gitlab

spec/ci/built_kinds_spec.rb

@@ -1,7 +1,7 @@
 require "rails_helper"
 
-RSpec.describe WarpEngine::CI::Woodpecker::PipelineConfig do
-  BUILT_KINDS = described_class::BUILT_KINDS
+shared_examples "pipeline config built kinds" do |config_class|
+  built_kinds = config_class::BUILT_KINDS
 
   def self.fragment_for(kind)
     case kind
@@ -12,17 +12,17 @@ RSpec.describe WarpEngine::CI::Woodpecker::PipelineConfig do
     end
   end
 
-  def config_for(platform)
-    described_class.new(platforms: { platform => { builder: "builder:latest", exporter: "exporter:latest" } })
+  define_method(:config_for) do |platform|
+    config_class.new(platforms: { platform => { builder: "builder:latest", exporter: "exporter:latest" } })
   end
 
   it "knows every platform in the registry" do
-    expect(BUILT_KINDS.keys).to match_array(WarpEngine::Platform.names)
+    expect(built_kinds.keys).to match_array(WarpEngine::Platform.names)
   end
 
   WarpEngine::Platform::NAMES.each do |platform|
     context platform do
-      let(:kinds) { BUILT_KINDS.fetch(platform) }
+      let(:kinds) { built_kinds.fetch(platform) }
       let(:rendered) do
         config_for(platform).render(platform: platform, name: "example", update_server: "https://example.test")
       end
@@ -52,3 +52,11 @@ RSpec.describe WarpEngine::CI::Woodpecker::PipelineConfig do
     end
   end
 end
+
+RSpec.describe WarpEngine::CI::Woodpecker::PipelineConfig do
+  include_examples "pipeline config built kinds", described_class
+end
+
+RSpec.describe WarpEngine::CI::Gitlab::PipelineConfig do
+  include_examples "pipeline config built kinds", described_class
+end

spec/ci/gitlab_client_spec.rb

@@ -0,0 +1,142 @@
+require "rails_helper"
+require "webmock/rspec"
+
+RSpec.describe WarpEngine::CI::Gitlab::Client do
+  let(:base_url) { "https://gitlab.example.test" }
+  let(:token) { "gl-test-token" }
+  let(:client) { described_class.new(url: base_url, token: token) }
+
+  def stub_gl(method, path, status: 200, body: nil, request_body: nil)
+    stub = stub_request(method, "#{base_url}#{path}")
+      .with(headers: { "PRIVATE-TOKEN" => token, "Accept" => "application/json" })
+    stub = stub.with(body: request_body) if request_body
+    stub.to_return(status: status, body: body&.to_json, headers: { "Content-Type" => "application/json" })
+  end
+
+  describe "repos" do
+    it "lists repos" do
+      repos = [{ "id" => 1, "path" => "game1" }]
+      stub_gl(:get, "/api/v4/projects?membership=true&per_page=100&simple=true", body: repos)
+
+      expect(client.list_repos).to eq(repos)
+    end
+
+    it "gets a repo" do
+      repo = { "id" => 42, "path" => "mygame" }
+      stub_gl(:get, "/api/v4/projects/42", body: repo)
+
+      expect(client.get_repo(42)).to eq(repo)
+    end
+
+    it "activate is a no-op" do
+      expect(client.activate_repo(42)).to be_nil
+    end
+
+    it "deactivate is a no-op" do
+      expect(client.deactivate_repo(42)).to be_nil
+    end
+  end
+
+  describe "secrets (variables)" do
+    it "lists variables" do
+      vars = [{ "key" => "application_token" }]
+      stub_gl(:get, "/api/v4/projects/1/variables", body: vars)
+
+      expect(client.list_secrets(1)).to eq(vars)
+    end
+
+    it "creates a variable" do
+      stub_gl(:post, "/api/v4/projects/1/variables", status: 201, body: { "key" => "application_token" })
+
+      result = client.create_secret(1, name: "application_token", value: "secret123")
+      expect(result["key"]).to eq("application_token")
+    end
+
+    it "updates a variable" do
+      stub_gl(:put, "/api/v4/projects/1/variables/application_token", status: 200, body: { "key" => "application_token" })
+
+      result = client.update_secret(1, "application_token", value: "newsecret")
+      expect(result["key"]).to eq("application_token")
+    end
+
+    it "deletes a variable" do
+      stub_gl(:delete, "/api/v4/projects/1/variables/application_token", status: 204)
+
+      expect(client.delete_secret(1, "application_token")).to be_nil
+    end
+  end
+
+  describe "pipelines" do
+    it "lists pipelines" do
+      pipelines = [{ "id" => 1, "status" => "success" }]
+      stub_gl(:get, "/api/v4/projects/42/pipelines?page=1&per_page=25", body: pipelines)
+
+      expect(client.list_pipelines(42)).to eq(pipelines)
+    end
+
+    it "gets latest pipeline" do
+      pipeline = { "id" => 5, "status" => "running" }
+      stub_gl(:get, "/api/v4/projects/42/pipelines?per_page=1&sort=desc", body: [pipeline])
+
+      expect(client.latest_pipeline(42)).to eq(pipeline)
+    end
+
+    it "returns nil when no pipelines exist" do
+      stub_gl(:get, "/api/v4/projects/42/pipelines?per_page=1&sort=desc", body: [])
+
+      expect(client.latest_pipeline(42)).to be_nil
+    end
+
+    it "gets a specific pipeline" do
+      pipeline = { "id" => 99, "status" => "success" }
+      stub_gl(:get, "/api/v4/projects/42/pipelines/99", body: pipeline)
+
+      expect(client.get_pipeline(42, 99)).to eq(pipeline)
+    end
+
+    it "triggers a pipeline" do
+      pipeline = { "id" => 6, "status" => "created" }
+      stub_gl(:post, "/api/v4/projects/42/pipeline", body: pipeline)
+
+      expect(client.trigger_pipeline(42, branch: "main")).to eq(pipeline)
+    end
+  end
+
+  describe "error handling" do
+    it "raises ApiError on 404" do
+      stub_gl(:get, "/api/v4/projects/999", status: 404, body: { "error" => "not found" })
+
+      expect { client.get_repo(999) }.to raise_error(WarpEngine::CI::ApiError) { |e|
+        expect(e.status).to eq(404)
+      }
+    end
+
+    it "raises ApiError on 500" do
+      stub_gl(:get, "/api/v4/projects?membership=true&per_page=100&simple=true", status: 500, body: { "error" => "internal" })
+
+      expect { client.list_repos }.to raise_error(WarpEngine::CI::ApiError) { |e|
+        expect(e.status).to eq(500)
+      }
+    end
+
+    it "raises ConnectionError on connection refused" do
+      stub_request(:get, "#{base_url}/api/v4/projects?membership=true&per_page=100&simple=true").to_raise(Errno::ECONNREFUSED)
+
+      expect { client.list_repos }.to raise_error(WarpEngine::CI::ConnectionError)
+    end
+
+    it "raises ConnectionError on timeout" do
+      stub_request(:get, "#{base_url}/api/v4/projects?membership=true&per_page=100&simple=true").to_timeout
+
+      expect { client.list_repos }.to raise_error(WarpEngine::CI::ConnectionError)
+    end
+
+    it "raises ApiError when a 200 response is not JSON" do
+      stub_request(:get, "#{base_url}/api/v4/projects?membership=true&per_page=100&simple=true")
+        .to_return(status: 200, body: "<!doctype html><html></html>",
+                   headers: { "Content-Type" => "text/html" })
+
+      expect { client.list_repos }.to raise_error(WarpEngine::CI::ApiError, /Expected JSON/)
+    end
+  end
+end

spec/ci/gitlab_signature_verifier_spec.rb

@@ -0,0 +1,45 @@
+require "rails_helper"
+
+RSpec.describe WarpEngine::CI::Gitlab::SignatureVerifier do
+  let(:webhook_secret) { "gl-webhook-secret-token" }
+
+  def mock_request(token:)
+    instance_double(ActionDispatch::Request,
+                    headers: { "X-Gitlab-Token" => token })
+  end
+
+  it "accepts a request with matching token" do
+    request = mock_request(token: webhook_secret)
+    verifier = described_class.new(request, webhook_secret: webhook_secret)
+
+    expect(verifier).to be_valid
+  end
+
+  it "rejects a request with wrong token" do
+    request = mock_request(token: "wrong-token")
+    verifier = described_class.new(request, webhook_secret: webhook_secret)
+
+    expect(verifier).not_to be_valid
+  end
+
+  it "rejects a request with no token" do
+    request = mock_request(token: nil)
+    verifier = described_class.new(request, webhook_secret: webhook_secret)
+
+    expect(verifier).not_to be_valid
+  end
+
+  it "rejects a request with blank token" do
+    request = mock_request(token: "")
+    verifier = described_class.new(request, webhook_secret: webhook_secret)
+
+    expect(verifier).not_to be_valid
+  end
+
+  it "rejects when webhook secret is not configured" do
+    request = mock_request(token: "anything")
+    verifier = described_class.new(request, webhook_secret: nil)
+
+    expect(verifier).not_to be_valid
+  end
+end

spec/ci_spec.rb

@@ -19,6 +19,13 @@ RSpec.describe WarpEngine::CI do
       expect(WarpEngine.ci).not_to be_configured
     end
 
+    it "drives GitLab when configured" do
+      WarpEngine.config.ci_adapter = :gitlab
+
+      expect(WarpEngine.ci).to be_a(WarpEngine::CI::Gitlab::Adapter)
+      expect(WarpEngine.ci.name).to eq("GitLab")
+    end
+
     it "hands back whatever object the host named" do
       own = Class.new { def name = "Forge Runner" }.new
       WarpEngine.config.ci_adapter = own
@@ -133,4 +140,109 @@ RSpec.describe WarpEngine::CI do
         .to eq({ configs: [ { name: "godot", data: "steps: []" } ] })
     end
   end
+
+  describe WarpEngine::CI::Gitlab::Adapter do
+    let(:client) { instance_double(WarpEngine::CI::Gitlab::Client) }
+    let(:adapter) do
+      described_class.new(url: "https://gitlab.test", api_token: "tok",
+                          webhook_secret: "gl-secret",
+                          platforms: { "godot" => { builder: "registry.test/godot:1" } },
+                          update_server: "https://games.test")
+    end
+
+    before { allow(adapter).to receive(:client).and_return(client) }
+
+    it "is inactive without a server and a token" do
+      expect(described_class.new(url: nil, api_token: nil)).not_to be_configured
+      expect(adapter).to be_configured
+    end
+
+    it "normalizes a repository from GitLab JSON" do
+      allow(client).to receive(:list_repos).and_return([
+        { "id" => 7, "path" => "game", "name" => "game",
+          "namespace" => { "path" => "org", "name" => "Org" } }
+      ])
+
+      repo = adapter.repos.first
+
+      expect(repo.id).to eq(7)
+      expect(repo.name).to eq("game")
+      expect(repo.full_name).to eq("org/game")
+      expect(repo).to be_active
+    end
+
+    it "normalizes a run from GitLab pipeline JSON" do
+      allow(client).to receive(:trigger_pipeline).and_return(
+        { "id" => 42, "status" => "success", "ref" => "main",
+          "created_at" => "2025-08-06T12:00:00.000Z",
+          "web_url" => "https://gitlab.test/org/game/-/pipelines/42" }
+      )
+
+      run = adapter.trigger(7, branch: "main")
+
+      expect(run.number).to eq(42)
+      expect(run).to be_success
+      expect(run.created_at).to be_present
+      expect(run.url).to eq("https://gitlab.test/org/game/-/pipelines/42")
+    end
+
+    it "creates a variable the project does not have yet" do
+      allow(client).to receive(:list_secrets).and_return([])
+      allow(client).to receive(:create_secret)
+
+      adapter.secret_set(7, name: "application_token", value: "plain")
+
+      expect(client).to have_received(:create_secret).with(
+        7, name: "application_token", value: "plain"
+      )
+    end
+
+    it "updates a variable the project already has" do
+      allow(client).to receive(:list_secrets).and_return([ { "key" => "application_token" } ])
+      allow(client).to receive(:update_secret)
+
+      adapter.secret_set(7, name: "application_token", value: "plain")
+
+      expect(client).to have_received(:update_secret).with(7, "application_token", value: "plain")
+    end
+
+    it "reads the platform marker out of a config request" do
+      params = ActionController::Parameters.new(
+        repo: { name: "mygame" },
+        configs: [ { name: ".gitlab-ci.yml", data: "platform: godot\n" } ]
+      )
+
+      expect(adapter.config_marker(params)).to eq({ platform: "godot", name: "mygame" })
+    end
+
+    it "ignores a config request that is not a marker" do
+      params = ActionController::Parameters.new(
+        configs: [ { name: ".gitlab-ci.yml", data: "stages:\n  - build\n" } ]
+      )
+
+      expect(adapter.config_marker(params)).to be_nil
+    end
+
+    it "renders only the platforms it was given" do
+      expect(adapter.pipeline_config(platform: "godot", name: "mygame",
+                                     update_server: "https://games.test")).to include("registry.test/godot:1")
+      expect(adapter.pipeline_config(platform: "amiga", name: "mygame",
+                                     update_server: "https://games.test")).to be_nil
+    end
+
+    it "shapes the response the way the CI server expects" do
+      expect(adapter.config_response(platform: "godot", config: "stages: []"))
+        .to eq({ configs: [ { name: "godot", data: "stages: []" } ] })
+    end
+
+    it "verifies webhook requests via X-Gitlab-Token" do
+      good_request = instance_double(ActionDispatch::Request,
+                                     headers: { "X-Gitlab-Token" => "gl-secret" })
+      bad_request = instance_double(ActionDispatch::Request,
+                                    headers: { "X-Gitlab-Token" => "wrong" })
+
+      expect(adapter.verify_config_request(good_request)).to be(true)
+      expect(adapter.verify_config_request(bad_request)).to be(false)
+    end
+  end
 end