.gitlab-ci.yml

image: golang:1.22-alpine

variables:
  CGO_ENABLED: 0
  RELEASE_CLI_VERSION: "v0.18.0"
  DEVELOPER_BRANCH: "features"
  PACKAGE_REGISTRY_URL: "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/${CI_PROJECT_NAME}/${CI_COMMIT_TAG}/"
  PLATFORMS: "darwin/amd64 darwin/arm64 freebsd/amd64 freebsd/arm64 linux/amd64 linux/arm64 netbsd/amd64 netbsd/arm64 openbsd/amd64 openbsd/arm64 windows/amd64 windows/arm64"

stages:
  - test
  - build
  - upload
  - release
  - push

sast:
  stage: test

test analyze 1/3:
  stage: test
  script:
    - go fmt $(go list ./... | grep -v /vendor/)
    - go vet $(go list ./... | grep -v /vendor/)
  rules:
    - if: $CI_COMMIT_BRANCH == $DEVELOPER_BRANCH

test analyze 2/3:
  stage: test
  script:
    - go test -short $(go list ./... | grep -v /vendor/)
  rules:
    - if: $CI_COMMIT_BRANCH == $DEVELOPER_BRANCH

test analyze 3/3:
  stage: test
  variables:
    CGO_ENABLED: 1
  script:
    - apk add --no-cache build-base
    - go test -race -short $(go list ./... | grep -v /vendor/)
  rules:
    - if: $CI_COMMIT_BRANCH == $DEVELOPER_BRANCH

build:
  stage: build
  script:
    - |
      tag="dev"
      if [[ -n "$CI_COMMIT_TAG" ]]; then
          tag="${CI_COMMIT_TAG}"
      fi

      for PLATFORM in ${PLATFORMS}; do
          GOOS=${PLATFORM%/*}
          GOARCH=${PLATFORM#*/}
          FILEPATH="${CI_PROJECT_DIR}/bin/${GOOS}-${GOARCH}"
          mkdir -p ${FILEPATH}
          BIN_FILE_NAME="${FILEPATH}/${CI_PROJECT_NAME}-${GOOS}-${GOARCH}-${tag}"

          if [[ "${GOOS}" == "windows" ]]; then
              BIN_FILE_NAME="${BIN_FILE_NAME}.exe"
          fi

          echo "Building ${BIN_FILE_NAME}"
          GOOS=${GOOS} GOARCH=${GOARCH} go build -mod=vendor -ldflags="-s -X main.version=${tag}-${CI_COMMIT_SHORT_SHA}" -o ${BIN_FILE_NAME} .
      done
  artifacts:
    paths:
      - bin/

upload:
  stage: upload
  image: curlimages/curl:latest
  script:
    - |
      find ${CI_PROJECT_DIR}/bin/ -type f | while read filename; do
          curl --header "JOB-TOKEN: ${CI_JOB_TOKEN}" --upload-file ${filename} ${PACKAGE_REGISTRY_URL}/$(basename ${filename})
      done
  rules:
    - if: $CI_COMMIT_TAG

release:
  stage: release
  image: registry.gitlab.com/gitlab-org/release-cli:$RELEASE_CLI_VERSION
  script:
    - |
      ASSETS=""

      for PLATFORM in ${PLATFORMS}; do
          GOOS=${PLATFORM%/*}
          GOARCH=${PLATFORM#*/}
          BIN_FILE_NAME="${CI_PROJECT_NAME}-${GOOS}-${GOARCH}-${CI_COMMIT_TAG}"

          if [[ "${GOOS}" == "windows" ]]; then
              BIN_FILE_NAME="${BIN_FILE_NAME}.exe"
          fi
      
          echo "Adding asset ${BIN_FILE_NAME}"
          ASSETS="${ASSETS} --assets-link {\"name\":\"${BIN_FILE_NAME}\",\"url\":\"${PACKAGE_REGISTRY_URL}/${BIN_FILE_NAME}\"}"
      done
      
      release-cli create --name "Release ${CI_COMMIT_TAG}" --tag-name ${CI_COMMIT_TAG} ${ASSETS}
  rules:
    - if: $CI_COMMIT_TAG

docker:
  stage: build
  image: docker:26
  before_script:
    - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" ${CI_REGISTRY}
  script:
    - docker pull ${CI_REGISTRY_IMAGE}:latest || true
    - >
      docker build
      --pull
      --build-arg http_proxy=${http_proxy}
      --build-arg https_proxy=${https_proxy}
      --build-arg no_proxy=${no_proxy}
      --cache-from ${CI_REGISTRY_IMAGE}:latest
      --label "org.opencontainers.image.title=${CI_PROJECT_TITLE}"
      --label "org.opencontainers.image.url=${CI_PROJECT_URL}"
      --label "org.opencontainers.image.created=${CI_JOB_STARTED_AT}"
      --label "org.opencontainers.image.revision=${CI_COMMIT_SHA}"
      --label "org.opencontainers.image.version=${CI_COMMIT_REF_NAME}"
      --tag ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA}
      .
    - docker push ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA}

push tags 1/2:
  stage: push
  image: docker:26
  before_script:
    - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" ${CI_REGISTRY}
  variables:
    GIT_STRATEGY: none
  script:
    - docker pull ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA}
    - |
      if [[ "${CI_COMMIT_BRANCH}" == "${CI_DEFAULT_BRANCH}" ]]; then
        docker_tag="latest"
      else
        docker_tag="dev"
      fi
    - docker tag ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA} ${CI_REGISTRY_IMAGE}:${docker_tag}
    - docker push ${CI_REGISTRY_IMAGE}:${docker_tag}

push tags 2/2:
  stage: push
  image: docker:26
  before_script:
    - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" ${CI_REGISTRY}
  variables:
    GIT_STRATEGY: none
  script:
    - docker pull ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA}
    - docker tag ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA} ${CI_REGISTRY_IMAGE}:${CI_COMMIT_REF_NAME}
    - docker push ${CI_REGISTRY_IMAGE}:${CI_COMMIT_REF_NAME}
  rules:
    - if: $CI_COMMIT_TAG

secret_detection:
  variables:
    SECRET_DETECTION_HISTORIC_SCAN: "true"

include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml