.gitlab-ci.yml

# Copyright 2023-2024 Arm Limited and/or its affiliates
# <open-source-office@arm.com>
# SPDX-License-Identifier: MIT

default:
  # cancel the job if a new pipeline is triggered on the same branch
  interruptible: true
  image: ${OPEN_IOT_SDK_DOCKER_REGISTRY}/open-iot-sdk:${OPEN_IOT_SDK_DOCKER_VERSION}

include:
  local: '$PWD/tools/ci/pipeline-baseline-fri.yml'

variables:
  OPEN_IOT_SDK_DOCKER_VERSION: v2
  GIT_SUBMODULE_STRATEGY: none
  RETRY_LIMIT: 100

# Those fragments contain base variables required by pipelines for applications.
# They can be used to set matrix parameters and extended using << : .anchor syntax
.pipeline_config_corstone320: &pipeline_config_corstone320
  TARGET: [corstone320]
.pipeline_config_corstone315: &pipeline_config_corstone315
  TARGET: [corstone315]
.pipeline_config_corstone310: &pipeline_config_corstone310
  TARGET: [corstone310]
.pipeline_config_corstone300: &pipeline_config_corstone300
  TARGET: [corstone300]
.pipeline_config_toolchain: &pipeline_config_toolchain
  TOOLCHAIN: [ARMCLANG, GNU]

stages:
  - quality-check
  - build
  - test
  - cleanup

workflow:
  rules:
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_REF_NAME =~ /^release-.*/
    - if: $CI_PIPELINE_SOURCE == "web"
    - if: $CI_PIPELINE_SOURCE == "schedule"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

# This build job is used as a template for building the available platforms' applications
.build_job:
  tags:
    - iotmsw-amd64
  extends: .base-job-rules
  before_script:
    - python -m pip install pyelftools
  script:
    - |
      apt-get update -y && \
      apt-get install ccache -y && \
      apt-get clean && \
      rm -rf /var/lib/apt/lists
    - ccache -o cache_dir=/cache/$CI_JOB_NAME_SLUG/.ccache
    - ccache -p
    - ln -s /usr/bin/ccache /usr/lib/ccache/arm-none-eabi-gcc
    - ln -s /usr/bin/ccache /usr/lib/ccache/arm-none-eabi-g++
    - ln -s /usr/bin/ccache /usr/lib/ccache/arm-none-eabi-cpp
    - ln -s /usr/bin/ccache /usr/lib/ccache/arm-none-eabi-c++
    - ln -s /usr/bin/ccache /usr/lib/ccache/arm-none-eabi-ar
    - ln -s /usr/bin/ccache /usr/lib/ccache/armclang
    - ln -s /usr/bin/ccache /usr/lib/ccache/armar
    - export PATH=/usr/lib/ccache:$PATH
    - echo $PATH
    - export APP_UNDERSCORED=$(echo ${APP} | tr '-' '_')
    - ./tools/ci/generate_credentials.sh -f -p applications/${APP_UNDERSCORED}/configs/aws_configs
    - git config --global user.email "ci@example.com"
    - git config --global user.name "ci"
    - git config --global core.autocrlf input
    - |
      ./tools/scripts/build.sh ${APP} \
        --target $TARGET \
        --inference $INFERENCE \
        --audio $AUDIO \
        --toolchain $TOOLCHAIN \
        --certificate_path $PWD/certificate.pem \
        --private_key_path $PWD/private_key.pem \
        --conn-stack $CONN_STACK \
        --psa-crypto-implementation $PSA_CRYPTO_IMPLEMENTATION
    - |
      if [ $APP == "blinky" ];then
        tar -czf ${TARGET}_${APP}_${TOOLCHAIN}_${INFERENCE}_${AUDIO}_${CONN_STACK}_${PSA_CRYPTO_IMPLEMENTATION}_build.tar.gz \
          build/${APP}_merged.elf
      else
        tar -czf ${TARGET}_${APP}_${TOOLCHAIN}_${INFERENCE}_${AUDIO}_${CONN_STACK}_${PSA_CRYPTO_IMPLEMENTATION}_build.tar.gz \
          build/${APP}_merged.elf \
          build/${APP}-update_signed.bin \
          build/update-signature.txt \
          build/CMakeCache.txt \
          applications/${APP_UNDERSCORED}/configs/aws_configs
      fi
    - ccache -s
  variables:
    KUBERNETES_CPU_REQUEST: 8
    KUBERNETES_EPHEMERAL_STORAGE_REQUEST: 10Gi
    KUBERNETES_MEMORY_REQUEST: 12Gi

# Build Corstone320 applications which later are tested.
build-applications-corstone320:
  stage: build
  extends: .build_job
  parallel:
    matrix:
       -
         << : [*pipeline_config_corstone320, *pipeline_config_toolchain]
         APP: [blinky, keyword-detection, speech-recognition, object-detection]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
  artifacts:
    paths:
      - ${TARGET}_${APP}_${TOOLCHAIN}_${INFERENCE}_${AUDIO}_${CONN_STACK}_${PSA_CRYPTO_IMPLEMENTATION}_build.tar.gz
    expire_in: 1 week
  variables:
    GIT_SUBMODULE_STRATEGY: recursive

# Build Corstone315 applications which later are tested.
build-applications-corstone315:
  stage: build
  extends: .build_job
  parallel:
    matrix:
       -
         << : [*pipeline_config_corstone315, *pipeline_config_toolchain]
         APP: [blinky, keyword-detection, speech-recognition, object-detection]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
  artifacts:
    paths:
      - ${TARGET}_${APP}_${TOOLCHAIN}_${INFERENCE}_${AUDIO}_${CONN_STACK}_${PSA_CRYPTO_IMPLEMENTATION}_build.tar.gz
    expire_in: 1 week
  variables:
    GIT_SUBMODULE_STRATEGY: recursive

# Build Corstone310 applications which later are tested.
build-applications-corstone310:
  stage: build
  extends: .build_job
  parallel:
    matrix:
       -
         << : [*pipeline_config_corstone310, *pipeline_config_toolchain]
         APP: [blinky, keyword-detection, speech-recognition]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
  artifacts:
    paths:
      - ${TARGET}_${APP}_${TOOLCHAIN}_${INFERENCE}_${AUDIO}_${CONN_STACK}_${PSA_CRYPTO_IMPLEMENTATION}_build.tar.gz
    expire_in: 1 week
  variables:
    GIT_SUBMODULE_STRATEGY: recursive

# Build Corstone300 applications which later are tested.
build-applications-corstone300:
  stage: build
  extends: .build_job
  parallel:
    matrix:
       -
         << : [*pipeline_config_corstone300, *pipeline_config_toolchain]
         APP: [blinky, keyword-detection, speech-recognition]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
  artifacts:
    paths:
      - ${TARGET}_${APP}_${TOOLCHAIN}_${INFERENCE}_${AUDIO}_${CONN_STACK}_${PSA_CRYPTO_IMPLEMENTATION}_build.tar.gz
    expire_in: 1 week
  variables:
    GIT_SUBMODULE_STRATEGY: recursive

# The test job extends .basejob. It add rules to map targets to FVP binaries,
# require the application to be built and retrieve the artifacts.
.test_job:
  tags:
    - iotmsw-amd64
  extends: .base-job-rules
  before_script:
    - python -m pip install pyelftools
    - |
      if [ $TARGET == "corstone300" ];then
        FVP_BIN=FVP_Corstone_SSE-300_Ethos-U55
      fi
    - |
      if [ $TARGET == "corstone310" ];then
        FVP_BIN=FVP_Corstone_SSE-310
      fi
    - |
      if [ $TARGET == "corstone315" ];then
        FVP_BIN=FVP_Corstone_SSE-315
      fi
    - |
      if [ $TARGET == "corstone320" ];then
        FVP_BIN=FVP_Corstone_SSE-320
      fi
  parallel:
    matrix:
      - *pipeline_config_corstone320
      - *pipeline_config_corstone315
      - *pipeline_config_corstone310
      - *pipeline_config_corstone300
  variables:
    PYTHONUNBUFFERED: 1
    KUBERNETES_CPU_REQUEST: 16
    KUBERNETES_EPHEMERAL_STORAGE_REQUEST: 10Gi
    KUBERNETES_MEMORY_REQUEST: 12Gi

test-blinky-output:
  extends: .test_job
  needs:
    - job: build-applications-corstone320
      artifacts: true
    - job: build-applications-corstone315
      artifacts: true
    - job: build-applications-corstone310
      artifacts: true
    - job: build-applications-corstone300
      artifacts: true
  script:
    - tar xf ${TARGET}_${APP}_${TOOLCHAIN}_${INFERENCE}_${AUDIO}_${CONN_STACK}_${PSA_CRYPTO_IMPLEMENTATION}_build.tar.gz
    - |
        pytest -s tools/tests/test_blinky_output.py \
        --build-artefacts-path "build" \
        --fvp $FVP_BIN \
        --merged-elf-name "${APP}_merged.elf" \
        --timeout-seconds 900 \
        --pass-output-file "applications/${APP}/tests/${TARGET}_pass_output.log" \
        --fail-output-file "applications/${APP}/tests/fail_output.log"
  parallel:
    matrix:
       -
         << : [*pipeline_config_corstone320, *pipeline_config_toolchain]
         APP: [blinky]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : [*pipeline_config_corstone315, *pipeline_config_toolchain]
         APP: [blinky]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : [*pipeline_config_corstone310, *pipeline_config_toolchain]
         APP: [blinky]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : [*pipeline_config_corstone300, *pipeline_config_toolchain]
         APP: [blinky]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]

.test-applications_base:
  extends: .test_job
  script:
    - |
      if [[ -f "${TARGET}_${APP}_${TOOLCHAIN}_${INFERENCE}_${AUDIO}_${CONN_STACK}_${PSA_CRYPTO_IMPLEMENTATION}_build.tar.gz" ]]; then
        tar xf ${TARGET}_${APP}_${TOOLCHAIN}_${INFERENCE}_${AUDIO}_${CONN_STACK}_${PSA_CRYPTO_IMPLEMENTATION}_build.tar.gz
      fi
    - export APP_UNDERSCORED=$(echo ${APP} | tr '-' '_')
    - export SIGNING_ALGO=$(cat build/CMakeCache.txt | grep AWS_OTA_SIGNATURE_TYPE | sed s/.*=// | sed s/-.*//)
    - |
      if [[ $AUDIO == "VSI" ]]; then
        pytest -s tools/tests/test_applications.py \
        --audio-file-path "applications/${APP_UNDERSCORED}/resources/test.wav" \
        --build-artefacts-path "build" \
        --fvp $FVP_BIN \
        --credentials-path "applications/${APP_UNDERSCORED}/configs/aws_configs" \
        --merged-elf-name "${APP}_merged.elf" \
        --signed-update-bin-name "${APP}-update_signed.bin" \
        --signing-algo ${SIGNING_ALGO} \
        --timeout-seconds 2700 \
        --pass-output-file "applications/${APP_UNDERSCORED}/tests/${TARGET}_pass_output.log" \
        --fail-output-file "applications/${APP_UNDERSCORED}/tests/fail_output.log" \
        --pythonhome-path "/opt/python/3.9.18"
      elif [[ $APP == "object-detection" ]]; then
        pytest -s tools/tests/test_applications.py \
        --frm-file-path "applications/${APP_UNDERSCORED}/resources/test.frm" \
        --build-artefacts-path "build" \
        --fvp $FVP_BIN \
        --credentials-path "applications/${APP_UNDERSCORED}/configs/aws_configs" \
        --merged-elf-name "${APP}_merged.elf" \
        --signed-update-bin-name "${APP}-update_signed.bin" \
        --signing-algo ${SIGNING_ALGO} \
        --timeout-seconds 1800 \
        --pass-output-file "applications/${APP_UNDERSCORED}/tests/${TARGET}_pass_output.log" \
        --fail-output-file "applications/${APP_UNDERSCORED}/tests/fail_output.log"
      else
        pytest -s tools/tests/test_applications.py \
        --build-artefacts-path "build" \
        --fvp $FVP_BIN \
        --credentials-path "applications/${APP_UNDERSCORED}/configs/aws_configs" \
        --merged-elf-name "${APP}_merged.elf" \
        --signed-update-bin-name "${APP}-update_signed.bin" \
        --signing-algo ${SIGNING_ALGO} \
        --timeout-seconds 2700 \
        --pass-output-file "applications/${APP_UNDERSCORED}/tests/${TARGET}_pass_output.log" \
        --fail-output-file "applications/${APP_UNDERSCORED}/tests/fail_output.log"
      fi

# The test-ml-applications-output job should wait for build-applications-corstone3xx jobs to finish as
# this test job uses the output build artifacts from build-applications-corstone3xx jobs.
test-ml-applications-output:
  extends: .test-applications_base
  needs:
  - job: build-applications-corstone320
    artifacts: true
  - job: build-applications-corstone315
    artifacts: true
  - job: build-applications-corstone310
    artifacts: true
  - job: build-applications-corstone300
    artifacts: true
  parallel:
    matrix:
       -
         << : *pipeline_config_corstone320
         APP: [keyword-detection, speech-recognition, object-detection]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone315
         APP: [keyword-detection, speech-recognition, object-detection]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone310
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone300
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]

unit-tests:
  extends: .base-job-rules
  tags:
    - iotmsw-amd64
  stage: quality-check
  script:
    - cmake -S . -B build_unit_test -GNinja -DOPT_ENABLE_COVERAGE=ON
    - cmake --build build_unit_test
    - ctest --test-dir build_unit_test --output-on-failure
  variables:
    GIT_SUBMODULE_STRATEGY: recursive

integration-tests:
  extends: .test_job
  stage: test
  rules:
    - if: ( $SCHEDULED_JOB_TO_RUN == "integration-tests" )
  script:
    - |
      apt-get update -y && \
      apt-get install ccache -y && \
      apt-get clean && \
      rm -rf /var/lib/apt/lists
    - ccache -o cache_dir=/cache/$CI_JOB_NAME_SLUG/.ccache
    - ccache -p
    - ln -s /usr/bin/ccache /usr/lib/ccache/arm-none-eabi-gcc
    - ln -s /usr/bin/ccache /usr/lib/ccache/arm-none-eabi-g++
    - ln -s /usr/bin/ccache /usr/lib/ccache/arm-none-eabi-cpp
    - ln -s /usr/bin/ccache /usr/lib/ccache/arm-none-eabi-c++
    - ln -s /usr/bin/ccache /usr/lib/ccache/arm-none-eabi-ar
    - ln -s /usr/bin/ccache /usr/lib/ccache/armclang
    - ln -s /usr/bin/ccache /usr/lib/ccache/armar
    - export PATH=/usr/lib/ccache:$PATH
    - echo $PATH
    - export APP_UNDERSCORED=$(echo ${APP} | tr '-' '_')
    - ./tools/ci/generate_credentials.sh -f -p applications/${APP_UNDERSCORED}/configs/aws_configs
    - git config --global user.email "ci@example.com"
    - git config --global user.name "ci"
    - git config --global core.autocrlf input
    # With https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/commit/4471af64de1d481374881917bbba8736b1217530,
    # a validation logic has been introduced which checks, if one of the
    # address in an IP packet is loopback then both source and destination
    # addresses must be loopback. For network interface tests, we run the
    # server on the local machine and use loopback interface address in
    # integration tests to communicate with the server. This causes
    # validation logic to fail, as the destination address in the IP in the
    # packet returned by the server is not a loopback address, but instead
    # address assigned to the device. As a workaround, we use the ethernet
    # interface address of the host machine instead of loopback to
    # communicate with the server.
    - host_ip_address=`ifconfig eth0 | grep -w 'inet' | awk '{print $2}'`
    - sed -i "s/#define ECHO_SERVER_ENDPOINT .*$/#define ECHO_SERVER_ENDPOINT \"$host_ip_address\"/g" applications/freertos_iot_libraries_tests/test_param_config.h
    - ./tools/scripts/build.sh ${APP} --target $TARGET --toolchain $TOOLCHAIN --certificate_path $PWD/certificate.pem  --private_key_path $PWD/private_key.pem --conn-stack $CONN_STACK --psa-crypto-implementation $PSA_CRYPTO_IMPLEMENTATION
    - pushd components/tools/freertos_libraries_integration_tests/library/tools/echo_server
    - go run echo_server.go&
    - popd
    - sleep 5
    - |
      pytest -s tools/tests/test_integration.py \
      --build-artefacts-path "build" \
      --fvp $FVP_BIN \
      --credentials-path "applications/${APP_UNDERSCORED}/configs/aws_configs" \
      --merged-elf-name "${APP}_merged.elf" \
      --signed-update-bin-name "${APP}-update_signed.bin" \
      --timeout-seconds 14400
    - ccache -s
  parallel:
    matrix:
      -
        << : [*pipeline_config_corstone320, *pipeline_config_toolchain]
        APP: [freertos-iot-libraries-tests]
        CONN_STACK: [FREERTOS_PLUS_TCP, IOT_VSOCKET]
        PSA_CRYPTO_IMPLEMENTATION: [TF-M]
      -
        << : [*pipeline_config_corstone315, *pipeline_config_toolchain]
        APP: [freertos-iot-libraries-tests]
        CONN_STACK: [FREERTOS_PLUS_TCP, IOT_VSOCKET]
        PSA_CRYPTO_IMPLEMENTATION: [TF-M]
      -
        << : [*pipeline_config_corstone310, *pipeline_config_toolchain]
        APP: [freertos-iot-libraries-tests]
        CONN_STACK: [FREERTOS_PLUS_TCP, IOT_VSOCKET]
        PSA_CRYPTO_IMPLEMENTATION: [TF-M]
      -
        << : [*pipeline_config_corstone300, *pipeline_config_toolchain]
        APP: [freertos-iot-libraries-tests]
        CONN_STACK: [FREERTOS_PLUS_TCP, IOT_VSOCKET]
        PSA_CRYPTO_IMPLEMENTATION: [TF-M]
  retry:
    max: 2
    when:
      - script_failure
      - stuck_or_timeout_failure
      - runner_system_failure
  variables:
    GIT_SUBMODULE_STRATEGY: recursive

sw-vsi-configs-test:
  tags:
    - iotmsw-amd64
  extends: .base-job-rules
  rules:
  - if: ( $SCHEDULED_JOB_TO_RUN == "sw-vsi-configs-test" )
  before_script:
    - !reference [.build_job, before_script]
    - !reference [.build_job, script]
  script:
    # test_job's `before_script` section is referenced in the `script` section to set the correct value for FVP_BIN variable used in testing.
    # test-applications_base job's `script` section is referenced in the `script` section of
    # this job to do the testing part after the build stage is done where the build stage is inherited
    # from `.build_job`
    - !reference [.test_job, before_script]
    - !reference [.test-applications_base, script]
  parallel:
    matrix:
       -
         << : *pipeline_config_corstone320
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [ETHOS]
         AUDIO: [VSI]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone320
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [SOFTWARE]
         AUDIO: [ROM, VSI]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone320
         APP: [object-detection]
         INFERENCE: [SOFTWARE]
         AUDIO: [ROM]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone315
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [ETHOS]
         AUDIO: [VSI]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone315
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [SOFTWARE]
         AUDIO: [ROM, VSI]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone315
         APP: [object-detection]
         INFERENCE: [SOFTWARE]
         AUDIO: [ROM]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone310
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [ETHOS]
         AUDIO: [VSI]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone310
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [SOFTWARE]
         AUDIO: [ROM, VSI]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone300
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [ETHOS]
         AUDIO: [VSI]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone300
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [SOFTWARE]
         AUDIO: [ROM, VSI]
         TOOLCHAIN: [ARMCLANG]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
  retry:
    max: 2
    when:
      - script_failure
      - stuck_or_timeout_failure
      - runner_system_failure
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
    KUBERNETES_CPU_REQUEST: 16
    KUBERNETES_EPHEMERAL_STORAGE_REQUEST: 10Gi
    KUBERNETES_MEMORY_REQUEST: 12Gi


gnu-toolchain-test:
  tags:
    - iotmsw-amd64
  extends: .base-job-rules
  rules:
  - if: ( $SCHEDULED_JOB_TO_RUN == "gnu-toolchain-test" )
  before_script:
    - !reference [.build_job, before_script]
    - !reference [.build_job, script]
  script:
    # test_job's `before_script` section is referenced in the `script` section to set the correct value for FVP_BIN variable used in testing.
    # test-applications_base job's `script` section is referenced in the `script` section of
    # this job to do the testing part after the build stage is done where the build stage is inherited
    # from `.build_job`
    - !reference [.test_job, before_script]
    - !reference [.test-applications_base, script]
  parallel:
    matrix:
       -
         << : *pipeline_config_corstone320
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [ETHOS, SOFTWARE]
         AUDIO: [ROM,VSI]
         TOOLCHAIN: [GNU]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone320
         APP: [object-detection]
         INFERENCE: [ETHOS, SOFTWARE]
         AUDIO: [ROM]
         TOOLCHAIN: [GNU]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone315
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [ETHOS, SOFTWARE]
         AUDIO: [ROM,VSI]
         TOOLCHAIN: [GNU]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone315
         APP: [object-detection]
         INFERENCE: [ETHOS, SOFTWARE]
         AUDIO: [ROM]
         TOOLCHAIN: [GNU]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone310
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [ETHOS, SOFTWARE]
         AUDIO: [ROM,VSI]
         TOOLCHAIN: [GNU]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
       -
         << : *pipeline_config_corstone300
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [ETHOS, SOFTWARE]
         AUDIO: [ROM,VSI]
         TOOLCHAIN: [GNU]
         CONN_STACK: [FREERTOS_PLUS_TCP]
         PSA_CRYPTO_IMPLEMENTATION: [TF-M]
  retry:
    max: 2
    when:
      - script_failure
      - stuck_or_timeout_failure
      - runner_system_failure
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
    KUBERNETES_CPU_REQUEST: 16
    KUBERNETES_EPHEMERAL_STORAGE_REQUEST: 10Gi
    KUBERNETES_MEMORY_REQUEST: 12Gi

iot-vsocket-psa-crypto-mbedtls-test:
  tags:
    - iotmsw-amd64
  extends: .base-job-rules
  rules:
  - if: ( $SCHEDULED_JOB_TO_RUN == "iot-vsocket-psa-crypto-mbedtls-test" )
  before_script:
    - !reference [.build_job, before_script]
    - !reference [.build_job, script]
  script:
    # test_job's `before_script` section is referenced in the `script` section to set the correct value for FVP_BIN variable used in testing.
    # test-applications_base job's `script` section is referenced in the `script` section of
    # this job to do the testing part after the build stage is done where the build stage is inherited
    # from `.build_job`
    - !reference [.test_job, before_script]
    - !reference [.test-applications_base, script]
  parallel:
    matrix:
       -
         << : *pipeline_config_corstone320
         APP: [keyword-detection, speech-recognition, object-detection]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         TOOLCHAIN: [GNU, ARMCLANG]
         CONN_STACK: [IOT_VSOCKET]
         PSA_CRYPTO_IMPLEMENTATION: [MBEDTLS]
       -
         << : *pipeline_config_corstone315
         APP: [keyword-detection, speech-recognition, object-detection]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         TOOLCHAIN: [GNU, ARMCLANG]
         CONN_STACK: [IOT_VSOCKET]
         PSA_CRYPTO_IMPLEMENTATION: [MBEDTLS]
       -
         << : *pipeline_config_corstone310
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         TOOLCHAIN: [GNU, ARMCLANG]
         CONN_STACK: [IOT_VSOCKET]
         PSA_CRYPTO_IMPLEMENTATION: [MBEDTLS]
       -
         << : *pipeline_config_corstone300
         APP: [keyword-detection, speech-recognition]
         INFERENCE: [ETHOS]
         AUDIO: [ROM]
         TOOLCHAIN: [GNU, ARMCLANG]
         CONN_STACK: [IOT_VSOCKET]
         PSA_CRYPTO_IMPLEMENTATION: [MBEDTLS]
  retry:
    max: 2
    when:
      - script_failure
      - stuck_or_timeout_failure
      - runner_system_failure
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
    KUBERNETES_CPU_REQUEST: 16
    KUBERNETES_EPHEMERAL_STORAGE_REQUEST: 10Gi
    KUBERNETES_MEMORY_REQUEST: 12Gi

########################
# Black Duck scan      #
########################
black-duck:
  tags:
    - iotmsw-amd64
  variables:
    GIT_SUBMODULE_STRATEGY: none
  rules:
    - if: ( $SCHEDULED_JOB_TO_RUN == "run-blackduck-scan" )
  script:
    - export PROJECTNAME="${BLACKDUCK_PROJECT_NAME}"
    - apt update -y
    - apt install default-jdk -y
    - echo "-------Starting Black Duck Scan-------"
    - bash <(curl -s -L ${BLACKDUCK_DETECT_SCRIPT})
      --blackduck.url="${BLACKDUCK_URL}"
      --blackduck.api.token="${BLACKDUCK_API_TOKEN}"
      --detect.source.path="."
      --detect.project.name="${PROJECTNAME}"
      --detect.project.version.name="${CI_COMMIT_REF_NAME}"
      --detect.project.tags=security_scan
      --detect.project.version.phase=DEVELOPMENT
      --detect.project.version.distribution=OPENSOURCE
      --detect.project.version.update=true
      --detect.cleanup=false
      --detect.impact.analysis.enabled=true
      --detect.binary.scan.search.depth=05
      --detect.blackduck.scan.mode=INTELLIGENT
      --detect.blackduck.signature.scanner.individual.file.matching=ALL
      --detect.blackduck.signature.scanner.copyright.search=true
      --detect.blackduck.signature.scanner.license.search=true
      --detect.blackduck.signature.scanner.snippet.matching=SNIPPET_MATCHING
      --detect.blackduck.signature.scanner.upload.source.mode=true
    - tar -czf fri-bd-scan-results.tar.gz -C /root/blackduck/runs .
  artifacts:
    paths:
      - fri-bd-scan-results.tar.gz
    expire_in: 1 week
    when: always

# The clean up only happens once daily when the `Daily OTA cleanup`
# scheduled pipeline sets the `SCHEDULED_JOB_TO_RUN` variable to `cleanup`.
aws-cleanup:
  stage: cleanup
  tags:
    - iotmsw-amd64
  rules:
    - if: $SCHEDULED_JOB_TO_RUN == "cleanup"
  script:
    - python -u ./tools/ci/aws_cleanup.py