.gitlab-ci.yml

stages:
  - Build
  - Test
  - Artifact Links

variables:
  BUILD_WIN: 'y'
  BUILD_WIN_ARM64: 'y'
  BUILD_MAC: 'y'
  BUILD_LINUX: 'y'
  BUILD_LINUX_ARM64: 'y'
  GIT_DEPTH: 5 # Only grab the last 5 commits when cloning
  NEXUS_PATH_ROOT: 'https://nexus.int.windscribe.com/repository/client-desktop/client-desktop'
  NEXUS_PATH_DEPS: '$NEXUS_PATH_ROOT/dependencies/current'
  NEXUS_PATH_VCPKG_CACHE: '$NEXUS_PATH_ROOT/vcpkg_cache/current'
  NEXUS_PATH_BRANCH_UPLOAD: '${NEXUS_PATH_ROOT}/branches/${CI_COMMIT_BRANCH}'
  NEXUS_PATH_TAGGED_UPLOAD: '${NEXUS_PATH_ROOT}/tagged-builds'
  LINUX_SIGNING_PATH: 'client/common/keys/linux'
  LINUX_PUBLIC_KEY_PATH: '$LINUX_SIGNING_PATH/key.pub'
  MAC_PROVISION_PROFILE_PATH : 'backend/mac/provisioning_profile'
  MAC_PROVISION_PROFILE_FILE_PATH: '$MAC_PROVISION_PROFILE_PATH/embedded.provisionprofile'
  ARCH_LINUX_BUILD_PATH: '/home/build/windscribe'
  RHEL_CMAKE_BUILD_PATH: '/home/build/windscribe'
  BUILD_LIBS_FOLDER: 'build-libs'
  VCPKG_ROOT_WINDOWS: 'c:\vcpkg'
  VCPKG_DEFAULT_BINARY_CACHE_WINDOWS: 'c:\vcpkg_cache'

.template_win10_build: &template_win10_build
  tags: [win10qty6]
  before_script:
    - ./tools/vcpkg/install_ci/vcpkg_install.bat %VCPKG_ROOT_WINDOWS% --configure-git
    - python3 -m pip install -r tools/requirements.txt
    # Remove the default Powershell curl alias so referencing 'curl' will call Windows built-in curl.exe
    - Remove-Item alias:curl
    - Set-Alias -Name curl -Value curl.exe
  interruptible: true

.template_win10_sign: &template_win10_sign
  tags: [win10-digicert-sign]
  before_script:
    - python3 -m pip install -r tools/requirements.txt
    # Remove the default Powershell curl alias so referencing 'curl' will call Windows built-in curl.exe
    - Remove-Item alias:curl
    - Set-Alias -Name curl -Value curl.exe
  interruptible: true

.template_mac_build: &template_mac_build
  before_script:
    - brew install pkg-config
    - export VCPKG_ROOT="${HOME}/vcpkg"
    - ./tools/vcpkg/install_ci/vcpkg_install.sh "${VCPKG_ROOT}" --configure-git
    - python3 -m pip install -r tools/requirements.txt
    - python3 -m pip install dmgbuild
    - python3 -m pip install gcovr
  interruptible: true

.template_aarch64_ubuntu_build: &template_aarch64_ubuntu_build
  tags: [linux-arm64-qt6]
  image: registry.gitlab.int.windscribe.com:5005/ws/client/desktop/client-desktop/ubuntu-aarch64
  before_script:
    - python3 -m pip install --user -r tools/requirements.txt
    # hack to fix 777 file permissions, which breaks the dpkg-deb command in the build_all script.
    - chmod -R o-w installer/linux
    # vcpkg settings
    - export VCPKG_ROOT="${HOME}/vcpkg"
    - export VCPKG_FORCE_SYSTEM_BINARIES=1
    - wget -q https://github.com/NixOS/patchelf/releases/download/0.18.0/patchelf-0.18.0-aarch64.tar.gz && mkdir -p tools/patchelf && tar -C tools/patchelf -xzf patchelf-0.18.0-aarch64.tar.gz
    - export PATH=${RHEL_CMAKE_BUILD_PATH}/bin:`pwd`/tools/patchelf/bin:$PATH
    - cmake --version
    - ninja --version
  interruptible: true

.template_rhel_build: &template_rhel_build
  # RHEL 8.4 is the minimum build target for Qt 6.5
  # Could not use the RHEL 8.4 ubi Docker images, as they require a subscription license in order to install many of the packages we require below.
  image: registry.gitlab.int.windscribe.com:5005/ws/client/desktop/client-desktop/fedora32
  before_script:
    # hack to fix 777 file permissions, which breaks the dpkg-deb command in the build_all script.
    - chmod -R o-w installer/linux
    # vcpkg settings
    - export VCPKG_ROOT="${HOME}/vcpkg"
    - export PATH=${RHEL_CMAKE_BUILD_PATH}/bin:$PATH
  interruptible: true

.download_dependency_openvpn_dco:
  script:
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --create-dirs -o ${BUILD_LIBS_FOLDER}/openvpn_dco.zip "${NEXUS_PATH_DEPS}/${OS_IDENTIFIER}/openvpn_dco.zip"

.download_dependency_qt:
  script:
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --create-dirs -o ${BUILD_LIBS_FOLDER}/qt.zip "${NEXUS_PATH_DEPS}/${OS_IDENTIFIER}/qt.zip"

.download_dependency_wintun:
  script:
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --create-dirs -o ${BUILD_LIBS_FOLDER}/wintun.zip "${NEXUS_PATH_DEPS}/${OS_IDENTIFIER}/wintun.zip"

.download_dependency_wireguard:
  script:
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --create-dirs -o ${BUILD_LIBS_FOLDER}/wireguard.zip "${NEXUS_PATH_DEPS}/${OS_IDENTIFIER}/wireguard.zip"

.download_dependency_wstunnel:
  script:
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --create-dirs -o ${BUILD_LIBS_FOLDER}/wstunnel.zip "${NEXUS_PATH_DEPS}/${OS_IDENTIFIER}/wstunnel.zip"

.download_vcpkg_cache:
  script:
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --create-dirs -o vcpkg_cache.zip "${NEXUS_PATH_VCPKG_CACHE}/${OS_IDENTIFIER}/vcpkg_cache.zip" || ./tools/vcpkg/install_ci/vcpkg_install.sh "${VCPKG_ROOT}" --configure-git

.download_dependencies_win:
  script:
    - !reference [.download_dependency_openvpn_dco, script]
    - !reference [.download_dependency_qt, script]
    - !reference [.download_dependency_wintun, script]
    - !reference [.download_dependency_wireguard, script]
    - !reference [.download_dependency_wstunnel, script]

.download_dependencies_posix:
  script:
    - !reference [.download_dependency_qt, script]
    - !reference [.download_dependency_wireguard, script]
    - !reference [.download_dependency_wstunnel, script]
    - !reference [.download_vcpkg_cache, script]

.package_vcpkg_cache:
  script:
    - rm -f vcpkg_cache.zip
    - (cd ${HOME} && zip -qr vcpkg_cache.zip vcpkg)
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file ${HOME}/vcpkg_cache.zip "${NEXUS_PATH_VCPKG_CACHE}/${OS_IDENTIFIER}/vcpkg_cache.zip"

.run_tests_posix:
  script:
    - set +o pipefail
    - build/client/wsnet_test | tee output.txt;
    - for i in {1..3}; do
          failed_tests=$(cat output.txt | grep "\[ *FAILED" | grep -v \( | grep -v ':' | cut -c 14- | paste -sd "," -);
          if [ -z "$failed_tests" ]; then
              break;
          else
              build/client/wsnet_test --gtest_filter=$failed_tests | tee output.txt;
          fi;
      done;

build:win:x64:app:
  <<: *template_win10_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
    VCPKG_ROOT: '%VCPKG_ROOT_WINDOWS%'
    VCPKG_DEFAULT_BINARY_CACHE: '%VCPKG_DEFAULT_BINARY_CACHE_WINDOWS%'
  script:
    - Set-Variable -name OS_IDENTIFIER -value "windows"
    - !reference [.download_dependencies_win, script]
    - 'IF(Test-Path .\$BUILD_LIBS_FOLDER\) {Get-ChildItem .\$BUILD_LIBS_FOLDER\*.zip | Foreach {.\tools\bin\7z.exe x $_.FullName -o"$BUILD_LIBS_FOLDER\"}}'
    - tools/build_all --build-app --ci-mode
    - $Diff = git diff client/gui/translations
    - if ( $Diff.Count -ne 0 ) { echo "You have changed desktop strings which are not in ts files.  Update your ts files by building locally, run the translation script on them, and add them to the commit."; exit 1 }
    - $Diff = git diff installer/common/translations
    - if ( $Diff.Count -ne 0 ) { echo "You have changed installer strings which are not in ts files.  Update your ts files by building locally, run the translation script on them, and add them to the commit."; exit 1 }
    - $Diff = git diff installer/windows/uninstaller/translations
    - if ( $Diff.Count -ne 0 ) { echo "You have changed uninstaller strings which are not in ts files.  Update your ts files by building locally, run the translation script on them, and add them to the commit."; exit 1 }
  artifacts:
    paths:
      - build/
      - temp/
    expire_in: 1 day
  rules:
    - if: $BUILD_WIN == "y" && ($CI_COMMIT_TAG != null || $CI_COMMIT_BRANCH != null) && $NIGHTLY_TEST_BUILD != "y"

build:win:x64:mr:
  <<: *template_win10_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
    VCPKG_ROOT: '%VCPKG_ROOT_WINDOWS%'
    VCPKG_DEFAULT_BINARY_CACHE: '%VCPKG_DEFAULT_BINARY_CACHE_WINDOWS%'
  script:
    - Set-Variable -name OS_IDENTIFIER -value "windows"
    - !reference [.download_dependencies_win, script]
    - 'IF(Test-Path .\$BUILD_LIBS_FOLDER\) {Get-ChildItem .\$BUILD_LIBS_FOLDER\*.zip | Foreach {.\tools\bin\7z.exe x $_.FullName -o"$BUILD_LIBS_FOLDER\"}}'
    - tools/build_all --ci-mode
  rules:
    - if: $BUILD_WIN == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH == null && $NIGHTLY_TEST_BUILD != "y"

sign:win:app:
  <<: *template_win10_sign
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - if ($BUILD_WIN -eq "y") { tools/build_all --sign-app --ci-mode }
    - if ($BUILD_WIN_ARM64 -eq "y") { tools/build_all --sign-app --arm64 --ci-mode }
  artifacts:
    paths:
      - build/
      - temp/
    expire_in: 1 day
  needs:
    - job: build:win:x64:app
      optional: true
      artifacts: true
    - job: build:win:arm64:app
      optional: true
      artifacts: true
  rules:
    - if: ($BUILD_WIN == "y" || $BUILD_WIN_ARM64 == "y") && ($CI_COMMIT_TAG != null || $CI_COMMIT_BRANCH != null) && $NIGHTLY_TEST_BUILD != "y"

build:win:x64:installer:
  <<: *template_win10_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
    VCPKG_ROOT: '%VCPKG_ROOT_WINDOWS%'
    VCPKG_DEFAULT_BINARY_CACHE: '%VCPKG_DEFAULT_BINARY_CACHE_WINDOWS%'
  script:
    - Set-Variable -name OS_IDENTIFIER -value "windows"
    - !reference [.download_dependency_qt, script]
    - 'IF(Test-Path .\$BUILD_LIBS_FOLDER\) {Get-ChildItem .\$BUILD_LIBS_FOLDER\*.zip | Foreach {.\tools\bin\7z.exe x $_.FullName -o"$BUILD_LIBS_FOLDER\"}}'
    - tools/build_all --build-installer --ci-mode
  artifacts:
    paths:
      - build/
      - temp/
    expire_in: 1 day
  needs:
    - job: sign:win:app
      optional: true
      artifacts: true
  rules:
    - if: $BUILD_WIN == "y" && ($CI_COMMIT_TAG != null || $CI_COMMIT_BRANCH != null) && $NIGHTLY_TEST_BUILD != "y"

sign:win:installer:
  <<: *template_win10_sign
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - if ($BUILD_WIN -eq "y") { tools/build_all --sign-installer --ci-mode }
    - if ($BUILD_WIN_ARM64 -eq "y") { tools/build_all --sign-installer --arm64 --ci-mode }
  artifacts:
    paths:
      - build/
      - temp/
    expire_in: 1 day
  needs:
    - job: build:win:x64:installer
      optional: true
      artifacts: true
    - job: build:win:arm64:installer
      optional: true
      artifacts: true
  rules:
    - if: ($BUILD_WIN == "y" || $BUILD_WIN_ARM64 == "y") && ($CI_COMMIT_TAG != null || $CI_COMMIT_BRANCH != null) && $NIGHTLY_TEST_BUILD != "y"

build:win:x64:bootstrap:
  <<: *template_win10_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
    VCPKG_ROOT: '%VCPKG_ROOT_WINDOWS%'
    VCPKG_DEFAULT_BINARY_CACHE: '%VCPKG_DEFAULT_BINARY_CACHE_WINDOWS%'
  script:
    - Set-Variable -name OS_IDENTIFIER -value "windows"
    - !reference [.download_dependency_qt, script]
    - 'IF(Test-Path .\$BUILD_LIBS_FOLDER\) {Get-ChildItem .\$BUILD_LIBS_FOLDER\*.zip | Foreach {.\tools\bin\7z.exe x $_.FullName -o"$BUILD_LIBS_FOLDER\"}}'
    - tools/build_all --build-bootstrap --ci-mode
  artifacts:
    paths:
      - build/
      - temp/
    expire_in: 1 day
  needs:
    - job: sign:win:installer
      optional: true
      artifacts: true
  rules:
    - if: $BUILD_WIN == "y" && ($CI_COMMIT_TAG != null || $CI_COMMIT_BRANCH != null) && $NIGHTLY_TEST_BUILD != "y"

sign:win:bootstrap:
  <<: *template_win10_sign
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - Set-Variable -name VERSION -value $(python3 tools/base/extract.py)
    - if ($BUILD_WIN -eq "y") {
      tools/build_all --sign-bootstrap --ci-mode;
      Set-Variable -name OS_IDENTIFIER -value "windows";
      curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/Windscribe_$VERSION.exe "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/Windscribe_$VERSION.exe";
      curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/WindscribeSymbols_$VERSION.zip "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/WindscribeSymbols_$VERSION.zip"
      }
    - if ($BUILD_WIN_ARM64 -eq "y") {
      tools/build_all --sign-bootstrap --arm64 --ci-mode;
      Set-Variable -name OS_IDENTIFIER -value "windows-arm64";
      curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/Windscribe_$VERSION.exe "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/Windscribe_${VERSION}_arm64.exe";
      curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/WindscribeSymbols_$VERSION.zip "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/WindscribeSymbols_${VERSION}_arm64.zip"
      }
  needs:
    - job: build:win:x64:bootstrap
      optional: true
      artifacts: true
    - job: build:win:arm64:bootstrap
      optional: true
      artifacts: true
  rules:
    - if: ($BUILD_WIN == "y" || $BUILD_WIN_ARM64 == "y") && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH != null && $NIGHTLY_TEST_BUILD != "y"

sign:win:bootstrap:tagged:
  <<: *template_win10_sign
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - Set-Variable -name VERSION -value $(python3 tools/base/extract.py);
    - Set-Variable -name TAG -value $($CI_COMMIT_TAG -replace '^v([0-9].*)','$1')
    - if ($BUILD_WIN -eq "y") {
      tools/build_all --sign-bootstrap --ci-mode;
      Set-Variable -name OS_IDENTIFIER -value "windows";
      curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/Windscribe_$VERSION.exe "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/Windscribe_$VERSION.exe";
      curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/WindscribeSymbols_$VERSION.zip "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/WindscribeSymbols_$VERSION.zip"
      }
    - if ($BUILD_WIN_ARM64 -eq "y") {
      tools/build_all --sign-bootstrap --arm64 --ci-mode;
      Set-Variable -name OS_IDENTIFIER -value "windows-arm64";
      curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/Windscribe_$VERSION.exe "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/Windscribe_${VERSION}_arm64.exe";
      curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/WindscribeSymbols_$VERSION.zip "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/WindscribeSymbols_${VERSION}_arm64.zip"
      }
  needs:
    - job: build:win:x64:bootstrap
      optional: true
      artifacts: true
    - job: build:win:arm64:bootstrap
      optional: true
      artifacts: true
  rules:
    - if: ($BUILD_WIN == "y" || $BUILD_WIN_ARM64 == "y") && $CI_COMMIT_TAG != null

build:win:arm64:app:
  <<: *template_win10_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
    VCPKG_ROOT: '%VCPKG_ROOT_WINDOWS%'
    VCPKG_DEFAULT_BINARY_CACHE: '%VCPKG_DEFAULT_BINARY_CACHE_WINDOWS%'
  script:
    # Need the x64 Qt package so we can reference it as the QT_HOST_PATH in build_all.
    - Set-Variable -name OS_IDENTIFIER -value "windows"
    - Set-Variable -name BUILD_LIBS_FOLDER -value "build-libs"
    - !reference [.download_dependency_qt, script]
    - 'IF(Test-Path .\$BUILD_LIBS_FOLDER\) {Get-ChildItem .\$BUILD_LIBS_FOLDER\*.zip | Foreach {.\tools\bin\7z.exe x $_.FullName -o"$BUILD_LIBS_FOLDER\"}}'
    - Set-Variable -name OS_IDENTIFIER -value "windows-arm64"
    - Set-Variable -name BUILD_LIBS_FOLDER -value "build-libs-arm64"
    - !reference [.download_dependencies_win, script]
    - 'IF(Test-Path .\$BUILD_LIBS_FOLDER\) {Get-ChildItem .\$BUILD_LIBS_FOLDER\*.zip | Foreach {.\tools\bin\7z.exe x $_.FullName -o"$BUILD_LIBS_FOLDER\"}}'
    - tools/build_all --build-app --arm64 --ci-mode
  artifacts:
    paths:
      - build-arm64/
      - temp/
    expire_in: 1 day
  rules:
    - if: $BUILD_WIN_ARM64 == "y" && ($CI_COMMIT_TAG != null || $CI_COMMIT_BRANCH != null) && $NIGHTLY_TEST_BUILD != "y"

build:win:arm64:mr:
  <<: *template_win10_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
    VCPKG_ROOT: '%VCPKG_ROOT_WINDOWS%'
    VCPKG_DEFAULT_BINARY_CACHE: '%VCPKG_DEFAULT_BINARY_CACHE_WINDOWS%'
  script:
    # Need the x64 Qt package so we can reference it as the QT_HOST_PATH in build_all.
    - Set-Variable -name OS_IDENTIFIER -value "windows"
    - Set-Variable -name BUILD_LIBS_FOLDER -value "build-libs"
    - !reference [.download_dependency_qt, script]
    - 'IF(Test-Path .\$BUILD_LIBS_FOLDER\) {Get-ChildItem .\$BUILD_LIBS_FOLDER\*.zip | Foreach {.\tools\bin\7z.exe x $_.FullName -o"$BUILD_LIBS_FOLDER\"}}'
    - Set-Variable -name OS_IDENTIFIER -value "windows-arm64"
    - Set-Variable -name BUILD_LIBS_FOLDER -value "build-libs-arm64"
    - !reference [.download_dependencies_win, script]
    - 'IF(Test-Path .\$BUILD_LIBS_FOLDER\) {Get-ChildItem .\$BUILD_LIBS_FOLDER\*.zip | Foreach {.\tools\bin\7z.exe x $_.FullName -o"$BUILD_LIBS_FOLDER\"}}'
    - tools/build_all --arm64 --ci-mode
  rules:
    - if: $BUILD_WIN_ARM64 == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH == null && $NIGHTLY_TEST_BUILD != "y"

build:win:arm64:installer:
  <<: *template_win10_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
    VCPKG_ROOT: '%VCPKG_ROOT_WINDOWS%'
    VCPKG_DEFAULT_BINARY_CACHE: '%VCPKG_DEFAULT_BINARY_CACHE_WINDOWS%'
  script:
    - Set-Variable -name OS_IDENTIFIER -value "windows"
    - Set-Variable -name BUILD_LIBS_FOLDER -value "build-libs"
    - !reference [.download_dependency_qt, script]
    - 'IF(Test-Path .\$BUILD_LIBS_FOLDER\) {Get-ChildItem .\$BUILD_LIBS_FOLDER\*.zip | Foreach {.\tools\bin\7z.exe x $_.FullName -o"$BUILD_LIBS_FOLDER\"}}'
    - Set-Variable -name OS_IDENTIFIER -value "windows-arm64"
    - Set-Variable -name BUILD_LIBS_FOLDER -value "build-libs-arm64"
    - !reference [.download_dependency_qt, script]
    - 'IF(Test-Path .\$BUILD_LIBS_FOLDER\) {Get-ChildItem .\$BUILD_LIBS_FOLDER\*.zip | Foreach {.\tools\bin\7z.exe x $_.FullName -o"$BUILD_LIBS_FOLDER\"}}'
    - tools/build_all --build-installer --arm64 --ci-mode
  artifacts:
    paths:
      - build-arm64/
      - temp/
    expire_in: 1 day
  needs:
    - job: sign:win:app
      optional: true
      artifacts: true
  rules:
    - if: $BUILD_WIN_ARM64 == "y" && ($CI_COMMIT_TAG != null || $CI_COMMIT_BRANCH != null) && $NIGHTLY_TEST_BUILD != "y"

build:win:arm64:bootstrap:
  <<: *template_win10_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
    VCPKG_ROOT: '%VCPKG_ROOT_WINDOWS%'
    VCPKG_DEFAULT_BINARY_CACHE: '%VCPKG_DEFAULT_BINARY_CACHE_WINDOWS%'
  script:
    - Set-Variable -name OS_IDENTIFIER -value "windows-arm64"
    - Set-Variable -name BUILD_LIBS_FOLDER -value "build-libs-arm64"
    - !reference [.download_dependency_qt, script]
    - 'IF(Test-Path .\$BUILD_LIBS_FOLDER\) {Get-ChildItem .\$BUILD_LIBS_FOLDER\*.zip | Foreach {.\tools\bin\7z.exe x $_.FullName -o"$BUILD_LIBS_FOLDER\"}}'
    - tools/build_all --build-bootstrap --arm64 --ci-mode
  artifacts:
    paths:
      - build-arm64/
      - temp/
    expire_in: 1 day
  needs:
    - job: sign:win:installer
      optional: true
      artifacts: true
  rules:
    - if: $BUILD_WIN_ARM64 == "y" && ($CI_COMMIT_TAG != null || $CI_COMMIT_BRANCH != null) && $NIGHTLY_TEST_BUILD != "y"


.build_mac_installer_common:
  script:
    - OS_IDENTIFIER="macos"
    - !reference [.download_dependencies_posix, script]
    - if [ -d ./${BUILD_LIBS_FOLDER}/ ]; then for z in ./${BUILD_LIBS_FOLDER}/*.zip; do unzip -qod ./${BUILD_LIBS_FOLDER} $z; done; fi
    - VAULT_CLIENT_TOKEN=$(curl --cacert tools/cacert.pem --data "{\"role_id\":\"$VAULT_ROLE_ID\",\"secret_id\":\"$VAULT_SECRET_ID\"}"
      $VAULT_ADDR/v1/auth/approle/login | python3 tools/base/vaulthelper.py --get-client-token)
    # get the secrets JSON and put in VAULT_RESPONSE_JSON
    # Note: the single quotes MUST be used here or we'll get a syntax error
    - 'VAULT_RESPONSE_JSON=$(curl --cacert tools/cacert.pem -H "X-Vault-Token: $VAULT_CLIENT_TOKEN" $VAULT_ADDR/v1/kv/cicd/client-desktop)'
    # parse the secrets
    - PROVISION_PROFILE_BASE64=$(echo $VAULT_RESPONSE_JSON | python3 tools/base/vaulthelper.py --get-mac-provision-profile)
    # write the secrets to file -- Nice to have: use secrets without files, no need to cleanup
    # use echo -e to print \n as newlines
    - mkdir -p $MAC_PROVISION_PROFILE_PATH
    - echo -e ${PROVISION_PROFILE_BASE64} | base64 -d > $MAC_PROVISION_PROFILE_FILE_PATH
    - VERSION=$(python3 tools/base/extract.py)

build:mac:installer:
  <<: *template_mac_build
  tags: [macos11qt6]
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - !reference [.build_mac_installer_common, script]
    - tools/build_all --ci-mode --sign
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/Windscribe_$VERSION.dmg "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/Windscribe_$VERSION.dmg"
  rules:
    - if: $BUILD_MAC == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH != null && $NIGHTLY_TEST_BUILD != "y"

# We don't upload artifacts for merge requests
build:mac:installer:mr:
  <<: *template_mac_build
  tags: [macos-arm64-qt6]
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - !reference [.build_mac_installer_common, script]
    - tools/build_all --ci-mode --sign
  rules:
    - if: $BUILD_MAC == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH == null && $NIGHTLY_TEST_BUILD != "y"

build:mac:installer:tagged:
  <<: *template_mac_build
  tags: [macos11qt6]
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - !reference [.build_mac_installer_common, script]
    # Only tagged builds are notarized
    - tools/build_all --ci-mode --notarize --sign
    - VERSION_NO_SUFFIX=$(python3 tools/base/extract.py --no-suffix)
    - if [[ $CI_COMMIT_TAG =~ ^v[0-9] ]]; then TAG=${CI_COMMIT_TAG:1}; else TAG=${CI_COMMIT_TAG}; fi
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/Windscribe_$VERSION.dmg "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/Windscribe_$VERSION.dmg"
  rules:
    - if: $BUILD_MAC == "y" && $CI_COMMIT_TAG != null

.build_linux_installer_common:
  script:
    - !reference [.download_dependencies_posix, script]
    - if [ -d ./${BUILD_LIBS_FOLDER}/ ]; then for z in ./${BUILD_LIBS_FOLDER}/*.zip; do unzip -qod ./${BUILD_LIBS_FOLDER} $z; done; fi
    - if [ -f vcpkg_cache.zip ]; then rm -rf ${HOME}/vcpkg; unzip -qod ${HOME} vcpkg_cache.zip; fi
    # write public key to file
    - mkdir -p ${LINUX_SIGNING_PATH}
    # create the public key from the private key
    - echo -e ${LINUX_SIGNING_KEY} | openssl rsa -in /dev/stdin -pubout > $LINUX_PUBLIC_KEY_PATH
    - export LINUX_SIGNING_KEY_FORMATTED="`echo -e ${LINUX_SIGNING_KEY}`"
    - VERSION=$(python3 tools/base/extract.py)

build:aarch64_ubuntu:installer:
  <<: *template_aarch64_ubuntu_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux-arm64"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --ci-mode --sign
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe_${VERSION}_arm64.deb "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/windscribe_${VERSION}_arm64.deb"
    - !reference [.package_vcpkg_cache, script]
  rules:
    - if: $BUILD_LINUX_ARM64 == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH != null && $NIGHTLY_TEST_BUILD != "y"

build:aarch64_ubuntu_cli:installer:
  <<: *template_aarch64_ubuntu_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux-arm64"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --ci-mode --sign --build-cli-only
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe-cli_${VERSION}_arm64.deb "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/windscribe-cli_${VERSION}_arm64.deb"
    - !reference [.package_vcpkg_cache, script]
  rules:
    - if: $BUILD_LINUX_ARM64 == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH != null && $NIGHTLY_TEST_BUILD != "y"

# We don't upload artifacts for merge requests
build:aarch64_ubuntu:installer:mr:
  <<: *template_aarch64_ubuntu_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux-arm64"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --ci-mode --sign
  rules:
    - if: $BUILD_LINUX_ARM64 == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH == null && $NIGHTLY_TEST_BUILD != "y"

build:aarch64_ubuntu_cli:installer:mr:
  <<: *template_aarch64_ubuntu_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux-arm64"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --ci-mode --sign --build-cli-only
  rules:
    - if: $BUILD_LINUX_ARM64 == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH == null && $NIGHTLY_TEST_BUILD != "y"

build:aarch64_ubuntu:installer:tagged:
  <<: *template_aarch64_ubuntu_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux-arm64"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --ci-mode --sign
    - VERSION_NO_SUFFIX=$(python3 tools/base/extract.py --no-suffix)
    - if [[ $CI_COMMIT_TAG =~ ^v[0-9] ]]; then TAG=${CI_COMMIT_TAG:1}; else TAG=${CI_COMMIT_TAG}; fi
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe_${VERSION}_arm64.deb "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe_${VERSION}_arm64.deb"
  rules:
    - if: $BUILD_LINUX_ARM64 == "y" && $CI_COMMIT_TAG != null && $NIGHTLY_TEST_BUILD != "y"

build:aarch64_ubuntu_cli:installer:tagged:
  <<: *template_aarch64_ubuntu_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux-arm64"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --ci-mode --sign --build-cli-only
    - VERSION_NO_SUFFIX=$(python3 tools/base/extract.py --no-suffix)
    - if [[ $CI_COMMIT_TAG =~ ^v[0-9] ]]; then TAG=${CI_COMMIT_TAG:1}; else TAG=${CI_COMMIT_TAG}; fi
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe-cli_${VERSION}_arm64.deb "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe-cli_${VERSION}_arm64.deb"
  rules:
    - if: $BUILD_LINUX_ARM64 == "y" && $CI_COMMIT_TAG != null && $NIGHTLY_TEST_BUILD != "y"

build:rhel:installer:
  <<: *template_rhel_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --ci-mode --sign --build-deb --build-rpm --build-rpm-opensuse
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe_${VERSION}_x86_64_fedora.rpm "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/windscribe_${VERSION}_x86_64_fedora.rpm"
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe_${VERSION}_x86_64_opensuse.rpm "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/windscribe_${VERSION}_x86_64_opensuse.rpm"
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe_${VERSION}_amd64.deb "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/windscribe_${VERSION}_amd64.deb"
    - !reference [.package_vcpkg_cache, script]
  rules:
    - if: $BUILD_LINUX == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH != null && $NIGHTLY_TEST_BUILD != "y"

build:rhel_cli:installer:
  <<: *template_rhel_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --ci-mode --sign --build-deb --build-rpm --build-rpm-opensuse --build-cli-only
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe-cli_${VERSION}_x86_64_fedora.rpm "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/windscribe-cli_${VERSION}_x86_64_fedora.rpm"
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe-cli_${VERSION}_x86_64_opensuse.rpm "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/windscribe-cli_${VERSION}_x86_64_opensuse.rpm"
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe-cli_${VERSION}_amd64.deb "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/windscribe-cli_${VERSION}_amd64.deb"
    - !reference [.package_vcpkg_cache, script]
  rules:
    - if: $BUILD_LINUX == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH != null && $NIGHTLY_TEST_BUILD != "y"

# We don't upload artifacts for merge requests
build:rhel:installer:mr:
  <<: *template_rhel_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --ci-mode --sign --build-deb --build-rpm --build-rpm-opensuse
  rules:
    - if: $BUILD_LINUX == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH == null && $NIGHTLY_TEST_BUILD != "y"

build:rhel_cli:installer:mr:
  <<: *template_rhel_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --ci-mode --sign --build-deb --build-rpm --build-rpm-opensuse --build-cli-only
  rules:
    - if: $BUILD_LINUX == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH == null && $NIGHTLY_TEST_BUILD != "y"

build:rhel:installer:tagged:
  <<: *template_rhel_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --ci-mode --sign --build-deb --build-rpm --build-rpm-opensuse
    - VERSION_NO_SUFFIX=$(python3 tools/base/extract.py --no-suffix)
    - if [[ $CI_COMMIT_TAG =~ ^v[0-9] ]]; then TAG=${CI_COMMIT_TAG:1}; else TAG=${CI_COMMIT_TAG}; fi
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe_${VERSION}_x86_64_fedora.rpm "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe_${VERSION}_x86_64_fedora.rpm"
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe_${VERSION}_x86_64_opensuse.rpm "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe_${VERSION}_x86_64_opensuse.rpm"
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe_${VERSION}_amd64.deb "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe_${VERSION}_amd64.deb"
  rules:
    - if: $BUILD_LINUX == "y" && $CI_COMMIT_TAG != null && $NIGHTLY_TEST_BUILD != "y"

build:rhel_cli:installer:tagged:
  <<: *template_rhel_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --ci-mode --sign --build-deb --build-rpm --build-rpm-opensuse --build-cli-only
    - VERSION_NO_SUFFIX=$(python3 tools/base/extract.py --no-suffix)
    - if [[ $CI_COMMIT_TAG =~ ^v[0-9] ]]; then TAG=${CI_COMMIT_TAG:1}; else TAG=${CI_COMMIT_TAG}; fi
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe-cli_${VERSION}_x86_64_fedora.rpm "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe-cli_${VERSION}_x86_64_fedora.rpm"
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe-cli_${VERSION}_x86_64_opensuse.rpm "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe-cli_${VERSION}_x86_64_opensuse.rpm"
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file build-exe/windscribe-cli_${VERSION}_amd64.deb "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe-cli_${VERSION}_amd64.deb"
  rules:
    - if: $BUILD_LINUX == "y" && $CI_COMMIT_TAG != null && $NIGHTLY_TEST_BUILD != "y"

.template_archlinux_build: &template_archlinux_build
  image: registry.gitlab.int.windscribe.com:5005/ws/client/desktop/client-desktop/arch

.build_archlinux_installer_prep_build_dir:
  script:
    # makepkg cannot be run as root.  Set up a build folder and use the nobody user.
    - mkdir -p ${ARCH_LINUX_BUILD_PATH}
    - chgrp nobody ${ARCH_LINUX_BUILD_PATH}
    - chmod g+ws ${ARCH_LINUX_BUILD_PATH}
    - setfacl -m u::rwx,g::rwx ${ARCH_LINUX_BUILD_PATH}
    - setfacl -d --set u::rwx,g::rwx,o::- ${ARCH_LINUX_BUILD_PATH}
    - export VERSION=$(python3 tools/base/extract.py)
    - export VERSION_NO_SUFFIX=$(python3 tools/base/extract.py --no-suffix)

.build_archlinux_installer_makepkg:
  script:
    # Convert Ubuntu package referenced by APP_DOWNLOAD_URL to an Arch Linux package.
    - cd ${ARCH_LINUX_BUILD_PATH}
    - sudo --preserve-env --user=nobody makepkg --syncdeps
    - cd -

build:archlinux:installer:
  <<: *template_archlinux_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux"
    - !reference [.build_archlinux_installer_prep_build_dir, script]
    - cp installer/linux/gui/arch_package/* ${ARCH_LINUX_BUILD_PATH}
    - export APP_DOWNLOAD_URL="${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/windscribe_${VERSION}_amd64.deb"
    - !reference [.build_archlinux_installer_makepkg, script]
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file ${ARCH_LINUX_BUILD_PATH}/windscribe-$VERSION_NO_SUFFIX-1-x86_64.pkg.tar.zst
      "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/windscribe_${VERSION}_x86_64.pkg.tar.zst"
  needs:
    - job: "build:rhel:installer"
      optional: true
  rules:
    - if: $BUILD_LINUX == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH != null && $NIGHTLY_TEST_BUILD != "y"

build:archlinux_cli:installer:
  <<: *template_archlinux_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux"
    - !reference [.build_archlinux_installer_prep_build_dir, script]
    - cp installer/linux/cli/arch_package/* ${ARCH_LINUX_BUILD_PATH}
    - export APP_DOWNLOAD_URL="${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/windscribe-cli_${VERSION}_amd64.deb"
    - !reference [.build_archlinux_installer_makepkg, script]
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file ${ARCH_LINUX_BUILD_PATH}/windscribe-cli-$VERSION_NO_SUFFIX-1-x86_64.pkg.tar.zst
      "${NEXUS_PATH_BRANCH_UPLOAD}/${OS_IDENTIFIER}/windscribe-cli_${VERSION}_x86_64.pkg.tar.zst"
  needs:
    - job: "build:rhel_cli:installer"
      optional: true
  rules:
    - if: $BUILD_LINUX == "y" && $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH != null && $NIGHTLY_TEST_BUILD != "y"

build:archlinux:installer:tagged:
  <<: *template_archlinux_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - !reference [.build_archlinux_installer_prep_build_dir, script]
    - cp installer/linux/gui/arch_package/* ${ARCH_LINUX_BUILD_PATH}
    - export APP_DOWNLOAD_URL=${NEXUS_PATH_TAGGED_UPLOAD}/$VERSION_NO_SUFFIX/windscribe_${VERSION}_amd64.deb
    - !reference [.build_archlinux_installer_makepkg, script]
    - if [[ $CI_COMMIT_TAG =~ ^v[0-9] ]]; then TAG=${CI_COMMIT_TAG:1}; else TAG=${CI_COMMIT_TAG}; fi
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file ${ARCH_LINUX_BUILD_PATH}/windscribe-$VERSION_NO_SUFFIX-1-x86_64.pkg.tar.zst
      "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe_${VERSION}_x86_64.pkg.tar.zst"
  needs:
    - job: "build:rhel:installer:tagged"
      optional: true
  rules:
    - if: $BUILD_LINUX == "y" && $CI_COMMIT_TAG != null && $NIGHTLY_TEST_BUILD != "y"

build:archlinux_cli:installer:tagged:
  <<: *template_archlinux_build
  stage: Build
  variables:
    GIT_STRATEGY: clone
  script:
    - !reference [.build_archlinux_installer_prep_build_dir, script]
    - cp installer/linux/cli/arch_package/* ${ARCH_LINUX_BUILD_PATH}
    - export APP_DOWNLOAD_URL=${NEXUS_PATH_TAGGED_UPLOAD}/$VERSION_NO_SUFFIX/windscribe-cli_${VERSION}_amd64.deb
    - !reference [.build_archlinux_installer_makepkg, script]
    - if [[ $CI_COMMIT_TAG =~ ^v[0-9] ]]; then TAG=${CI_COMMIT_TAG:1}; else TAG=${CI_COMMIT_TAG}; fi
    - curl --silent --show-error --fail -u "${NEXUS_USERNAME}:${NEXUS_PASSWORD}" --cacert tools/cacert.pem
      --upload-file ${ARCH_LINUX_BUILD_PATH}/windscribe-cli-$VERSION_NO_SUFFIX-1-x86_64.pkg.tar.zst
      "${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe-cli_${VERSION}_x86_64.pkg.tar.zst"
  needs:
    - job: "build:rhel_cli:installer:tagged"
      optional: true
  rules:
    - if: $BUILD_LINUX == "y" && $CI_COMMIT_TAG != null && $NIGHTLY_TEST_BUILD != "y"

build:artifact:links:
  tags: [win10qty6]
  stage: Artifact Links
  script:
    - Set-Variable -name VERSION -value $(python3 tools/base/extract.py)
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/windows/Windscribe_$VERSION.exe
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/windows-arm64/Windscribe_${VERSION}_arm64.exe
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/macos/Windscribe_$VERSION.dmg
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/linux/windscribe_${VERSION}_amd64.deb
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/linux-arm64/windscribe_${VERSION}_arm64.deb
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/linux/windscribe-cli_${VERSION}_amd64.deb
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/linux-arm64/windscribe-cli_${VERSION}_arm64.deb
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/linux/windscribe_${VERSION}_x86_64_fedora.rpm
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/linux/windscribe-cli_${VERSION}_x86_64_fedora.rpm
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/linux/windscribe_${VERSION}_x86_64_opensuse.rpm
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/linux/windscribe-cli_${VERSION}_x86_64_opensuse.rpm
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/linux/windscribe_${VERSION}_x86_64.pkg.tar.zst
    - echo ${NEXUS_PATH_BRANCH_UPLOAD}/linux/windscribe-cli_${VERSION}_x86_64.pkg.tar.zst
  dependencies: []
  rules:
    - if: $CI_COMMIT_TAG == null && $CI_COMMIT_BRANCH != null && $NIGHTLY_TEST_BUILD != "y"

build:artifact:links:tagged:
  tags: [win10qty6]
  stage: Artifact Links
  script:
    - Set-Variable -name VERSION -value $(python3 tools/base/extract.py)
    - Set-Variable -name TAG -value $($CI_COMMIT_TAG -replace '^v([0-9].*)','$1')
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/Windscribe_$VERSION.exe
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/Windscribe_${VERSION}_arm64.exe
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/Windscribe_$VERSION.dmg
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe_${VERSION}_amd64.deb
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe_${VERSION}_arm64.deb
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe-cli_${VERSION}_amd64.deb
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe-cli_${VERSION}_arm64.deb
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe_${VERSION}_x86_64_fedora.rpm
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe-cli_${VERSION}_x86_64_fedora.rpm
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe_${VERSION}_x86_64_opensuse.rpm
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe-cli_${VERSION}_x86_64_opensuse.rpm
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe_${VERSION}_x86_64.pkg.tar.zst
    - echo ${NEXUS_PATH_TAGGED_UPLOAD}/${TAG}/windscribe-cli_${VERSION}_x86_64.pkg.tar.zst
  dependencies: []
  rules:
    - if: $CI_COMMIT_TAG != null && $NIGHTLY_TEST_BUILD != "y"

lint:flake8:
  <<: *template_win10_build
  stage: Test
  variables:
    GIT_STRATEGY: clone
  script:
    - python3 -m pip install flake8
    - flake8 --ignore=E402,E501 tools
  dependencies: []
  rules:
    - if: $BUILD_WIN == "y"

test:translations:
  <<: *template_win10_build
  stage: Test
  variables:
    GIT_STRATEGY: clone
  script:
    - $Unfinished = Select-String -Path client\gui\translations\*,installer\common\translations\*,installer\windows\uninstaller\translations\* -Pattern 'type="unfinished"'
    - if ( $Unfinished.Matches.Count -ne 0 ) { echo "You have untranslated strings in your ts files.  Run the translation script on the ts files and add them to the commit."; exit 1 }
    - $Vanished = Select-String -Path client\gui\translations\*,installer\common\translations\*,installer\windows\uninstaller\translations\* -Pattern 'type="vanished"'
    - if ( $Vanished.Matches.Count -ne 0 ) { echo "You have vanished strings in your ts files.  Run the translation script on the ts files with --remove-vanished and add them to the commit."; exit 1 }
  dependencies: []
  rules:
    - if: $BUILD_WIN == "y"

test:wsnet:win:
  <<: *template_win10_build
  stage: Test
  variables:
    GIT_STRATEGY: clone
    VCPKG_ROOT: '%VCPKG_ROOT_WINDOWS%'
    VCPKG_DEFAULT_BINARY_CACHE: '%VCPKG_DEFAULT_BINARY_CACHE_WINDOWS%'
  script:
    - Set-Variable -name OS_IDENTIFIER -value "windows"
    - !reference [.download_dependencies_win, script]
    - 'IF(Test-Path .\$BUILD_LIBS_FOLDER\) {Get-ChildItem .\$BUILD_LIBS_FOLDER\*.zip | Foreach {.\tools\bin\7z.exe x $_.FullName -o"$BUILD_LIBS_FOLDER\"}}'
    - tools/build_all --build-app --build-tests
    - cd build/test
    - ./wsnet_test.exe | Tee-Object -Variable TestOutput;
      For ($i=1; $i -le 3; $i++) {
          $FailedTests = ($TestOutput -match  "^\[  FAILED  \] .*[^:)]$");
          if (!$FailedTests) {
              break;
          } else {
              $TestString = $FailedTests.SubString(13) -join ':';
              ./wsnet_test.exe --gtest_filter=$TestString | Tee-Object -Variable TestOutput;
          }
      }
  rules:
    - if: $BUILD_WIN == "y" && $NIGHTLY_TEST_BUILD == "y"

test:wsnet:mac:
  <<: *template_mac_build
  tags: [macos11qt6]
  stage: Test
  variables:
    GIT_STRATEGY: clone
  script:
    - !reference [.build_mac_installer_common, script]
    - tools/build_all --build-app --build-tests
    - !reference [.run_tests_posix, script]

  after_script:
    - python3 -m gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    name: ${CI_JOB_NAME}-${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHA}-mac
    expire_in: 1 day
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
  rules:
    - if: $BUILD_MAC == "y" && $NIGHTLY_TEST_BUILD == "y"

test:wsnet:rhel:
  <<: *template_rhel_build
  stage: Test
  variables:
    GIT_STRATEGY: clone
  script:
    - OS_IDENTIFIER="linux"
    - !reference [.build_linux_installer_common, script]
    - tools/build_all --build-app --build-tests
    - !reference [.run_tests_posix, script]

  after_script:
    - python3 -m gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    name: ${CI_JOB_NAME}-${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHA}-linux
    expire_in: 1 day
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
  rules:
    - if: $BUILD_LINUX == "y" && $NIGHTLY_TEST_BUILD == "y"