.gitlab-ci.yml

include:
  - project: jitesoft/gitlab-ci-lib
    file: Scan/trivy.yml
  - project: jitesoft/gitlab-ci-lib
    file: OCI/sign.yml

stages:
  - pre
  - build
  - containerize
  - post

check:
  stage: pre
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: always
    - if: '$CI_PIPELINE_SOURCE == "web"'
      when: always
    - when: never
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - touch version.txt
    - REMOTE_VERSION=$(wget -qO- https://api.github.com/repos/aquasecurity/trivy/releases | jq -r ".[0].name")
    - LOCAL_VERSION=$(cat version.txt)
    - REMOTE_VERSION="${REMOTE_VERSION#?}"
    - |
      if [ ! -z "${FORCE_BUILD+x}" ] || [ "${REMOTE_VERSION}" != "${LOCAL_VERSION}" ]; then
        echo "${REMOTE_VERSION} and ${LOCAL_VERSION} differ. Running build."
        curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[VERSION]=${REMOTE_VERSION}" -F "variables[BUILD]=true" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      else
        echo "${REMOTE_VERSION} and ${LOCAL_VERSION} where equal. Running scan."
        curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[VERSION]=${REMOTE_VERSION}" -F "variables[SCAN]=true" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      fi
  cache:
    paths:
      - version.txt
    policy: pull

download:
  rules:
    - if: "$BUILD"
      when: always
    - when: never
  stage: pre
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  variables:
    GIT_STRATEGY: none
  script:
    - curl -SsL https://github.com/aquasecurity/trivy/archive/v${VERSION}.tar.gz -o trivy.tar.gz
  artifacts:
    paths:
      - trivy.tar.gz
    expire_in: 1 hour

build:
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  stage: build
  parallel:
    matrix:
      - { TAG_ARCH: "native-arm64", GIT_STRATEGY: "none", GO111MODULE: "on", ARCH: "arm64", GOARCH: "arm64" }
      - { TAG_ARCH: "native-amd64", GIT_STRATEGY: "none", GO111MODULE: "on", ARCH: "amd64", GOARCH: "amd64" }
  needs:
    - job: download
      artifacts: true
  image: registry.gitlab.com/jitesoft/dockerfiles/go:latest
  script:
    - apk add --no-cache gcc
    - mkdir -p ${GOPATH}/src/github.com/aquasecurity/trivy
    - tar -xzf trivy.tar.gz --strip-components=1 -C "${GOPATH}/src/github.com/aquasecurity/trivy"
    - cd ${GOPATH}/src/github.com/aquasecurity/trivy
    - go mod download
    - go build -v -a -ldflags "-s -w -X=main.version=v${VERSION}" ./cmd/trivy
    - mv trivy ${CI_PROJECT_DIR}/trivy-${ARCH}
  tags:
    - ${TAG_ARCH}
  artifacts:
    paths:
      - trivy-${ARCH}
    expire_in: 1 hour

containerize:
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  stage: containerize
  needs:
    - job: build
      artifacts: true
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - mkdir -p binaries/contrib
    - curl -SsL https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/Trivy.gitlab-ci.yaml -o binaries/contrib/Trivy.gitlab-ci.yaml
    - curl -SsL https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/gitlab.tpl -o binaries/contrib/gitlab.tpl
    - curl -SsL https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/hyml.tpl -o binaries/contrib/html.tpl
    - curl -SsL https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/sarif.tpl -o binaries/contrib/sarif.tpl
    - curl -SsL https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/junit.tpl -o binaries/contrib/junit.tpl
    - curl -SsL https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/asff.tpl -o binaries/contrib/asff.tpl
    - curl -SsL https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/gitlab-codequality.tpl -o binaries/contrib/gitlab-codequality.tpl
    - mv trivy-* binaries/
    - mv entrypoint binaries/
    - TAGLIST=$(helper "${CI_REGISTRY_IMAGE},jitesoft/trivy,ghcr.io/jitesoft/trivy" "latest,${VERSION}")
    - docker buildx build ${TAGLIST} --progress=plain --platform=linux/amd64,linux/arm64 --build-arg BUILD_TIME="$(date -Iseconds)"  --build-arg VERSION="${VERSION}" --push .
  tags:
    - buildx
    - protected

sign:
  extends: .sign
  tags: [ jitesoft, protected, buildx ]
  stage: post
  variables:
    COSIGN_ANNOTATIONS: "-a sig=jitesoft-bot"
    SIGN_TAGS: "${VERSION},latest"
    SIGN_IMAGES: "jitesoft/trivy,${CI_REGISTRY_IMAGE},ghcr.io/jitesoft/trivy"
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never

scan:
  rules:
    - if: "$SCAN"
      when: always
    - if: "$BUILD"
      when: on_success
    - when: never
  tags: [ protected, jitesoft ]
  stage: post
  extends: .container_scanning
  before_script:
    - apk add --no-cache wget grep
    - VERSION=$(wget -qO- https://github.com/aquasecurity/trivy/releases | grep -oP '(?<=releases\/tag\/)(.*?)(?=\">)' | awk 'NR==1{print $1}' | head -1)
    - export SCANNING_IMAGE_NAME="${CI_REGISTRY_IMAGE}:${VERSION#?}"
    - trivy --version
  variables:
    GIT_STRATEGY: none

create-cache:
  stage: post
  script:
    - echo "${VERSION}" > version.txt
  cache:
    paths:
      - version.txt
    policy: push
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never