.gitlab-ci.yml

# You can override the included template(s) by including variable overrides
# SAST customization:
# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
# Note that environment variables can be set in several places
# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence


workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
      when: never
    - if: $CI_COMMIT_BRANCH
    - if: $CI_COMMIT_TAG


.go-cache:
    variables:
        GOPATH: $CI_PROJECT_DIR/.go
    cache:
      paths:
        - .go/pkg/mod/

variables:
  MAINTENANCE_MODE: 1
  DOCKER_BASE_IMAGE: redhat/ubi9:latest
  BUILD_IMAGE: $CI_REGISTRY_IMAGE/infinidat-csi-driver:$CI_COMMIT_REF_NAME
  METRICS_BUILD_IMAGE: $CI_REGISTRY_IMAGE/infinidat-csi-metrics:$CI_COMMIT_REF_NAME

stages:
- lint
- test
- build
- docker_build
- release

lint:
    image:
      name: golangci/golangci-lint:v1.62.2
      pull_policy: if-not-present
    stage: lint
    tags:
      - go-test
    extends: .go-cache
    allow_failure: false
    except:
      - tags
    script:
      - golangci-lint -v --timeout=5m run

unit_test:
  image:
    name: quay.io/projectquay/golang:1.23
    pull_policy: if-not-present
  stage: test
  except:
    - tags
  tags:
    - go-test
  script:
  - go test  -v ./...
  
sast:
  stage: test
  tags:
    - go-test
  variables: 
    SAST_EXCLUDED_PATHS: "**/*_test.go, test_helper/*.go"
    SCAN_KUBERNETES_MANIFESTS: "true"
    KUBESEC_HELM_CHARTS_PATH: deploy/helm/infinibox-csi-driver

go-build:
  stage: build
  tags:
    - go-build
  image:
    name: quay.io/projectquay/golang:1.23
    pull_policy: if-not-present
  script:
  - make build
  artifacts:
    paths:
      - infinibox-csi-driver
    expire_in: 1 day

go-iboxreplica-build:
  stage: build
  tags:
    - go-build
  image:
    name: quay.io/projectquay/golang:1.23
    pull_policy: if-not-present
  script:
    - make -f Makefile-iboxreplica build
  artifacts:
    paths:
      - bin/iboxreplica-controller
    expire_in: 1 day

go-metrics-build:
  stage: build
  tags:
    - go-build
  image:
    name: quay.io/projectquay/golang:1.23
    pull_policy: if-not-present
  script:
    - make build-metrics
  artifacts:
    paths:
      - infinibox-csi-metrics
    expire_in: 1 day

go-e2e-test:
  stage: test
  tags:
    - go-test
  only:
    - merge_request
  image:
    name: quay.io/projectquay/golang:1.23
    pull_policy: if-not-present
  script:
  - make build-e2e


build-image:
  stage: docker_build
  tags:
    - docker-build
  image:
    name: docker:20.10.16
    pull_policy: if-not-present
  services:
    - name: docker:20.10.16-dind
      alias: dockerhost
  variables:
    DOCKER_HOST: tcp://dockerhost:2375/
    # Use the overlayfs driver for improved performance:
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_CERTDIR: ""
  before_script:
   - echo -n $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY
  script:
    - > 
      docker build --pull 
      --build-arg VCS_REF=$CI_COMMIT_SHORT_SHA
      --build-arg BLAME_USER=$CI_REGISTRY_USER
      --build-arg IMAGE_TAG=$CI_COMMIT_REF_SLUG
      --build-arg BLAME_BUILD_TIME=$CI_JOB_STARTED_AT
      --build-arg BLAME_MACHINE=$CI_SERVER_HOST
      -t $BUILD_IMAGE -f Dockerfile .
    - docker push $BUILD_IMAGE

build-metrics-image:
  stage: docker_build
  tags:
    - docker-build
  image:
    name: docker:20.10.16
    pull_policy: if-not-present
  services:
    - name: docker:20.10.16-dind
      alias: dockerhost
  variables:
    DOCKER_HOST: tcp://dockerhost:2375/
    # Use the overlayfs driver for improved performance:
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_CERTDIR: ""
  before_script:
   - echo -n $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY
  script:
    - > 
      docker build --pull 
      --build-arg VCS_REF=$CI_COMMIT_SHORT_SHA
      --build-arg BLAME_USER=$CI_REGISTRY_USER
      --build-arg IMAGE_TAG=$CI_COMMIT_REF_SLUG
      --build-arg BLAME_BUILD_TIME=$CI_JOB_STARTED_AT
      --build-arg BLAME_MACHINE=$CI_SERVER_HOST
      -t $METRICS_BUILD_IMAGE -f cmd/infinidat-csi-metrics/Dockerfile .
    - docker push $METRICS_BUILD_IMAGE


test-merge-image-build:
  stage: docker_build
  tags:
    - docker-build
  only:
    - merge_request
  image:
    name: docker:20.10.16
    pull_policy: if-not-present
  services:
    - name: docker:20.10.16-dind
      alias: dockerhost
  variables:
    DOCKER_HOST: tcp://dockerhost:2375/
    # Use the overlayfs driver for improved performance:
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_CERTDIR: ""
  before_script:
   - echo -n $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY
  script:
    - docker pull $DEV_IMAGE || true
    - > 
      docker build --pull 
      --build-arg VCS_REF=$CI_COMMIT_SHORT_SHA
      --build-arg BLAME_USER=$CI_REGISTRY_USER
      --build-arg IMAGE_TAG=$CI_COMMIT_REF_SLUG
      --build-arg BLAME_BUILD_TIME=$CI_JOB_STARTED_AT
      --build-arg BLAME_MACHINE=$CI_SERVER_HOST
      -t $BUILD_IMAGE -f Dockerfile .


include:
- template: Security/SAST.gitlab-ci.yml
# container scanning disabled - further configuration required.
# - template: Security/Container-Scanning.gitlab-ci.yml