.gitlab-ci.yml

include:
  - template: Code-Quality.gitlab-ci.yml
  - project: 'dev/ext-project-packaging/ci-includes'
    file: 'gitbox-deb-ci.yml'

variables:
  LANG: C.UTF-8
  IMAGE_NAME: linotp-build-test-environment_buster
  BUILD_CODE_IMAGE: $CI_REGISTRY/$IMAGE_NAME:$CI_COMMIT_REF_NAME
  LATEST_CODE_IMAGE: $CI_REGISTRY/$IMAGE_NAME:$CI_PIPELINE_ID
  DOCKERFY_URL: https://debs-devel.corp.linotp.de/misc/dockerfy/dockerfy
  DEBIAN_MIRROR: ftp.de.debian.org
  DEPENDENCY_DEB_REPO: http://debs-devel.corp.linotp.de/linotp3 buster linotp
  # DEPENDENCY_GPG_KEYID: 7CC736921C5A21B7
  DEPENDENCY_GPG_KEYID: ""
  DEPENDENCY_GPG_KEY_URL: http://debs-devel.corp.linotp.de/misc/gpg/linotp-dev-archive-keyring.gpg
  DOCKER_TAGS: $CI_PIPELINE_ID
  IMAGE_PREFIX: $CI_REGISTRY/$CI_PROJECT_PATH/ci
  NOSE_COVER_PACKAGE: linotp
  DOCKER_COMPOSE_VERSION: "1.22.0"
  # Docker network per build - needed for DNS resolution between services (service linotp needs db)
  FF_NETWORK_PER_BUILD: 1
  BLACKDOG_LDAP_IMAGE: $CI_REGISTRY/docker-images/blackdog-ldap/blackdog-ldap:latest
  BLACKDOG_MYSQL_IMAGE: $CI_REGISTRY/docker-images/blackdog-mysql/blackdog-mysql:latest
  PYPI_IMAGE: $IMAGE_PREFIX/linotp-pypi-testenv
  # Variables for upload-debs
  REPOSITORY: linotp3
  COMPONENT: linotp

workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == 'schedule'              # Execute nightly pipeline
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' # Execute pipeline in merge request context
    - if: '$CI_PIPELINE_SOURCE == "web"'                 # Execute pipeline manually triggered from the web
    - if: $CI_COMMIT_TAG                                 # Execute pipeline on release tag
    - if: '$CI_COMMIT_BRANCH =~ /^(branch-v|master)/'    # Execute pipeline when a new commit is pushed to a stable or master branch
    - if: $NIGHTLY_PIPELINE                              # Execute pipeline if run with this variable set

stages:
  - pypi-image
  - pypi-tests
  - check-and-build
  - test
  - lint
  - coverage-report
  - apidocs
  - upload-debian-packages
  - iso

.docker-registry: &docker-registry
  docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY

build-and-upload-pypi-image-testenv:
  stage: pypi-image
  # image: docker:latest
  # TODO: user docker:latest again once the pipeline-issue
  # https://forum.gitlab.com/t/the-ci-cd-pipeline-suddenly-fails-without-any-changes-done-to-the-repository/81117
  # has been resolved.
  # For now we use the proposed solution with the previous (and working) image `docker:20.10.22-dind` referenced by hash
  # docker@sha256:c8bb6fa5388b56304dd770c4bc0478de81ce18540173b1a589178c0d31bfce90
  image: docker@sha256:c8bb6fa5388b56304dd770c4bc0478de81ce18540173b1a589178c0d31bfce90
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: manual
      allow_failure: true
      variables:
        PYPI_IMAGE_TAG: $PYPI_IMAGE:$CI_MERGE_REQUEST_TARGET_BRANCH_NAME
  variables:
    PYPI_IMAGE_TAG: $PYPI_IMAGE:$CI_COMMIT_REF_NAME
  before_script:
    - *docker-registry
  script:
    - docker build -t "$PYPI_IMAGE_TAG" -f Dockerfile.pypi-testenv .
    - docker push "$PYPI_IMAGE_TAG"

pre-commit-check:
  stage: check-and-build
  needs: []
  image: python:3.7-buster
  interruptible: true
  cache:
    paths:
      - $CI_PROJECT_DIR/.pre-commit-cache
  rules:
    - exists:
      - .pre-commit-config.yaml
  before_script:
    - pip install pre-commit
  script:
    - PRE_COMMIT_HOME=$CI_PROJECT_DIR/.pre-commit-cache pre-commit run --all-files

.docker-build-args: &docker-build-args |
  DOCKER_BUILD_ARGS="--build-arg BUILDKIT_INLINE_CACHE=1"
  # Use cached docker images in non-nightly pipelines
  if [ -z "${NIGHTLY_PIPELINE}" ]; then
    DOCKER_BUILD_ARGS="$DOCKER_BUILD_ARGS --cache-from=$BUILDER_CACHE_IMAGE --cache-from=$LINOTP_CACHE_IMAGE"       
  fi

# Build docker images and debs
# This builds the .debs and docker images (builder, linotp, testenv).
# Everything else depends on these, so we build everything in one go
# to make the build of all the images as fast as possible. We use
# Docker caching to speed things up.
.build-debs-and-images:
  stage: check-and-build
  image: docker:latest
  interruptible: true
  retry:
    max: 2
  needs: []
  before_script:
    - *docker-registry
  script:
    - apk add --no-cache make
    - REGISTRY_IMAGE=$IMAGE_PREFIX/linotp-${DEBIAN_RELEASE_NAME}
    - BUILDER_CACHE_KEY=$(sha256sum Dockerfile.builder | cut -d ' ' -f1)
    - BUILDER_CACHE_IMAGE=$REGISTRY_IMAGE-builder:${BUILDER_CACHE_KEY}
    - LINOTP_CACHE_KEY=$(sha256sum Dockerfile | cut -d ' ' -f1)
    - LINOTP_CACHE_IMAGE=$REGISTRY_IMAGE:${LINOTP_CACHE_KEY}
    # Pull the old images to speedup the build process, the hope is
    # that the modified time will always be the same unless the file
    # has actually been changed
    - export DOCKER_BUILDKIT=1
    - docker pull debian:${DEBIAN_RELEASE_NAME}
    - docker pull $BUILDER_CACHE_IMAGE || true
    - docker pull $LINOTP_CACHE_IMAGE || true
    # Build the images
    - *docker-build-args
    - >
        make
        docker-build-linotp-builder
        docker-build-linotp
        docker-build-linotp-test-image
        docker-build-linotp-softhsm
        BUILDDIR="${CI_PROJECT_DIR}"
        DOCKER_BUILD_ARGS="${DOCKER_BUILD_ARGS}"
    # Tag and push images to repository in the form:
    #  registry/ci/release/linotp-IMAGENAME:pipelineID
    #  registry/ci/release/linotp-IMAGENAME:sha256
    # First for linotp-builder
    - docker tag linotp-builder:latest "${BUILDER_CACHE_IMAGE}"
    - docker tag linotp-builder:latest "$REGISTRY_IMAGE-builder:${CI_PIPELINE_ID}"
    - docker push "${BUILDER_CACHE_IMAGE}"
    - docker push "$REGISTRY_IMAGE-builder:${CI_PIPELINE_ID}"
    # Now do the same for linotp
    - docker tag linotp:latest "${LINOTP_CACHE_IMAGE}"
    - docker tag linotp:latest "$REGISTRY_IMAGE:${CI_PIPELINE_ID}"
    - docker push "${LINOTP_CACHE_IMAGE}"
    - docker push "$REGISTRY_IMAGE:${CI_PIPELINE_ID}"
    # Now we push the testenv and softhsm images. We do not bother to cache
    # this because they change every time we do a new linotp build.
    - docker tag linotp-testenv:latest "$REGISTRY_IMAGE-testenv:${CI_PIPELINE_ID}"
    - docker push "$REGISTRY_IMAGE-testenv:${CI_PIPELINE_ID}"
    - docker tag linotp-softhsm:latest "$REGISTRY_IMAGE-softhsm:${CI_PIPELINE_ID}"
    - docker push "$REGISTRY_IMAGE-softhsm:${CI_PIPELINE_ID}"
    # Log all the images to stdout
    - docker images
    # Save build job id to artifacts for later uploads
    - echo "$CI_JOB_ID" > apt/"$DEBIAN_RELEASE_NAME"_build_job_id.txt
    - echo "DEB_ARTIFACTS_URL=https://${GITLAB_DOMAIN_NAME}/api/v4/projects/${CI_PROJECT_ID}/jobs/${CI_JOB_ID}/artifacts" >> build.env

build:debian-buster:
  extends: .build-debs-and-images
  variables:
    DEBIAN_RELEASE_NAME: buster
  artifacts:
    expose_as: apt-buster
    paths:
      - apt/
    name: "linotp-debs${CI_COMMIT_REF_SLUG}"
    expire_in: 2 weeks
    reports:
      dotenv: build.env


lint:
  stage: lint
  when: manual
  image: ${IMAGE_PREFIX}/${DEBIAN_RELEASE_NAME}/linotp-testenv:${CI_PIPELINE_ID}
  needs: ["build:debian-buster"]
  interruptible: true
  variables:
    LINTED_MODULE: ""
    DEBIAN_RELEASE_NAME: buster
    EXIT_ON_FATAL: "1"
    EXIT_ON_ERROR: "0"
    EXIT_ON_WARNING: "0"
  script:
    - pylint3 linotp/${LINTED_MODULE} && STATUS=0 || STATUS=$?
    - echo STATUS:$STATUS
    - "test $(( $STATUS & 32 )) -eq 0 || (echo 'Fail: usage error'; false)"
    - "test $(( $EXIT_ON_FATAL && $STATUS & 1 )) -eq 0 || (echo 'Fail: Fatal errors'; false)"
    - "test $(( $EXIT_ON_ERROR && $STATUS & 2 )) -eq 0 || (echo 'Fail: Errors'; false)"
    - "test $(( $EXIT_ON_WARNING && $STATUS & 4 )) -eq 0 || (echo 'Fail: Warnings'; false)"
  parallel:
    matrix:
      - LINTED_MODULE: [controllers, lib, model, provider, tokens, useridresolver]

# Provide pytest arguments based on base rules
# The tests need a number of arguments based on the type
# of job they represent. (database type, parallel run, nightly, etc.).
# We also need do decide whether to include parallel arguments depending on
# the job variables provided. We implement this as a shell command so that
# we can make use of the shell to put all the pieces together in once place.
#
# Pytest arguments can be specified in these variables:
#  NIGHTLY_ARGS     - Only used if this is a nightly (extended) pipeline or merge-train
#  NON_NIGHTLY_ARGS - Only used for normal pipelines (MRs, merges, tags)
#  ALL_JOB_ARGS     - Both nightly and non-nightly jobs
#
# Behaviour configuration:
#  NIGHTLY_PIPELINE - If set, the pipeline runs in nightly mode and enables an
#                     extended set of tests
#
# Other variables used:
#  CI_JOB_NAME      - the test report file is derived from the job name
#  CI_NODE_TOTAL    - parallel run configuration
#  CI_NODE_INDEX
.pytest-args: &pytest-args |
  # Junit XML filename is based on the job name
  PYTESTARGS="--junitxml=`echo ${CI_JOB_NAME} | tr ' /' '_'`.xml"
  if [ -n "${CI_NODE_INDEX}" ]; then
    PYTESTARGS="$PYTESTARGS --test-group-count=${CI_NODE_TOTAL} --test-group=${CI_NODE_INDEX}"
  fi
  # Add arguments from job definition
  PYTESTARGS="$PYTESTARGS ${ALL_JOB_ARGS}"
  # Job definition of nightly / non-nightly arguments
  if [ -n "${NIGHTLY_PIPELINE}" ]; then
    PYTESTARGS="$PYTESTARGS ${NIGHTLY_ARGS}"
  else
    PYTESTARGS="$PYTESTARGS ${NON_NIGHTLY_ARGS}"
  fi
  #
  if [ -n "${PYPI_ARGS}" ]; then
    PYTESTARGS="$PYTESTARGS ${PYPI_ARGS}"
  fi
  # Coverage report
  PYTESTARGS="$PYTESTARGS --cov=linotp --cov-report=xml:${CI_PROJECT_DIR}/coverage.xml"

# Nightly tests are scheduled to run once a day and contain
# more tests than the regular set
# Merge_trains too run against more to prevent a broken master
.only-nightly-and-merge:
  rules:
    - if: $NIGHTLY_PIPELINE
      when: always
    - if: $CI_MERGE_REQUEST_EVENT_TYPE == 'merge_train'
      variables:
        NIGHTLY_PIPELINE: 1
      when: always

# Tests should run on Debian buster
.buster-tests:
  variables:
    DEBIAN_RELEASE_NAME: buster
  needs: ["build:debian-buster"]

# The next sections provide different database configurations
.mysql-vars: &mysql-vars
  MYSQL_DATABASE: linotp_db
  MYSQL_ROOT_PASSWORD: rootpass
  MYSQL_USER: linotp
  MYSQL_PASSWORD: linotppass
  LINOTP_DB_HOST: "db"
  LINOTP_DB_PORT: "3306"
  LINOTP_DB_WAITTIME: 2m
  LINOTP_DATABASE_URI: "mysql+mysqldb://linotp:linotppass@db/linotp_db?charset=utf8"
  LINOTP_PYTEST_DATABASE_URI: "mysql+mysqldb://linotp:linotppass@db/linotp_db?charset=utf8"

.mariadb-database:
  rules:
    - if: $NIGHTLY_PIPELINE
      when: always
    - if: $CI_MERGE_REQUEST_EVENT_TYPE == 'merge_train'
      variables:
        NIGHTLY_PIPELINE: 1
      when: always
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

  variables:
    <<: *mysql-vars
    DB: mariadb:10.1
  services:
    - name: ${DB}
      alias: db

.mysql-database:
  extends:
    - .only-nightly-and-merge
  variables:
    <<: *mysql-vars
    DB: mysql:5.5
  services:
    - name: ${DB}
      alias: db
      command: ["mysqld", "--character-set-server=utf8", "--collation-server=utf8_general_ci"]

.postgres-database:
  extends:
    - .only-nightly-and-merge
  variables:
    DB: postgres:12
    POSTGRES_DB: linotp_db
    POSTGRES_USER: linotp
    POSTGRES_PASSWORD: "linotppass"
    POSTGRES_HOST_AUTH_METHOD: trust
    LINOTP_DB_HOST: "db"
    LINOTP_DB_PORT: "3306"
    LINOTP_DB_WAITTIME: 2m
    LINOTP_DATABASE_URI: postgres://linotp:linotppass@db/linotp_db
    LINOTP_PYTEST_DATABASE_URI: postgres://linotp:linotppass@db/linotp_db
  services:
    - name: ${DB}
      alias: db

## Test stages
.parallel:
  matrix:
    - CI_FLASK_VERSION: [Flask-1, Flask-2]
      CI_NODE_INDEX: [1, 2, 3, 4]
      CI_NODE_TOTAL: [4]
  matrix-no-test-splitting:
    - CI_FLASK_VERSION: [Flask-1, Flask-2]
      CI_NODE_INDEX: [1]
      CI_NODE_TOTAL: [1]
  matrix-flask1-only:
    - CI_FLASK_VERSION: [Flask-1]
      CI_NODE_INDEX: [1, 2, 3, 4]
      CI_NODE_TOTAL: [4]
  matrix-no-test-splitting-flask1-only:
    - CI_FLASK_VERSION: [Flask-1]
      CI_NODE_INDEX: [1]
      CI_NODE_TOTAL: [1]
  script-install-flask2: &script-install-flask2
    if [ "$CI_FLASK_VERSION" == "Flask-2" ];
      then
        pip3 install --upgrade pip wheel;
        pip3 install --upgrade "Flask==2.1.3" Flask-JWT-Extended "Flask-Babel<3.0.0" Flask-SQLAlchemy pytest-flask;
        if ! pip3 freeze | grep Flask==2; then echo "FLASK_VERSION is != 2" && exit 1; fi
    ; fi

.test-base:
  interruptible: true
  parallel:
    matrix: !reference [.parallel, matrix]
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: ${CI_PROJECT_DIR}/coverage.xml

.test-base-pypi:
  extends: .test-base
  stage: pypi-tests
  image: $PYPI_IMAGE_TAG
  rules:
    - if: $CI_MERGE_REQUEST_EVENT_TYPE == 'merged_result'
  variables:
    PYPI_IMAGE_TAG: $PYPI_IMAGE:$CI_MERGE_REQUEST_TARGET_BRANCH_NAME
    PYPI_ARGS: "-m \"not fails_in_pypi_tests\" -n auto"
  before_script:
    # install env
    - pip3 install --upgrade --upgrade-strategy eager -e ".[test]" smpplib pytest-test-groups pytest-xdist
    - *script-install-flask2
    - *pytest-args
  
.test-base-debs:
  extends:
    - .test-base
    - .only-nightly-and-merge
  stage: test
  needs: build:debian-buster
  image: ${IMAGE_PREFIX}/linotp-${DEBIAN_RELEASE_NAME}-testenv:${CI_PIPELINE_ID}

unit-test-pypi:
  extends: .test-base-pypi
  script:
      - make unittests PYTESTARGS="$PYTESTARGS"

.functional-test-base-pypi:
  extends:
    - .test-base-pypi
  artifacts:
    reports:
      junit: linotp/tests/functional/functional-pypi*.xml
  script:
    - make functionaltests PYTESTARGS="$PYTESTARGS"

functional-test-pypi:
  extends: .functional-test-base-pypi

# Unit tests
unit-test:
  extends:
    - .test-base-debs
    - .buster-tests
  artifacts:
    reports:
      junit: linotp/tests/unit/unit-*.xml
  before_script:
    !reference [.parallel, script-install-flask2]
  script:
    - *pytest-args
    - make unittests PYTESTARGS="$PYTESTARGS"

# Functional tests
.functional-test-base:
  extends:
    - .test-base-debs
    - .buster-tests
  artifacts:
    reports:
      junit: linotp/tests/functional/functional-*.xml
  before_script:
    !reference [.parallel, script-install-flask2]
  script:
    - *pytest-args
    - make functionaltests PYTESTARGS="$PYTESTARGS"

.functional-test-base-dbs:
  extends: .functional-test-base

functional-test:
  extends: .functional-test-base

functional-test-mariadb:
  extends:
    - .functional-test-base-dbs
    - .mariadb-database
    - .only-nightly-and-merge

functional-test-postgres:
  extends:
    - .functional-test-base-dbs
    - .postgres-database

functional-test-mysql:
  extends:
    - .functional-test-base-dbs
    - .mysql-database

.e2e-test:
  extends:
    - .test-base-debs
    - .buster-tests
  parallel:
    matrix: !reference [.parallel, matrix-flask1-only]
  variables:
    LINOTP_IMAGE: "linotp"
    LINOTP_HOST: "test-linotp"
    LINOTP_PORT: "443"
    LINOTP_PROTOCOL: "https"
    LINOTP_USERNAME: "admin"
    LINOTP_PASSWORD: "admin"
    HEALTHCHECK_PORT: "80"
    SELENIUM_DRIVER: "chrome"
    SELENIUM_PROTOCOL: "http"
    SELENIUM_HOST: "test-chrome"
    SELENIUM_PORT: "4444"
    SSL_TRUSTED_CERT: "
      Issuer: O = LinOTP-DE, CN = LinOTP-DE Root CA
        Validity
            Not Before: Feb  6 12:15:37 2022 GMT
            Not After : Feb  4 12:15:37 2032 GMT
        Subject: O = LinOTP-DE, CN = LinOTP-DE Root CA
      -----BEGIN CERTIFICATE-----
      MIIBojCCAUmgAwIBAgIQPlwfzlZDQsPhD1rWE9Ux3TAKBggqhkjOPQQDAjAwMRIw
      EAYDVQQKEwlMaW5PVFAtREUxGjAYBgNVBAMTEUxpbk9UUC1ERSBSb290IENBMB4X
      DTIyMDIwNjEyMTUzN1oXDTMyMDIwNDEyMTUzN1owMDESMBAGA1UEChMJTGluT1RQ
      LURFMRowGAYDVQQDExFMaW5PVFAtREUgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqG
      SM49AwEHA0IABGZPiX58lcLz+oX/CNZFdJI3bWE9KdxRlmypYWwbZUqkhLn1ARWc
      lblmltOU/L6/XlbYuLWdTE3Hk1VF7UA+zdejRTBDMA4GA1UdDwEB/wQEAwIBBjAS
      BgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRY28kvC11GjduDBsUaQvIr87ke
      MDAKBggqhkjOPQQDAgNHADBEAiB9pumbZbFk5ChludETNKxFzSVRCx7Cbzm1zNCw
      TGfofQIgFClkyscaKq+ALGjKzDAf+oF4A1BgOzqdFxafFePRH54=
      -----END CERTIFICATE-----
      "
  artifacts:
    name: browser-screenshots
    paths:
      - Screenshots/
    when: on_failure
    reports:
      junit: linotp/tests/integration/e2e-*.xml
  script:
    - cd linotp/tests/integration
    - >
        /usr/local/bin/dockerfy
        --template docker_cfg.ini.tmpl:/tmp/server_cfg.ini
        --wait tcp://$SELENIUM_HOST:$SELENIUM_PORT
        --timeout 60m
        --wait tcp://$LINOTP_HOST:$LINOTP_PORT
        --timeout 60m
    - *pytest-args
    - make integrationtests TCFILE=/tmp/server_cfg.ini PYTESTARGS="$PYTESTARGS"
  after_script:
    - mv linotp/tests/integration/Screenshots .

e2e-test-mariadb:
  extends:
    - .e2e-test
    - .mariadb-database
  services:
    - name: "${IMAGE_PREFIX}/${LINOTP_IMAGE}-${DEBIAN_RELEASE_NAME}:${CI_PIPELINE_ID}"
      alias: test-linotp
    - name: $BLACKDOG_LDAP_IMAGE
      alias: blackdog-ldap
    - name: $BLACKDOG_MYSQL_IMAGE
      alias: blackdog-mysql
    - name: ${DB}
      alias: db
    - name: selenium/standalone-chrome-debug:latest
      alias: test-chrome
  allow_failure: false

# End to end test using Soft HSM image
e2e-test-softhsm:
  extends:
    - e2e-test-mariadb
    - .only-nightly-and-merge
  variables:
    ALL_JOB_ARGS: "-m smoketest -v"
    LINOTP_IMAGE: "linotp-softhsm"
  allow_failure: true
  parallel:
    matrix: !reference [.parallel, matrix-no-test-splitting-flask1-only]

# Auto-generate API docs using Sphinx.
apidocs:
  stage: apidocs
  image: $IMAGE_PREFIX/linotp-buster:${CI_PIPELINE_ID}
  interruptible: true
  needs: ["build:debian-buster"]
  script:
    - python3 --version
    - pip3 install -e ".[apidocs]"
    - cd ${CI_PROJECT_DIR}/api-doc
    - make apidocs
    - make html
    - mkdir ${CI_PROJECT_DIR}/api-docs
    - cp -a build/html/. ${CI_PROJECT_DIR}/api-docs
  artifacts:
    name: "linotp-apidocs"
    paths:
      - api-docs
    expire_in: 2 weeks

# Upload deb packages
.debian-releases:
  parallel:
    matrix:
      - DEBIAN_RELEASE_NAME:
        - buster


upload-debs:
  stage: upload-debian-packages
  extends: .upload-debs

# Build and upload are being handled by dev/linotp/sva2/build-isos
.build-and-upload-iso:
  stage: iso
  trigger:
    project: dev/linotp/sva2/build-isos
    strategy: depend

build-and-upload-iso:
  extends: .build-and-upload-iso
  variables:
    UPLOAD: "yes"
  rules:
    - if: '$CI_COMMIT_TAG =~ /^dev\//'                  # Release candidate for QA
      variables:
        BUILD: golden
    - if: '$CI_COMMIT_TAG =~ /^release/'                # Release version
      variables:
        BUILD: release

build-iso:
  extends: .build-and-upload-iso
  when: manual
  allow_failure: true
  variables:
    DEB_ARTIFACTS_URL: $DEB_ARTIFACTS_URL
    BUILD: commit
    UPLOAD: "no"
  rules:
    - if: $CI_PIPELINE_SOURCE == 'schedule'            # Nightly/Scheduled pipeline
    - if: $CI_MERGE_REQUEST_REF_PATH                    # Commit on branch