.gitlab-ci.yml

include:
  - file: /Scan/trivy.yml
    project: jitesoft/gitlab-ci-lib

stages:
  - build
  - containerize
  - scan

.build:src:alpine:
  stage: build
  image: registry.gitlab.com/jitesoft/dockerfiles/go:latest
  script:
    - mkdir binaries
    - mkdir -p ${GOPATH}/github.com/keybase/bot-sshca
    - apk add --no-cache wget grep tar curl
    - VERSION=$(wget -qO- https://github.com/keybase/bot-sshca/releases | grep -oP '(?<=releases\/tag\/)(.*?)(?=\">)' | awk 'NR==1{print $1}')
    - printf ${VERSION} > binaries/version.txt
    - curl -L https://github.com/keybase/bot-sshca/archive/${VERSION}.tar.gz -o /tmp/kssh-bot.tar.gz
    - tar -xzf /tmp/kssh-bot.tar.gz -C ${GOPATH}/github.com/keybase/bot-sshca --strip-components=1
    - cd ${GOPATH}/github.com/keybase/bot-sshca
    - go mod download
    - go build -ldflags "-w -s -X main.VersionNumber=${VERSION}" ${GOPATH}/github.com/keybase/bot-sshca/src/cmd/keybaseca/keybaseca.go
    - cd ${CI_PROJECT_DIR}
    - mv Alpine/entrypoint binaries/entrypoint
    - mv Alpine/Dockerfile ${CI_PROJECT_DIR}/Dockerfile
    - cp ${GOPATH}/github.com/keybase/bot-sshca/keybaseca ${CI_PROJECT_DIR}/binaries/keybaseca-${ARCH}
  artifacts:
    paths:
      - binaries
      - Dockerfile
    expire_in: 1 hour

build:src:alpine:amd64:
  extends: .build:src:alpine
  tags:
    - native-amd64
  variables:
    ARCH: "amd64"
    GO111MODULE: "on"

build:src:alpine:arm64:
  extends: .build:src:alpine
  tags:
    - native-aarch64
  variables:
    ARCH: "arm64"
    GO111MODULE: "on"


.build:src:ubuntu:
  stage: build
  image: registry.gitlab.com/jitesoft/dockerfiles/go/ubuntu:latest
  script:
    - mkdir binaries
    - mkdir -p ${GOPATH}/github.com/keybase/bot-sshca
    - apt-get update
    - apt-get install -y wget grep tar curl
    - VERSION=$(wget -qO- https://github.com/keybase/bot-sshca/releases | grep -oP '(?<=releases\/tag\/)(.*?)(?=\">)' | awk 'NR==1{print $1}')
    - printf ${VERSION} > binaries/version.txt
    - printf ${VERSION} > binaries/version.txt
    - curl -L https://github.com/keybase/bot-sshca/archive/${VERSION}.tar.gz -o /tmp/kssh-bot.tar.gz
    - tar -xzf /tmp/kssh-bot.tar.gz -C ${GOPATH}/github.com/keybase/bot-sshca --strip-components=1
    - cd ${GOPATH}/github.com/keybase/bot-sshca
    - go mod download
    - go build -ldflags "-w -s -X main.VersionNumber=${VERSION}" ${GOPATH}/github.com/keybase/bot-sshca/src/cmd/keybaseca/keybaseca.go
    - cd ${CI_PROJECT_DIR}
    - mv Ubuntu/entrypoint binaries/entrypoint
    - mv Ubuntu/Dockerfile ${CI_PROJECT_DIR}/Dockerfile
    - cp ${GOPATH}/github.com/keybase/bot-sshca/keybaseca ${CI_PROJECT_DIR}/binaries/keybaseca-${ARCH}
  artifacts:
    paths:
      - binaries
      - Dockerfile
    expire_in: 1 hour

build:src:ubuntu:amd64:
  extends: .build:src:ubuntu
  tags:
    - native-amd64
  variables:
    ARCH: "amd64"
    GO111MODULE: "on"

build:src:ubuntu:arm64:
  extends: .build:src:ubuntu
  tags:
    - native-aarch64
  variables:
    ARCH: "arm64"
    GO111MODULE: "on"

containerize:alpine:
  needs:
    - build:src:alpine:amd64
    - build:src:alpine:arm64
  stage: containerize
  variables:
    GIT_STRATEGY: none
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - VERSION=$(cat binaries/version.txt)
    - VERSION_SHORT=$(echo ${VERSION} | cut -d'-' -f 1)
    - TAG_LIST=$(helper "${CI_REGISTRY_IMAGE}/alpine" "latest,${VERSION}")
    - TAG_LIST="$(helper "jitesoft/keybase-sshca,ghcr.io/jitesoft/keybase-sshca" "latest-alpine,${VERSION}-alpine,${VERSION_SHORT}-alpine") ${TAG_LIST}"
    - docker buildx build --platform linux/amd64,linux/arm64 --push ${TAG_LIST} --build-arg VERSION="${VERSION}" --progress plain .
  tags: [ jitesoft, protected, buildx ]

containerize:ubuntu:
  needs:
    - build:src:ubuntu:amd64
    - build:src:ubuntu:arm64
  stage: containerize
  variables:
    GIT_STRATEGY: none
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - VERSION=$(cat binaries/version.txt)
    - VERSION_SHORT=$(echo ${VERSION} | cut -d'-' -f 1)
    - TAG_LIST=$(helper "${CI_REGISTRY_IMAGE}" "latest,${VERSION}")
    - TAG_LIST="$(helper "jitesoft/keybase-sshca,ghcr.io/jitesoft/keybase-sshca" "latest,${VERSION},${VERSION_SHORT}") ${TAG_LIST}"
    - docker buildx build --platform linux/amd64,linux/arm64 --push ${TAG_LIST} --build-arg VERSION="${VERSION}" --progress plain .
  tags: [ jitesoft, protected, buildx ]

scan:ubuntu:
  extends: .container_scanning
  variables:
    SCANNING_IMAGE_NAME: "${CI_REGISTRY_IMAGE}:latest"

scan:alpine:
  extends: .container_scanning
  variables:
    SCANNING_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/alpine:latest"