sf python3 env/bin/python
    # Clone the virtualenv with virtualenv-clone into the desired location.
    - virtualenv-clone -vvv $PWD/env /opt/make_post_sell/env
    # Create a tarball of the virtualenv.
    - tar -zcf env.tar.gz -C /opt/make_post_sell .
    # Create SHA512 hash of env.tar.gz.
    - sha512sum env.tar.gz >> env.tar.gz.hash
    # Create commit-hash.txt to track this build's git commit hash.
    - echo $CI_COMMIT_SHA >> commit-hash.txt

  artifacts:
    paths:
      - env.tar.gz
      - env.tar.gz.hash
      - static.tar.gz
      - commit-hash.txt
    expire_in: 1 month
    when: always

deploy:
  stage: deploy
  needs: [build]
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"'
      when: on_success
  trigger:
    include: .gitlab-ci.deploy.yml

pypi-twine:
  stage: pypi-twine
  tags:
    - build
  only:
    - tags
  script:
    - python3 -m venv twine_env
    - source twine_env/bin/activate
    - pip install --upgrade pip
    # Pin twine <6 — newer twine auto-detects GitLab CI and refuses to
    # fall back to ~/.pypirc on the runner, requiring PYPI_ID_TOKEN
    # (Trusted Publishing OIDC). Until we migrate to Trusted Publishing,
    # stick with the classic ~/.pypirc auth on the build runner.
    - pip install "twine<6" build
    - python3 -m build
    - twine check dist/*
    - twine upload --non-interactive dist/*