.gitlab-ci.yml

# include:
#   - project: enterprise-pipelines/gitlab-ci/includes
#     file: SAST/sonarqube.yml

stages:
  - build
  - static-analysis
  - deploy

default:
  tags: [openshift]

.build-image:
  interruptible: true
  variables:
    KUBERNETES_CPU_REQUEST: "500m"
    KUBERNETES_CPU_LIMIT: "500m"
    KUBERNETES_MEMORY_REQUEST: "768Mi"
    KUBERNETES_MEMORY_LIMIT: "768Mi"
    OCI_IMAGE_TAG: ${CI_COMMIT_SHORT_SHA}
  image: registry.redhat.io/ubi8/buildah:latest
  stage: build
  script:
    - buildah --storage-driver=${STORAGE_DRIVER:-vfs} bud ${BUILD_EXTRA_ARGS:-} --format=${IMAGE_FORMAT:-oci} --tls-verify=${TLS_VERIFY:-true} --no-cache -f ${CONTAINERFILE:-Dockerfile} -t ${OCI_IMAGE_NAME}:${OCI_IMAGE_TAG:-latest} ${BUILD_CONTEXT:-.}
    - >
      if [ "$CI_COMMIT_BRANCH" == "$CI_DEFAULT_BRANCH" ]; then
        buildah --storage-driver=${STORAGE_DRIVER:-vfs} push --creds ${QUAY_CREDS_STAGE} ${PUSH_EXTRA_ARGS:-} --tls-verify=${TLS_VERIFY:-true} ${OCI_IMAGE_NAME}:${OCI_IMAGE_TAG:-latest} docker://${OCI_IMAGE_NAME}:${OCI_IMAGE_TAG:-latest}
      else
        echo "Skipping pushing image ${OCI_IMAGE_NAME}:${OCI_IMAGE_TAG:-latest}"
      fi
  rules:
#    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

build:
  image:
    name: registry.access.redhat.com/ubi9@sha256:53d6c19d664f4f418ce5c823d3a33dbb562a2550ea249cf07ef10aa063ace38f
    entrypoint: [""]
  stage: build
  cache:
    key: maven
    paths:
      - .m2/repository
  rules:
#    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  variables:
    KUBERNETES_CPU_REQUEST: "1500m"
    KUBERNETES_CPU_LIMIT: "1500m"
    KUBERNETES_MEMORY_REQUEST: "5Gi"
    KUBERNETES_MEMORY_LIMIT: "5Gi"
    MAVEN_OPTS: >-
      -Dhttps.protocols=TLSv1.2
      -Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository
      -Dorg.slf4j.simpleLogger.showDateTime=true
      -Djava.awt.headless=true
      -XX:InitialRAMPercentage=50 -XX:MaxRAMPercentage=50 -XX:+ExitOnOutOfMemoryError -XshowSettings:vm
    MAVEN_CLI_OPTS: >-
      --batch-mode
      --errors
      --fail-at-end
      --show-version
      -DinstallAtEnd=true
      -DdeployAtEnd=true
      -Dsurefire.useFile=false
      -Denforcer.skipRules=bannedRepositories
      --no-transfer-progress
  before_script:
    - dnf -y --noplugins --setopt=install_weak_deps=0 --setopt=tsflags=nodocs upgrade
    - dnf install -y --setopt=tsflags=nodocs unzip zip
    - curl -s "https://get.sdkman.io" | bash
    - echo "sdkman_auto_answer=true" > $HOME/.sdkman/etc/config
    - source "$HOME/.sdkman/bin/sdkman-init.sh"
    - sdk install java 17.0.12-tem
    - keytool -import -trustcacerts -alias 2022-IT-Root-CA -file $IT_ROOT_CA_2022 -cacerts -noprompt -storepass changeit
    - keytool -import -trustcacerts -alias 2015-IT-Root-CA -file $IT_ROOT_CA_2015 -cacerts -noprompt -storepass changeit
  script:
    - ./mvnw -s .ci/settings.xml verify ${MAVEN_CLI_OPTS} -Dquarkus.hibernate-orm.log.sql=false -DbuildNumber=${CI_COMMIT_SHORT_SHA} jacoco:report sonar:sonar -Dsonar.projectKey=SBOMer

  artifacts:
    when: always
    reports:
      junit:
        - "**/target/surefire-reports/**/*.xml"
    paths:
      - service/target
      - cli/target
      - core/target
      - e2e/target
      - native/cli/runtime/target
      - native/cli/deployment/target

build-ui:
  image:
    name: registry.access.redhat.com/ubi9/nodejs-20-minimal@sha256:385526489068b5b053aa8f1e65ebfd7cdf72d05c1659a6c11808b997933f834e
    entrypoint: [""]
  stage: build
  cache:
    key: ui
    paths:
      - ui/node_modules
  rules:
    #- if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  variables:
    KUBERNETES_CPU_REQUEST: "1000m"
    KUBERNETES_CPU_LIMIT: "1000m"
    KUBERNETES_MEMORY_REQUEST: "2Gi"
    KUBERNETES_MEMORY_LIMIT: "2Gi"
  script:
    - export REACT_APP_SBOMER_RELEASE=${CI_COMMIT_SHORT_SHA}
    - export REACT_APP_SBOMER_BUILD_TIMESTAMP=$(date +%s)
    - cd ui
    - npm install
    - npm run build
  artifacts:
    when: always
    paths:
      - ui/dist

build-image-service:
  extends:
    - .build-image
  variables:
    OCI_IMAGE_NAME: ${IMAGE_REGISTRY_STAGE}/sbomer-service
    CONTAINERFILE: images/sbomer-service/Containerfile
  before_script:
    - mkdir certs
    - cp $IT_ROOT_CA_2022 certs/2022-IT-Root-CA.pem
    - cp $IT_ROOT_CA_2015 certs/2015-IT-Root-CA.pem
  dependencies:
    - build
  needs:
    - job: build

build-image-generator:
  extends:
    - .build-image
  variables:
    OCI_IMAGE_NAME: ${IMAGE_REGISTRY_STAGE}/sbomer-generator
    CONTAINERFILE: images/sbomer-generator/Containerfile
  before_script:
    - mkdir certs
    - cp $IT_ROOT_CA_2022 certs/2022-IT-Root-CA.pem
    - cp $IT_ROOT_CA_2015 certs/2015-IT-Root-CA.pem
  dependencies:
    - build
  needs:
    - job: build

build-image-ui:
  extends:
    - .build-image
  variables:
    OCI_IMAGE_NAME: ${IMAGE_REGISTRY_STAGE}/sbomer-ui
    CONTAINERFILE: images/sbomer-ui/Containerfile
  dependencies:
    - build-ui
  needs:
    - job: build-ui

pages:
  image:
    name: registry.redhat.io/ubi9/nodejs-20-minimal@sha256:757c8a7add8f812afb9ca3bad63da5d38b2ddb4705c53f84301edf10eff1f831
    entrypoint: [""]
  variables:
    KUBERNETES_CPU_REQUEST: "100m"
    KUBERNETES_CPU_LIMIT: "300m"
    KUBERNETES_MEMORY_REQUEST: "256Mi"
    KUBERNETES_MEMORY_LIMIT: "512Mi"
  stage: build
  cache:
    key:
      files:
        - package-lock.json
    paths:
      - .npm/
  before_script:
    - npm ci --cache .npm --prefer-offline
  script:
    - npm install --global yarn
    - yarn install --frozen-lockfile --no-progress
    - >
      NODE_TLS_REJECT_UNAUTHORIZED=0
      npx antora --fetch --to-dir public antora-playbook.yml
  artifacts:
    paths:
      - public
  rules:
    # - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

deploy:
  variables:
    RELEASE_HASH: ${CI_COMMIT_SHORT_SHA}
  stage: deploy
  trigger:
    project: appsvcs-platform/security/sbomer-helm
    branch: main
    strategy: depend
  needs:
    - job: build-image-generator
    - job: build-image-service
    - job: build-image-ui
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH