.gitlab-ci.yml

---
stages:
  - unittests
  - test
  - build
  - scanimage
  - testapi
  - release

default:
  image:
    name: registry.met.no/team-punkt/gitlab-ci/images/docker-punkt:latest
    pull_policy: if-not-present

unittests:
  stage: unittests
  image: python:3.12-slim
  script:
    - apt update
    - apt install -y libeccodes-dev
    - cd app
    - pip install tox
    - tox --parallel
  tags:
    - teampunkt

.container_scanning:
  stage: scanimage
  tags:
    - teampunkt
  image:
    name: docker.io/aquasec/trivy
    entrypoint: [""]
  variables:
    # No need to clone the repo, we exclusively work on artifacts.  See
    # https://docs.gitlab.com/ee/ci/runners/README.html#git-strategy
    GIT_STRATEGY: none
    TRIVY_USERNAME: "$CI_REGISTRY_USER"
    TRIVY_PASSWORD: "$CI_REGISTRY_PASSWORD"
    TRIVY_AUTH_URL: "$CI_REGISTRY"

  script:
    - export TRIVY_CACHE_DIR=$(pwd)/.trivycache/
    - mkdir -p ${TRIVY_CACHE_DIR}
    - trivy --version
    # cache cleanup is needed when scanning images with the same tags, it does not remove the database
    - time trivy clean --scan-cache
    # update vulnerabilities db
    # TOOMANYREQUESTS problems, https://gitlab.met.no/team-punkt/hydra/lekestue/edrisobaric/-/issues/31
    # - time trivy image --download-db-only --no-progress
    # Builds report and puts it in the default workdir $CI_PROJECT_DIR, so `artifacts:` can take it from there
    - echo "RELEASE_IMAGE_NAME $RELEASE_IMAGE_NAME CI_PROJECT_DIR/CI_JOB_NAME $CI_PROJECT_DIR/${CI_JOB_NAME}.xml"
    - time trivy image --db-repository public.ecr.aws/aquasecurity/trivy-db --java-db-repository public.ecr.aws/aquasecurity/trivy-java-db --exit-code 0 --no-progress --format template --template "@/contrib/junit.tpl" --output "$CI_PROJECT_DIR/${CI_JOB_NAME}.xml" "$RELEASE_IMAGE_NAME"
    # Prints full report
    - time trivy image --exit-code 0 --no-progress "$RELEASE_IMAGE_NAME"
    # Fails on high and critical vulnerabilities
    - time trivy image --exit-code 1 --ignore-unfixed --severity CRITICAL --no-progress "$RELEASE_IMAGE_NAME"
  cache:
    paths:
      - .trivycache/
  # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold)
  artifacts:
    when: always
    reports:
      junit: $CI_JOB_NAME.xml

test:
  stage: test
  script:
    - TMP_IMAGE_NAME="${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHA}"
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build -t $TMP_IMAGE_NAME -f Dockerfile.metno .
  tags:
    - teampunkt
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: never
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_COMMIT_TAG == null
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
  needs: ["unittests"]

build_image:
  stage: build
  rules:
    - if: $CI_COMMIT_TAG
  tags:
    - teampunkt
  script:
    - RELEASE_TAG="${CI_COMMIT_TAG}-${CI_PIPELINE_IID}"
    - RELEASE_IMAGE_NAME="${CI_REGISTRY_IMAGE}:${RELEASE_TAG}"
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build --pull -t $RELEASE_IMAGE_NAME -f Dockerfile.metno .
    - docker push $RELEASE_IMAGE_NAME
    - echo "RELEASE_IMAGE_NAME=${RELEASE_IMAGE_NAME}" >> build.env
    - echo "RELEASE_TAG=${RELEASE_TAG}" >> build.env
  artifacts:
    reports:
      dotenv: build.env

build_container_scanning:
  extends: .container_scanning
  rules:
    - if: $CI_COMMIT_TAG
  dependencies:
    - build_image

rebuild_image:
  stage: build
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
  tags:
    - teampunkt
  script:
    - LAST_GIT_TAG=$(git describe --tags --match="v[0-9]*" --abbrev=0)
    - if [ -z "$LAST_GIT_TAG" ]; then echo "LAST_GIT_TAG variable not set!"; exit 1;fi
    - git checkout $LAST_GIT_TAG
    - RELEASE_TAG="${LAST_GIT_TAG}-${CI_PIPELINE_IID}"
    - RELEASE_IMAGE_NAME="${CI_REGISTRY_IMAGE}:${RELEASE_TAG}"
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build --pull -t $RELEASE_IMAGE_NAME .
    - docker push $RELEASE_IMAGE_NAME
    - echo "RELEASE_IMAGE_NAME=${RELEASE_IMAGE_NAME}" >> build.env
    - echo "RELEASE_TAG=${RELEASE_TAG}" >> build.env
  after_script:
    - source build.env
    - /teampunkt/chat-message.sh -u "${CI_CHAT_WEBHOOK}" -m "Scheduled rebuild of image ${RELEASE_IMAGE_NAME} for <gitlab project>. Manual deployment."
  artifacts:
    reports:
      dotenv: build.env

rebuild_container_scanning:
  extends: .container_scanning
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
  dependencies:
    - rebuild_image

testapi:
  stage: testapi
  tags:
    - teampunkt
  rules:
    - if: $CI_COMMIT_TAG
  script:
    - VALIDATOR_IMAGE="ghcr.io/metno/sedr:0.7.6"
    - LAST_GIT_TAG=$(git describe --tags --match="v[0-9]*" --abbrev=0)
    - RELEASE_TAG="${LAST_GIT_TAG}-${CI_PIPELINE_IID}"
    - RELEASE_IMAGE_NAME="${CI_REGISTRY_IMAGE}:${RELEASE_TAG}"
    - echo "LAST_GIT_TAG=$LAST_GIT_TAG RELEASE_TAG=$RELEASE_TAG RELEASE_IMAGE_NAME=$RELEASE_IMAGE_NAME"
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - echo "Starting $RELEASE_IMAGE_NAME"
    - docker pull $RELEASE_IMAGE_NAME
    - docker run --tty=true --detach=true --network=host $RELEASE_IMAGE_NAME --bind_host 0.0.0.0
    - echo "Testing API with ghcr.io/metno/sedr"
    - docker pull $VALIDATOR_IMAGE
    - docker run --tty=true --network=host --rm $VALIDATOR_IMAGE --openapi http://localhost:5000/api --url http://localhost:5000
  dependencies:
    - build_image

tjenester/edrisobaric:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
  needs:
    - testapi
  variables:
    UPSTREAM_CI_COMMIT_SHA: "${CI_COMMIT_SHA}"
    UPSTREAM_CI_PROJECT_PATH: "${CI_PROJECT_PATH}"
    UPSTREAM_CI_PROJECT_URL: "${CI_PROJECT_URL}"
    UPSTREAM_IMAGES: "${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}-${CI_PIPELINE_IID}"
  trigger: tjenester/edrisobaric