.gitlab-ci.yml

image: dockerhub.artifactory-phx.ecd.axway.int/library/docker:20.10.6

variables:
  PROJECT: "agents-webmethods"
  CSR_SUPPRESSION_LIST: "/tmp/csr-suppressions/amplify-central/golang-agents-common.json"

  # Fortify
  FORTIFY_PROJECT: "10808"
  FORTIFY_BUILD_ID: "agents-webmethods"
  FORTIFY_INCLUDE: "**/*.go"
  FORTIFY_EXCLUDE: "**/*_test.go"

  # Blackduck
  BLACKDUCK_PROJECT_NAME: "Amplify - APIC webMethods Agents"

  # just to be sure we don't do vendoring
  GOFLAGS: "-mod=mod"

########################################
# set up custom names for the pipelines of releases and nightly schedules
########################################
  PIPELINE_NAME: "$CI_COMMIT_MESSAGE"

workflow:
  name: "$PIPELINE_NAME"
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule" && $COMPONENT_TESTS_ONLY == "y"
      variables:
        PIPELINE_NAME: "Scheduled nightly tests"
    - if: $CI_PIPELINE_SOURCE == "schedule"
      variables:
        PIPELINE_NAME: "Scheduled nightly CSR"
    - when: always

stages:
  - test
  - qa-test
  - sonar-preview
  - sonar-publish
  - build
  - security-scans
  - security-review

############################################################
# Section for included yaml files
############################################################
include:
  - project: "apigov/gitlabci"
    ref: master
    file: "/.gitlab-ci-sonar.yml"
  - project: "apigov/beano_cicd"
    ref: $BEANO_CICD_LATEST
    # the order of these include files is important
    file:
      - "/gitlabci/variables.yml"
      - "/gitlabci/restrictions.yml"
      - "/gitlabci/jobs.yml"
  - project: "scurity/gitlabci"
    ref: $SCURITY_LATEST
    file:
      - "/.gitlab-ci-fortify.yml"
      - "/.gitlab-ci-blackduck.yml"
      - "/.gitlab-ci-iriusrisk.yml"
      - "/.gitlab-ci-twistlock.yml"
      - "/.gitlab-ci-csr.yml"
  - project: "apigov/beano_cicd"
    ref: $BEANO_CICD_LATEST
    # this one MUST be after the scurity jobs in order for overrides to work correctly!
    file:
      - "/gitlabci/csrjobs.yml"

twistlock-discovery:
  extends: .twistlock
  rules:
    - !reference [.mirror-branch-csr-rules, rules]
  before_script:
    - apk --no-cache update && apk add make
    - make docker-build-discovery
    - export IMAGE_NAME=webmethods_discovery_agent:latest

# twistlock-traceability:
#   extends: .twistlock
  # rules:
  #   - !reference [.mirror-branch-csr-rules, rules]
#   before_script:
#     - apk --no-cache update && apk add make
#     - make docker-build-traceability
#     - export IMAGE_NAME=webmethods_traceability_agent:latest

twistlock-discovery:on-schedule:
  extends: .twistlock
  rules:
    - !reference [.mirror-schedule-csr-rules, rules]
  dependencies: []
  variables:
    # need to override this variable for github agents because the tag willneed the 'v' if it exists
    NO_V_RELEASE_TAG_REGEX: "^v?[0-9]{1,}\\.[0-9]{1,}\\.[0-9]{1,}$"
  before_script:
    - !reference [.get-agent-last-tag, script]
    - echo "Using the last tagged version ${LAST_TAG_VERSION}"
    - export IMAGE_NAME=ghcr.io/axway/webmethods_discovery_agent:${LAST_TAG_VERSION}
    - docker pull ${IMAGE_NAME}

# twistlock-traceability:on-schedule:
#   extends: .twistlock
  # rules:
  #   - !reference [.mirror-schedule-csr-rules, rules]
#   dependencies: []
#   before_script:
#     - apk --no-cache update && apk add git
#     - *get-latest-tag
#     - export IMAGE_NAME=ghcr.io/axway/webmethods_traceability_agent:${LAST_TAG_VERSION}
#     - docker pull ${IMAGE_NAME}

blackduck:on-schedule:
  rules:
    - !reference [.mirror-schedule-csr-rules, rules]
  before_script:
    - !reference [.get-agent-last-tag, script]

# overridden from csrjobs.yml because mirror repos like this one don't get merge events
fortify:
  rules:
    - !reference [.mirror-branch-csr-rules, rules]

fetch-fortify:
  rules:
    - !reference [.mirror-branch-csr-rules, rules]

blackduck-rapid:
  rules:
    - !reference [.mirror-branch-csr-rules, rules]

run-csr:
  rules:
    - !reference [.mirror-branch-csr-rules, rules]

####################
# CSR - overridden from csrjobs.yml to effectively not see these jobs ever. For some reason, probably multi-level
# extends and overrides, using only-never for these csr jobs doesn't work. Had to do it like this.
####################
fetch-iriusrisk:
  rules:
    - !reference [.only-never-rule, rules]

fetch-iriusrisk:on-schedule:
  rules:
    - !reference [.only-never-rule, rules]

twistlock:
  rules:
    - !reference [.only-never-rule, rules]
  dependencies:

twistlock:on-schedule:
  rules:
    - !reference [.only-never-rule, rules]