Component-Driven Pipeline

workflow:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "main"'

stages:
  - build
  - test
  - deploy

variables:
  REGISTRY: registry.example.com
  APP_NAME: my-service

include:
  # CI/CD catalog component — uses version pinning and component context
  - component: $CI_SERVER_FQDN/my-org/security-components/secret-detection@1.0
  - component: $CI_SERVER_FQDN/gitlab-org/components/rust/lint@2.5

# Build job with parallel:matrix and id_tokens for OIDC auth
build_matrix:
  stage: build
  image: node:22-alpine
  id_tokens:
    OIDC_TOKEN:
      aud: $CI_SERVER_URL
  parallel:
    matrix:
      - TARGET: ["linux-x64", "linux-arm64", "macos-x64"]
  script:
    - echo "Building $TARGET"
    - npm ci
    - npm run build -- --target $TARGET
    - echo "Pushing to $REGISTRY/$APP_NAME:$CI_COMMIT_SHA-$TARGET"
  artifacts:
    paths:
      - dist/
    exclude:
      - dist/**/*.map

# Test with component context interpolation (GitLab 18.7+)
test_component:
  stage: test
  image: node:22-alpine
  spec:
    component:
      inputs:
        version:
        sha:
  needs:
    - build_matrix
  script:
    - echo "Testing component version $[[ component.version ]]"
    - echo "Component SHA $[[ component.sha ]]"
    - npm run test

# Security scan via included component
secret_detection:
  stage: test
  needs: []

# Deploy with manual gate and environment (GitLab 18.3+ environment:stop)
deploy_prod:
  stage: deploy
  image: alpine:3.21
  needs:
    - test_component
    - secret_detection
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: manual
      allow_failure: false
  environment:
    name: production/$CI_COMMIT_BRANCH
    url: https://app.example.com
    auto_stop_in: 2 weeks
  script:
    - echo "Deploying $APP_NAME to production"
    - echo "Using OIDC token $OIDC_TOKEN"

# Environment stop job (GitLab 18.3+)
stop_production:
  stage: deploy
  needs:
    - deploy_prod
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: manual
      allow_failure: true
  environment:
    name: production/$CI_COMMIT_BRANCH
    action: stop
  script:
    - echo "Stopping production environment"