.gitlab-ci.yml

include:
  - project: jitesoft/gitlab-ci-lib
    file: Scan/trivy.yml
  - project: jitesoft/gitlab-ci-lib
    file: OCI/sign.yml
  - file: /OCI/push-readme.yml
    project: jitesoft/gitlab-ci-lib

stages:
  - readme
  - download
  - build
  - containerize
  - cgi
  - sign
  - scan
  - cache

update-readme:
  stage: readme
  extends: .readme-check.v2
  variables:
    PUSHRM_FILE: "$CI_PROJECT_DIR/README.md"
    GIT_DEPTH: "3"
    REGISTRIES: "quay.io/jitesoft/lighttpd,docker.io/jitesoft/lighttpd"
  tags: [ protected ]

check:
  stage: download
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: always
    - if: '$CI_PIPELINE_SOURCE == "web"'
      when: always
    - when: never
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - touch version.txt
    - VERSION=$(wget -qO- https://download.lighttpd.net/lighttpd/releases-1.4.x/ | grep -oP "(?<=<a href=\"lighttpd-)([0-9]{0,3}[.][0-9]{0,3}[.][0-9]{0,3})" | sort -r -u - | awk 'NR==1{print $1}')
    - |
      if [ ! -z "${FORCE_BUILD+x}" ] || [ "${VERSION}" != "$(cat version.txt)" ]; then
        echo "${VERSION} and $(cat version.txt) differ. Running build."
        curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[VERSION]=${VERSION}" -F "variables[BUILD]=true" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      else
        echo "${REMOTE_VERSION} and ${LOCAL_VERSION} where equal. Running scan."
        curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[VERSION]=${VERSION}" -F "variables[SCAN]=true" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      fi
  cache:
    paths:
      - version.txt
    policy: pull

download:
  rules:
    - if: "$BUILD"
      when: always
    - when: never
  stage: download
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - curl -OsS https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-${VERSION}.tar.xz
    - curl -OsS https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-${VERSION}.tar.xz.asc
    - curl -OsS https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-${VERSION}.sha256sum
    - |
      for key in $(cat keys.txt); do \
        gpg --keyserver hkps://keys.openpgp.org --recv-keys "$key" 2>&1 || \
        gpg --keyserver keyserver.ubuntu.com --recv-keys "$key" 2>&1 || \
        gpg --keyserver hkp://ha.pool.sks-keyservers.net:80 --recv-keys "$key" 2>&1 || \
        gpg --keyserver hkp://keyserver.pgp.com:80 --recv-keys "$key" 2>&1 || \
        gpg --keyserver hkp://pgp.mit.edu:80 --recv-keys "$key"; \
      done
    - gpg --verify lighttpd-${VERSION}.tar.xz.asc lighttpd-${VERSION}.tar.xz
    - grep " lighttpd-${VERSION}.tar.xz\$" lighttpd-${VERSION}.sha256sum lighttpd-${VERSION}.tar.xz
  artifacts:
    expire_in: 1 day
    paths:
      - lighttpd-*.tar.xz

.build:
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  image: registry.gitlab.com/jitesoft/dockerfiles/misc/buildbase/3.20:latest
  needs:
    - download
  stage: build
  before_script:
    - export CCACHE_DIR="${CI_PROJECT_DIR}/ccache"
    - export PATH="/usr/lib/ccache/bin:$PATH"
    - if [ ! -d "ccache" ]; then mkdir ccache; fi
    - apk add --force-overwrite --no-cache build-base pcre2-dev bsd-compat-headers brotli-dev flex libressl-dev bzip2-dev lua5.3-dev openldap-dev libxml2-dev sqlite-dev libev-dev
    - mkdir src
    - tar -xJhf lighttpd-${VERSION}.tar.xz --strip-components=1 -C src
  script:
    - cd src
    - ./autogen.sh
    - ./configure --prefix=/usr/local --with-lua --with-openssl --with-ldap --with-brotli
    - make -j4
    - make install
    - ccache -s
    - $(cd /usr/local && tar -czf /tmp/lighttpd.tar.gz *)
    - cd ..
    - mkdir out
    - mv /tmp/lighttpd.tar.gz out/lighttpd-${ARCH}.tar.gz
  artifacts:
    paths:
      - out
    expire_in: 1 day
  cache:
    paths:
      - ccache
    key: lighttpd.build.ccache-${ARCH}

build:arm:
  extends: .build
  tags:
    - native-aarch64
  variables:
    GIT_STRATEGY: none
    ARCH: arm64

build:amd:
  extends: .build
  tags:
    - native-amd64
  variables:
    GIT_STRATEGY: none
    ARCH: amd64

containerize:lighttpd:
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  stage: containerize
  needs:
    - build:amd
    - build:arm
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - mv entrypoint out/
    - mv healthcheck out/
    - mv lighttpd.conf out/
    - mv conf.d out/
    - TAGS=$(helper "${CI_REGISTRY_IMAGE},jitesoft/lighttpd,ghcr.io/jitesoft/lighttpd,quay.io/jitesoft/lighttpd" "latest,${VERSION}")
    - docker buildx build --sbom=true --provenance=true --platform linux/amd64,linux/arm64 --progress plain --push ${TAGS} --build-arg VERSION=${VERSION} .
  tags: [ jitesoft, buildx, protected ]

containerize:lighttpd:cgi:
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  needs:
    - job: containerize:lighttpd
      artifacts: false
  stage: cgi
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - TAGS=$(helper taglist "${CI_REGISTRY_IMAGE}/cgi", "latest,${VERSION}")
    - OTAGS=$(helper taglist "jitesoft/lighttpd,ghcr.io/jitesoft/lighttpd,quay.io/jitesoft/lighttpd" "latest-cgi,${VERSION}-cgi,cgi")
    - TAGS="$TAGS $OTAGS"
    - docker buildx build --sbom=true --provenance=true --platform linux/amd64,linux/arm64 --build-arg BUILD_TIME="$(date -Iseconds)" --build-arg "VERSION=${VERSION}" --progress plain --push ${TAGS} -f cgi/Dockerfile .
  tags: [ jitesoft, buildx, protected ]

scan:
  stage: scan
  rules:
    - if: "$SCAN"
      when: always
    - if: "$BUILD"
      when: on_success
    - when: never
  extends: .container_scanning
  variables:
    SCANNING_IMAGE_NAME: "${CI_REGISTRY_IMAGE}:${VERSION}"
    GIT_STRATEGY: none

scan:cgi:
  stage: scan
  rules:
    - if: "$SCAN"
      when: always
    - if: "$BUILD"
      when: on_success
    - when: never
  extends: .container_scanning
  variables:
    SCANNING_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/cgi:${VERSION}"
    GIT_STRATEGY: none

create-cache:
  stage: cache
  script:
    - echo "${VERSION}" > version.txt
  cache:
    paths:
      - version.txt
    policy: push
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never