.gitlab-ci.yml

default:
  tags:
    - search

stages:
  - build
  - package
  - test
  - deploy

variables:
  PIP_REQUIREMENTS_FILE: "requirements.txt"

.poetry:
  image: python:3.7

  variables:
    PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"

  cache:
    key:
      files:
        - poetry.lock
    paths:
      - .cache/pip

  before_script:
    - pip install poetry
    - poetry config virtualenvs.in-project true
    - poetry install --with dev,docs,slim,test --no-ansi --no-interaction -vv
    - source `poetry env info --path`/bin/activate

export requirements txt:
  extends: .poetry
  stage: .pre
  script:
    - poetry export -o "$PIP_REQUIREMENTS_FILE"
  artifacts:
    paths:
      - "$PIP_REQUIREMENTS_FILE"

build docs:
  extends: .poetry
  stage: build
  script:
    - poetry install --with docs
    - poetry run sphinx-build -M html docs/ docs/_build/ -W
  artifacts:
    paths:
      - docs/_build/html/
      - pyproject.toml
      - poetry.lock

.yarn:
  image: node:latest

  cache:
    key:
      files:
        - yarn.lock
    paths:
      - .yarn-cache/

  before_script:
    - echo 'yarn-offline-mirror ".yarn-cache/"' >> .yarnrc
    - echo 'yarn-offline-mirror-pruning true' >> .yarnrc
    - yarn install --frozen-lockfile --no-progress

build app:
  extends: .yarn
  stage: build
  script:
    - yarn setup
    - yarn workspace @splunk/censys run build:prod
    - mkdir -p dist
    - mv packages/censys/censys/ dist/censys/
  artifacts:
    paths:
      - dist/censys/

.slim-package:
  extends: .poetry
  stage: package
  artifacts:
    paths:
      - "*.tar.gz"

package add-on:
  extends: .slim-package
  script:
    - poetry run slim package packages/Splunk_TA_censys

package app:
  extends: .slim-package
  script:
    - poetry run slim package dist/censys
  dependencies:
    - build app

pytest:
  extends: .poetry
  stage: test
  script: pytest --junitxml pytest.xml
  artifacts:
    when: always
    paths:
      - pytest.xml
    reports:
      junit: pytest.xml

.jest:
  extends: .yarn
  stage: test
  artifacts:
    when: always
    paths:
      - packages/*/test-reports/unit-results.xml
    reports:
      junit: packages/*/test-reports/unit-results.xml

# jest censys-setup:
#   extends: .jest
#   script:
#     - yarn workspace @splunk/censys-setup run test:ci

jest censys-getting-started:
  extends: .jest
  script:
    - yarn workspace @splunk/censys-getting-started run test:ci

appinspect add-on:
  extends: .poetry
  stage: test
  script:
    - poetry run splunk-appinspect inspect Splunk_TA_censys-*.tar.gz --data-format junitxml --output-file add-on-appinspect.xml --included-tags cloud --included-tags future --included-tags python3_version
  artifacts:
    when: always
    paths:
      - add-on-appinspect.xml
    reports:
      junit: add-on-appinspect.xml
  dependencies:
    - package add-on

appinspect app:
  extends: .poetry
  stage: test
  script:
    - poetry run splunk-appinspect inspect censys-*.tar.gz --data-format junitxml --output-file app-appinspect.xml --included-tags cloud --included-tags future --included-tags python3_version
  artifacts:
    when: always
    paths:
      - app-appinspect.xml
    reports:
      junit: app-appinspect.xml
  dependencies:
    - package app

python lint:
  extends: .poetry
  stage: test
  script:
    - poetry run isort . --check-only
    - poetry run black . --check --extend-exclude ".*\/(aob_py3|lib)\/.*"

eslint:
  extends: .yarn
  stage: test
  script:
    - yarn run lint:ci

release add-on:
  extends: .poetry
  stage: deploy
  script:
    - poetry run python ./censys_splunk/release.py -a 6399 -f Splunk_TA_censys-*.tar.gz
  rules:
    - if: $CI_COMMIT_TAG =~ /^add-on-v[0-9]+\.[0-9]+\.[0-9]+$/
      when: manual
  dependencies:
    - package add-on

release app:
  extends: .poetry
  stage: deploy
  script:
    - poetry run python ./censys_splunk/release.py -a 4830 -f censys-*.tar.gz
  rules:
    - if: $CI_COMMIT_TAG =~ /^app-v[0-9]+\.[0-9]+\.[0-9]+$/
      when: manual
  dependencies:
    - package app

include:
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/License-Scanning.gitlab-ci.yml
  - template: Security/SAST-IaC.latest.gitlab-ci.yml
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml

sast:
  stage: test
  variables:
    SEARCH_MAX_DEPTH: "10"
    SAST_BANDIT_EXCLUDED_PATHS: "*/aob_py3/*"

kics-iac-sast:
  stage: test

secret_detection:
  stage: test
  variables:
    SECRET_DETECTION_HISTORIC_SCAN: "true"
    SECRET_DETECTION_EXCLUDED_PATHS: "**/bin/**/aob_py3"

license_scanning:
  stage: test
  dependencies:
    - export requirements txt

gemnasium-python-dependency_scanning:
  stage: test
  dependencies:
    - export requirements txt
  before_script:
    - rm poetry.lock pyproject.toml
  # Triggers artifacts download, until https://gitlab.com/gitlab-org/gitlab/-/issues/249569 is implemented