.gitlab-ci.yml

stages:
  - lint
  - test
  - build
  - deploy
  - review
  - dast
  - fuzz
  - staging
  - canary
  - production
  - incremental rollout 10%
  - incremental rollout 25%
  - incremental rollout 50%
  - incremental rollout 100%
  - performance
  - cleanup

docker-build:
  image: docker:latest
  stage: build
  services:
    - docker:dind
  before_script:
    - docker pull tonistiigi/binfmt:latest
    - docker run --privileged --rm tonistiigi/binfmt --uninstall qemu-*
    - docker run --privileged --rm tonistiigi/binfmt --install all
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
  script:
    - docker buildx create --use
    - docker buildx build -f Dockerfile --push --pull --platform linux/amd64,linux/arm64
       -t "${CI_REGISTRY_IMAGE}/${CI_COMMIT_BRANCH}:latest"
       -t "${CI_REGISTRY_IMAGE}/${CI_COMMIT_BRANCH}:${CI_COMMIT_SHORT_SHA}" .
    - if [ "$CI_COMMIT_BRANCH" = "master" ]; then
       docker buildx build -f Dockerfile --push --pull --platform linux/amd64,linux/arm64
       -t "${CI_REGISTRY_IMAGE}:latest" .; fi;
  rules:
    - if: $PULL == "true"
      when: never
    - if: $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "dev"
      exists:
        - Dockerfile

pull:
  image: alpine:latest
  before_script:
    - apk add git
    - git checkout master
    - git remote set-url origin https://root:$gitlab_token@$CI_SERVER_HOST/$CI_PROJECT_PATH.git
    - git remote add upstream https://github.com/hauxir/imgpush || git remote set-url upstream https://github.com/hauxir/imgpush
    - git config --global user.email "bot@metahkg.org"
    - git config --global user.name "metahkg-bot"
    - git config pull.rebase false
    - git pull origin master
  script:
    - |
      git fetch upstream
      git merge -X theirs upstream/master -m "Pull upstream" --allow-unrelated-histories
      git push origin --all
  rules:
    - if: $PULL == "true"

build:
  stage: build
  allow_failure: true

test:
  stage: test
  image: python:3.10-alpine
  services:
    - name: mongo
      alias: db
      command: ["mongod", "--bind_ip_all"]
  before_script:
    - apk add coreutils
    - pip install poetry
    - poetry config virtualenvs.create false
  script:
    - poetry install
    - cp example.env .env
    - mkdir images cache
    - echo "IMAGES_DIR=$PWD/images/" >> .env
    - echo "CACHE_DIR=$PWD/cache/" >> .env
    - echo "MONGO_URI=mongodb://db" >> .env
    - echo "DEBUG=true" >> .env
    - nohup python imgpush/app.py &
    - sleep 5
    - python imgpush/test.py
  rules:
     - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
     - if: $CI_COMMIT_TAG
     - if: $CI_COMMIT_BRANCH

dast:
  stage: dast
  allow_failure: true
  rules:
    - if: $CI_COMMIT_BRANCH
      when: never

code_quality:
  stage: test
  rules:
     - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
     - if: $CI_COMMIT_TAG
     - if: $CI_COMMIT_BRANCH

container_scanning:
  stage: review
  needs: [ "docker-build" ]
  variables:
    GIT_STRATEGY: fetch
    CI_APPLICATION_REPOSITORY: $CI_REGISTRY_IMAGE/$CI_COMMIT_BRANCH
    CI_APPLICATION_TAG: $CI_COMMIT_SHORT_SHA
    CLAIR_OUTPUT: High
  artifacts:
    paths:
      - gl-container-scanning-report.json
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "dev"
      exists:
        - Dockerfile

include:
  - template: Auto-DevOps.gitlab-ci.yml
    rules:
      - if: $PULL != "true"