GitLab CI/CD (.gitlab-ci.yml) Pipeline Generator

# ============================================================================
# GitLab CI/CD Pipeline Configuration (.gitlab-ci.yml)
# Synthesized via ToolsAA Flagship Generator (100% Client-Side Engine)
# ============================================================================

include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml

stages:
  - lint
  - test
  - security
  - build
  - deploy

default:
  image: node:20-alpine
  interruptible: true
  retry:
    max: 2
    when:
      - runner_system_failure
      - stuck_or_timeout_failure
  tags:
    - docker
    - saas-linux-medium-amd64

variables:
  FF_USE_FASTZIP: "true"
  ARTIFACT_COMPRESSION_LEVEL: "fast"
  CACHE_COMPRESSION_LEVEL: "fast"
  SAST_EXCLUDED_PATHS: "test, tests, spec, docs"
  NEXT_TELEMETRY_DISABLED: "1"
  CI: "true"

cache:
  key:
    files:
      - pnpm-lock.yaml
  policy: pull-push
  paths:
    - .pnpm-store
    - node_modules/.cache

lint-and-format:
  stage: lint
  timeout: 25m
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_TAG
  before_script:
    - npm install -g pnpm
    - pnpm config set store-dir .pnpm-store
    - pnpm install --frozen-lockfile
  script:
    - pnpm run lint
    - pnpm run typecheck

unit-tests:
  stage: test
  timeout: 25m
  parallel:
    matrix:
      - NODE_VERSION: ["18", "20", "22"]
  image: node:${NODE_VERSION}-alpine
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_TAG
  before_script:
    - npm install -g pnpm
    - pnpm config set store-dir .pnpm-store
    - pnpm install --frozen-lockfile
  script:
    - pnpm test -- --coverage
  coverage: '/Lines\s*:\s*(\d+\.\d+\%)/'
  artifacts:
    reports:
      junit: junit.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura-coverage.xml
    expire_in: 3 days
    when: always

compile-and-package:
  stage: build
  timeout: 25m
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_TAG
  before_script:
    - npm install -g pnpm
    - pnpm install --frozen-lockfile
  script:
    - pnpm run build
  artifacts:
    paths:
      - dist/
      - .next/
      - coverage/
    expire_in: 1 week
    when: on_success

deploy-service:
  stage: deploy
  environment:
    name: production
    url: https://toolsaa.com
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual
  script:
    - echo "Deploying production bundle..."