include:
  - template: SAST.gitlab-ci.yml  # https://gitlab.com/gitlab-org/gitlab-foss/blob/master/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
  - template: Security/Dependency-Scanning.gitlab-ci.yml # https://docs.gitlab.com/ee/user/application_security/dependency_scanning/
  - template: Security/Secret-Detection.gitlab-ci.yml # https://docs.gitlab.com/ee/user/application_security/secret_detection/

variables:
  LANG: "C.UTF-8"

default:
  tags:
    - gitlab-org

workflow:
  rules: &workflow_rules
    # For merge requests, create a pipeline.
    - if: '$CI_MERGE_REQUEST_IID'
    # For `master` branch, create a pipeline (this includes on schedules, pushes, merges, etc.).
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
    # For tags, create a pipeline.
    - if: '$CI_COMMIT_TAG'

.specs:
  cache:
    key: "$CI_JOB_NAME"
    paths:
      - vendor/ruby
  before_script:
    - apt update
    - apt install python3 python3-pip git build-essential -y
    - apt remove python -y
    - pip3 install "docutils==$DOCUTILS_VERSION"
    - bundle install --jobs $(nproc)
  script:
    - echo "Testing without posix-spawn..."
    - cp Gemfile Gemfile.orig
    - sed -i -e '/posix-spawn/d' Gemfile
    - bundle install
    - bundle exec rake test
    - echo "Testing with posix-spawn..."
    - mv Gemfile.orig Gemfile
    - bundle install
    - bundle exec rake test

.docutils-016:
  variables:
    DOCUTILS_VERSION: "0.16"

.docutils-019:
    variables:
      DOCUTILS_VERSION: "0.19"

ruby-27-du16:
  image: ruby:2.7
  extends:
    - .docutils-016
    - .specs

ruby-30-du16:
  image: ruby:3.0
  extends:
    - .docutils-016
    - .specs

ruby-27-du19:
  image: ruby:2.7
  extends:
    - .docutils-019
    - .specs

ruby-30-du19:
  image: ruby:3.0
  extends:
    - .docutils-019
    - .specs

# Dependency Scanning
gemnasium-dependency_scanning:
  rules: *workflow_rules

# Secret Detection
secret_detection:
  rules: *workflow_rules
