stages:
  - image
  - build

variables:
  DOCKER_HOST: tcp://docker:2375
  DOCKER_TLS_CERTDIR: ""
  DOCKER_BUILDKIT: "1"
  # apt mirror used inside both images (override per pipeline if needed)
  APT_MIRROR: "http://mirrors.tuna.tsinghua.edu.cn/ubuntu"
  # Images are shared through Harbor (plain HTTP), never as artifacts.
  HARBOR_HOST: "192.168.1.11:9090"
  HARBOR_PROJECT: "openra3"
  IMAGE: "$HARBOR_HOST/$HARBOR_PROJECT/$CI_PROJECT_NAME"

# dind: pull docker.io through the intranet Harbor proxy (plain HTTP ->
# --insecure-registry) and enable the containerd snapshotter so the *docker*
# driver can export the registry BuildKit cache (the classic overlay2 driver
# rejects it). Anchor is an array, so `services: *dind` stays an array.
.dind: &dind
  - name: docker:dind
    command:
      - --registry-mirror=http://192.168.1.11:9090/dockerhub
      - --insecure-registry=192.168.1.11:9090
      - --feature=containerd-snapshotter=true

# Retry helper for transient network failures (login / build / push / pull).
.retry: &retry
  - |
    retry() {
      n=0
      until "$@"; do
        n=$((n + 1))
        [ "$n" -ge 5 ] && { echo "failed after $n tries: $*" >&2; return 1; }
        echo "attempt $n failed, retrying: $*" >&2
        sleep 15
      done
    }

# --- build the two isolated toolchain images and push them to Harbor ----------
linux_image:
  stage: image
  image: docker:latest
  services: *dind
  tags:
    - docker
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - |
      retry docker build \
        --cache-from type=registry,ref=$IMAGE:cache-linux,insecure=true \
        --cache-to type=registry,ref=$IMAGE:cache-linux,mode=max,insecure=true \
        --build-arg APT_MIRROR=$APT_MIRROR \
        --target dev \
        -t $IMAGE:$CI_COMMIT_SHORT_SHA-linux \
        -f Dockerfile .
    - retry docker push $IMAGE:$CI_COMMIT_SHORT_SHA-linux

windows_image:
  stage: image
  image: docker:latest
  services: *dind
  tags:
    - docker
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - |
      retry docker build \
        --cache-from type=registry,ref=$IMAGE:cache-windows,insecure=true \
        --cache-to type=registry,ref=$IMAGE:cache-windows,mode=max,insecure=true \
        --build-arg APT_MIRROR=$APT_MIRROR \
        --target dev \
        -t $IMAGE:$CI_COMMIT_SHORT_SHA-windows \
        -f Dockerfile.win .
    - retry docker push $IMAGE:$CI_COMMIT_SHORT_SHA-windows

# --- build and test each target ----------------------------------------------
build_linux:
  stage: build
  image: docker:latest
  services: *dind
  tags:
    - docker
  needs:
    - linux_image
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - retry docker pull $IMAGE:$CI_COMMIT_SHORT_SHA-linux
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-linux cmake -S . -B build/linux -G Ninja -DCMAKE_BUILD_TYPE=Release -DOPENRA3_DISTRO_TAG=ubuntu26.04
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-linux cmake --build build/linux -j
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-linux ctest --test-dir build/linux --output-on-failure
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-linux bash -c "cd build/linux && cpack -G DEB"
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-linux bash -c "mkdir -p artifacts/linux && cp build/linux/bin/openra3 build/linux/*.deb artifacts/linux/"
  artifacts:
    name: "$CI_PROJECT_NAME-linux-$CI_COMMIT_SHORT_SHA"
    paths:
      - artifacts/linux/
    expire_in: 7 days

build_windows:
  stage: build
  image: docker:latest
  services: *dind
  tags:
    - docker
  needs:
    - windows_image
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - retry docker pull $IMAGE:$CI_COMMIT_SHORT_SHA-windows
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-windows
        cmake -S . -B build/windows -G Ninja
          -DCMAKE_TOOLCHAIN_FILE=cmake/toolchains/llvm-mingw-x86_64.cmake
          -DCMAKE_BUILD_TYPE=Release
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-windows cmake --build build/windows -j
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-windows cmake --build build/windows --target openra3_msi
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-windows bash -c "cd build/windows && cpack -G ZIP"
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-windows bash -c "mkdir -p artifacts/windows && cp build/windows/bin/openra3.exe build/windows/bin/SDL3.dll build/windows/bin/*.msi build/windows/*.zip artifacts/windows/"
  artifacts:
    name: "$CI_PROJECT_NAME-windows-$CI_COMMIT_SHORT_SHA"
    paths:
      - artifacts/windows/
    expire_in: 7 days

# --- arm64 + Debian toolchain images -----------------------------------------
linux_arm64_image:
  stage: image
  image: docker:latest
  services: *dind
  tags:
    - docker
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - |
      retry docker build \
        --cache-from type=registry,ref=$IMAGE:cache-linux-arm64,insecure=true \
        --cache-to type=registry,ref=$IMAGE:cache-linux-arm64,mode=max,insecure=true \
        --build-arg APT_MIRROR=$APT_MIRROR \
        --target dev \
        -t $IMAGE:$CI_COMMIT_SHORT_SHA-linux-arm64 \
        -f Dockerfile.linux-arm64 .
    - retry docker push $IMAGE:$CI_COMMIT_SHORT_SHA-linux-arm64

windows_arm64_image:
  stage: image
  image: docker:latest
  services: *dind
  tags:
    - docker
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - |
      retry docker build \
        --cache-from type=registry,ref=$IMAGE:cache-windows-arm64,insecure=true \
        --cache-to type=registry,ref=$IMAGE:cache-windows-arm64,mode=max,insecure=true \
        --build-arg APT_MIRROR=$APT_MIRROR \
        --target dev \
        -t $IMAGE:$CI_COMMIT_SHORT_SHA-windows-arm64 \
        -f Dockerfile.win-arm64 .
    - retry docker push $IMAGE:$CI_COMMIT_SHORT_SHA-windows-arm64

debian_image:
  stage: image
  image: docker:latest
  services: *dind
  tags:
    - docker
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - |
      retry docker build \
        --cache-from type=registry,ref=$IMAGE:cache-debian,insecure=true \
        --cache-to type=registry,ref=$IMAGE:cache-debian,mode=max,insecure=true \
        --build-arg APT_MIRROR=$APT_MIRROR \
        --target dev \
        -t $IMAGE:$CI_COMMIT_SHORT_SHA-debian \
        -f Dockerfile.debian .
    - retry docker push $IMAGE:$CI_COMMIT_SHORT_SHA-debian

debian_arm64_image:
  stage: image
  image: docker:latest
  services: *dind
  tags:
    - docker
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - |
      retry docker build \
        --cache-from type=registry,ref=$IMAGE:cache-debian-arm64,insecure=true \
        --cache-to type=registry,ref=$IMAGE:cache-debian-arm64,mode=max,insecure=true \
        --build-arg APT_MIRROR=$APT_MIRROR \
        --target dev \
        -t $IMAGE:$CI_COMMIT_SHORT_SHA-debian-arm64 \
        -f Dockerfile.debian-arm64 .
    - retry docker push $IMAGE:$CI_COMMIT_SHORT_SHA-debian-arm64

# --- build each target (binary + packages) -----------------------------------
build_linux_arm64:
  stage: build
  image: docker:latest
  services: *dind
  tags:
    - docker
  needs:
    - linux_arm64_image
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - retry docker pull $IMAGE:$CI_COMMIT_SHORT_SHA-linux-arm64
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-linux-arm64 cmake -S . -B build/linux-arm64 -G Ninja -DCMAKE_TOOLCHAIN_FILE=cmake/toolchains/clang-aarch64-linux-gnu.cmake -DCMAKE_BUILD_TYPE=Release -DOPENRA3_DISTRO_TAG=ubuntu26.04
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-linux-arm64 cmake --build build/linux-arm64 -j
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-linux-arm64 bash -c "cd build/linux-arm64 && cpack -G DEB"
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-linux-arm64 bash -c "mkdir -p artifacts/linux-arm64 && cp build/linux-arm64/bin/openra3 build/linux-arm64/*.deb artifacts/linux-arm64/"
  artifacts:
    name: "$CI_PROJECT_NAME-linux-arm64-$CI_COMMIT_SHORT_SHA"
    paths:
      - artifacts/linux-arm64/
    expire_in: 7 days

build_windows_arm64:
  stage: build
  image: docker:latest
  services: *dind
  tags:
    - docker
  needs:
    - windows_arm64_image
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - retry docker pull $IMAGE:$CI_COMMIT_SHORT_SHA-windows-arm64
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-windows-arm64 cmake -S . -B build/windows-arm64 -G Ninja -DCMAKE_TOOLCHAIN_FILE=cmake/toolchains/llvm-mingw-aarch64.cmake -DCMAKE_BUILD_TYPE=Release
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-windows-arm64 cmake --build build/windows-arm64 -j
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-windows-arm64 bash -c "cd build/windows-arm64 && cpack -G ZIP"
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-windows-arm64 bash -c "mkdir -p artifacts/windows-arm64 && cp build/windows-arm64/bin/openra3.exe build/windows-arm64/bin/SDL3.dll build/windows-arm64/*.zip artifacts/windows-arm64/"
  artifacts:
    name: "$CI_PROJECT_NAME-windows-arm64-$CI_COMMIT_SHORT_SHA"
    paths:
      - artifacts/windows-arm64/
    expire_in: 7 days

build_debian:
  stage: build
  image: docker:latest
  services: *dind
  tags:
    - docker
  needs:
    - debian_image
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - retry docker pull $IMAGE:$CI_COMMIT_SHORT_SHA-debian
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-debian cmake -S . -B build/debian -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_STDLIB_MODULES_JSON=/usr/lib/llvm-19/lib/libc++.modules.json -DOPENRA3_DISTRO_TAG=debian13
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-debian cmake --build build/debian -j
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-debian ctest --test-dir build/debian --output-on-failure
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-debian bash -c "cd build/debian && cpack -G DEB"
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-debian bash -c "mkdir -p artifacts/debian && cp build/debian/bin/openra3 build/debian/*.deb artifacts/debian/"
  artifacts:
    name: "$CI_PROJECT_NAME-debian-$CI_COMMIT_SHORT_SHA"
    paths:
      - artifacts/debian/
    expire_in: 7 days

build_debian_arm64:
  stage: build
  image: docker:latest
  services: *dind
  tags:
    - docker
  needs:
    - debian_arm64_image
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - retry docker pull $IMAGE:$CI_COMMIT_SHORT_SHA-debian-arm64
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-debian-arm64 cmake -S . -B build/debian-arm64 -G Ninja -DCMAKE_TOOLCHAIN_FILE=cmake/toolchains/clang-aarch64-linux-gnu.cmake -DCMAKE_BUILD_TYPE=Release -DOPENRA3_AARCH64_CC=clang-19 -DOPENRA3_AARCH64_CXX=clang++-19 -DOPENRA3_AARCH64_STDLIB_MODULES_JSON=/usr/lib/llvm-19/lib/libc++.modules.json -DOPENRA3_DISTRO_TAG=debian13
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-debian-arm64 cmake --build build/debian-arm64 -j
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-debian-arm64 bash -c "cd build/debian-arm64 && cpack -G DEB"
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-debian-arm64 bash -c "mkdir -p artifacts/debian-arm64 && cp build/debian-arm64/bin/openra3 build/debian-arm64/*.deb artifacts/debian-arm64/"
  artifacts:
    name: "$CI_PROJECT_NAME-debian-arm64-$CI_COMMIT_SHORT_SHA"
    paths:
      - artifacts/debian-arm64/
    expire_in: 7 days
# --- WebAssembly (Emscripten) -------------------------------------------------
wasm_image:
  stage: image
  image: docker:latest
  services: *dind
  tags:
    - docker
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - |
      retry docker build \
        --cache-from type=registry,ref=$IMAGE:cache-wasm,insecure=true \
        --cache-to type=registry,ref=$IMAGE:cache-wasm,mode=max,insecure=true \
        --build-arg APT_MIRROR=$APT_MIRROR \
        --target dev \
        -t $IMAGE:$CI_COMMIT_SHORT_SHA-wasm \
        -f Dockerfile.wasm .
    - retry docker push $IMAGE:$CI_COMMIT_SHORT_SHA-wasm

build_wasm:
  stage: build
  image: docker:latest
  services: *dind
  tags:
    - docker
  needs:
    - wasm_image
  before_script: *retry
  script:
    - retry sh -c 'echo "$HARBOR_PASSWORD" | docker login "$HARBOR_HOST" -u "$HARBOR_USERNAME" --password-stdin'
    - retry docker pull $IMAGE:$CI_COMMIT_SHORT_SHA-wasm
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-wasm cmake -S . -B build/wasm -G Ninja -DCMAKE_TOOLCHAIN_FILE=cmake/toolchains/emscripten-wasm.cmake -DCMAKE_BUILD_TYPE=Release
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-wasm cmake --build build/wasm -j
    - docker run --rm -v "$(pwd):/work" -w /work $IMAGE:$CI_COMMIT_SHORT_SHA-wasm bash -c "mkdir -p artifacts/wasm && cp build/wasm/bin/openra3.html build/wasm/bin/openra3.js build/wasm/bin/openra3.wasm build/wasm/bin/openra3.data artifacts/wasm/ 2>/dev/null || cp build/wasm/bin/openra3.html build/wasm/bin/openra3.js build/wasm/bin/openra3.wasm artifacts/wasm/"
  artifacts:
    name: "$CI_PROJECT_NAME-wasm-$CI_COMMIT_SHORT_SHA"
    paths:
      - artifacts/wasm/
    expire_in: 7 days