.gitlab-ci.yml

# You can override the included template(s) by including variable overrides
# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
# Note that environment variables can be set in several places
# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
stages:
- build
- test
- deploy
- manifest

include:
- remote: https://gitlab.com/yobasystems/gitlab-ci-templates/raw/master/container_scanning_all_arch.yml
- template: Security/Secret-Detection.gitlab-ci.yml
- template: Security/SAST.gitlab-ci.yml

.build_template: &build_definition
  image: yobasystems/alpine-docker:dind
  stage: build
  script:
    - echo "Build Timestamp ${CI_COMMIT_TIMESTAMP} - ${CI_COMMIT_SHORT_SHA}"
    - echo "Building for ARCH=${ARCH}, PLATFORM=${PLATFORM}"
    - apk add --update git
    - cd alpine-nginx-${ARCH}/
    - docker build
      --build-arg VCS_REF=${CI_COMMIT_SHORT_SHA}
      --build-arg BUILD_DATE=${CI_COMMIT_TIMESTAMP}
      -t ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}
      --platform linux/${PLATFORM}
      .
    - echo "$CI_JOB_TOKEN" | docker login -u gitlab-ci-token "$CI_REGISTRY" --password-stdin
    - docker push ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}

amd64 alpine-nginx build:
  <<: *build_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    PLATFORM: amd64

arm32v7 alpine-nginx build:
  <<: *build_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    PLATFORM: arm/v7

arm64v8 alpine-nginx build:
  <<: *build_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    PLATFORM: arm64/v8

sast:
  stage: test

.deploy_template: &deploy_definition
  image: yobasystems/alpine-docker:dind
  stage: deploy
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  script:
    - echo "$CI_JOB_TOKEN" | docker login -u gitlab-ci-token "$CI_REGISTRY" --password-stdin
    - echo "$DOCKERHUB_PASSWORD" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
    - echo "$QUAY_PASSWORD" | docker login -u "$QUAY_USERNAME" quay.io --password-stdin
    - echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_USERNAME" --password-stdin
    - docker pull ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} $CI_REGISTRY_IMAGE:${ARCH}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} $DOCKER_REGISTRY_DOCKERHUB_REPO:${ARCH}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} quay.io/$DOCKER_REGISTRY_QUAY_REPO:${ARCH}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${ARCH}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} $CI_REGISTRY_IMAGE:${ARCH2}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} $DOCKER_REGISTRY_DOCKERHUB_REPO:${ARCH2}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} quay.io/$DOCKER_REGISTRY_QUAY_REPO:${ARCH2}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${ARCH2}
    - docker push $CI_REGISTRY_IMAGE:${ARCH}
    - docker push $DOCKER_REGISTRY_DOCKERHUB_REPO:${ARCH}
    - docker push quay.io/$DOCKER_REGISTRY_QUAY_REPO:${ARCH}
    - docker push ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${ARCH}
    - docker push $CI_REGISTRY_IMAGE:${ARCH2}
    - docker push $DOCKER_REGISTRY_DOCKERHUB_REPO:${ARCH2}
    - docker push quay.io/$DOCKER_REGISTRY_QUAY_REPO:${ARCH2}
    - docker push ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${ARCH2}
    - |
      if [[ "$CI_COMMIT_TAG" ]]; then
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG}-${ARCH}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} $DOCKER_REGISTRY_DOCKERHUB_REPO:${CI_COMMIT_TAG}-${ARCH}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} quay.io/$DOCKER_REGISTRY_QUAY_REPO:${CI_COMMIT_TAG}-${ARCH}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${CI_COMMIT_TAG}-${ARCH}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG}-${ARCH2}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} $DOCKER_REGISTRY_DOCKERHUB_REPO:${CI_COMMIT_TAG}-${ARCH2}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} quay.io/$DOCKER_REGISTRY_QUAY_REPO:${CI_COMMIT_TAG}-${ARCH2}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH} ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${CI_COMMIT_TAG}-${ARCH2}
        docker push $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG}-${ARCH}
        docker push $DOCKER_REGISTRY_DOCKERHUB_REPO:${CI_COMMIT_TAG}-${ARCH}
        docker push quay.io/$DOCKER_REGISTRY_QUAY_REPO:${CI_COMMIT_TAG}-${ARCH}
        docker push ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${CI_COMMIT_TAG}-${ARCH}
        docker push $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG}-${ARCH2}
        docker push $DOCKER_REGISTRY_DOCKERHUB_REPO:${CI_COMMIT_TAG}-${ARCH2}
        docker push quay.io/$DOCKER_REGISTRY_QUAY_REPO:${CI_COMMIT_TAG}-${ARCH2}
        docker push ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${CI_COMMIT_TAG}-${ARCH2}
      fi

amd64 alpine-nginx deploy:
  <<: *deploy_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    ARCH2: x86_64
    PLATFORM: amd64
  needs:
    - amd64 alpine-nginx build

arm32v7 alpine-nginx deploy:
  <<: *deploy_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    ARCH2: arm32v7
    PLATFORM: arm/v7
  needs:
    - arm32v7 alpine-nginx build

arm64v8 alpine-nginx deploy:
  <<: *deploy_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    ARCH2: arm64v8
    PLATFORM: arm64/v8
  needs:
    - arm64v8 alpine-nginx build

amd64 alpine-nginx-git build:
  <<: *build_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    PLATFORM: amd64
    VARIANT: git
  script:
    - echo "Build Timestamp ${CI_COMMIT_TIMESTAMP} - ${CI_COMMIT_SHORT_SHA}"
    - echo "Building for ARCH=${ARCH}, PLATFORM=${PLATFORM}, VARIANT=${VARIANT}"
    - apk add --update git
    - cd alpine-nginx-${VARIANT}-${ARCH}/
    - docker build
      --build-arg VCS_REF=${CI_COMMIT_SHORT_SHA}
      --build-arg BUILD_DATE=${CI_COMMIT_TIMESTAMP}
      -t ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}-${VARIANT}
      --platform linux/${PLATFORM}
      .
    - echo "$CI_JOB_TOKEN" | docker login -u gitlab-ci-token "$CI_REGISTRY" --password-stdin
    - docker push ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}-${VARIANT}

arm32v7 alpine-nginx-git build:
  <<: *build_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    PLATFORM: arm/v7
    VARIANT: git
  script:
    - !reference [amd64 alpine-nginx-git build, script]

arm64v8 alpine-nginx-git build:
  <<: *build_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    PLATFORM: arm64/v8
    VARIANT: git
  script:
    - !reference [amd64 alpine-nginx-git build, script]

amd64 alpine-nginx-git-ssh build:
  <<: *build_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    PLATFORM: amd64
    VARIANT: git-ssh
  script:
    - !reference [amd64 alpine-nginx-git build, script]

arm32v7 alpine-nginx-git-ssh build:
  <<: *build_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    PLATFORM: arm/v7
    VARIANT: git-ssh
  script:
    - !reference [amd64 alpine-nginx-git build, script]

arm64v8 alpine-nginx-git-ssh build:
  <<: *build_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    PLATFORM: arm64/v8
    VARIANT: git-ssh
  script:
    - !reference [amd64 alpine-nginx-git build, script]

amd64 alpine-nginx-stable build:
  <<: *build_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    PLATFORM: amd64
    VARIANT: stable
  script:
    - !reference [amd64 alpine-nginx-git build, script]

arm32v7 alpine-nginx-stable build:
  <<: *build_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    PLATFORM: arm/v7
    VARIANT: stable
  script:
    - !reference [amd64 alpine-nginx-git build, script]

arm64v8 alpine-nginx-stable build:
  <<: *build_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    PLATFORM: arm64/v8
    VARIANT: stable
  script:
    - !reference [amd64 alpine-nginx-git build, script]

amd64 alpine-nginx-git deploy:
  <<: *deploy_definition
  variables:
    ARCH: amd64
    ARCH2: x86_64
    PLATFORM: amd64
    VARIANT: git
  needs:
    - amd64 alpine-nginx-git build
  script:
    - echo "$CI_JOB_TOKEN" | docker login -u gitlab-ci-token "$CI_REGISTRY" --password-stdin
    - echo "$DOCKERHUB_PASSWORD" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
    - echo "$QUAY_PASSWORD" | docker login -u "$QUAY_USERNAME" quay.io --password-stdin
    - echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_USERNAME" --password-stdin
    - docker pull ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}-${VARIANT}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}-${VARIANT} $CI_REGISTRY_IMAGE:${ARCH}-${VARIANT}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}-${VARIANT} $DOCKER_REGISTRY_DOCKERHUB_REPO:${ARCH}-${VARIANT}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}-${VARIANT} quay.io/$DOCKER_REGISTRY_QUAY_REPO:${ARCH}-${VARIANT}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}-${VARIANT} ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${ARCH}-${VARIANT}
    - docker push $CI_REGISTRY_IMAGE:${ARCH}-${VARIANT}
    - docker push $DOCKER_REGISTRY_DOCKERHUB_REPO:${ARCH}-${VARIANT}
    - docker push quay.io/$DOCKER_REGISTRY_QUAY_REPO:${ARCH}-${VARIANT}
    - docker push ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${ARCH}-${VARIANT}

manifest creation git:
  image: yobasystems/alpine-docker:dind
  stage: manifest
  needs:
    - amd64 alpine-nginx-git deploy
    - arm32v7 alpine-nginx-git deploy
    - arm64v8 alpine-nginx-git deploy
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  variables:
    VARIANT: git
  script:
    - mkdir -p ~/.docker
    - echo '{"experimental":"enabled"}' > ~/.docker/config.json
    - echo "$CI_JOB_TOKEN" | docker login -u gitlab-ci-token "$CI_REGISTRY" --password-stdin
    - echo "$DOCKERHUB_PASSWORD" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
    - echo "$QUAY_PASSWORD" | docker login -u "$QUAY_USERNAME" quay.io --password-stdin
    - echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_USERNAME" --password-stdin
    - |
      create_and_push_manifest() {
        repo=$1
        tag=$2
        docker manifest create $repo:$tag \
          $repo:amd64-${VARIANT} \
          $repo:armhf-${VARIANT} \
          $repo:aarch64-${VARIANT}
        docker manifest annotate $repo:$tag $repo:amd64-${VARIANT} --os linux --arch amd64
        docker manifest annotate $repo:$tag $repo:armhf-${VARIANT} --os linux --arch arm --variant v7
        docker manifest annotate $repo:$tag $repo:aarch64-${VARIANT} --os linux --arch arm64 --variant v8
        docker manifest push $repo:$tag
      }
    - |
      for repo in $CI_REGISTRY_IMAGE $DOCKER_REGISTRY_DOCKERHUB_REPO quay.io/$DOCKER_REGISTRY_QUAY_REPO ghcr.io/$DOCKER_REGISTRY_GHCR_REPO; do
        create_and_push_manifest $repo ${VARIANT}
      done

arm32v7 alpine-nginx-git deploy:
  <<: *deploy_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    ARCH2: arm32v7
    PLATFORM: arm/v7
    VARIANT: git
  needs:
    - arm32v7 alpine-nginx-git build
  script:
    - !reference [amd64 alpine-nginx-git deploy, script]

arm64v8 alpine-nginx-git deploy:
  <<: *deploy_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    ARCH2: arm64v8
    PLATFORM: arm64/v8
    VARIANT: git
  needs:
    - arm64v8 alpine-nginx-git build
  script:
    - !reference [amd64 alpine-nginx-git deploy, script]

amd64 alpine-nginx-git-ssh deploy:
  <<: *deploy_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    ARCH2: x86_64
    PLATFORM: amd64
    VARIANT: git-ssh
  needs:
    - amd64 alpine-nginx-git-ssh build
  script:
    - !reference [amd64 alpine-nginx-git deploy, script]

arm32v7 alpine-nginx-git-ssh deploy:
  <<: *deploy_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    ARCH2: arm32v7
    PLATFORM: arm/v7
    VARIANT: git-ssh
  needs:
    - arm32v7 alpine-nginx-git-ssh build
  script:
    - !reference [amd64 alpine-nginx-git deploy, script]

arm64v8 alpine-nginx-git-ssh deploy:
  <<: *deploy_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    ARCH2: arm64v8
    PLATFORM: arm64/v8
    VARIANT: git-ssh
  needs:
    - arm64v8 alpine-nginx-git-ssh build
  script:
    - !reference [amd64 alpine-nginx-git deploy, script]

amd64 alpine-nginx-stable deploy:
  <<: *deploy_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    ARCH2: x86_64
    PLATFORM: amd64
    VARIANT: stable
  needs:
    - amd64 alpine-nginx-stable build
  script:
    - !reference [amd64 alpine-nginx-git deploy, script]

arm32v7 alpine-nginx-stable deploy:
  <<: *deploy_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    ARCH2: arm32v7
    PLATFORM: arm/v7
    VARIANT: stable
  needs:
    - arm32v7 alpine-nginx-stable build
  script:
    - !reference [amd64 alpine-nginx-git deploy, script]

arm64v8 alpine-nginx-stable deploy:
  <<: *deploy_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    ARCH2: arm64v8
    PLATFORM: arm64/v8
    VARIANT: stable
  needs:
    - arm64v8 alpine-nginx-stable build
  script:
    - !reference [amd64 alpine-nginx-git deploy, script]

manifest creation git-ssh:
  image: yobasystems/alpine-docker:dind
  stage: manifest
  needs:
    - amd64 alpine-nginx-git-ssh deploy
    - arm32v7 alpine-nginx-git-ssh deploy
    - arm64v8 alpine-nginx-git-ssh deploy
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  variables:
    VARIANT: git-ssh
  script:
    - !reference [manifest creation git, script]

manifest creation stable:
  image: yobasystems/alpine-docker:dind
  stage: manifest
  needs:
    - amd64 alpine-nginx-stable deploy
    - arm32v7 alpine-nginx-stable deploy
    - arm64v8 alpine-nginx-stable deploy
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  variables:
    VARIANT: stable
  script:
    - !reference [manifest creation git, script]

manifest creation version:
  image: yobasystems/alpine-docker:dind
  stage: manifest
  needs:
    - amd64 alpine-nginx deploy
    - arm32v7 alpine-nginx deploy
    - arm64v8 alpine-nginx deploy
  rules:
    - if: $CI_COMMIT_TAG
  script:
    - mkdir -p ~/.docker
    - echo '{"experimental":"enabled"}' > ~/.docker/config.json
    - echo "$CI_JOB_TOKEN" | docker login -u gitlab-ci-token "$CI_REGISTRY" --password-stdin
    - echo "$DOCKERHUB_PASSWORD" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
    - echo "$QUAY_PASSWORD" | docker login -u "$QUAY_USERNAME" quay.io --password-stdin
    - echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_USERNAME" --password-stdin
    - |
      create_and_push_manifest() {
        repo=$1
        tag=$2
        docker manifest create $repo:$tag --amend \
          $repo:amd64 \
          $repo:armhf \
          $repo:aarch64
        docker manifest annotate $repo:$tag $repo:amd64 --os linux --arch amd64
        docker manifest annotate $repo:$tag $repo:armhf --os linux --arch arm --variant v7
        docker manifest annotate $repo:$tag $repo:aarch64 --os linux --arch arm64 --variant v8
        docker manifest push $repo:$tag
      }
    - echo "Processing tag $CI_COMMIT_TAG"
    - VERSION=$(echo $CI_COMMIT_TAG | cut -d- -f1)
    - MAJOR=$(echo $VERSION | cut -d. -f1)
    - MINOR=$(echo $VERSION | cut -d. -f2)
    - PATCH=$(echo $VERSION | cut -d. -f3)
    - |
      for repo in $CI_REGISTRY_IMAGE $DOCKER_REGISTRY_DOCKERHUB_REPO quay.io/$DOCKER_REGISTRY_QUAY_REPO ghcr.io/$DOCKER_REGISTRY_GHCR_REPO; do
        create_and_push_manifest $repo $CI_COMMIT_TAG
        create_and_push_manifest $repo $MAJOR
        create_and_push_manifest $repo $MAJOR.$MINOR
        create_and_push_manifest $repo $MAJOR.$MINOR.$PATCH
      done