.gitlab-ci.yml

# SPDX-License-Identifier: GPL-3.0-or-later
# vim:foldmethod=marker
variables:
  DEBIAN_FRONTEND: noninteractive
  LC_ALL: C.UTF-8
  GIT_SUBMODULE_STRATEGY: recursive
  GIT_STRATEGY: clone # sometimes unclean submodule dirs otherwise
  RESPDIFF_PRIORITY: 5
  DISTROTEST_PRIORITY: 6
  RESPDIFF_COUNT: 1
  RESPDIFF_FORCE: 0
  RESPERF_FORCE: 0
  KNOT_VERSION: '3.1'
  LIBKRES_ABI: 9
  LIBKRES_NAME: libkres
  MESON_TEST: meson test -C build_ci* -t 4 --print-errorlogs
  PREFIX: $CI_PROJECT_DIR/.local
  EMAIL: 'ci@nic'

image: $CI_REGISTRY/knot/knot-resolver/ci/debian-11:knot-$KNOT_VERSION
default:
  interruptible: true
  tags:
    - docker
    - linux
    - amd64

stages:
  - build
  - sanity
  - test
  - respdiff
  - deploy
  - pkgtest

 # https://docs.gitlab.com/ce/ci/jobs/job_control.html#select-different-runner-tags-for-each-parallel-matrix-job
.multi_platform: &multi_platform
  parallel:
    matrix:
      - PLATFORM: [ amd64, arm64 ]
  tags: # some will override this part
    - ${PLATFORM}
    - docker
    - linux

.common: &common
  except:
    refs:
      - master@knot/knot-resolver
      - master@knot/security/knot-resolver
      - tags
    variables:
      - $SKIP_CI == "1"
  tags:
    - docker
    - linux
    - amd64
  # Tests which decided to skip themselves get orange non-failure.
  allow_failure:
    exit_codes:
      - 77

.after_build: &after_build
  <<: *common
  needs:
    - build
  before_script:
    # meson detects changes and performs useless rebuild; hide the log
    - ninja -C build_ci* &>/dev/null
    - rm build_ci*/meson-logs/testlog*.txt  # start with clean testlog
  artifacts:
    when: always
    # The deckard-specific parts are a little messy, but they're hard to separate in YAML.
    paths:
      - build_ci*/meson-logs/testlog*.txt
      - tmpdeckard*
      - build_ci*/meson-logs/integration.deckard.junit.xml
    reports:
      junit: build_ci*/meson-logs/integration.deckard.junit.xml

.nodep: &nodep
  <<: *common
  needs: []

# build {{{
.build: &build
  <<: *common
  stage: build
  artifacts:
    when: always
    paths:
      - .local
      - build_ci*
      - pkg
    reports:
      junit: build_ci*/meson-logs/testlog.junit.xml
  after_script:
    - ci/fix-meson-junit.sh build_ci*/meson-logs/testlog.junit.xml

archive:
  <<: *build
  except: null
  script:
    - apkg make-archive

build:
  <<: *build
  script:
    - meson build_ci --default-library=static --prefix=$PREFIX -Dmalloc=disabled -Dwerror=true -Dextra_tests=enabled
    - ninja -C build_ci
    - ninja -C build_ci install >/dev/null
    - ${MESON_TEST} --suite unit --suite config --suite dnstap --no-suite snowflake

build-knot32:
  <<: *build
  image: $CI_REGISTRY/knot/knot-resolver/ci/debian-11:knot-3.2
  script:
    - meson build_ci_knot32 --default-library=static --prefix=$PREFIX -Dmalloc=disabled -Dwerror=true -Dextra_tests=enabled
    - ninja -C build_ci_knot32
    - ninja -C build_ci_knot32 install >/dev/null
    - ${MESON_TEST} --suite unit --suite config --suite dnstap --no-suite snowflake

build-asan:
  <<: *build
  script:
      # "undefined" sanitizer causes C++ issues when loading ahocorasick.so in CI
    - CC=clang CXX=clang++ CFLAGS=-fno-sanitize-recover=all CXXFLAGS=-fno-sanitize=undefined meson build_ci_asan --default-library=static --prefix=$PREFIX -Dmalloc=jemalloc -Db_sanitize=address,undefined -Dextra_tests=enabled
    - ninja -C build_ci_asan
    - ninja -C build_ci_asan install >/dev/null
      # TODO _leaks: not sure what exactly is wrong in leak detection on config tests
      # TODO skip_asan: all three of these disappear locally when using gcc 9.1 (except some leaks)
    - MESON_TESTTHREADS=1 ASAN_OPTIONS=detect_leaks=0 ${MESON_TEST} --suite unit --suite config --suite dnstap --no-suite skip_asan --no-suite snowflake

build:macOS:
  <<: *nodep
  only:
    refs:
      - branches@knot/knot-resolver
  stage: build
  when: delayed
  start_in: 3 minutes  # allow some time for mirroring, job creation
  script:
    - ci/gh_actions.py ${CI_COMMIT_REF_NAME} ${CI_COMMIT_SHA}

docker:
  <<: *nodep
  stage: build
  image: docker:latest
  <<: *multi_platform
  only:
    refs:
      - branches@knot/knot-resolver
  tags:
    - ${PLATFORM}
    - dind
  variables:
    DOCKER_IMAGE_NAME: knot-resolver-test:${CI_COMMIT_SHA}
  script:
    - docker build --no-cache -t ${DOCKER_IMAGE_NAME} .
    - echo "quit()" | docker run -i ${DOCKER_IMAGE_NAME}
  after_script:  # remove dangling images to avoid running out of disk space
    - docker rmi ${DOCKER_IMAGE_NAME}
    - docker rmi $(docker images -f "dangling=true" -q)

sonarcloud:
  <<: *nodep
  stage: build
  except: null
  only:
    - tags
    - master@knot/knot-resolver
  script:
    - meson build_sonarcloud --default-library=static --prefix=$PREFIX -Dmalloc=disabled
    - build-wrapper-linux-x86-64 --out-dir bw-output ninja -C build_sonarcloud
    - >
        sonar-scanner
        -Dsonar.organization=cz-nic
        -Dsonar.projectKey=CZ-NIC_knot-resolver
        -Dsonar.sources=.
        -Dsonar.cfamily.build-wrapper-output=bw-output
        -Dsonar.host.url=https://sonarcloud.io
        -Dsonar.projectVersion="$(git describe)"
# }}}

# sanity {{{
.sanity: &sanity
  <<: *nodep
  stage: sanity

authors:
  <<: *sanity
  only:
    refs:
      - /^release.*$/
  script:
    - LC_ALL=en_US.UTF-8 scripts/update-authors.sh

news:
  <<: *sanity
  only:
    refs:
      - /^release.*$/
  script:
    - head -n 1 NEWS | grep -q $(date +%Y-%m-%d)

trivial_checks: # aggregated to save some processing
  <<: *sanity
  script:
    - ci/no_assert_check.sh
    - ci/deckard_commit_check.sh

doc:
  <<: *sanity
  script:
    - meson build_doc -Ddoc=enabled
    - ninja -C build_doc doc-strict
  artifacts:
    expire_in: 6 hour
    paths:
      - doc/html

lint:other:
  <<: *sanity
  script:
    - meson build_ci_lint &>/dev/null
    - ninja -C build_ci* pylint
    - ninja -C build_ci* flake8
    - ninja -C build_ci* luacheck

lint:pedantic:
  <<: *after_build
  stage: sanity
  script:
    - meson build_pedantic_gcc -Dwerror=true -Dc_args='-Wpedantic' -Dextra_tests=enabled
    - ninja -C build_pedantic_gcc
    - >
      CC=clang CXX=clang++ meson build_pedantic_clang -Dwerror=true -Dextra_tests=enabled -Dc_args='
      -Wpedantic -Wno-newline-eof -Wno-gnu-zero-variadic-macro-arguments -Wno-gnu-folding-constant'
    - ninja -C build_pedantic_clang

lint:scan-build:
  <<: *after_build
  # TODO migrate lint to debian-11
  image: $CI_REGISTRY/knot/knot-resolver/ci/debian-buster:knot-$KNOT_VERSION
  before_script:
  # -- end TODO
  stage: sanity
  artifacts:
    when: on_failure
    expire_in: '1 day'
    paths:
      - build_ci*/meson-logs/scanbuild
  script:
    - export SCANBUILD="$(realpath ./scripts/run-scanbuild-with-args.sh)"
    - ninja -C build_ci* scan-build || true
    - test "$(ls build_ci*/meson-logs/scanbuild/*/report-*.html | wc -l)" = 22 # we have this many errors ATM :-)

lint:tidy:
  <<: *after_build
  # TODO migrate lint to debian-11
  image: $CI_REGISTRY/knot/knot-resolver/ci/debian-buster:knot-$KNOT_VERSION
  before_script:
  # -- end TODO
  stage: sanity
  script:
    - ninja -C build_ci* tidy

# Coverity reference: https://www.synopsys.com/blogs/software-security/integrating-coverity-scan-with-gitlab-ci/
lint:coverity:
  <<: *sanity
  image: $CI_REGISTRY/knot/knot-resolver/ci/debian-11-coverity:knot-$KNOT_VERSION
  only:
    refs:
      - nightly@knot/knot-resolver
      - coverity@knot/knot-resolver
  script:
    - meson build_ci_cov --prefix=$PREFIX
    - /opt/cov-analysis/bin/cov-build --dir cov-int ninja -C build_ci_cov
    - tar cfz cov-int.tar.gz cov-int
    - curl https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME
      --form token=$COVERITY_SCAN_TOKEN --form email="knot-resolver@labs.nic.cz"
      --form file=@cov-int.tar.gz --form version="`git describe --tags`"
      --form description="`git describe --tags` / $CI_COMMIT_TITLE / $CI_COMMIT_REF_NAME:$CI_PIPELINE_ID"

.kres-gen: &kres-gen
  <<: *sanity
  script:
    - meson build_ci_lib --prefix=$PREFIX -Dkres_gen_test=false
    - ninja -C build_ci_lib daemon/kresd
    - ninja -C build_ci_lib kres-gen
    - git diff --quiet || (git diff; exit 1)
kres-gen-30:
  <<: *kres-gen
  image: $CI_REGISTRY/knot/knot-resolver/ci/debian-11:knot-3.0
kres-gen-31:
  <<: *kres-gen
  image: $CI_REGISTRY/knot/knot-resolver/ci/debian-11:knot-3.1
kres-gen-32:
  <<: *kres-gen
  image: $CI_REGISTRY/knot/knot-resolver/ci/debian-11:knot-3.2

root.hints:
  <<: *sanity
  only:
    refs:
      - /^release.*$/
  script:
    - scripts/update-root-hints.sh
# }}}

# test {{{
.test_flaky: &test_flaky
  <<: *after_build
  stage: test
  retry:
    max: 1
    when:
      - script_failure

deckard:
  <<: *test_flaky
  # Deckard won't work with jemalloc due to a faketime bug:
  # https://github.com/wolfcw/libfaketime/issues/130
  only:  # trigger job only in repos under our control (privileged runner required)
    - branches@knot/knot-resolver
    - branches@knot/security/knot-resolver
  tags:
    - privileged
    - amd64
  variables:
    TMPDIR: $CI_PROJECT_DIR
  script:
    - ${MESON_TEST} --suite integration

respdiff:basic:
  <<: *after_build
  stage: test
  needs:
    - build-asan
  script:
    - ulimit -n "$(ulimit -Hn)" # applies only for kresd ATM
    - ./ci/respdiff/start-resolvers.sh
    - ./ci/respdiff/run-respdiff-tests.sh udp
    - $PREFIX/sbin/kres-cache-gc -c . -u 0  # simple GC sanity check
    - cat results/respdiff.txt
    - echo 'test if mismatch rate < 1.0 %'
    - grep -q '^target disagrees.*0\.[0-9][0-9] %' results/respdiff.txt
  after_script:
    - killall --wait kresd
  artifacts:
    when: always
    paths:
      - kresd.log*
      - results/*.txt
      - results/*.png
      - results/respdiff.db/data.mdb*
      - ./*.info

test:valgrind:
  <<: *test_flaky
  script:
    - ${MESON_TEST} --suite unit --suite config --no-suite snowflake --wrap="valgrind --leak-check=full --trace-children=yes --quiet --suppressions=/lj.supp"
    - MESON_TESTTHREADS=1 ${MESON_TEST} --wrap="valgrind --leak-check=full --trace-children=yes --quiet --suppressions=/lj.supp" --suite snowflake

pkgtest:
  stage: test
  trigger:
    include: ci/pkgtest.yaml
    strategy: depend
  needs:
    - build
  variables: # https://gitlab.nic.cz/help/ci/yaml/README.md#artifact-downloads-to-child-pipelines
    PARENT_PIPELINE_ID: $CI_PIPELINE_ID
  except:
    refs:
      - master@knot/knot-resolver
      - master@knot/security/knot-resolver
      - tags
    variables:
      - $SKIP_CI == "1"

pytests:
  <<: *test_flaky
  needs:
    - build-asan
  artifacts:
    when: always
    paths:
      - build_ci*/meson-logs/testlog*.txt
      - tests/pytests/*.html
      - tests/pytests/*.junit.xml
    reports: # Can't have multiple junit XMLs?
      junit: tests/pytests/pytests.parallel.junit.xml
  script:
    - ${MESON_TEST} --suite pytests
# }}}

# respdiff {{{
.condor: &condor
  <<: *common
  tags:
    - condor
  needs: []
  only:  # trigger job only in repos under our control
    - branches@knot/knot-resolver
    - branches@knot/security/knot-resolver
  # The set of respdiff+resperf jobs takes over two hours to execute.
  when: manual

.respdiff:  &respdiff
  <<: *condor
  stage: respdiff
  script:
    - git diff-index --name-only origin/master | grep -qEv '^(AUTHORS|ci/|config.mk|COPYING|distro/|doc/|etc/|NEWS|README.md|scripts/|tests/|\.gitignore|\.gitlab-ci\.yml|\.travis\.yml)' || test $RESPDIFF_FORCE -gt 0 || exit 77
    - test ! -f /var/tmp/respdiff-jobs/buffer/buffer_$RESPDIFF_TEST_stats.json || test $RESPDIFF_FORCE -gt 0 || ( echo "Reference unstable, try again in ~3h or use RESPDIFF_FORCE=1."; exit 1 )
    - export LABEL=gl$(date +%s)
    - export COMMITDIR="/var/tmp/respdiff-jobs/$(git rev-parse --short HEAD)-$LABEL"
    - export TESTDIR="$COMMITDIR/$RESPDIFF_TEST"
    - ln -s $COMMITDIR respdiff_commitdir
    - >
      sudo -u respdiff /var/opt/respdiff/contrib/job_manager/submit.py -w
      -p $RESPDIFF_PRIORITY
      -c $RESPDIFF_COUNT
      $(sudo -u respdiff /var/opt/respdiff/contrib/job_manager/create.py
      "$(git rev-parse --short HEAD)" -l $LABEL -t $RESPDIFF_TEST --knot-branch=$KNOT_VERSION
      --respdiff-stats /var/tmp/respdiff-jobs/ref_current/*_${RESPDIFF_TEST}_stats.json)
    - for f in $TESTDIR/*.json; do test -s "$f" || (cat $TESTDIR/*stderr*; cat $TESTDIR/j*_docker.txt; exit 1); done
    - sudo -u respdiff /var/opt/respdiff/contrib/job_manager/plot_ref.sh $TESTDIR/.. /var/tmp/respdiff-jobs/ref_current $RESPDIFF_TEST
  after_script:
    - 'cp -t . respdiff_commitdir/$RESPDIFF_TEST/j* ||:'
    - 'cp -t . respdiff_commitdir/*$RESPDIFF_TEST*.png ||:'
    - 'cat respdiff_commitdir/$RESPDIFF_TEST/*histogram.tar.gz | tar -xf - -i ||:'
  artifacts:
    when: always
    expire_in: 1 week
    paths:
      - ./j*
      - ./*.png
      - ./*histogram/*

fwd-tls6-kresd.udp6:
  <<: *respdiff
  variables:
    RESPDIFF_TEST: shortlist.fwd-tls6-kresd.udp6

fwd-udp6-kresd.udp6:
  <<: *respdiff
  variables:
    RESPDIFF_TEST: shortlist.fwd-udp6-kresd.udp6

iter.udp6:
  <<: *respdiff
  variables:
    RESPDIFF_TEST: shortlist.iter.udp6

iter.tls6:
  <<: *respdiff
  variables:
    RESPDIFF_TEST: shortlist.iter.tls6

fwd-udp6-unbound.udp6:
  <<: *respdiff
  variables:
    RESPDIFF_TEST: shortlist.fwd-udp6-unbound.udp6

fwd-udp6-unbound.tcp6:
  <<: *respdiff
  variables:
    RESPDIFF_TEST: shortlist.fwd-udp6-unbound.tcp6

fwd-udp6-unbound.tls6:
  <<: *respdiff
  variables:
    RESPDIFF_TEST: shortlist.fwd-udp6-unbound.tls6

.resperf:  &resperf
  <<: *condor
  stage: respdiff
  script:
    - git diff-index --name-only origin/master | grep -qEv '^(AUTHORS|ci/|config.mk|COPYING|distro/|doc/|etc/|NEWS|README.md|scripts/|tests/|\.gitignore|\.gitlab-ci\.yml|\.travis\.yml)' || test $RESPERF_FORCE -gt 0 || exit 77
    - export LABEL=gl$(date +%s)
    - export COMMITDIR="/var/tmp/respdiff-jobs/$(git rev-parse --short HEAD)-$LABEL"
    - export TESTDIR="$COMMITDIR/$RESPERF_TEST"
    - ln -s $COMMITDIR resperf_commitdir
    - >
      sudo -u respdiff /var/opt/respdiff/contrib/job_manager/submit.py -w
      $(sudo -u respdiff /var/opt/respdiff/contrib/job_manager/create.py
      "$(git rev-parse --short HEAD)" -l $LABEL --asan -t $RESPERF_TEST --knot-branch=$KNOT_VERSION)
    - export EXITCODE=$(cat $TESTDIR/j*_exitcode)
    - if [[ "$EXITCODE" == "0" ]]; then cat $TESTDIR/j*_resperf.txt; else cat $TESTDIR/j*_docker.txt; fi
    - exit $EXITCODE
  after_script:
    - 'cp -t . resperf_commitdir/$RESPERF_TEST/j* ||:'
  artifacts:
    when: always
    expire_in: 1 week
    paths:
      - ./j*

rp:fwd-tls6.udp-asan:
  <<: *resperf
  variables:
    RESPERF_TEST: resperf.fwd-tls6.udp

rp:fwd-udp6.udp-asan:
  <<: *resperf
  variables:
    RESPERF_TEST: resperf.fwd-udp6.udp

rp:iter.udp-asan:
  <<: *resperf
  variables:
    RESPERF_TEST: resperf.iter.udp
# }}}

# deploy {{{
# copy snapshot of current master to nightly branch for further processing
# (this is workaround for missing complex conditions for job limits in Gitlab)
nightly:copy:
  stage: deploy
  needs: []
  only:
    variables:
      - $CREATE_NIGHTLY == "1"
    refs:
      - master@knot/knot-resolver
  script:
    - 'tmp_file=$(mktemp)'
    # delete nightly branch
    - 'STATUS=$(curl --request PUT --header "PRIVATE-TOKEN: $GITLAB_API_TOKEN" -s -o ${tmp_file} -w "%{http_code}" "https://gitlab.nic.cz/api/v4/projects/147/repository/branches/nightly/unprotect")'
    - '[ "x${STATUS}" == "x200" ] || { cat ${tmp_file}; rm ${tmp_file}; exit 1; }'
    # no output from DELETE command
    - 'STATUS=$(curl --request DELETE --header "PRIVATE-TOKEN: $GITLAB_API_TOKEN" -s -o ${tmp_file} -w "%{http_code}" "https://gitlab.nic.cz/api/v4/projects/147/repository/branches/nightly")'
    # recreate nightly branch from current master
    - 'STATUS=$(curl --request POST --header "PRIVATE-TOKEN: $GITLAB_API_TOKEN" -s -o ${tmp_file} -w "%{http_code}" "https://gitlab.nic.cz/api/v4/projects/147/repository/branches?branch=nightly&ref=master")'
    - '[ "x${STATUS}" == "x201" ] || { cat ${tmp_file}; rm ${tmp_file}; exit 1; }'
    - 'STATUS=$(curl --request PUT --header "PRIVATE-TOKEN: $GITLAB_API_TOKEN" -s -o ${tmp_file} -w "%{http_code}" "https://gitlab.nic.cz/api/v4/projects/147/repository/branches/nightly/protect")'
    - '[ "x${STATUS}" == "x200" ] || { cat ${tmp_file}; rm ${tmp_file}; exit 1; }'
    - 'rm ${tmp_file}'

obs:trigger: &obs_trigger
  stage: deploy
  only:
    variables:
      - $OBS_REPO
  dependencies:  # wait for previous stages to finish
    - archive
  environment:
    name: OBS/$OBS_REPO
    url: https://build.opensuse.org/package/show/home:CZ-NIC:$OBS_REPO/knot-resolver
  tags:
    - condor
  allow_failure: false  # required to make when: manual action blocking
  script:
    - scripts/make-obs.sh
    - echo y | scripts/build-in-obs.sh $OBS_REPO

obs:release:
  <<: *obs_trigger
  only:
    - tags
  variables:
    OBS_REPO: knot-resolver-latest
  when: manual

obs:odvr:
  <<: *obs_trigger
  stage: pkgtest  # last stage to ensure it doesn't block anything
  only:
    - tags
  variables:
    OBS_REPO: knot-resolver-odvr
  when: manual
# }}}

# pkgtest {{{
.deploytest: &deploytest
  stage: pkgtest
  only:
    variables:
      - $OBS_REPO =~ /^knot-resolver-devel|knot-dns-devel|knot-resolver-testing$/
      - $CI_COMMIT_TAG
  dependencies: []  # wait for previous stages to finish
  variables:
    OBS_REPO: knot-resolver-latest
  when: delayed
  start_in: 3 minutes  # give OBS build some time
  tags:
    - condor

obs:build:all:
  <<: *deploytest
  only:
    variables:
      - $OBS_REPO =~ /^knot-resolver-devel|knot-dns-devel|knot-resolver-testing|knot-resolver-odvr$/
      - $CI_COMMIT_TAG
  allow_failure: true
  script:
    - "osc results home:CZ-NIC:$OBS_REPO knot-resolver -w"
    - version=$(sed 's/^v//' <(git describe --exact-match HEAD || git rev-parse --short HEAD) )
    - > # check version only for one (reliable) repo to avoid false negatives
      ! osc ls -b home:CZ-NIC:$OBS_REPO knot-resolver Debian_9.0 x86_64 | \
        grep -E '(rpm|deb|tar\.xz)$' | grep -v $version || \
        (echo "ERROR: version mismatch"; exit 1)
    - >
      ! osc results home:CZ-NIC:$OBS_REPO knot-resolver --csv | \
        grep -Ev 'disabled|excluded|Rawhide|CentOS_8_EPEL' | grep -v 'succeeded' -q || \
        (echo "ERROR: build(s) failed"; exit 1)

.distrotest: &distrotest
  <<: *deploytest
  # Description of the distrotest script workflow:
  # 1. wait for OBS package build to complete
  # 2. check the OBS build suceeded
  # 3. set up some variables, dir names etc.
  # 4. create a symlink with predictable name to export artifacts afterwards
  # 5. create an HTCondor job and submit it to a HTCondor cluster
  # 6. check exit code from condor, optionally display one of the logs and end the job with same exit code
  script:
    - "osc results home:CZ-NIC:$OBS_REPO knot-resolver -a x86_64 -r $DISTROTEST_REPO -w"
    - >
      osc results home:CZ-NIC:$OBS_REPO knot-resolver -a x86_64 -r $DISTROTEST_REPO --csv | grep 'succeeded|$' -q || \
        (echo "ERROR: build failed"; exit 1)
    - export LABEL="gl$(date +%s)_$OBS_REPO"
    - export COMMITDIR="/var/tmp/respdiff-jobs/$(git rev-parse --short HEAD)-$LABEL"
    - export TESTDIR="$COMMITDIR/distrotest.$DISTROTEST_NAME"
    - ln -s $COMMITDIR distrotest_commitdir
    - sudo -u respdiff /var/opt/respdiff/contrib/job_manager/submit.py -w
      -p $DISTROTEST_PRIORITY
      $(sudo -u respdiff /var/opt/respdiff/contrib/job_manager/create.py
        "$(git rev-parse --short HEAD)" -l $LABEL -t distrotest.$DISTROTEST_NAME
        --obs-repo $OBS_REPO)
    - export EXITCODE=$(cat $TESTDIR/j*_exitcode)
    - if [[ "$EXITCODE" != "0" ]]; then cat $TESTDIR/j*_{vagrant.log.txt,stdout.txt}; fi
    - exit $EXITCODE
  after_script:
    - 'cp -t . distrotest_commitdir/distrotest.$DISTROTEST_NAME/j* ||:'
  artifacts:
    when: always
    expire_in: 1 week
    paths:
      - ./j*
  retry:
    max: 1
    when:
      - script_failure

obs:rocky8:x86_64:
  <<: *distrotest
  allow_failure: true
  variables:
    OBS_REPO: knot-resolver-latest
    DISTROTEST_NAME: rocky8
    DISTROTEST_REPO: CentOS_8_EPEL

obs:debian10:x86_64:
  <<: *distrotest
  only:
    variables:
      - $OBS_REPO =~ /^knot-resolver-devel|knot-dns-devel|knot-resolver-testing|knot-resolver-odvr$/
      - $CI_COMMIT_TAG
  variables:
    OBS_REPO: knot-resolver-latest
    DISTROTEST_NAME: debian10
    DISTROTEST_REPO: Debian_10

obs:debian11:x86_64:
  <<: *distrotest
  only:
    variables:
      - $OBS_REPO =~ /^knot-resolver-devel|knot-dns-devel|knot-resolver-testing|knot-resolver-odvr$/
      - $CI_COMMIT_TAG
  variables:
    OBS_REPO: knot-resolver-latest
    DISTROTEST_NAME: debian11
    DISTROTEST_REPO: Debian_11

obs:fedora35:x86_64:
  <<: *distrotest
  allow_failure: true
  variables:
    OBS_REPO: knot-resolver-latest
    DISTROTEST_NAME: fedora35
    DISTROTEST_REPO: Fedora_35

obs:fedora36:x86_64:
  <<: *distrotest
  allow_failure: true
  variables:
    OBS_REPO: knot-resolver-latest
    DISTROTEST_NAME: fedora36
    DISTROTEST_REPO: Fedora_36

obs:leap15:x86_64:
  <<: *distrotest
  allow_failure: true
  variables:
    OBS_REPO: knot-resolver-latest
    DISTROTEST_NAME: leap15
    DISTROTEST_REPO: openSUSE_Leap_15.4

obs:ubuntu1804:x86_64:
  <<: *distrotest
  variables:
    OBS_REPO: knot-resolver-latest
    DISTROTEST_NAME: ubuntu1804
    DISTROTEST_REPO: xUbuntu_18.04

obs:ubuntu2004:x86_64:
  <<: *distrotest
  only:
    variables:
      - $OBS_REPO =~ /^knot-resolver-devel|knot-dns-devel|knot-resolver-testing|knot-resolver-odvr$/
      - $CI_COMMIT_TAG
  variables:
    OBS_REPO: knot-resolver-latest
    DISTROTEST_NAME: ubuntu2004
    DISTROTEST_REPO: xUbuntu_20.04

obs:ubuntu2204:x86_64:
  <<: *distrotest
  allow_failure: true
  variables:
    OBS_REPO: knot-resolver-latest
    DISTROTEST_NAME: ubuntu2204
    DISTROTEST_REPO: xUbuntu_22.04

.packagingtest: &packagingtest
  stage: pkgtest
  only:
    refs:
      - nightly@knot/knot-resolver
  needs: []
  tags:
    - dind
    - amd64
  variables:
    DISTRO: debian_10
  script:
    - pytest -r fEsxX tests/packaging -k $DISTRO

packaging:centos_8:
  <<: *packagingtest
  variables:
    DISTRO: centos_8

packaging:centos_7:
  <<: *packagingtest
  variables:
    DISTRO: centos_7

packaging:fedora_31:
  <<: *packagingtest
  variables:
    DISTRO: fedora_31

packaging:fedora_32:
  <<: *packagingtest
  variables:
    DISTRO: fedora_32

# }}}